A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

9
votes
4answers
896 views

RBAC model: user in two roles access dilemma

I am implementing the Role-Based Access Control (RBAC) model security system and I have a dilemma: one User1 is in Role1 and is in Role2. Role1 allows access to the Resource1 and Role2 denies access ...
0
votes
1answer
506 views

Standards for physical Access Control systems

Hoping to help protect an IT installation, I've been looking into physical protection systems, specifically Access Control for protected areas. The field is quite big. Are there any US or ...
1
vote
2answers
153 views

Preventing Client PC's from accessing C&C machines

At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my ...
0
votes
1answer
442 views

website hacked and all its content erased despite the protections

i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...
2
votes
1answer
64 views

Access Flags for Handles

The handles window in process Explorer has a column Access which supposedly determines the access rights of that particular handle. I am not able to get any documentation on how to read the flags and ...
1
vote
1answer
794 views

How secure is github's whitelisting CORS domains?

The Github API allows you to make requests using CORS [1]. The CORS requests are only allowed by certain whitelisted domains : Any domain that is registered as an OAuth Application is accepted. ...
7
votes
3answers
399 views

Is it advisable to have a web browser remember login credentials?

I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
50
votes
8answers
9k views

Risks of giving developers admin rights to their own PCs

I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
7
votes
2answers
922 views

What is the procedure to follow against a security breach?

Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information. One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
1
vote
1answer
383 views

Installing applications with different user accounts on linux

I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
3
votes
2answers
117 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
2
votes
2answers
1k views

How to use 'key material' so that multiple people can access protected files?

I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
17
votes
4answers
4k views

Protection against account lockout DoS

Any ideas on how to protect against the following scenario? Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
2
votes
1answer
882 views

Putting the Biba-LaPadula Mandatory Access Control Methods to Practise?

Text books on database systems always refer to the two Mandatory Access Control models; Biba for the Integrity objective and Bell-LaPadula for the Secrecy or Confidentiality objective. Text books ...
4
votes
1answer
1k views

Covert Channels Exploit and the Bell-LaPadula MAC Model

I'm wrapping my head around Mandatory Access Control (MAC) and the well-known Bell-LaPadula model. One limitation that is mentioned with this model is covert channel exploitation. The one example I ...
3
votes
3answers
666 views

Do you give local administrator account password to notebook users?

My notebook users need to travel a lot. Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings. Should I give them local administrator's ...
0
votes
1answer
104 views

Implementation of a FREE web filter [closed]

I just want some advice for the implementation of a web filter for a school network. Just want to block some contents and url. A free tool should be fine I guess. Any recommendations? Thanks!
3
votes
1answer
340 views

Trial version security

I am developing stand-alone software in BDS 2006. I want to provide a trial version for 6 months -- the user can use it for just 6 months, but no more on a particular system. I have handled most ...
0
votes
1answer
173 views

Best practice for selective opening of ports on network gateway

Our network is currently isolated from the outside by a Linux box, running iptables and Squid to control web access. By default we deny all outgoing traffic from all IP's, to force Web traffic ...
6
votes
6answers
430 views

Disable internet access of development PC for security

My friend's company is trying to disable Internet access of programmer's primary development PC to improve security, while giving them another PC to connect to the Internet. He is a web programmer. I ...
1
vote
1answer
276 views

Can HIPS software practically be considered a form of MAC

Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system. Given that with the use ...
13
votes
1answer
813 views

Are there Linux rootkits circulating that directly modify the kernel (without modules)?

It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
3
votes
4answers
338 views

Help to account all the points of physical access to a rack server to steal software

Let's say I want to move my 1U Dell server to co-location site with a hostile company who will try to steal my code (this is almost 90% probability if I dont take steps)... The limitation for their ...
19
votes
4answers
939 views

Securing an area both physically and technically

I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security". Essentially this means that if any pictures/information/files/etc. of the product were ...
1
vote
0answers
229 views

What is the best way to manage temporary accounts on Active Directory [closed]

The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
2
votes
1answer
107 views

User Account Notification under Windows useful at all?

IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
2
votes
1answer
228 views

Does this htaccess snippet provide sufficient security?

I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
7
votes
2answers
1k views

Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?

I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
6
votes
5answers
867 views

What is the practical difference between MAC and Capabilities

Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user. Is there any ...
6
votes
2answers
1k views

How do I log everything a certain program is doing?

i have a program which is pretty simple. Its just a simple login form. Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
5
votes
3answers
3k views

Bell-LaPadula imlementation example

I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example. I understand how the model works, but I have difficulties implementing it in a programming language ...
8
votes
1answer
217 views

What practical uses are there for the AD feature of “Confidential Attributes”

Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes? Would you store sensitive information here such as a private key, or a salt here? I'm ...
6
votes
3answers
165 views

Requiring Authentication to Exit

I've often wondered why facilities do not require authentication as a default on exit. Beyond the oblivious reasons: Fire safety policies would require a panic mechanism to override the access ...
3
votes
1answer
2k views

BLP Lattice-structered system from Access Control Matrix

I've been reading a Computer Security book by Walliam Stallings and have found this example: http://i.imgur.com/5CAlc.png of an Access Control Matrix. Any example will do I just thought I'd screenshot ...
5
votes
1answer
926 views

Does Fedora 15 still use suid bits?

I heard that Fedora 15 will not use suid bits. Is that true? Is the suid bit a security design bug?
3
votes
2answers
296 views

Which access rights should be chosen for doku wiki?

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages). At the moment I gave the ...
4
votes
1answer
4k views

Windows task manager can see all processes as non administrator without permission

On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which ...
9
votes
1answer
699 views

How to prepare for protecting identity after death?

In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
3
votes
3answers
442 views

How do I clearly distinguish between groups of formal and informal models?

I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
8
votes
1answer
354 views

What is a practical example of an action that violates the non-interference model?

I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations). I ...
7
votes
2answers
2k views

What's the difference between an access control method, security model, and security policy?

(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me). I'm studying for the CISSP exam and I'm getting confused ...
4
votes
2answers
143 views

Is it correct to consider audits as exclusively “detective” in nature?

I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain ...
4
votes
1answer
1k views

Is it correct to consider Task Based Access Control as a type of RBAC?

I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture: "Role Based Access Control doesn't ...
11
votes
3answers
235 views

Different MySQL Users Security Benefits

Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
5
votes
3answers
2k views

Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?

I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-Lapadula Model. I understand the mechanics of it and that ...
24
votes
1answer
17k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...
5
votes
3answers
1k views

Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account

How do large companies implement their security requirements which are centralized and used to drive things people can do (allowed to call a certain web-service, submit an order, etc.) as well as to ...
5
votes
1answer
663 views

access control to data-center using rfid

I don't know if "here" is the right place to make this kind of question... so here it is.. Is rfid a good solution for controlling access to a data-center? Because rfid is "wireless", is it ...
5
votes
1answer
1k views

Clark Wilson Integrity Model: Rules

What is the conceptual difference between certification rules and enforcement rules in the Clark Wilson model? Am I on a wrong path when I assume that certification rules ensure external integrity ...
7
votes
3answers
3k views

User “home directory” on iPhone, Android, Windows mobiles and Blackberry

Is anyone aware of any mobile (iPhone, Android, Windows mobiles and Blackberry) Operating System that support multi users? I am not aware but I thought it is worth double checking. Off course, in ...