A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

11
votes
3answers
220 views

Different MySQL Users Security Benefits

Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
5
votes
3answers
2k views

Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?

I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-Lapadula Model. I understand the mechanics of it and that ...
8
votes
3answers
1k views

Practical non-government uses of Biba, Bell-LaPadula, etc. models

For example, the Biba model is now hanging out in current versions of Windows. Things downloaded from the Internet are tagged as such. Internet (low) stuff can't alter user (medium) stuff which isn't ...
5
votes
3answers
1k views

Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account

How do large companies implement their security requirements which are centralized and used to drive things people can do (allowed to call a certain web-service, submit an order, etc.) as well as to ...
5
votes
1answer
630 views

access control to data-center using rfid

I don't know if "here" is the right place to make this kind of question... so here it is.. Is rfid a good solution for controlling access to a data-center? Because rfid is "wireless", is it ...
5
votes
1answer
1k views

Clark Wilson Integrity Model: Rules

What is the conceptual difference between certification rules and enforcement rules in the Clark Wilson model? Am I on a wrong path when I assume that certification rules ensure external integrity ...
7
votes
3answers
2k views

User “home directory” on iPhone, Android, Windows mobiles and Blackberry

Is anyone aware of any mobile (iPhone, Android, Windows mobiles and Blackberry) Operating System that support multi users? I am not aware but I thought it is worth double checking. Off course, in ...
14
votes
4answers
3k views

Protection against account lockout DoS

Any ideas on how to protect against the following scenario? Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
11
votes
3answers
449 views

Given SSH access, what should I do to protect a server and monitor (dangerous) user actions?

Context: Small business, mostly a software house for web applications but also some desktop software. Many external collaborators, so a variety of outside users with access to the servers. Single ...
5
votes
1answer
1k views

Windows mandatory access control: How to remove “mandatory level” label from the file?

1) How to remove "mandatory level" label from the file? I have two files, for first icalcs return Mandatory Label\Medium Mandatory Level:(NW) for second icalcs doesn't return anything (that means ...
3
votes
1answer
819 views

I'm using a Cisco ASA as a VPN endpoint. Where do the VPN clients get firewalled?

(Is this too application specific? It seems like a reasonable question that would be useful to other people...) So, I've got this ASA in front of a network that I didn't set up. It's been ...
12
votes
3answers
6k views

Prevent acccess to the C drive on Windows systems

Is it possible to prevent regular users from accessing the C drive via Windows Explorer? they should be allowed to execute certain programs. This is to ensure that employees cannot steal or copy out ...
7
votes
3answers
603 views

What prevents this exploit from working (unix SUID)?

If I have a user on a unix system where Im allowed to create new files, what prevents me from downloading an executable file onto that system which is already SUID'ed to root on a different system? ...
6
votes
2answers
2k views

Bell-LaPadula and Biba Together

Theoretically, could the Bell-Lapaluda security model be implemented with the Biba integrity model in an Operating System? Or do are they mutually exclusive? [Edit: Follow up from this question on ...
5
votes
2answers
163 views

How is the password prompt going to protect me from ruining my computer?

On Unix based systems, I'm often prompted to enter my password before installing or running a program. Why does this protect me? If I'm running a kiosk, I understand that a password might prevent ...
7
votes
2answers
320 views

How is UAC a security improvement?

What does User Account Control on Windows offer in terms of security? It's just an extra click to potentially run a virus.
9
votes
4answers
816 views

RBAC model: user in two roles access dilemma

I am implementing the Role-Based Access Control (RBAC) model security system and I have a dilemma: one User1 is in Role1 and is in Role2. Role1 allows access to the Resource1 and Role2 denies access ...
22
votes
1answer
12k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...