A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

2
votes
0answers
20 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
-1
votes
0answers
16 views

Impossible to modify Windows 10 drives from other OSs [migrated]

I'm here to describe an interesting issue I've been facing today, in order to get some hints or solutions. My goal : access and modify one of my computer's Windows (10) system hard drive in order to ...
3
votes
1answer
65 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
0
votes
1answer
46 views

Bell-LaPadula no read no write

I'm reading about the Bell-LaPadula model. I understand the Simple Security Property and the Star Property, and I see that the model also incorporates a Discretional Security Property. My question is: ...
49
votes
4answers
7k views

Are there DRM techniques to effectively prevent pirating?

A question on Skeptics.SE asks whether current DRM techniques effectively prevent pirating: Is DRM effective? The question for IT Security is: Can DRM be made effective, and are there any examples? ...
1
vote
0answers
36 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
4
votes
1answer
39 views

What are best practices for secure admin access management to critical 3rd party cloud application in big companies?

I've always wondered how can we manage admin access to critical 3rd party resources (social media, SaaS CRM, etc) in big companies to mitigate: The administrator might leave the company without ...
1
vote
1answer
69 views

What kind of answer is this textbook question looking for in access control model?

I'm going over a practice question and I have trouble understanding what it's asking. Draw an access control matrix for the following Linux file system. Group A1 contains S1 and S3, group A2 ...
3
votes
0answers
89 views

Work wants to create an admin account on my system that I don't have access to? [closed]

This is on a Windows 10 system, and they want to create an administrator account that only my manager will have the password to. This is apparently to enforce some new "security policies" that haven't ...
3
votes
1answer
67 views

Restricted Access through Box and log commands

I want to solve following problem. Please share your ideas or directly product name that capable to solve this. Our system administrators need to connect customer's servers but I don't want to share ...
1
vote
1answer
32 views

Defense-In-Depth With Common Security Controls

Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
6
votes
4answers
3k views

Security provided through MAC filtering: Wired vs. Wireless Networks

My question refers to the following article on Wikipedia: MAC Filtering. The article states: MAC filtering is not effective control in wireless network as attackers can eavesdrop on wireless ...
4
votes
1answer
56 views

Are Linux System Capabilities Considered Mandatory Access Controls?

DAC is not mandatory because access permissions are left up to the resource owner's discretion. Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a ...
43
votes
8answers
11k views

Why am I allowed to access protected Windows files when I boot Ubuntu from USB?

How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C ...
10
votes
3answers
9k views

What are the advantages/disadvantages of attribute-based access control?

An example attribute would be "employee is currently located in the US" and is trying to access a document that requires the person to be accessing the document in US territory.
0
votes
0answers
27 views

idevicerestore installation trouble

Can anyone help me figure out what im doing wrong to install this software? ``` root@kali:~/libimobiledevice# sudo apt-get install libusbmuxd-dev libplist-dev libplist++ Reading package lists... Done ...
1
vote
1answer
16 views

What are the tools/frameworks/techniques for authorizing a device accessing a web app?

I've a password protected web application (ASP.NET 4.5), and a requirement that when a registered user accesses the site from a device for the first time, I should authorize that access by sending an ...
3
votes
1answer
65 views

What can I do to separate users best way if they are allowed to run their ruby (python) code

I have Ubuntu server 12.04 on VDS and I allow users to run their own Rails applications on behalf their own accounts. That means: They can use any shell they want They can upload what they want, ...
5
votes
1answer
3k views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
-1
votes
1answer
50 views

Is Linux protection mechanism implemented using capability lists?

I often get confused whether a particular protection mechanism is ACL or CL by definition. As an example to clarify this, I would like to consider the case of Linux. I believe Linux uses capability ...
5
votes
2answers
74 views

How to secure shared user on build server?

We have a CI server which is installed as the builduser and all tasks are executed as that respective user at the OS level. We have many teams sharing the build server which means the build user and ...
0
votes
1answer
172 views

Authorization on complex ownership

I have problem with object ownership in my web application. In my web application. There are object types: 1. Faculty 2. Student 3. Student Group 4. Student Lesson The following user roles are ...
3
votes
2answers
53 views

Is ignoring share permissions ok?

For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according ...
0
votes
0answers
10 views

Implementation of security policy using BLP

I'm studying for an exam that covers BLP (Bell-Lapadula) and I was wondering if the following could be represented using this policy. All the examples I've found online are of a simple hierarchical ...
1
vote
0answers
35 views

Why doesn't homebrew fix file access problems by itself?

