A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

1
vote
1answer
163 views

Is open-to-all CORS safe for non-cookie-based authentication schemes (e.g. OAuth)

I'm building an API with both protected and public endpoints, and I'm protecting it with OAuth 2's various flows. I want this API to be open to the world - the main consumer website won't even be on ...
1
vote
1answer
578 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
1
vote
1answer
89 views

what are security flaws on providing access to users through a unlisted/private/token/signed URL?

Some web applications enable registered users to grant temporal application access to un-registered users sending token/private/unlisted/signed URLs (I ignore the exact terminology for this), which ...
1
vote
4answers
230 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
1
vote
1answer
305 views

Is a separate server needed for remotely accesing accounting software?

Wishing you all a great 2014. I hope this is the right section. Basically we have a Dell Poweredge R520 server in our office, and we now want to install some accounting software that can be accessed ...
1
vote
1answer
170 views

Spoofing and guest network security

I know a little bit about network security but it's only about enough to know there's a lot I don't know. My requirement is to add a 2nd wifi to my current setup (1 wifi emitted by a ...
1
vote
1answer
424 views

Installing Joomla with nobody:nobody user/group (CentOS/cPanel)

If you are installing Joomla via cPanel's File Manager to your mywebsite.com (user mywebsite) account, you will upload the package to your server and extract the archive. All files will have the user ...
1
vote
1answer
81 views

Storing opened mail attachments unencrypted in /tmp is a normal thing?

So there is an E-mail client. I can encrypt its database with a few clicks in its menu. But it's storing the opened attachments unencrypted in /tmp/foo/bla.xls. The bla.xls has 644 UNIX permission ...
1
vote
2answers
206 views

Main requirements to secure my Application in any database related features

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
1
vote
1answer
78 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
1
vote
2answers
164 views

passwords database - access control and/or synchronization

so, we've got a ton of passwords that several different administrators need to have access to, each with their unique password/key/user/whatever... it needs to be either centralized, or the passwords ...
1
vote
1answer
912 views

How secure is github's whitelisting CORS domains?

The Github API allows you to make requests using CORS [1]. The CORS requests are only allowed by certain whitelisted domains : Any domain that is registered as an OAuth Application is accepted. ...
1
vote
2answers
630 views

Closing handles of a process as a regular user

Here's the situation: As an adminstrator, I am able to stall the application by closing 2 handles held by the process. (Using ProcExplorer) . Is there any way/hack I can use to close file handles ...
1
vote
1answer
225 views

IPtables - Accept Arbitrary Packets

I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by ...
1
vote
0answers
33 views

How to access files or getting rights access with NJrat

When I'm using NJrat to control my own computer, I can't delete, open or move some files. Are there some kind of security access I need to stop first? How can I change this to allow full access?
1
vote
1answer
43 views

Restricted Access through Box and log commands

I want to solve following problem. Please share your ideas or directly product name that capable to solve this. Our system administrators need to connect customer's servers but I don't want to share ...
1
vote
0answers
31 views

Access Control that are used on Ubuntu? [closed]

I want to ask about access control that are used on Ubuntu. I already read Ubuntu Access Control List but I'm still confused. Is there someone can explain about access control on Ubuntu? Because ...
1
vote
0answers
51 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
1
vote
0answers
304 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...
1
vote
0answers
189 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
1
vote
0answers
555 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
1
vote
0answers
53 views

What's The Easiest Way To Maintain Remote Users Access to a Webapp

Here is a real world case: A chain of high schools (several hundreds) has many websites (~ 3x number of Schools) that are content driven by users (the students). Every school maintains about 2-4 ...
1
vote
0answers
251 views

What is the best way to manage temporary accounts on Active Directory [closed]

The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
1
vote
3answers
77 views

How do I allow only app to view/download files from server?

I have an Android app that uploads and downloads pictures from my dedicated server. However, before I go live, I want to know if there is some way I can secure the server to allow only my app to ...
0
votes
6answers
362 views

What sort of security method is this called (if it has a name)?

I have thought of a way of securing access to an application interacting with another application. Using this method Application 1 - "What is the sum of 1+1?" Application 2 - "3" Application 1 - ...
0
votes
3answers
461 views

Is a console application with NT Authority/System rights dangerous?

A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in. From that command prompt it is possible to execute arbitrary programs like ...
0
votes
3answers
310 views

Keyless entry security systems and HIPAA implications

We are upgrading our office to have badged security doors. What I would particularly like to know is if Keyless Entry systems exist or are of decent quality. By this I mean, I would like the doors ...
0
votes
3answers
452 views

What security issues will I face with outsourced VPS server?

