A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

2
votes
1answer
66 views

How to find out if content on my XAMPP server has been altered

During the development of a site, me and the team decided to develop the site with my computer as a server, with me making my localhost available from outside. I have been using several settings to ...
2
votes
3answers
532 views

MySQL database access prevention

I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
2
votes
1answer
623 views

OAuth: client credentials vs tokens

Wouldn't it be much simpler and virtually equally secure to replace tokens by pure client credentials? Client credentials wouldn't expire and resource owners would always be able to modify their ...
2
votes
1answer
166 views

How do automated systems store their keys securely?

As with many systems (primarily websites) there are automatic components that run on a server and are not user based (such as crons) that don't have the opportunity for a real person to input a secret ...
2
votes
2answers
2k views

DMZ and LAN data exchange - what direction should connections be made?

When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure: DMZ service pushes data to LAN service or LAN service pulls data from DMZ ...
2
votes
2answers
1k views

How to use 'key material' so that multiple people can access protected files?

I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
2
votes
1answer
67 views

How to reset a second factor authentication without compromising the authentication process

I am designing a system that uses two-factor authentication. Where the user can only granted access only if the two authentication factors passed the verification. Let us assume that the first ...
2
votes
2answers
323 views

Gaining root access on Ubuntu 14.04 [closed]

I am taking a Computer Security class and I am supposed to harden my system really well but I am supposed to leave one "hard backdoor" for the adversary to gain root access. I have been trying to ...
2
votes
2answers
98 views

How to appropriately secure a database using different db users

I was thinking recently of the steps to secure a database server. Most of us are aware how to handle the security on the application side, although a malicious user might find his way to bypass the ...
2
votes
1answer
65 views

Is there a strong protection against CSRF executed from the sames server via stored XSS?

If we have a domain with stored-XSS vulnerability. I know it's already critical!.. But, I'm talking about limiting the damage. The hacker can't get the session cookie of the admin, because it's ...
2
votes
1answer
4k views

MAC vs DAC vs RBAC

Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
2
votes
1answer
779 views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
2
votes
1answer
72 views

Preventing softwares from leaving traces in Windows | deleting the traces easily

Say I open a .doc file from my UFD. I want to avoid leaving any traces in Windows (e.g. recent files, back-up files, swaps, etc) , or at least be able to delete all easily. So in this case, I want to ...
2
votes
1answer
1k views

Is htaccess secure enought to whitelist clients IPs?

I'm using .htaccess to control source IP of connections to my web application. My configuration looks more or less like this: order deny,allow deny from all allow from X.Y.Z.Q These ...
2
votes
2answers
180 views

Preventing Client PC's from accessing C&C machines

At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my ...
2
votes
1answer
51 views

How to determine which program accessed the Mac Camera?

The green light on my laptop's camera just flashed on and then off after 1 second. I am extremely concerned about this since I am not running any programs which could have enabled the camera. I ...
2
votes
3answers
520 views

On Windows, how to restrict access to a folder, sub folder and files to only some applications (not users)

We have an application which is not per user and can be used by multiple users simultaneously. Data is also shared by all users. The path to the data folders we use is ProgramData\OurAppName\Data ...
2
votes
1answer
87 views

Smart cards and firewalls are what type of access control?

Specifically for the CISSP, trying to figure out what type of access control these would be considered.
2
votes
2answers
138 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if ...
2
votes
1answer
73 views

Access Flags for Handles

The handles window in process Explorer has a column Access which supposedly determines the access rights of that particular handle. I am not able to get any documentation on how to read the flags and ...
2
votes
1answer
108 views

User Account Notification under Windows useful at all?

IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
2
votes
0answers
40 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
2
votes
2answers
358 views

Teamviewer Security Question [closed]

Currently we are using Teamviewer 9. We have a couple of desktop machines that are locked down in the following manner: 1). The shell is no longer explorer.exe, it is a custom program we have ...
2
votes
2answers
282 views

Can I use stormpath user management service with a XACML library like BALANA?

I'm trying to implement some security access control in a software I'm building. I came across Stormpath for user management and they have somewhat an approach for RBAC yet what I was considering is ...
2
votes
0answers
829 views

Google ads and/or DoubleClick wants to access the keyboard API in Firefox? [closed]

I have started Firefox in an Ubuntu terminal, and now I see these messages during browsing: "No permission to use the keyboard API for http://googleads.g.doubleclick.net" I mean... WTF? Why does ...
1
vote
1answer
538 views

Is a firewall an access control list?

I want to know if a firewall is considered an access control list (ACL). I know there are other types of ACLs, but am specifically interested in knowing if a firewall is an ACL. Edit: It appears ...
1
vote
2answers
160 views

Wifi box produces three SSIDs?

