A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

4
votes
1answer
1k views

Covert Channels Exploit and the Bell-LaPadula MAC Model

I'm wrapping my head around Mandatory Access Control (MAC) and the well-known Bell-LaPadula model. One limitation that is mentioned with this model is covert channel exploitation. The one example I ...
4
votes
3answers
223 views

(custom software) Security rules on each record when using user-groups per application

I'm working with custom software here, so don't worry about Microsoft whatever, Open anything, or something else. Let’s stick to theory of how this should go together. Let’s say I have a user ...
4
votes
2answers
79 views

Using a single application for user and admin (with different auth methods) vs separating them into two applications

I am creating a human resource management application that allows access from both employee and HR administrator. Now, I'm faced with a best practice issue. There would definitely be two users: ...
4
votes
4answers
4k views

Block unauthorized user from getting access to intranet

What's the common way to block users from accessing intranet? Right now, whoever plugs in a cable can access any intranet server freely. I want to change this behavior. But given that we run not only ...
4
votes
2answers
86 views

Using identifiers in URLs to authenticate users

Someone I know is registered on a community website where they can exchange messages etc. Taking a look at the email notification they receive when something new has been posted, contains an image ...
4
votes
5answers
4k views

Is it possible to restrict USB keys to only certified ones, and block that key's access on other computers

I am working on security for an organisation, we have purchased some encrypted USB keys but wanted to stop any employees leaking data. is there any way to stop their laptop accepting any key but the ...
4
votes
1answer
5k views

Windows task manager can see all processes as non administrator without permission

On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which ...
4
votes
2answers
949 views

How can the low-water mark property apply to Bell-LaPadula?

I am taking a computer security class, and have a homework problem which has the following setup: Now assume a dynamic version of the Bell-La Padula Confidentiality model that incorporates a ...
4
votes
1answer
2k views

BLP Lattice-structered system from Access Control Matrix

I've been reading a Computer Security book by Walliam Stallings and have found this example: http://i.imgur.com/5CAlc.png of an Access Control Matrix. Any example will do I just thought I'd screenshot ...
4
votes
1answer
1k views

Is it correct to consider Task Based Access Control as a type of RBAC?

I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture: "Role Based Access Control doesn't ...
4
votes
1answer
39 views

What are best practices for secure admin access management to critical 3rd party cloud application in big companies?

I've always wondered how can we manage admin access to critical 3rd party resources (social media, SaaS CRM, etc) in big companies to mitigate: The administrator might leave the company without ...
4
votes
1answer
530 views

Safety in Access Control Matrix and Take-Grant Model

I'm learning about the Take-Grant Model and Access Control Matrix, and I have a couple of questions regarding leaking and the safety question. Definitions These are the definitions I am using (see ...
4
votes
5answers
344 views

Can someone please explain RBAC to me?

From http://msdn.microsoft.com/en-us/library/jj709705.aspx In contrast to the DAC model, which is oriented around objects, the AzMan RBAC model attempts to orient the common administrative experience ...
4
votes
2answers
238 views

Car Remote App Security

Car manufactures like BMW, Audi or Mercedes-Benz all provide mobile applications to control your car. All apps share really critical functions like remote lock/unlock or the ability to find your car ...
4
votes
2answers
172 views

Is there a security advantage to requiring a user id instead of just /me in an api request?

Is there a security advantage to requiring a request to conform to /api/1234 instead of /api/me? Both would obviously have access tokens. My guess is that api/1234 is more secure because if someone ...
4
votes
1answer
56 views

Are Linux System Capabilities Considered Mandatory Access Controls?

DAC is not mandatory because access permissions are left up to the resource owner's discretion. Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a ...
4
votes
2answers
1k views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
4
votes
2answers
16k views

How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?

This is what I believe to be an interesting challenge :) A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
4
votes
4answers
199 views

How can an Subject only read and write to its owned objects?

It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
3
votes
4answers
391 views

Help to account all the points of physical access to a rack server to steal software

Let's say I want to move my 1U Dell server to co-location site with a hostile company who will try to steal my code (this is almost 90% probability if I dont take steps)... The limitation for their ...
3
votes
3answers
4k views

Should I give developers admin rights or leave as power users? [duplicate]

In my organization we are in the process of upgrading everyone to Windows 7.We have all of our users configured as power users. The issue we are running into is this: Should we give developers local ...
3
votes
3answers
2k views

How can reverse proxies be used to bypass acceptable use policies of a company?

I am wondering how reverse proxies can be used to bypass company acceptable use policies? What can be done to prevent it?
3
votes
3answers
624 views

How do I clearly distinguish between groups of formal and informal models?

