A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.
39
votes
9answers
4k views
Risks of giving developers admin rights to their own PCs
I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
27
votes
19answers
2k views
How can I prevent my kids from bypassing my computer restrictions?
My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions:
Can this damage my computer or corrupt my files? (I have lots of pictures)
Is ...
26
votes
4answers
2k views
Are there DRM techniques to effectively prevent pirating?
A question on Skeptics.SE asks whether current DRM techniques effectively prevent pirating: Is DRM effective?
The question for IT Security is: Can DRM be made effective, and are there any examples?
...
18
votes
7answers
420 views
In Healthcare IT, is a “break glass” mode to bypass access controls commonly required?
I've seen referenced in literature the need to have a "break glass" mode in Healthcare IT applications. In this mode, the access controls in an application can be bypassed for an emergency when it is ...
16
votes
4answers
487 views
Securing an area both physically and technically
I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security". Essentially this means that if any pictures/information/files/etc. of the product were ...
14
votes
1answer
1k views
Why can you bypass restricted WiFis by adding “?.jpg” to the URL?
I recently read an article on Hacking a commercial airport WLAN. It's basically about circumventing paid airport WiFi redirections (they redirect you to a certain URL when you type something in the ...
13
votes
6answers
967 views
Is it possible for a hacker to download a php file without executing it first?
I have a php website where everything is in the public_html\ folder, including inclides folder with config and classes. I told my developer to move it away from public folder but he said there is no ...
13
votes
1answer
507 views
Are there Linux rootkits circulating that directly modify the kernel (without modules)?
It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
13
votes
3answers
249 views
Risks of Mullions in High Security Areas
I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
12
votes
5answers
28k views
Can someone steal money from my bank account if they know my IBAN and personal details?
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
12
votes
1answer
5k views
What is the difference between RBAC and DAC/ACL?
What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged?
Do you have examples of common usages?
And what about MAC, where ...
11
votes
3answers
3k views
Prevent acccess to the C drive on Windows systems
Is it possible to prevent regular users from accessing the C drive via Windows Explorer? they should be allowed to execute certain programs. This is to ensure that employees cannot steal or copy out ...
11
votes
4answers
2k views
Protection against account lockout DoS
Any ideas on how to protect against the following scenario?
Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
11
votes
2answers
323 views
Network policies under AppArmor/SELinux
I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor.
I see that both SELinux and AppArmor allow the selected granting of socket level access ...
10
votes
6answers
397 views
My company policy states I must put all passwords in a password safe shared with management. Is this secure?
As the title says, my company has a policy that all passwords to e.g. our workstations and server logins must be stored in an online safe. I won't say which one but there are some out there you can ...
10
votes
3answers
350 views
Given SSH access, what should I do to protect a server and monitor (dangerous) user actions?
Context:
Small business, mostly a software house for web applications but also some desktop software.
Many external collaborators, so a variety of outside users with access to the servers.
Single ...
10
votes
3answers
6k views
How do you discover what permissions an AD group has, if you have no documentation?
You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
10
votes
3answers
181 views
Different MySQL Users Security Benefits
Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
8
votes
1answer
458 views
Best practices for implementation of role-based access control in healthcare applications
Amongst the open source EMRs, which ones may be good to learn from? Any references I can go to as a starting point?
8
votes
3answers
807 views
Role Based Access Control + Data Ownership based permissions
Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership?
For example:
Bob is a doctor and has the role ...
8
votes
1answer
151 views
What is a practical example of an action that violates the non-interference model?
I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations).
I ...
8
votes
4answers
597 views
RBAC model: user in two roles access dilemma
I am implementing the Role-Based Access Control (RBAC) model security system and I have a dilemma: one User1 is in Role1 and is in Role2. Role1 allows access to the Resource1 and Role2 denies access ...
8
votes
2answers
497 views
Why do some Java APIs bypass standard SecurityManager checks?
In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
8
votes
1answer
153 views
What practical uses are there for the AD feature of “Confidential Attributes”
Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes?
Would you store sensitive information here such as a private key, or a salt here?
I'm ...
7
votes
5answers
431 views
What is the practical difference between MAC and Capabilities
Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user.
Is there any ...
7
votes
3answers
450 views
What prevents this exploit from working (unix SUID)?
