A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

2
votes
2answers
283 views

Can I use stormpath user management service with a XACML library like BALANA?

I'm trying to implement some security access control in a software I'm building. I came across Stormpath for user management and they have somewhat an approach for RBAC yet what I was considering is ...
1
vote
1answer
43 views

Restricted Access through Box and log commands

I want to solve following problem. Please share your ideas or directly product name that capable to solve this. Our system administrators need to connect customer's servers but I don't want to share ...
0
votes
1answer
40 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...
2
votes
0answers
41 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
1
vote
0answers
33 views

How to access files or getting rights access with NJrat

When I'm using NJrat to control my own computer, I can't delete, open or move some files. Are there some kind of security access I need to stop first? How can I change this to allow full access?
1
vote
0answers
51 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
1
vote
0answers
304 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...
1
vote
0answers
189 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
1
vote
0answers
555 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
1
vote
0answers
53 views

What's The Easiest Way To Maintain Remote Users Access to a Webapp

Here is a real world case: A chain of high schools (several hundreds) has many websites (~ 3x number of Schools) that are content driven by users (the students). Every school maintains about 2-4 ...
0
votes
0answers
52 views

How can security models be relevant to the current environment?

I am trying to understand the Clark-Wilson and Brewer Nash Security Models. After deep research, I couldn't find any solution or idea to find out the relevance of these models in the current ...