A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

3
votes
3answers
199 views

Governement like classified information system

I need to implement a classification system for my company, similar to the government's. I'm working for a company working with the government. The classification system in my country isn't public so ...
3
votes
4answers
5k views

how safe is a home NAS with ssh access?

I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files. Some extras include: ssh, ftp, telnet, mail servers photo gallery ...
3
votes
3answers
2k views

How can reverse proxies be used to bypass acceptable use policies of a company?

I am wondering how reverse proxies can be used to bypass company acceptable use policies? What can be done to prevent it?
3
votes
3answers
492 views

How do I clearly distinguish between groups of formal and informal models?

I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
3
votes
3answers
3k views

Should I give developers admin rights or leave as power users? [duplicate]

In my organization we are in the process of upgrading everyone to Windows 7.We have all of our users configured as power users. The issue we are running into is this: Should we give developers local ...
3
votes
3answers
54 views

encryption vs access control comparison

I have a very basic and simple question about two security concepts. Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
3
votes
2answers
338 views

Which access rights should be chosen for doku wiki?

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages). At the moment I gave the ...
3
votes
1answer
2k views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
3
votes
3answers
1k views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
3
votes
2answers
116 views

Authorising use of apps from a public store with no back end service

I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
3
votes
5answers
356 views

Is there an access-control model defined in terms of application structure?

I'm working on the access control component of a complex web application. One of the goals is to have a strictly defined model for who can do what, but I can't find an existing model that meets our ...
3
votes
4answers
13k views

How to check if computer is controlled remotely

My laptop has windows 7 installed. One Saturday night I couldn't fall asleep and was just lying in bed. Then suddenly at around 2 in the morning I heard the fan of the laptop start up and lights on ...
3
votes
3answers
693 views

Do you give local administrator account password to notebook users?

My notebook users need to travel a lot. Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings. Should I give them local administrator's ...
3
votes
2answers
83 views

How do we verify identity before creating a new admin account?

We are designing the security for a B2B Saas service, the user and admin accounts are based on the customer's email addresses - typically our customers are small organisations without their own in ...
3
votes
2answers
1k views

Biba and Bell LaPadula together

Can Biba model always be combined with Bell-LaPadula model? What are the issues that arise?Would there be conflicts?How would information flow be affected?
3
votes
3answers
760 views

Access Control and Authentication using Facebook access tokens in a webapp

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create ...
3
votes
1answer
959 views

I'm using a Cisco ASA as a VPN endpoint. Where do the VPN clients get firewalled?

(Is this too application specific? It seems like a reasonable question that would be useful to other people...) So, I've got this ASA in front of a network that I didn't set up. It's been ...
3
votes
5answers
1k views

Security purpose of asking admin password to mount partition on Linux

So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
3
votes
2answers
120 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
3
votes
1answer
982 views

Securing sensitive data in a DB,is using H2 worth it?

I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now of course, besides the usual password hashing + salt +.... I ...
3
votes
1answer
33 views

Are there file-encryption tools that only allow access to whitelisted processes?

I am looking into VeraCrypt, a spiritual successor of TrueCrypt. This made a question pop up: As far as I understand, as long as the encrypted volume is mounted, every process can access the data. ...
3
votes
1answer
606 views

Limit BitTorrent Sync connections to a specific network

Is it possible to limit BitTorrent Sync connections to a a specific network using the client software? Right now the closest I can come up with would be IP limitations imposed on each client using a ...
3
votes
1answer
2k views

Wireless MAC Address Filtering - Authentication/Association

Can somebody explain to me how a wireless AP denies access to the network if the client does not have the correct MAC Address. Does it not send a probe response when a client has not got a correct ...
3
votes
2answers
120 views

web security testing - vulnerability issue

I'm testing a website to find out vulnerabilities. Website is fully running on HTTPS only. While testing, I came to know that the pdf files can be downloaded by authorized users only. This ...
3
votes
1answer
150 views

What methods are websites using to prevent direct access to media?

I really hope this question isn't off-topic... Background The question pertains to media security (video, audio, etc.), where the media in question is digitally protected (legally, DMCA-style) or ...
3
votes
1answer
151 views

Access rights management in large companies

I'm wondering how large companies with tens / hundred of applications are handling access-rights for their users. From what I've seen, it's a nightmare that never ends, and it requires full-time ...
3
votes
5answers
169 views

Windows: Any method to enforce user confirmation before the browser opens a URL requested by an external desktop app?

