A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.
2
votes
1answer
90 views
User Account Notification under Windows useful at all?
IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
1
vote
2answers
120 views
Wifi box produces three SSIDs?
While using a friend's wifi, he said I should use his SSID, let's call it XYZ's Wifi. When I started my Macbook Pro, three SSIDs came up. Two were called XYZ's Wifi and the third was called XYZ's ...
1
vote
3answers
182 views
Keyless entry security systems and HIPAA implications
We are upgrading our office to have badged security doors. What I would particularly like to know is if Keyless Entry systems exist or are of decent quality. By this I mean, I would like the doors ...
1
vote
2answers
161 views
BLP Lattice structure with missing top and bottom levels
I designed a system similar to the above diagram. However There is no (Top Secret, {nuclear,crypto}) and no (Secret,{}) levels. Meaning that there is no top and bottom level.
Would it make the BLP ...
1
vote
1answer
170 views
Installing applications with different user accounts on linux
I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
1
vote
3answers
943 views
How to set password on applications in Mac OS to prevent an administrator to start them?
Is there any program that can set password on the app like mail or browser? I know about parent control, but I doesn't work with administrator account.
What I want is some program that blocks some ...
1
vote
2answers
319 views
how safe is a home NAS with ssh access?
I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files.
Some extras include:
ssh, ftp, telnet, mail servers
photo gallery ...
1
vote
1answer
114 views
How do automated systems store their keys securely?
As with many systems (primarily websites) there are automatic components that run on a server and are not user based (such as crons) that don't have the opportunity for a real person to input a secret ...
1
vote
1answer
158 views
Can HIPS software practically be considered a form of MAC
Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system.
Given that with the use ...
1
vote
2answers
273 views
Star property in read/write access
The * star property requirement for append access [SC(S) <= SC(O)] is looser than for write access [SC(S) = SC(O)]. Can someone explain the reason for this?
1
vote
1answer
113 views
What are the basic implementations that make a network secure from the inside\outside?
Would you consider the following to be "basic hardening items" for network equipment and servers?
VLANs
Access Control (such as NTFS permissions)
Patch Management System
Host Firewall
Anti-Virus
...
1
vote
1answer
34 views
Starting point for Mobile Device Security particularly in a MDM setting?
I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
1
vote
2answers
113 views
passwords database - access control and/or synchronization
so, we've got a ton of passwords that several different administrators need to have access to, each with their unique password/key/user/whatever...
it needs to be either centralized, or the passwords ...
1
vote
1answer
76 views
how to stop write downs
Consider a scenario with two security levels, Alice and Bob. Bob is Alice's boss. Bob must be able to read Alice's documents but not write anything to her documents.
I am using encryption keys to ...
1
vote
1answer
239 views
How secure is github's whitelisting CORS domains?
The Github API allows you to make requests using CORS [1]. The CORS requests are only allowed by certain whitelisted domains :
Any domain that is registered as an OAuth Application is accepted.
...
1
vote
2answers
132 views
Closing handles of a process as a regular user
Here's the situation: As an adminstrator, I am able to stall the application by closing 2 handles held by the process. (Using ProcExplorer) . Is there any way/hack I can use to close file handles ...
1
vote
1answer
165 views
IPtables - Accept Arbitrary Packets
I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by ...
1
vote
0answers
152 views
What is the best way to manage temporary accounts on Active Directory [closed]
The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
0
votes
6answers
316 views
What sort of security method is this called (if it has a name)?
I have thought of a way of securing access to an application interacting with another application.
Using this method
Application 1 - "What is the sum of 1+1?"
Application 2 - "3"
Application 1 - ...
0
votes
2answers
93 views
How to allow only the public key owner to submit requests to my site? And what is this type of security called?
This was probably asked many times here, but I'm not finding any because I'm not sure what to look for.
I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
0
votes
2answers
250 views
Access control matrix and integrity
Can access control matrix in addition to confidentiality provide the integrity of the objects to which access is being controlled?
0
votes
3answers
155 views
Using remote desktop
I was having trouble getting Outlook to work with my schools email account and called the help desk. They gave me a link to install a program called Bomgar. I installed it and clicked "allow viewing ...
