A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

1
vote
0answers
51 views

What's The Easiest Way To Maintain Remote Users Access to a Webapp

Here is a real world case: A chain of high schools (several hundreds) has many websites (~ 3x number of Schools) that are content driven by users (the students). Every school maintains about 2-4 ...
4
votes
5answers
2k views

Is it possible to restrict USB keys to only certified ones, and block that key's access on other computers

I am working on security for an organisation, we have purchased some encrypted USB keys but wanted to stop any employees leaking data. is there any way to stop their laptop accepting any key but the ...
0
votes
3answers
245 views

Storing passwords and other data for coworkers

At the moment we are encrypting our server passwords and other important data internal via PGP. Every coworker has got his/her own private key/pass combination set up on their workstation. The problem ...
1
vote
1answer
69 views

How to restrict access to a resource based on frequency of access?

I want to restrict access to a particular resource based on time (configurable). So suppose user A has time t configured from him. He can access the resource only once every t time units. The values ...
5
votes
1answer
734 views

Memory Protection Unit/MMU in context of multiple cores and security issues

There is a chipset I am working with that utilizes an ARM cortex -A7 as the Application processor and an ARM 9 Baseband processor. I had a major concern since the ARM cortex A7 is utilizing android ...
3
votes
2answers
1k views

Biba and Bell LaPadula together

Can Biba model always be combined with Bell-LaPadula model? What are the issues that arise?Would there be conflicts?How would information flow be affected?
4
votes
2answers
131 views

Is there a security advantage to requiring a user id instead of just /me in an api request?

Is there a security advantage to requiring a request to conform to /api/1234 instead of /api/me? Both would obviously have access tokens. My guess is that api/1234 is more secure because if someone ...
3
votes
1answer
595 views

Limit BitTorrent Sync connections to a specific network

Is it possible to limit BitTorrent Sync connections to a a specific network using the client software? Right now the closest I can come up with would be IP limitations imposed on each client using a ...
1
vote
2answers
194 views

Main requirements to secure my Application in any database related features

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
-4
votes
5answers
1k views

Google Calendar has events that I didn't create and it's not shared

This has been rewritten because at first I thought this may be an accident but now it’s clear there’s a security compromise. In my Google Calendar I noticed an event that occurred each day from ...
8
votes
2answers
266 views

What's ownership concept for?

I fail to grasp the necessity of using concept of owner (ownership) and find clear explanation of its necessity. What cannot be done without concept of owner(ownership) in filesystem/database object ...
3
votes
5answers
167 views

Windows: Any method to enforce user confirmation before the browser opens a URL requested by an external desktop app?

A robust outgoing firewall will protect against desktop applications directly connecting to the internet without your permission. However, as the browser is a generally authorized application for ...
0
votes
1answer
39 views

Restrict access to a specific type of entity

I want to create a web service that can only be accessed by a specific type of entity: my own mobile application. Is there any well-accepted methods to do this? I'm thinking about embedding a secret ...
13
votes
6answers
5k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
4
votes
4answers
1k views

Are keys or RFID tags more secure access control solutions?

Just musing to myself, what is the preferable access control mechanism in high security environments? Locks and Keys or RFID tags? Going under the assumption that the locks/keys are not knoow to be ...
6
votes
1answer
109 views

Building access card that has an identification role

The main question is should a building access card have the corporate logo on it? In this organization, the employee ID card is separate from building access card. We currently do not have the logo ...
22
votes
11answers
10k views

Prevent my site from being copied

Is it possible to protect my site from HTTrack Website Copier or any similar program? Without setting a max number of HTTP request from users.
0
votes
2answers
128 views

Allow or Deny Access to a Network Based on Client Hardware [duplicate]

We have to build a product that will have a network. Users will be able to connect to this network by downloading a client. However, before allowing them to access the network we want to check if ...
1
vote
1answer
825 views

Possible to limit server connections to clients with a specific certificate?

Usually when I read about SSL and HTTP it says that the certificate is set up to authenticate that the host is who it says it is. Is it possible to configure the host to prevent it from processing ...
4
votes
3answers
3k views

Role vs Identity based authentication? What is the difference?

What is the difference between role-based authentication and identity-based authentication? If a system uses ONLY a password mechanism to authenticate operators (different PIN for Admin and User) it ...
7
votes
2answers
5k views

What are the advantages/disadvantages of attribute-based access control?

An example attribute would be "employee is currently located in the US" and is trying to access a document that requires the person to be accessing the document in US territory.
47
votes
8answers
3k views

I'm an IT consultant. Should I discourage a client from telling me his password?