Our small comapny wants to launch a paid service, hosted on the outsourced VPS server. The obvious risk is that the machine is physically not in our office and that possibly the database could be ...
0
votes
3answers
235 views

Using remote desktop

I was having trouble getting Outlook to work with my schools email account and called the help desk. They gave me a link to install a program called Bomgar. I installed it and clicked "allow viewing ...
0
votes
2answers
333 views

Can you pick up any device specific information by monitoring bluetooth signals? [closed]

Could I use some sort of permanent device ID broadcasted by the bluetooth radio in my phone to do something like unlock my door? I don't want to have to ever pair the device, or take it out of my ...
0
votes
2answers
64 views

Contents retrieved from a not protected url from content owner's server. Legal? [closed]

Is legal to use contents retrieved from a not protected url (no authentication involved, just a public accessible URL) from the content owner's server? Is legal to distribute urls pointing to that ...
0
votes
2answers
131 views

Allow or Deny Access to a Network Based on Client Hardware [duplicate]

We have to build a product that will have a network. Users will be able to connect to this network by downloading a client. However, before allowing them to access the network we want to check if ...
0
votes
2answers
180 views

How to allow only the public key owner to submit requests to my site? And what is this type of security called?

This was probably asked many times here, but I'm not finding any because I'm not sure what to look for. I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
0
votes
2answers
652 views

Access control matrix and integrity

Can access control matrix in addition to confidentiality provide the integrity of the objects to which access is being controlled?
0
votes
1answer
83 views

When can the exploit for CVE: 2006-7098 be used?

I'm studying the vulnerabilities of an old version of Apache, the 1.3.34. And I don't quite understand in what exact situation the CVE 2006-7098 vulnerability can be exploited. The README included in ...
0
votes
3answers
1k views

Prevent a server side script from a direct URL access

There is a server side script written in php(say backend_file.php) or coldfusion(say backend_file.cfm). Lets say, i am using Apache and I have a sample web folder (on my Localhost) like: ...
0
votes
2answers
74 views

How many accounts should I have in an information system?

Is it a problem to have more than one account in an information system from security point of view? Let me clarify a bit. It is a bank system. I wonder if having a CSO (customer service officer) ...
0
votes
2answers
149 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
0
votes
2answers
123 views

Anonymizing data for applications

I try to design a system which reads events comming from devices, stores them and exposes API to various applications. Originally I wanted to introduce a module Id translator, so I would store only ...
0
votes
1answer
220 views

Employee Snooping [closed]

I just got hired at this SW tech company with a few IT gurus in it. There is a clever genius that is suspect. He obtained my personal home email address I use. It was obtained from company ...
0
votes
1answer
370 views

Difference between password expiration and account expiration [closed]

If a password expires, the user can't access the account. If the account expires, the user can't access the account... So, what's the difference? Just that in the case of an expired account, I'd need ...
0
votes
1answer
1k views

Protecting MYSQL with Fail2Ban? [closed]

I have a bunch Raspberry Pis collecting data from behind client firewalls. I want to start sending this data to MYSQL server. Because the Raspberry Pis do not have static IP addresses, I obviously ...
0
votes
1answer
345 views

Can I use a vpn to securely use prototypes of webapps from my phone or laptop?

I want to experiment with web development (using django) for both desktop and mobile. Server, phones and desktops could all be part of the same virtual private network. The VPN will be from some ...
0
votes
1answer
40 views

Restrict access to a specific type of entity

I want to create a web service that can only be accessed by a specific type of entity: my own mobile application. Is there any well-accepted methods to do this? I'm thinking about embedding a secret ...
0
votes
2answers
459 views

File shares from a DMZ into an internal network

We have a firewall policy that prohibits MS RPC through firewall, particularly from internet facing DMZ's back to the internal network. There is a business unit requesting an alternative method to ...
0
votes
1answer
593 views

Standards for physical Access Control systems

Hoping to help protect an IT installation, I've been looking into physical protection systems, specifically Access Control for protected areas. The field is quite big. Are there any US or ...
0
votes
1answer
526 views

website hacked and all its content erased despite the protections

i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...
0
votes
1answer
77 views

“If encryption has not been implemented, a comparable alternative has been implemented” [closed]

What constitutes as a comparable alternative to encryption? I know that password keepers and other services are not comparable and are not considered encryption. If the context is authorized access ...
0
votes
1answer
49 views

Control access to public API

I'm working on a public API for project X. System allows to register an app_id and call API methods providing it, as usual. Now, I need to develop an official mobile client for project X that should ...
0
votes
1answer
105 views

Bell-LaPadula model and composite services

The Bell-LaPadula model is useful for access control. Can I use this model for access control in composite services? The security level of each service is exported from WS_SecurityPolicy file.