A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.
39
votes
9answers
4k views
Risks of giving developers admin rights to their own PCs
I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
27
votes
19answers
2k views
How can I prevent my kids from bypassing my computer restrictions?
My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions:
Can this damage my computer or corrupt my files? (I have lots of pictures)
Is ...
26
votes
4answers
2k views
Are there DRM techniques to effectively prevent pirating?
A question on Skeptics.SE asks whether current DRM techniques effectively prevent pirating: Is DRM effective?
The question for IT Security is: Can DRM be made effective, and are there any examples?
...
18
votes
7answers
481 views
In Healthcare IT, is a “break glass” mode to bypass access controls commonly required?
I've seen referenced in literature the need to have a "break glass" mode in Healthcare IT applications. In this mode, the access controls in an application can be bypassed for an emergency when it is ...
16
votes
4answers
496 views
Securing an area both physically and technically
I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security". Essentially this means that if any pictures/information/files/etc. of the product were ...
15
votes
3answers
823 views
Router password vs MAC filtering?
I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
15
votes
3answers
260 views
Risks of Mullions in High Security Areas
I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
14
votes
1answer
2k views
Why can you bypass restricted WiFis by adding “?.jpg” to the URL?
I recently read an article on Hacking a commercial airport WLAN. It's basically about circumventing paid airport WiFi redirections (they redirect you to a certain URL when you type something in the ...
14
votes
1answer
6k views
What is the difference between RBAC and DAC/ACL?
What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged?
Do you have examples of common usages?
And what about MAC, where ...
14
votes
1answer
522 views
Are there Linux rootkits circulating that directly modify the kernel (without modules)?
It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
13
votes
6answers
1k views
Is it possible for a hacker to download a php file without executing it first?
I have a php website where everything is in the public_html\ folder, including inclides folder with config and classes. I told my developer to move it away from public folder but he said there is no ...
12
votes
5answers
30k views
Can someone steal money from my bank account if they know my IBAN and personal details?
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
11
votes
3answers
3k views
Prevent acccess to the C drive on Windows systems
Is it possible to prevent regular users from accessing the C drive via Windows Explorer? they should be allowed to execute certain programs. This is to ensure that employees cannot steal or copy out ...
11
votes
4answers
2k views
Protection against account lockout DoS
Any ideas on how to protect against the following scenario?
Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
11
votes
2answers
327 views
Network policies under AppArmor/SELinux
I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor.
I see that both SELinux and AppArmor allow the selected granting of socket level access ...
10
votes
6answers
413 views
My company policy states I must put all passwords in a password safe shared with management. Is this secure?
As the title says, my company has a policy that all passwords to e.g. our workstations and server logins must be stored in an online safe. I won't say which one but there are some out there you can ...
10
votes
3answers
355 views
Given SSH access, what should I do to protect a server and monitor (dangerous) user actions?
Context:
Small business, mostly a software house for web applications but also some desktop software.
Many external collaborators, so a variety of outside users with access to the servers.
Single ...
10
votes
3answers
7k views
How do you discover what permissions an AD group has, if you have no documentation?
You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
10
votes
3answers
185 views
Different MySQL Users Security Benefits
Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
8
votes
1answer
507 views
Best practices for implementation of role-based access control in healthcare applications
Amongst the open source EMRs, which ones may be good to learn from? Any references I can go to as a starting point?
8
votes
3answers
872 views
Role Based Access Control + Data Ownership based permissions
Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership?
For example:
Bob is a doctor and has the role ...
8
votes
1answer
164 views
What is a practical example of an action that violates the non-interference model?
I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations).
I ...
8
votes
4answers
614 views
RBAC model: user in two roles access dilemma
I am implementing the Role-Based Access Control (RBAC) model security system and I have a dilemma: one User1 is in Role1 and is in Role2. Role1 allows access to the Resource1 and Role2 denies access ...
8
votes
2answers
536 views
Why do some Java APIs bypass standard SecurityManager checks?
In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
8
votes
1answer
158 views
What practical uses are there for the AD feature of “Confidential Attributes”
Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes?
Would you store sensitive information here such as a private key, or a salt here?
I'm ...
7
votes
5answers
442 views
What is the practical difference between MAC and Capabilities
Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user.