I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
0
votes
2answers
368 views

File shares from a DMZ into an internal network

We have a firewall policy that prohibits MS RPC through firewall, particularly from internet facing DMZ's back to the internal network. There is a business unit requesting an alternative method to ...
18
votes
3answers
11k views

Router password vs MAC filtering?

I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
4
votes
4answers
8k views

How to prevent restrict access to a web application to authorized devices only?

I have developed an MVC web app. Right now, the client using this app in office area. The client has requested that no one should use this app on any device except the office's PC/tablets. Now ...
1
vote
1answer
74 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
4
votes
4answers
3k views

Block unauthorized user from getting access to intranet

What's the common way to block users from accessing intranet? Right now, whoever plugs in a cable can access any intranet server freely. I want to change this behavior. But given that we run not only ...
0
votes
1answer
606 views

Who to assign read/write access rights for a single-user application to run correctly?

My application installs for a single user on a Windows machine. Any user may install the application for himself, but the application will save some information common to all users in a separate ...
17
votes
6answers
28k views

Is it possible for a hacker to download a php file without executing it first?

I have a php website where everything is in the public_html\ folder, including inclides folder with config and classes. I told my developer to move it away from public folder but he said there is no ...
10
votes
7answers
2k views

Alternative to VPN

We have a network that is completely closed to the outside world. It needs to be. Problem is we need to remote into a server on this network once in a blue moon for diagnostics. We've discussed ways ...
7
votes
2answers
441 views

Full-disk encryption and theft mitigation?

Is it possible to combine the security of full-disk encryption (e.g. Truecrypt) with the honeypot-like performance of anti-theft tools (e.g. Prey)? In other words, is it feasible to have both strong ...
0
votes
2answers
168 views

How to allow only the public key owner to submit requests to my site? And what is this type of security called?

This was probably asked many times here, but I'm not finding any because I'm not sure what to look for. I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
7
votes
1answer
234 views

Using / finding covert channels in inter-process communication

I've got a class exercise that involves a virtual game of Werewolves/Mafia. We're not really taught how to do anything in this class, which makes it hard for everyone to do the labs. The idea is that ...
5
votes
3answers
447 views

How can i deal with management who want 'Domain Admin' access?

While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...
11
votes
2answers
3k views

Is there a secure way to have a publicly facing terminal server?

TL;DR We are looking at opening port 3389 for a terminal server all the advice I’ve seen is that its suicidal but without good explanations as to why. Is it really that bad? We are looking at setting ...
2
votes
3answers
174 views

Why are UNIX-like ACLs not a form of MAC

What is the reason for UNIX-like access permissions (both the traditional user-group-others and extended ACLs) being classified as a form of DAC (Discretionary Access Control) system and not MAC ...
-1
votes
1answer
103 views

For a Broker/Dealer, what technology is appropriate to limit transaction to a given state? [closed]

The SEC allows for individuals to not register with them if they don't permit business with users outside of the state: A broker-dealer that conducts all of its business in one state does not ...
2
votes
2answers
2k views

Prevent unauthorized workstations from joining a Windows Domain

Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the ...
3
votes
3answers
1k views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
2
votes
3answers
497 views

MySQL database access prevention

I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
3
votes
2answers
116 views

Authorising use of apps from a public store with no back end service

I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
6
votes
4answers
2k views

Safest way for multiple users post to a single social networking account

Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
-1
votes
1answer
112 views

Bringing in an intern

When bringing in an intern to help you in the IT world and with access to servers and client information, what kind of forms should be signed, especially when they work remotely?
4
votes
2answers
668 views

How can the low-water mark property apply to Bell-LaPadula?

I am taking a computer security class, and have a homework problem which has the following setup: Now assume a dynamic version of the Bell-La Padula Confidentiality model that incorporates a ...
2
votes
2answers
444 views

MySQL Access Control?

I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
2
votes
1answer
538 views

OAuth: client credentials vs tokens

Wouldn't it be much simpler and virtually equally secure to replace tokens by pure client credentials? Client credentials wouldn't expire and resource owners would always be able to modify their ...
3
votes
1answer
262 views

Is RDP an effective security barrier

If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct ...
4
votes
4answers
178 views

How can an Subject only read and write to its owned objects?

It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
-1
votes
1answer
176 views

setting up website for logged in users, anyone, and files no one should see (via the web) [closed]

I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
1
vote
1answer
304 views

What are the basic implementations that make a network secure from the inside\outside?

Would you consider the following to be "basic hardening items" for network equipment and servers? VLANs Access Control (such as NTFS permissions) Patch Management System Host Firewall Anti-Virus ...