0
votes
1answer
211 views
Standards for physical Access Control systems
Hoping to help protect an IT installation, I've been looking into physical protection systems, specifically Access Control for protected areas. The field is quite big. Are there any US or ...
0
votes
1answer
263 views
website hacked and all its content erased despite the protections
i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...
0
votes
1answer
58 views
Credentials using AWS IAM
I have a server, which should provide temporary credentials to the client.
The credentials will be transmitted using HTTPS.
The client should be able to upload S3 files, as well as download them.
The ...
0
votes
1answer
89 views
Implementation of a FREE web filter [closed]
I just want some advice for the implementation of a web filter for a school network. Just want to block some contents and url. A free tool should be fine I guess.
Any recommendations?
Thanks!
0
votes
1answer
96 views
Best practice for selective opening of ports on network gateway
Our network is currently isolated from the outside by a Linux box, running iptables and Squid to control web access.
By default we deny all outgoing traffic from all IP's, to force Web traffic ...
0
votes
1answer
51 views
Who to assign read/write access rights for a single-user application to run correctly?
My application installs for a single user on a Windows machine. Any user may install the application for himself, but the application will save some information common to all users in a separate ...
0
votes
0answers
43 views
Application access control and time-keeping software [closed]
I am looking for software that controls and logs access to a program installed on a Windows XP machine which controls an instrument in a analytical chemistry lab to prevent unauthorized use and track ...
0
votes
0answers
66 views
Writing a script to tell which users are currently typing? [closed]
I'm working on a lab for a cyber-security class and need to find out when certain users are communicating with each other (through named pipes).
The users use:
python gameProgram.py
And then that ...
0
votes
1answer
41 views
Relative costs involved in making changes to the current organisational security
I need help understanding what is required by the phrase "a comparison of the relative costs involved in making changes to the current organizational security procedures".
Am I to compare the cost ...
0
votes
0answers
53 views
Need to write an XACML security policy to express the two access control requirements [closed]
Anyone have any good websites or tips for me to write a simple XACML security policy or examples ?
Thanks
0
votes
1answer
664 views
Juniper SRX210, how to make port forwarding work? [closed]
I have a PC 192.168.1.151 which needs 554 and 9001 publicly available. So I used the following configuration but it does not work. Can anyone see my mistake ?
version 10.0R3.10;
system {
...
-1
votes
5answers
187 views
How can I configure my router to prevent connections bypassing it?
I am trying to configure my router to control access for several of my devices at home.
I am currently using a linksys router.
Our home consists of three devices (a desktop, a laptop, and a ...
-1
votes
3answers
146 views
How information in an access log could be used to identify the true identity of an impostor?
Is it possible to use information in an access log to identify the true identity of an impostor who has acquired unauthorized access to a computing system (Perhaps by combining several different ...
-1
votes
1answer
84 views
Bringing in an intern
When bringing in an intern to help you in the IT world and with access to servers and client information, what kind of forms should be signed, especially when they work remotely?
-1
votes
2answers
217 views
Can you pick up any device specific information by monitoring bluetooth signals? [closed]
Could I use some sort of permanent device ID broadcasted by the bluetooth radio in my phone to do something like unlock my door?
I don't want to have to ever pair the device, or take it out of my ...
-1
votes
1answer
64 views
setting up website for logged in users, anyone, and files no one should see (via the web) [closed]
I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
-1
votes
1answer
77 views
For a Broker/Dealer, what technology is appropriate to limit transaction to a given state? [closed]
The SEC allows for individuals to not register with them if they don't permit business with users outside of the state:
A broker-dealer that conducts all of its business in one state does
not ...
-1
votes
1answer
59 views
Giving privilege with validity in Windows 7
In parental control I can restrict the games, applications, and also set time for usage. But how can I grant some privilege (like using some application or playing games) with a validity? To be more ...
-3
votes
3answers
147 views
wireless security concern [closed]
My small office has Netgear Router (N300 DGN2200). I had it secured using "password" . So any computer which needed access had to give the security password. But today a outsider accessed my router ...