A robust outgoing firewall will protect against desktop applications directly connecting to the internet without your permission. However, as the browser is a generally authorized application for ...
3
votes
1answer
267 views

Is RDP an effective security barrier

If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct ...
3
votes
1answer
345 views

Trial version security

I am developing stand-alone software in BDS 2006. I want to provide a trial version for 6 months -- the user can use it for just 6 months, but no more on a particular system. I have handled most ...
3
votes
1answer
2k views

BLP Lattice-structered system from Access Control Matrix

I've been reading a Computer Security book by Walliam Stallings and have found this example: http://i.imgur.com/5CAlc.png of an Access Control Matrix. Any example will do I just thought I'd screenshot ...
3
votes
1answer
59 views

Enabling Unsigned ActiveX

A third-party wants to provide a web app which they say only works if we enable unsigned ActiveX (unfortunately users are required to use IE). I understand what 'signing' is, as well as the basic ...
3
votes
2answers
10k views

How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?

This is what I believe to be an interesting challenge :) A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
3
votes
0answers
42 views

Open source tools to run generic audit of user entitlements? [closed]

Over the past years, my team has been asked to conduct audits/reviews for other teams. Most of these audits have been compliance-driven and almost all of them have followed the same format: some group ...
2
votes
3answers
312 views

Remote Connection Tampering

My small high street laptop repair/service/maintenance shop has been up and running for about 3 years. It's doing quite well so I'm looking to expand into other areas of the PC market. One area I ...
2
votes
3answers
174 views

Why are UNIX-like ACLs not a form of MAC

What is the reason for UNIX-like access permissions (both the traditional user-group-others and extended ACLs) being classified as a form of DAC (Discretionary Access Control) system and not MAC ...
2
votes
2answers
2k views

Prevent unauthorized workstations from joining a Windows Domain

Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the ...
2
votes
1answer
232 views

Does this htaccess snippet provide sufficient security?

I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
2
votes
2answers
73 views

Expose the source code repository externally or allow VPN access?

To allow third party consultants, offshore developers and contractors working on the code, we can expose our Git repository externally. Or we can grant VPN access to the external parties and limit ...
2
votes
1answer
454 views

How can the Google web crawler bypass portals?

This is a situation that I have encountered on a number of occasions. I will conduct a web search in Google, a link to a file (.pdf for example) will take you to that file on the server. It opens up ...
2
votes
2answers
248 views

Access control of Linux and Bell LaPadula Model

I know that access control is a very important think when we want to protect our files and in security in general. Does anyone know what access control system is used by linux? In addition I just ...
2
votes
1answer
950 views

Putting the Biba-LaPadula Mandatory Access Control Methods to Practise?

Text books on database systems always refer to the two Mandatory Access Control models; Biba for the Integrity objective and Bell-LaPadula for the Secrecy or Confidentiality objective. Text books ...
2
votes
2answers
134 views

How risky is having sensitive files on webroot?

I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space ...
2
votes
2answers
121 views

Should I use a separate SQL Server instance for a database with PII?

We build software which needs a SQL SERVER database. This database will hold private user information (address,bank, ...) My question is: Should I install my database in a fresh SQL Server ...
2
votes
2answers
470 views

MySQL Access Control?

I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
2
votes
1answer
38 views

Security Administrator Windows Roles

I find that security administrators often need to perform vulnerability checks on systems and these tasks need at least domain or local administrative rights. Does the security administrator need full ...
2
votes
1answer
48 views

How to find out if content on my XAMPP server has been altered

During the development of a site, me and the team decided to develop the site with my computer as a server, with me making my localhost available from outside. I have been using several settings to ...
2
votes
3answers
506 views

MySQL database access prevention

I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
2
votes
1answer
561 views

OAuth: client credentials vs tokens

Wouldn't it be much simpler and virtually equally secure to replace tokens by pure client credentials? Client credentials wouldn't expire and resource owners would always be able to modify their ...
2
votes
1answer
164 views

How do automated systems store their keys securely?

As with many systems (primarily websites) there are automatic components that run on a server and are not user based (such as crons) that don't have the opportunity for a real person to input a secret ...
2
votes
2answers
2k views

DMZ and LAN data exchange - what direction should connections be made?

When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure: DMZ service pushes data to LAN service or LAN service pulls data from DMZ ...