A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

1
vote
3answers
1k views

How do I restrict network access to LAN for visitors

How do I restrict network access to LAN for visitors? In my organization's premises any outside visitor can come and connect to the LAN ports in our meeting rooms. We have seen that they are able to ...
1
vote
5answers
154 views

Is there a term for Authorizing before Authenticating? Is it even common?

In most scenarios a person identifies who they are (authentication/AuthN) via something like a username and password. Afterwards a system would likely evaluate what that validated identity can perform ...
1
vote
2answers
92 views

user roles or access levels

I am beginning a new project and I already know that I'll have various roles for various users, regardless of their access level. They just have different jobs to do. With that in mind, I'm thinking ...
1
vote
2answers
69 views

Contents retrieved from a not protected url from content owner's server. Legal? [closed]

Is legal to use contents retrieved from a not protected url (no authentication involved, just a public accessible URL) from the content owner's server? Is legal to distribute urls pointing to that ...
1
vote
1answer
494 views

Installing applications with different user accounts on linux

I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
1
vote
3answers
1k views

How to set password on applications in Mac OS to prevent an administrator to start them?

Is there any program that can set password on the app like mail or browser? I know about parent control, but I doesn't work with administrator account. What I want is some program that blocks some ...
1
vote
2answers
188 views

Is VPN the best solution against man-in-the-middle attack? [closed]

I'm looking for the best way to protect my enterprise against man in the middle attacks, because a lot of people connect to the same network. So I was thinking of creating a VPN. Is this really the ...
1
vote
2answers
127 views

Access token vs. UserID + access token

My goal is to associate (authenticate) hardware devices to users in the database. The access token is generated via webinterface. It is then entered into the hardware device by the user, and the ...
1
vote
1answer
98 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
1
vote
1answer
136 views

How secure is the web-based file browser that comes with my NAS?

I have a Buffalo Linkstation Pro 2 Duo for home use. It has a web GUI for browsing the contents of the NAS (distinct from the admin interface). The idea is that you would expose the web GUI to the ...
1
vote
1answer
1k views

Possible to limit server connections to clients with a specific certificate?

Usually when I read about SSL and HTTP it says that the certificate is set up to authenticate that the host is who it says it is. Is it possible to configure the host to prevent it from processing ...
1
vote
2answers
424 views

Contactless session on ATM?

I'm currently reading about an access control and saw something interesting about smartcard contact & contactless. From what I understood from the book, smartcard contact is like an ATM Card. ...
1
vote
2answers
55 views

Should application logs be available to admins or just superuser?

I'm developing a kind of standard web-application, to be hosted internally on few customer's servers (not a public service, startup or anything like that). A kind of CMS, e-learning platform or ...
1
vote
2answers
389 views

Isolating guest networks

I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network. Initially, I used IP filtering ...
1
vote
1answer
80 views

How to restrict access to a resource based on frequency of access?

I want to restrict access to a particular resource based on time (configurable). So suppose user A has time t configured from him. He can access the resource only once every t time units. The values ...
1
vote
1answer
337 views

What are the basic implementations that make a network secure from the inside\outside?

Would you consider the following to be "basic hardening items" for network equipment and servers? VLANs Access Control (such as NTFS permissions) Patch Management System Host Firewall Anti-Virus ...
1
vote
1answer
384 views

Can HIPS software practically be considered a form of MAC

Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system. Given that with the use ...
1
vote
2answers
581 views

Star property in read/write access

The * star property requirement for append access [SC(S) <= SC(O)] is looser than for write access [SC(S) = SC(O)]. Can someone explain the reason for this?
1
vote
1answer
61 views

What kind of answer is this textbook question looking for in access control model?

I'm going over a practice question and I have trouble understanding what it's asking. Draw an access control matrix for the following Linux file system. Group A1 contains S1 and S3, group A2 ...
1
vote
1answer
97 views

How safe are networking ACLs based on IP-address?

As far as I know, a determined attacker would have no major issues in hacking the IP address of the packets contained by his (web) request. Therefore, I cannot see how an Access Control List (such as ...
1
vote
1answer
131 views

Is it safe to store important data in an encrypted access token?

Is it safe to store important data in an encrypted access token? For example, instead of storing access tokens in a database, not storing them at all and putting their associated data into them before ...
1
vote
1answer
194 views

Is open-to-all CORS safe for non-cookie-based authentication schemes (e.g. OAuth)

I'm building an API with both protected and public endpoints, and I'm protecting it with OAuth 2's various flows. I want this API to be open to the world - the main consumer website won't even be on ...
1
vote
1answer
757 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
1
vote
1answer
109 views

what are security flaws on providing access to users through a unlisted/private/token/signed URL?

