A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

3
votes
3answers
355 views

How do I clearly distinguish between groups of formal and informal models?

I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
8
votes
1answer
284 views

What is a practical example of an action that violates the non-interference model?

I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations). I ...
7
votes
2answers
1k views

What's the difference between an access control method, security model, and security policy?

(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me). I'm studying for the CISSP exam and I'm getting confused ...
4
votes
2answers
140 views

Is it correct to consider audits as exclusively “detective” in nature?

I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain ...
4
votes
1answer
796 views

Is it correct to consider Task Based Access Control as a type of RBAC?

I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture: "Role Based Access Control doesn't ...
11
votes
3answers
220 views

Different MySQL Users Security Benefits

Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
5
votes
3answers
2k views

Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?

I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-Lapadula Model. I understand the mechanics of it and that ...
22
votes
1answer
12k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...
5
votes
3answers
1k views

Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account

How do large companies implement their security requirements which are centralized and used to drive things people can do (allowed to call a certain web-service, submit an order, etc.) as well as to ...
5
votes
1answer
630 views

access control to data-center using rfid

I don't know if "here" is the right place to make this kind of question... so here it is.. Is rfid a good solution for controlling access to a data-center? Because rfid is "wireless", is it ...
5
votes
1answer
1k views

Clark Wilson Integrity Model: Rules

What is the conceptual difference between certification rules and enforcement rules in the Clark Wilson model? Am I on a wrong path when I assume that certification rules ensure external integrity ...
7
votes
3answers
2k views

User “home directory” on iPhone, Android, Windows mobiles and Blackberry

Is anyone aware of any mobile (iPhone, Android, Windows mobiles and Blackberry) Operating System that support multi users? I am not aware but I thought it is worth double checking. Off course, in ...
5
votes
2answers
162 views

How is the password prompt going to protect me from ruining my computer?

On Unix based systems, I'm often prompted to enter my password before installing or running a program. Why does this protect me? If I'm running a kiosk, I understand that a password might prevent ...
7
votes
2answers
320 views

How is UAC a security improvement?

What does User Account Control on Windows offer in terms of security? It's just an extra click to potentially run a virus.
5
votes
1answer
1k views

Windows mandatory access control: How to remove “mandatory level” label from the file?

1) How to remove "mandatory level" label from the file? I have two files, for first icalcs return Mandatory Label\Medium Mandatory Level:(NW) for second icalcs doesn't return anything (that means ...
3
votes
1answer
819 views

I'm using a Cisco ASA as a VPN endpoint. Where do the VPN clients get firewalled?

(Is this too application specific? It seems like a reasonable question that would be useful to other people...) So, I've got this ASA in front of a network that I didn't set up. It's been ...
7
votes
3answers
603 views

What prevents this exploit from working (unix SUID)?

If I have a user on a unix system where Im allowed to create new files, what prevents me from downloading an executable file onto that system which is already SUID'ed to root on a different system? ...
6
votes
2answers
2k views

Bell-LaPadula and Biba Together

Theoretically, could the Bell-Lapaluda security model be implemented with the Biba integrity model in an Operating System? Or do are they mutually exclusive? [Edit: Follow up from this question on ...