I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
3
votes
3answers
2k views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
3
votes
3answers
624 views

encryption vs access control comparison

I have a very basic and simple question about two security concepts. Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
3
votes
2answers
586 views

Which access rights should be chosen for doku wiki?

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages). At the moment I gave the ...
3
votes
4answers
31k views

How to check if computer is controlled remotely

My laptop has windows 7 installed. One Saturday night I couldn't fall asleep and was just lying in bed. Then suddenly at around 2 in the morning I heard the fan of the laptop start up and lights on ...
3
votes
2answers
121 views

Authorising use of apps from a public store with no back end service

I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
3
votes
5answers
538 views

Is there an access-control model defined in terms of application structure?

I'm working on the access control component of a complex web application. One of the goals is to have a strictly defined model for who can do what, but I can't find an existing model that meets our ...
3
votes
3answers
744 views

Do you give local administrator account password to notebook users?

My notebook users need to travel a lot. Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings. Should I give them local administrator's ...
3
votes
1answer
55 views

Access via link in Email - How can I make this most secure?

I need your professional opinion on this matter, please. The app I'm building has 2 parts: Teachers & students. Teachers use the app to build a project and attach students to it. Then, the ...
3
votes
2answers
109 views

How do we verify identity before creating a new admin account?

We are designing the security for a B2B Saas service, the user and admin accounts are based on the customer's email addresses - typically our customers are small organisations without their own in ...
3
votes
3answers
864 views

Access Control and Authentication using Facebook access tokens in a webapp

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create ...
3
votes
1answer
1k views

I'm using a Cisco ASA as a VPN endpoint. Where do the VPN clients get firewalled?

(Is this too application specific? It seems like a reasonable question that would be useful to other people...) So, I've got this ASA in front of a network that I didn't set up. It's been ...
3
votes
5answers
2k views

Security purpose of asking admin password to mount partition on Linux

So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
3
votes
2answers
133 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
3
votes
1answer
1k views

Securing sensitive data in a DB,is using H2 worth it?

I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now of course, besides the usual password hashing + salt +.... I ...
3
votes
1answer
48 views

Are there file-encryption tools that only allow access to whitelisted processes?

I am looking into VeraCrypt, a spiritual successor of TrueCrypt. This made a question pop up: As far as I understand, as long as the encrypted volume is mounted, every process can access the data. ...
3
votes
1answer
760 views

Limit BitTorrent Sync connections to a specific network

Is it possible to limit BitTorrent Sync connections to a a specific network using the client software? Right now the closest I can come up with would be IP limitations imposed on each client using a ...
3
votes
1answer
3k views

Wireless MAC Address Filtering - Authentication/Association

Can somebody explain to me how a wireless AP denies access to the network if the client does not have the correct MAC Address. Does it not send a probe response when a client has not got a correct ...
3
votes
1answer
65 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
3
votes
1answer
84 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...
3
votes
2answers
58 views

Where do Access Controls Fit into the Parkerian Hexad?

The security elements of the Parkerian Hexad are: Confidentiality Possession or Control Integrity Authenticity Availability Utility Where do access controls (mandatory, discretionary and ACL) fit ...
3
votes
1answer
67 views

Why is it a terrible idea to implement restrictive measures in .bashrc?

Asking this because apparently there are multiple people who genuinely don't realize just how bad of an idea this is, and I want there to be a single, easy-to-find place for them to go / be sent.
3
votes
2answers
252 views

web security testing - vulnerability issue

I'm testing a website to find out vulnerabilities. Website is fully running on HTTPS only. While testing, I came to know that the pdf files can be downloaded by authorized users only. This ...
3
votes
1answer
1k views

What methods are websites using to prevent direct access to media?

I really hope this question isn't off-topic... Background The question pertains to media security (video, audio, etc.), where the media in question is digitally protected (legally, DMCA-style) or ...
3
votes
1answer
383 views

Access rights management in large companies

I'm wondering how large companies with tens / hundred of applications are handling access-rights for their users. From what I've seen, it's a nightmare that never ends, and it requires full-time ...
3
votes
5answers
189 views

Windows: Any method to enforce user confirmation before the browser opens a URL requested by an external desktop app?

A robust outgoing firewall will protect against desktop applications directly connecting to the internet without your permission. However, as the browser is a generally authorized application for ...
3
votes
1answer
292 views

Is RDP an effective security barrier

If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct ...
3
votes
1answer
353 views

Trial version security

I am developing stand-alone software in BDS 2006. I want to provide a trial version for 6 months -- the user can use it for just 6 months, but no more on a particular system. I have handled most ...