Before I took ownership of /usr/local, "brew link" caused a "/usr/local/..." not writeable. Is there any particular security reason why the program didn't say something like "The operating system ...
3
votes
2answers
49 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
3
votes
1answer
81 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...
4
votes
5answers
17k views

How to prevent restrict access to a web application to authorized devices only?

I have developed an MVC web app. Right now, the client using this app in office area. The client has requested that no one should use this app on any device except the office's PC/tablets. Now ...
5
votes
1answer
466 views

Storing a password securely as part of a webservice

Say I'm creating a public web service which needs to write files to a Dropbox account (just an example). It needs to write files to one central account, not one per user. This service needs to access ...
1
vote
1answer
113 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
2
votes
2answers
10k views

MAC vs DAC vs RBAC

Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
4
votes
2answers
79 views

Using a single application for user and admin (with different auth methods) vs separating them into two applications

I am creating a human resource management application that allows access from both employee and HR administrator. Now, I'm faced with a best practice issue. There would definitely be two users: ...
21
votes
7answers
3k views

Reading physical memory frame previously owned by another process to read contents of its memory page

I had a conversation with @anger32 who states that zeroing physical memory page frame when passing the page backed by that frame to another process is not the responsibility of OSes like Windows and ...
14
votes
3answers
5k views

Is there a secure way to have a publicly facing terminal server?

TL;DR We are looking at opening port 3389 for a terminal server all the advice I’ve seen is that its suicidal but without good explanations as to why. Is it really that bad? We are looking at setting ...
16
votes
4answers
4k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership? For example: Bob is a doctor and has the role ...
4
votes
2answers
86 views

Using identifiers in URLs to authenticate users

Someone I know is registered on a community website where they can exchange messages etc. Taking a look at the email notification they receive when something new has been posted, contains an image ...
3
votes
1answer
55 views

Access via link in Email - How can I make this most secure?

I need your professional opinion on this matter, please. The app I'm building has 2 parts: Teachers & students. Teachers use the app to build a project and attach students to it. Then, the ...
5
votes
1answer
98 views

Using a single number instead of an IP address or a DNS name, which are concrete uses? [closed]

My question: I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to ...
3
votes
0answers
64 views

What's The Easiest Way To Maintain Remote Users Access to a Webapp

Here is a real world case: A chain of high schools (several hundreds) has many websites (~ 3x number of Schools) that are content driven by users (the students). Every school maintains about 2-4 ...
5
votes
1answer
107 views

How to grant permission to read a text file to a specific application run by a regular user?

A text file is situated in /opt/somefolder. It contains a pair login - password read by an application when authenticating on a server. The application is run by a regular user, so that the file can ...
0
votes
1answer
66 views

Security concerns for image server?

I am new to the concept of security. I have a simple image server that takes in username and an image to be uploaded. Given a username on a different URL, all images can be viewed as a slide-show on ...
29
votes
4answers
3k views

Can the root user be removed from a *nix system to prevent privilege-escalation?

Once a *nix system is properly configured and hardened, is it a conceivable strategy to remove all super user/root users? Are there benefits to removing root from a system altogether to prevent ...
0
votes
1answer
65 views

How to remove Write-Only on 'encrypted USB' from Laptop [closed]

My laptop has been policy enforced to write only on Encrypted USBs like Kingston DataTraveler 4000. Other USBs are read-only and not writable. Are there any tweaks to have this removed. I read one ...
3
votes
2answers
58 views

Where do Access Controls Fit into the Parkerian Hexad?

The security elements of the Parkerian Hexad are: Confidentiality Possession or Control Integrity Authenticity Availability Utility Where do access controls (mandatory, discretionary and ACL) fit ...
5
votes
1answer
310 views

Mandatory vacation as a security control?

I recently came across the concept of mandatory vacation as a management security control. Employees are forced to take at least one week of consecutive vacation to provide the company to audit their ...
0
votes
1answer
63 views

Convert customer tracking system from web access to REST

Intro:In our company there is a service tracking website for our clients, where they can monitor the progress made in their cases with us. Our users are required to log in to that website (admin ...
0
votes
1answer
107 views

Difference Between MAC and DAC

Are the only difference between DAC and MAC: the fact that MAC can also dictate DAC-type permissions to processes, not just users and name space objects? (files,etc) And there's no concept of ...
3
votes
4answers
31k views

How to check if computer is controlled remotely

My laptop has windows 7 installed. One Saturday night I couldn't fall asleep and was just lying in bed. Then suddenly at around 2 in the morning I heard the fan of the laptop start up and lights on ...
0
votes
1answer
75 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...
5
votes
2answers
297 views

Keeping passwords out of source code

Secrets should not be in source code and in version control because of two reasons: External threat: An attacker can exploit a vulnerability to get access to files/source of your ...