A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

24
votes
11answers
17k views

Prevent my site from being copied

Is it possible to protect my site from HTTrack Website Copier or any similar program? Without setting a max number of HTTP request from users.
2
votes
0answers
12 views

hash function notations and existing cryptographic hash algorithms [migrated]

I am implementing Role-based access control by referencing the paper Enforcing Role-Based Access Control for Secure Data Storage in the Cloud. In page 6, they have mentioned to choose hash functions ...
2
votes
1answer
37 views
+50

What is the definition for different access attributes in object access auditing?

Though there is documentation available about configuring Object Access auditing, there is no place where I have found any documents explaining the different attributes in Object Access Auditing. Can ...
2
votes
0answers
26 views

Is FAR (False Accept Rate) a property of algorithm or a property of the system?

As known in biometrics: https://en.wikipedia.org/wiki/Biometrics#Performance False match rate (FMR, also called FAR = False Accept Rate): the probability that the system incorrectly matches the ...
1
vote
0answers
39 views

Certificate based Access Control for Pub Sub messaging

I'm extending an existing p2p/master Pub Sub framework to support additional security measures, via over the wire encryption and topic based access control. I'd like to use the x.509 certificates that ...
0
votes
2answers
88 views

How secure is Windows 10 account control?

I have a Microsoft account in my machine (Admin). I set a guest account (Standard) for a friend so he can play games. Is there any way he could access my files/folders info? I mean, get data, view ...
-2
votes
1answer
33 views

How to protect EXIF data against editing/deleting in jpeg file?

Is there any option to protect EXIF data against editing or provide password protection? I came accross the idea of creating executable file from image file, so that someone can view image the way is ...
21
votes
4answers
15k views

Router password vs MAC filtering?

I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
-2
votes
2answers
53 views

Limit possible harm of ransomware on a fileserver

First to say: I know I need a backup and I have one of course but my question isn't about the safety of the data but about how to reduce the possible time that is needed to restore data. I'm already ...
0
votes
1answer
51 views

Bell-LaPadula no read no write

I'm reading about the Bell-LaPadula model. I understand the Simple Security Property and the Star Property, and I see that the model also incorporates a Discretional Security Property. My question is: ...
8
votes
3answers
3k views

Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?

I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-Lapadula Model. I understand the mechanics of it and that ...
6
votes
4answers
2k views

Are keys or RFID tags more secure access control solutions?

Just musing to myself, what is the preferable access control mechanism in high security environments? Locks and Keys or RFID tags? Going under the assumption that the locks/keys are not knoow to be ...
0
votes
0answers
25 views

bundling session information in a binary

We are in the process of developing a desktop app. When a user is logged into the website we create a dynamic binary(.exe) and add session information to that binary which is valid for one time login. ...
4
votes
2answers
97 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
1
vote
1answer
48 views

Implement RBAC for my application

I'm beginning to work on a new web app for which I require implementing Role-Based Access Control. I've identified three Roles for my application which will be Role 1, Role 2 and an Role 3. Each user ...
3
votes
1answer
68 views

Restricted Access through Box and log commands

I want to solve following problem. Please share your ideas or directly product name that capable to solve this. Our system administrators need to connect customer's servers but I don't want to share ...
1
vote
1answer
44 views

Defense-In-Depth With Common Security Controls

Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
0
votes
2answers
48 views

Stateful Packet Filter structure

http://postimg.org/image/o1ojanqq3/ For stateful packet filter, Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter? Secondly, how can stateful ...
0
votes
1answer
19 views

Application proxy structure & funtions

http://postimg.org/image/76newirnv/ For application proxy, Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read ...
1
vote
2answers
38 views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
0
votes
1answer
41 views

Packet Filter with Access Control List

http://i66.tinypic.com/29p50zp.png Can anyone explain how to read and understand row 1,2 and 3? My understanding for row 1 is : If any inside packets want to go to outside via any source port to ...
3
votes
0answers
37 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
49
votes
4answers
7k views

Are there DRM techniques to effectively prevent pirating?

A question on Skeptics.SE asks whether current DRM techniques effectively prevent pirating: Is DRM effective? The question for IT Security is: Can DRM be made effective, and are there any examples? ...
1
vote
0answers
41 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
4
votes
1answer
40 views

What are best practices for secure admin access management to critical 3rd party cloud application in big companies?