While using a friend's wifi, he said I should use his SSID, let's call it XYZ's Wifi. When I started my Macbook Pro, three SSIDs came up. Two were called XYZ's Wifi and the third was called XYZ's ...
1
vote
2answers
259 views

How to restrict access to unwanted sites?

I use Ubuntu 13.10. I tried to used OpenDNS to restrict some websites. Unfortunately, I couldn't do that. I use AirStream 1200 USB modem to access WiMax internet. OpenDNS setting didn't work for me at ...
1
vote
2answers
742 views

BLP Lattice structure with missing top and bottom levels

I designed a system similar to the above diagram. However There is no (Top Secret, {nuclear,crypto}) and no (Secret,{}) levels. Meaning that there is no top and bottom level. Would it make the BLP ...
1
vote
3answers
236 views

Resetting passwords howto

I am currently in the process of designing a registration form for the users to register accounts. The accounts will contain a lot of personal information, so I want to ensure highest possible ...
1
vote
3answers
875 views

How do I restrict network access to LAN for visitors

How do I restrict network access to LAN for visitors? In my organization's premises any outside visitor can come and connect to the LAN ports in our meeting rooms. We have seen that they are able to ...
1
vote
5answers
141 views

Is there a term for Authorizing before Authenticating? Is it even common?

In most scenarios a person identifies who they are (authentication/AuthN) via something like a username and password. Afterwards a system would likely evaluate what that validated identity can perform ...
1
vote
2answers
79 views

user roles or access levels

I am beginning a new project and I already know that I'll have various roles for various users, regardless of their access level. They just have different jobs to do. With that in mind, I'm thinking ...
1
vote
1answer
440 views

Installing applications with different user accounts on linux

I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
1
vote
3answers
1k views

How to set password on applications in Mac OS to prevent an administrator to start them?

Is there any program that can set password on the app like mail or browser? I know about parent control, but I doesn't work with administrator account. What I want is some program that blocks some ...
1
vote
2answers
139 views

Is VPN the best solution against man-in-the-middle attack? [closed]

I'm looking for the best way to protect my enterprise against man in the middle attacks, because a lot of people connect to the same network. So I was thinking of creating a VPN. Is this really the ...
1
vote
1answer
97 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
1
vote
1answer
129 views

How secure is the web-based file browser that comes with my NAS?

I have a Buffalo Linkstation Pro 2 Duo for home use. It has a web GUI for browsing the contents of the NAS (distinct from the admin interface). The idea is that you would expose the web GUI to the ...
1
vote
2answers
166 views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
1
vote
2answers
326 views

Contactless session on ATM?

I'm currently reading about an access control and saw something interesting about smartcard contact & contactless. From what I understood from the book, smartcard contact is like an ATM Card. ...
1
vote
2answers
51 views

Should application logs be available to admins or just superuser?

I'm developing a kind of standard web-application, to be hosted internally on few customer's servers (not a public service, startup or anything like that). A kind of CMS, e-learning platform or ...
1
vote
2answers
319 views

Isolating guest networks

I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network. Initially, I used IP filtering ...
1
vote
1answer
75 views

How to restrict access to a resource based on frequency of access?

I want to restrict access to a particular resource based on time (configurable). So suppose user A has time t configured from him. He can access the resource only once every t time units. The values ...
1
vote
1answer
1k views

Possible to limit server connections to clients with a specific certificate?

Usually when I read about SSL and HTTP it says that the certificate is set up to authenticate that the host is who it says it is. Is it possible to configure the host to prevent it from processing ...
1
vote
1answer
322 views

What are the basic implementations that make a network secure from the inside\outside?

Would you consider the following to be "basic hardening items" for network equipment and servers? VLANs Access Control (such as NTFS permissions) Patch Management System Host Firewall Anti-Virus ...
1
vote
1answer
325 views

Can HIPS software practically be considered a form of MAC

Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system. Given that with the use ...
1
vote
2answers
489 views

Star property in read/write access

The * star property requirement for append access [SC(S) <= SC(O)] is looser than for write access [SC(S) = SC(O)]. Can someone explain the reason for this?
1
vote
1answer
75 views

How safe are networking ACLs based on IP-address?

As far as I know, a determined attacker would have no major issues in hacking the IP address of the packets contained by his (web) request. Therefore, I cannot see how an Access Control List (such as ...
1
vote
1answer
107 views

Is it safe to store important data in an encrypted access token?

Is it safe to store important data in an encrypted access token? For example, instead of storing access tokens in a database, not storing them at all and putting their associated data into them before ...
1
vote
1answer
163 views

Is open-to-all CORS safe for non-cookie-based authentication schemes (e.g. OAuth)

I'm building an API with both protected and public endpoints, and I'm protecting it with OAuth 2's various flows. I want this API to be open to the world - the main consumer website won't even be on ...