If I have a user on a unix system where Im allowed to create new files, what prevents me from downloading an executable file onto that system which is already SUID'ed to root on a different system?
...
7
votes
2answers
602 views
What is the procedure to follow against a security breach?
Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information.
One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
7
votes
2answers
760 views
Practical non-government uses of Biba, Bell-LaPadula, etc. models
For example, the Biba model is now hanging out in current versions of Windows. Things downloaded from the Internet are tagged as such. Internet (low) stuff can't alter user (medium) stuff which isn't ...
7
votes
2answers
271 views
How is UAC a security improvement?
What does User Account Control on Windows offer in terms of security? It's just an extra click to potentially run a virus.
7
votes
2answers
880 views
What's the difference between an access control method, security model, and security policy?
(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me).
I'm studying for the CISSP exam and I'm getting confused ...
7
votes
1answer
108 views
Using / finding covert channels in inter-process communication
I've got a class exercise that involves a virtual game of Werewolves/Mafia. We're not really taught how to do anything in this class, which makes it hard for everyone to do the labs.
The idea is that ...
6
votes
6answers
360 views
Disable internet access of development PC for security
My friend's company is trying to disable Internet access of programmer's primary development PC to improve security, while giving them another PC to connect to the Internet. He is a web programmer. I ...
6
votes
3answers
148 views
Requiring Authentication to Exit
I've often wondered why facilities do not require authentication as a default on exit. Beyond the oblivious reasons:
Fire safety policies would require a panic mechanism to override the access ...
6
votes
2answers
442 views
How do I log everything a certain program is doing?
i have a program which is pretty simple.
Its just a simple login form.
Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
6
votes
3answers
2k views
User “home directory” on iPhone, Android, Windows mobiles and Blackberry
Is anyone aware of any mobile (iPhone, Android, Windows mobiles and Blackberry) Operating System that support multi users? I am not aware but I thought it is worth double checking. Off course, in ...
6
votes
2answers
335 views
Comparsion Between AppArmor and Selinux
I was reviewing several different comparison of AppArmor and Selinux which include
Why I Like AppArmor More Than SELinux
SELinux and AppArmor: An Introductory Comparison
From these articles I ...
6
votes
3answers
319 views
Is it advisable to have a web browser remember login credentials?
I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
6
votes
2answers
1k views
Bell-LaPadula and Biba Together
Theoretically, could the Bell-Lapaluda security model be implemented with the Biba integrity model in an Operating System? Or do are they mutually exclusive?
[Edit: Follow up from this question on ...
6
votes
1answer
254 views
How to prepare for protecting identity after death?
In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
6
votes
2answers
200 views
Where to put private files on a shared web server
I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
5
votes
3answers
771 views
Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?
I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-Lapadula Model. I understand the mechanics of it and that ...
5
votes
3answers
1k views
Bell-LaPadula imlementation example
I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example.
I understand how the model works, but I have difficulties implementing it in a programming language ...
5
votes
3answers
707 views
Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account
How do large companies implement their security requirements which are centralized and used to drive things people can do (allowed to call a certain web-service, submit an order, etc.) as well as to ...
5
votes
1answer
508 views
access control to data-center using rfid
I don't know if "here" is the right place to make this kind of question...
so here it is..
Is rfid a good solution for controlling access to a data-center?
Because rfid is "wireless", is it ...
5
votes
4answers
204 views
How can i deal with management who want 'Domain Admin' access?
While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...
5
votes
4answers
183 views
Safest way for multiple users post to a single social networking account
Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
5
votes
1answer
605 views
Does Fedora 15 still use suid bits?
I heard that Fedora 15 will not use suid bits. Is that true?
Is the suid bit a security design bug?
5
votes
4answers
1k views
Two SSIDs on same Access point- not good?
If I were to offer two networks (one for trusted users and one to visitors) on one physical access point, is this dangerous because a visitor could compromise the trusted network across via the ...
5
votes
2answers
119 views
Full-disk encryption and theft mitigation?
Is it possible to combine the security of full-disk encryption (e.g. Truecrypt) with the honeypot-like performance of anti-theft tools (e.g. Prey)?
In other words, is it feasible to have both strong ...
5
votes
1answer
2k views
Windows task manager can see all processes as non administrator without permission
On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which ...