I've always wondered how can we manage admin access to critical 3rd party resources (social media, SaaS CRM, etc) in big companies to mitigate: The administrator might leave the company without ...
1
vote
1answer
70 views

What kind of answer is this textbook question looking for in access control model?

I'm going over a practice question and I have trouble understanding what it's asking. Draw an access control matrix for the following Linux file system. Group A1 contains S1 and S3, group A2 ...
3
votes
0answers
92 views

Work wants to create an admin account on my system that I don't have access to? [closed]

This is on a Windows 10 system, and they want to create an administrator account that only my manager will have the password to. This is apparently to enforce some new "security policies" that haven't ...
6
votes
4answers
3k views

Security provided through MAC filtering: Wired vs. Wireless Networks

My question refers to the following article on Wikipedia: MAC Filtering. The article states: MAC filtering is not effective control in wireless network as attackers can eavesdrop on wireless ...
4
votes
1answer
59 views

Are Linux System Capabilities Considered Mandatory Access Controls?

DAC is not mandatory because access permissions are left up to the resource owner's discretion. Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a process/...
43
votes
8answers
11k views

Why am I allowed to access protected Windows files when I boot Ubuntu from USB?

How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C ...
10
votes
3answers
10k views

What are the advantages/disadvantages of attribute-based access control?

An example attribute would be "employee is currently located in the US" and is trying to access a document that requires the person to be accessing the document in US territory.
0
votes
0answers
40 views

idevicerestore installation trouble

Can anyone help me figure out what im doing wrong to install this software? ``` root@kali:~/libimobiledevice# sudo apt-get install libusbmuxd-dev libplist-dev libplist++ Reading package lists... Done ...
1
vote
1answer
18 views

What are the tools/frameworks/techniques for authorizing a device accessing a web app?

I've a password protected web application (ASP.NET 4.5), and a requirement that when a registered user accesses the site from a device for the first time, I should authorize that access by sending an ...
3
votes
1answer
103 views

What can I do to separate users best way if they are allowed to run their ruby (python) code

I have Ubuntu server 12.04 on VDS and I allow users to run their own Rails applications on behalf their own accounts. That means: They can use any shell they want They can upload what they want, e.g....
5
votes
1answer
4k views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
-1
votes
1answer
55 views

Is Linux protection mechanism implemented using capability lists?

I often get confused whether a particular protection mechanism is ACL or CL by definition. As an example to clarify this, I would like to consider the case of Linux. I believe Linux uses capability ...
5
votes
2answers
78 views

How to secure shared user on build server?

We have a CI server which is installed as the builduser and all tasks are executed as that respective user at the OS level. We have many teams sharing the build server which means the build user and ...
1
vote
1answer
178 views

Authorization on complex ownership

I have problem with object ownership in my web application. In my web application. There are object types: 1. Faculty 2. Student 3. Student Group 4. Student Lesson The following user roles are ...
3
votes
2answers
55 views

Is ignoring share permissions ok?

For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according ...
0
votes
0answers
13 views

Implementation of security policy using BLP

I'm studying for an exam that covers BLP (Bell-Lapadula) and I was wondering if the following could be represented using this policy. All the examples I've found online are of a simple hierarchical ...
1
vote
0answers
35 views

Why doesn't homebrew fix file access problems by itself?

Before I took ownership of /usr/local, "brew link" caused a "/usr/local/..." not writeable. Is there any particular security reason why the program didn't say something like "The operating system won'...
3
votes
2answers
52 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
3
votes
1answer
99 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...
6
votes
5answers
18k views

How to prevent restrict access to a web application to authorized devices only?

I have developed an MVC web app. Right now, the client using this app in office area. The client has requested that no one should use this app on any device except the office's PC/tablets. Now ...
5
votes
1answer
468 views

Storing a password securely as part of a webservice

Say I'm creating a public web service which needs to write files to a Dropbox account (just an example). It needs to write files to one central account, not one per user. This service needs to access ...
1
vote
1answer
123 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
3
votes
2answers
11k views

MAC vs DAC vs RBAC

Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
4
votes
2answers
91 views

Using a single application for user and admin (with different auth methods) vs separating them into two applications

I am creating a human resource management application that allows access from both employee and HR administrator. Now, I'm faced with a best practice issue. There would definitely be two users: ...
21
votes
7answers
3k views

Reading physical memory frame previously owned by another process to read contents of its memory page

I had a conversation with @anger32 who states that zeroing physical memory page frame when passing the page backed by that frame to another process is not the responsibility of OSes like Windows and ...