Some web applications enable registered users to grant temporal application access to un-registered users sending token/private/unlisted/signed URLs (I ignore the exact terminology for this), which ...
1
vote
4answers
277 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
1
vote
1answer
341 views

Is a separate server needed for remotely accesing accounting software?

Wishing you all a great 2014. I hope this is the right section. Basically we have a Dell Poweredge R520 server in our office, and we now want to install some accounting software that can be accessed ...
1
vote
1answer
202 views

Spoofing and guest network security

I know a little bit about network security but it's only about enough to know there's a lot I don't know. My requirement is to add a 2nd wifi to my current setup (1 wifi emitted by a ...
1
vote
1answer
475 views

Installing Joomla with nobody:nobody user/group (CentOS/cPanel)

If you are installing Joomla via cPanel's File Manager to your mywebsite.com (user mywebsite) account, you will upload the package to your server and extract the archive. All files will have the user ...
1
vote
1answer
84 views

Storing opened mail attachments unencrypted in /tmp is a normal thing?

So there is an E-mail client. I can encrypt its database with a few clicks in its menu. But it's storing the opened attachments unencrypted in /tmp/foo/bla.xls. The bla.xls has 644 UNIX permission ...
1
vote
2answers
216 views

Main requirements to secure my Application in any database related features

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
1
vote
1answer
80 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
1
vote
2answers
170 views

passwords database - access control and/or synchronization

so, we've got a ton of passwords that several different administrators need to have access to, each with their unique password/key/user/whatever... it needs to be either centralized, or the passwords ...
1
vote
1answer
997 views

How secure is github's whitelisting CORS domains?

The Github API allows you to make requests using CORS [1]. The CORS requests are only allowed by certain whitelisted domains : Any domain that is registered as an OAuth Application is accepted. ...
1
vote
2answers
726 views

Closing handles of a process as a regular user

Here's the situation: As an adminstrator, I am able to stall the application by closing 2 handles held by the process. (Using ProcExplorer) . Is there any way/hack I can use to close file handles ...
1
vote
1answer
235 views

IPtables - Accept Arbitrary Packets

I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by ...
1
vote
1answer
47 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
1
vote
2answers
187 views

Is a long, random string in a URL considered adequate protection from unauthorised access? [duplicate]

I have recently had to submit a number of confidential PDF documents to a website. These documents contain more than enough information to use in identity theft, and I can conceive how others using ...
1
vote
0answers
47 views

Access Control that are used on Ubuntu? [closed]

I want to ask about access control that are used on Ubuntu. I already read Ubuntu Access Control List but I'm still confused. Is there someone can explain about access control on Ubuntu? Because ...
1
vote
0answers
55 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
1
vote
0answers
322 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...
1
vote
0answers
226 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
1
vote
0answers
710 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
1
vote
0answers
266 views

What is the best way to manage temporary accounts on Active Directory [closed]

The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
1
vote
1answer
72 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...
1
vote
3answers
165 views

How do I allow only app to view/download files from server?

I have an Android app that uploads and downloads pictures from my dedicated server. However, before I go live, I want to know if there is some way I can secure the server to allow only my app to ...
0
votes
6answers
369 views

What sort of security method is this called (if it has a name)?

I have thought of a way of securing access to an application interacting with another application. Using this method Application 1 - "What is the sum of 1+1?" Application 2 - "3" Application 1 - ...
0
votes
3answers
543 views

Is a console application with NT Authority/System rights dangerous?

A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in. From that command prompt it is possible to execute arbitrary programs like ...
0
votes
3answers
348 views

Keyless entry security systems and HIPAA implications

We are upgrading our office to have badged security doors. What I would particularly like to know is if Keyless Entry systems exist or are of decent quality. By this I mean, I would like the doors ...
0
votes
3answers
694 views

What security issues will I face with outsourced VPS server?

Our small comapny wants to launch a paid service, hosted on the outsourced VPS server. The obvious risk is that the machine is physically not in our office and that possibly the database could be ...
0
votes
3answers
242 views

Using remote desktop

I was having trouble getting Outlook to work with my schools email account and called the help desk. They gave me a link to install a program called Bomgar. I installed it and clicked "allow viewing ...