A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

3
votes
3answers
2k views

How can reverse proxies be used to bypass acceptable use policies of a company?

I am wondering how reverse proxies can be used to bypass company acceptable use policies? What can be done to prevent it?
3
votes
5answers
1k views

Security purpose of asking admin password to mount partition on Linux

So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
4
votes
3answers
185 views

(custom software) Security rules on each record when using user-groups per application

I'm working with custom software here, so don't worry about Microsoft whatever, Open anything, or something else. Let’s stick to theory of how this should go together. Let’s say I have a user ...
1
vote
2answers
468 views

Star property in read/write access

The * star property requirement for append access [SC(S) <= SC(O)] is looser than for write access [SC(S) = SC(O)]. Can someone explain the reason for this?
1
vote
2answers
544 views

Closing handles of a process as a regular user

Here's the situation: As an adminstrator, I am able to stall the application by closing 2 handles held by the process. (Using ProcExplorer) . Is there any way/hack I can use to close file handles ...
9
votes
4answers
923 views

RBAC model: user in two roles access dilemma

I am implementing the Role-Based Access Control (RBAC) model security system and I have a dilemma: one User1 is in Role1 and is in Role2. Role1 allows access to the Resource1 and Role2 denies access ...
0
votes
1answer
527 views

Standards for physical Access Control systems

Hoping to help protect an IT installation, I've been looking into physical protection systems, specifically Access Control for protected areas. The field is quite big. Are there any US or ...
2
votes
2answers
159 views

Preventing Client PC's from accessing C&C machines

At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my ...
0
votes
1answer
455 views

website hacked and all its content erased despite the protections

i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...
2
votes
1answer
65 views

Access Flags for Handles

The handles window in process Explorer has a column Access which supposedly determines the access rights of that particular handle. I am not able to get any documentation on how to read the flags and ...
1
vote
1answer
831 views

How secure is github's whitelisting CORS domains?

The Github API allows you to make requests using CORS [1]. The CORS requests are only allowed by certain whitelisted domains : Any domain that is registered as an OAuth Application is accepted. ...
7
votes
3answers
410 views

Is it advisable to have a web browser remember login credentials?

I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
50
votes
8answers
9k views

Risks of giving developers admin rights to their own PCs

I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
7
votes
2answers
940 views

What is the procedure to follow against a security breach?

Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information. One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
1
vote
1answer
397 views

Installing applications with different user accounts on linux

I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
3
votes
2answers
119 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
2
votes
2answers
1k views

How to use 'key material' so that multiple people can access protected files?

I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
18
votes
4answers
4k views

Protection against account lockout DoS

Any ideas on how to protect against the following scenario? Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
2
votes
1answer
929 views

Putting the Biba-LaPadula Mandatory Access Control Methods to Practise?

Text books on database systems always refer to the two Mandatory Access Control models; Biba for the Integrity objective and Bell-LaPadula for the Secrecy or Confidentiality objective. Text books ...
4
votes
1answer
1k views

Covert Channels Exploit and the Bell-LaPadula MAC Model

I'm wrapping my head around Mandatory Access Control (MAC) and the well-known Bell-LaPadula model. One limitation that is mentioned with this model is covert channel exploitation. The one example I ...
3
votes
3answers
680 views

Do you give local administrator account password to notebook users?

My notebook users need to travel a lot. Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings. Should I give them local administrator's ...
0
votes
1answer
104 views

Implementation of a FREE web filter [closed]

I just want some advice for the implementation of a web filter for a school network. Just want to block some contents and url. A free tool should be fine I guess. Any recommendations? Thanks!
3
votes
1answer
344 views

Trial version security

I am developing stand-alone software in BDS 2006. I want to provide a trial version for 6 months -- the user can use it for just 6 months, but no more on a particular system. I have handled most ...
0
votes
1answer
181 views

Best practice for selective opening of ports on network gateway

Our network is currently isolated from the outside by a Linux box, running iptables and Squid to control web access. By default we deny all outgoing traffic from all IP's, to force Web traffic ...
6
votes
6answers
437 views

Disable internet access of development PC for security

My friend's company is trying to disable Internet access of programmer's primary development PC to improve security, while giving them another PC to connect to the Internet. He is a web programmer. I ...
1
vote
1answer
288 views

Can HIPS software practically be considered a form of MAC

Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system. Given that with the use ...
13
votes
1answer
838 views

Are there Linux rootkits circulating that directly modify the kernel (without modules)?

It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
3
votes
4answers
341 views

Help to account all the points of physical access to a rack server to steal software

Let's say I want to move my 1U Dell server to co-location site with a hostile company who will try to steal my code (this is almost 90% probability if I dont take steps)... The limitation for their ...
19
votes
4answers
968 views

Securing an area both physically and technically

I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security". Essentially this means that if any pictures/information/files/etc. of the product were ...
1
vote
0answers
232 views

What is the best way to manage temporary accounts on Active Directory [closed]

The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
2
votes
1answer
108 views

User Account Notification under Windows useful at all?

IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
2
votes
1answer
230 views

Does this htaccess snippet provide sufficient security?

I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
7
votes
2answers
1k views

Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?

I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
6
votes
5answers
900 views

What is the practical difference between MAC and Capabilities

Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user. Is there any ...
6
votes
2answers
1k views

How do I log everything a certain program is doing?

i have a program which is pretty simple. Its just a simple login form. Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
5
votes
3answers
3k views

Bell-LaPadula imlementation example

I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example. I understand how the model works, but I have difficulties implementing it in a programming language ...
8
votes
1answer
220 views

What practical uses are there for the AD feature of “Confidential Attributes”

Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes? Would you store sensitive information here such as a private key, or a salt here? I'm ...
6
votes
3answers
165 views

Requiring Authentication to Exit

I've often wondered why facilities do not require authentication as a default on exit. Beyond the oblivious reasons: Fire safety policies would require a panic mechanism to override the access ...
3
votes
1answer
2k views

BLP Lattice-structered system from Access Control Matrix

I've been reading a Computer Security book by Walliam Stallings and have found this example: http://i.imgur.com/5CAlc.png of an Access Control Matrix. Any example will do I just thought I'd screenshot ...
5
votes
1answer
950 views

Does Fedora 15 still use suid bits?

I heard that Fedora 15 will not use suid bits. Is that true? Is the suid bit a security design bug?
3
votes
2answers
315 views

Which access rights should be chosen for doku wiki?

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages). At the moment I gave the ...
4
votes
1answer
4k views

Windows task manager can see all processes as non administrator without permission

On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which ...
9
votes
1answer
724 views

How to prepare for protecting identity after death?

In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
3
votes
3answers
471 views

How do I clearly distinguish between groups of formal and informal models?

I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
8
votes
1answer
390 views

What is a practical example of an action that violates the non-interference model?

I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations). I ...
7
votes
2answers
2k views

What's the difference between an access control method, security model, and security policy?

(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me). I'm studying for the CISSP exam and I'm getting confused ...
4
votes
2answers
143 views

Is it correct to consider audits as exclusively “detective” in nature?

I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain ...
4
votes
1answer
1k views

Is it correct to consider Task Based Access Control as a type of RBAC?

I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture: "Role Based Access Control doesn't ...
11
votes
3answers
238 views

Different MySQL Users Security Benefits

Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
5
votes
3answers
2k views

Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?

I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-Lapadula Model. I understand the mechanics of it and that ...