A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

5
votes
2answers
495 views

What are best practices for implementing ACL

I have a website that has certain menu items that need to be hidden from end users. The web site has PHP in the front-end and Java and Spring in the back-end, deployed on a Linux OS in a VM ...
6
votes
1answer
311 views

What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?

In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
1
vote
1answer
53 views

Teamviewer Security Question

Currently we are using Teamviewer 9. We have a couple of desktop machines that are locked down in the following manner: 1). The shell is no longer explorer.exe, it is a custom program we have ...
1
vote
1answer
144 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
0
votes
1answer
49 views

Can I use stormpath user management service with a XACML library like BALANA?

I'm trying to implement some security access control in a software I'm building. I came across Stormpath for user management and they have somewhat an approach for RBAC yet what I was considering is ...
0
votes
1answer
85 views

is UPnP / NAT-PMP really necessary today?

The possibility to enable port forwards for any hosts inside the LAN has of course security implications. The problem from my point of view is not that there are bad users, but bad hosts/programs and ...
1
vote
0answers
101 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
1
vote
0answers
50 views

What's The Easiest Way To Maintain Remote Users Access to a Webapp

Here is a real world case: A chain of high schools (several hundreds) has many websites (~ 3x number of Schools) that are content driven by users (the students). Every school maintains about 2-4 ...
0
votes
0answers
38 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
0
votes
0answers
28 views

Bell-LaPadula implementing by using sets of roles

I have sets of roles defined hierarchically, i.e. role anonymous is a subset of role super-user. The roles are given tu users and also used in the ACL for marking who has access to a resource. ...
0
votes
0answers
78 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...