A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

7
votes
3answers
384 views

Is it advisable to have a web browser remember login credentials?

I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
1
vote
1answer
207 views

IPtables - Accept Arbitrary Packets

I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by ...
3
votes
3answers
2k views

How can reverse proxies be used to bypass acceptable use policies of a company?

I am wondering how reverse proxies can be used to bypass company acceptable use policies? What can be done to prevent it?
1
vote
1answer
325 views

Installing applications with different user accounts on linux

I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
3
votes
2answers
116 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
6
votes
4answers
335 views

Are there a standard method(s) for me to give someone else read-only access to my data?

Are there a standard method(s) for me to give someone else read-only access to my data? There are several situations where I may want to give a few people read-only access to some data, but I would ...
2
votes
2answers
939 views

How to use 'key material' so that multiple people can access protected files?

I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
47
votes
8answers
7k views

Risks of giving developers admin rights to their own PCs

I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
7
votes
2answers
835 views

What is the procedure to follow against a security breach?

Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information. One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
2
votes
1answer
745 views

Putting the Biba-LaPadula Mandatory Access Control Methods to Practise?

Text books on database systems always refer to the two Mandatory Access Control models; Biba for the Integrity objective and Bell-LaPadula for the Secrecy or Confidentiality objective. Text books ...
3
votes
1answer
851 views

Covert Channels Exploit and the Bell-LaPadula MAC Model

I'm wrapping my head around Mandatory Access Control (MAC) and the well-known Bell-LaPadula model. One limitation that is mentioned with this model is covert channel exploitation. The one example I ...
0
votes
1answer
101 views

Implementation of a FREE web filter [closed]

I just want some advice for the implementation of a web filter for a school network. Just want to block some contents and url. A free tool should be fine I guess. Any recommendations? Thanks!
3
votes
1answer
325 views

Trial version security

I am developing stand-alone software in BDS 2006. I want to provide a trial version for 6 months -- the user can use it for just 6 months, but no more on a particular system. I have handled most ...
1
vote
3answers
1k views

How to set password on applications in Mac OS to prevent an administrator to start them?

Is there any program that can set password on the app like mail or browser? I know about parent control, but I doesn't work with administrator account. What I want is some program that blocks some ...
0
votes
1answer
146 views

Best practice for selective opening of ports on network gateway

Our network is currently isolated from the outside by a Linux box, running iptables and Squid to control web access. By default we deny all outgoing traffic from all IP's, to force Web traffic ...
5
votes
2answers
544 views

Combining capability-based access control with SAML

I have been looking into various research on identity, PKI and access control trying to boil it down to a simplified methodology for IAM (Identity & Access Management). One thing which pops up in ...
3
votes
3answers
572 views

Do you give local administrator account password to notebook users?

My notebook users need to travel a lot. Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings. Should I give them local administrator's ...
6
votes
6answers
413 views

Disable internet access of development PC for security

My friend's company is trying to disable Internet access of programmer's primary development PC to improve security, while giving them another PC to connect to the Internet. He is a web programmer. I ...
3
votes
4answers
309 views

Help to account all the points of physical access to a rack server to steal software

Let's say I want to move my 1U Dell server to co-location site with a hostile company who will try to steal my code (this is almost 90% probability if I dont take steps)... The limitation for their ...
10
votes
4answers
2k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership? For example: Bob is a doctor and has the role ...
1
vote
0answers
212 views

What is the best way to manage temporary accounts on Active Directory [closed]

The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
2
votes
1answer
105 views

User Account Notification under Windows useful at all?

IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
2
votes
1answer
217 views

Does this htaccess snippet provide sufficient security?

I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
5
votes
4answers
2k views

Two SSIDs on same Access point- not good?

If I were to offer two networks (one for trusted users and one to visitors) on one physical access point, is this dangerous because a visitor could compromise the trusted network across via the ...
3
votes
1answer
2k views

Wireless MAC Address Filtering - Authentication/Association

Can somebody explain to me how a wireless AP denies access to the network if the client does not have the correct MAC Address. Does it not send a probe response when a client has not got a correct ...
5
votes
2answers
1k views

Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?

I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
28
votes
20answers
3k views

How can I prevent my kids from bypassing my computer restrictions?

My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions: Can this damage my computer or corrupt my files? (I have lots of pictures) Is ...
1
vote
1answer
238 views

Can HIPS software practically be considered a form of MAC

Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system. Given that with the use ...
6
votes
5answers
735 views

What is the practical difference between MAC and Capabilities

Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user. Is there any ...
6
votes
2answers
793 views

How do I log everything a certain program is doing?

i have a program which is pretty simple. Its just a simple login form. Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
9
votes
2answers
965 views

Best practices for implementation of role-based access control in healthcare applications

Amongst the open source EMRs, which ones may be good to learn from? Any references I can go to as a starting point?
1
vote
2answers
395 views

Star property in read/write access

The * star property requirement for append access [SC(S) <= SC(O)] is looser than for write access [SC(S) = SC(O)]. Can someone explain the reason for this?
4
votes
3answers
3k views

Bell-LaPadula imlementation example

I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example. I understand how the model works, but I have difficulties implementing it in a programming language ...
19
votes
7answers
2k views

In Healthcare IT, is a “break glass” mode to bypass access controls commonly required?

I've seen referenced in literature the need to have a "break glass" mode in Healthcare IT applications. In this mode, the access controls in an application can be bypassed for an emergency when it is ...
2
votes
3answers
238 views

Remote Connection Tampering

My small high street laptop repair/service/maintenance shop has been up and running for about 3 years. It's doing quite well so I'm looking to expand into other areas of the PC market. One area I ...
8
votes
1answer
204 views

What practical uses are there for the AD feature of “Confidential Attributes”

Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes? Would you store sensitive information here such as a private key, or a salt here? I'm ...
6
votes
3answers
158 views

Requiring Authentication to Exit

I've often wondered why facilities do not require authentication as a default on exit. Beyond the oblivious reasons: Fire safety policies would require a panic mechanism to override the access ...
13
votes
1answer
737 views

Are there Linux rootkits circulating that directly modify the kernel (without modules)?

It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
17
votes
4answers
757 views

Securing an area both physically and technically

I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security". Essentially this means that if any pictures/information/files/etc. of the product were ...
3
votes
1answer
684 views

Securing sensitive data in a DB,is using H2 worth it?

I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now of course, besides the usual password hashing + salt +.... I ...
2
votes
1answer
2k views

BLP Lattice-structered system from Access Control Matrix

I've been reading a Computer Security book by Walliam Stallings and have found this example: http://i.imgur.com/5CAlc.png of an Access Control Matrix. Any example will do I just thought I'd screenshot ...
15
votes
5answers
60k views

Can someone steal money from my bank account if they know my IBAN and personal details?

To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
13
votes
2answers
516 views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...
3
votes
2answers
246 views

Which access rights should be chosen for doku wiki?

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages). At the moment I gave the ...
28
votes
4answers
3k views

Are there DRM techniques to effectively prevent pirating?

A question on Skeptics.SE asks whether current DRM techniques effectively prevent pirating: Is DRM effective? The question for IT Security is: Can DRM be made effective, and are there any examples? ...
11
votes
3answers
20k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
4
votes
1answer
4k views

Windows task manager can see all processes as non administrator without permission

On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which ...
8
votes
1answer
574 views

How to prepare for protecting identity after death?

In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
0
votes
2answers
266 views

Can you pick up any device specific information by monitoring bluetooth signals? [closed]

Could I use some sort of permanent device ID broadcasted by the bluetooth radio in my phone to do something like unlock my door? I don't want to have to ever pair the device, or take it out of my ...
5
votes
1answer
835 views

Does Fedora 15 still use suid bits?

I heard that Fedora 15 will not use suid bits. Is that true? Is the suid bit a security design bug?