Is there any ...
7
votes
3answers
457 views
What prevents this exploit from working (unix SUID)?
If I have a user on a unix system where Im allowed to create new files, what prevents me from downloading an executable file onto that system which is already SUID'ed to root on a different system?
...
7
votes
2answers
619 views
What is the procedure to follow against a security breach?
Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information.
One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
7
votes
2answers
802 views
Practical non-government uses of Biba, Bell-LaPadula, etc. models
For example, the Biba model is now hanging out in current versions of Windows. Things downloaded from the Internet are tagged as such. Internet (low) stuff can't alter user (medium) stuff which isn't ...
7
votes
2answers
273 views
How is UAC a security improvement?
What does User Account Control on Windows offer in terms of security? It's just an extra click to potentially run a virus.
7
votes
2answers
914 views
What's the difference between an access control method, security model, and security policy?
(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me).
I'm studying for the CISSP exam and I'm getting confused ...
7
votes
1answer
111 views
Using / finding covert channels in inter-process communication
I've got a class exercise that involves a virtual game of Werewolves/Mafia. We're not really taught how to do anything in this class, which makes it hard for everyone to do the labs.
The idea is that ...
6
votes
6answers
362 views
Disable internet access of development PC for security
My friend's company is trying to disable Internet access of programmer's primary development PC to improve security, while giving them another PC to connect to the Internet. He is a web programmer. I ...
6
votes
3answers
149 views
Requiring Authentication to Exit
I've often wondered why facilities do not require authentication as a default on exit. Beyond the oblivious reasons:
Fire safety policies would require a panic mechanism to override the access ...
6
votes
4answers
221 views
Safest way for multiple users post to a single social networking account
Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
6
votes
2answers
460 views
How do I log everything a certain program is doing?
i have a program which is pretty simple.
Its just a simple login form.
Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
6
votes
3answers
2k views
User “home directory” on iPhone, Android, Windows mobiles and Blackberry
Is anyone aware of any mobile (iPhone, Android, Windows mobiles and Blackberry) Operating System that support multi users? I am not aware but I thought it is worth double checking. Off course, in ...
6
votes
2answers
383 views
Comparsion Between AppArmor and Selinux
I was reviewing several different comparison of AppArmor and Selinux which include
Why I Like AppArmor More Than SELinux
SELinux and AppArmor: An Introductory Comparison
From these articles I ...
6
votes
3answers
326 views
Is it advisable to have a web browser remember login credentials?
I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
6
votes
2answers
1k views
Bell-LaPadula and Biba Together
Theoretically, could the Bell-Lapaluda security model be implemented with the Biba integrity model in an Operating System? Or do are they mutually exclusive?
[Edit: Follow up from this question on ...
6
votes
1answer
274 views
How to prepare for protecting identity after death?
In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
6
votes
2answers
212 views
Where to put private files on a shared web server
I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
5
votes
3answers
819 views
Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?
I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-Lapadula Model. I understand the mechanics of it and that ...
5
votes
3answers
2k views
Bell-LaPadula imlementation example
I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example.
I understand how the model works, but I have difficulties implementing it in a programming language ...
5
votes
3answers
720 views
Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account
How do large companies implement their security requirements which are centralized and used to drive things people can do (allowed to call a certain web-service, submit an order, etc.) as well as to ...
5
votes
1answer
520 views
access control to data-center using rfid
I don't know if "here" is the right place to make this kind of question...
so here it is..
Is rfid a good solution for controlling access to a data-center?
Because rfid is "wireless", is it ...
5
votes
4answers
215 views
How can i deal with management who want 'Domain Admin' access?
While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...
5
votes
1answer
613 views
Does Fedora 15 still use suid bits?
I heard that Fedora 15 will not use suid bits. Is that true?
Is the suid bit a security design bug?
5
votes
4answers
1k views
Two SSIDs on same Access point- not good?
If I were to offer two networks (one for trusted users and one to visitors) on one physical access point, is this dangerous because a visitor could compromise the trusted network across via the ...
5
votes
2answers
142 views
Full-disk encryption and theft mitigation?
Is it possible to combine the security of full-disk encryption (e.g. Truecrypt) with the honeypot-like performance of anti-theft tools (e.g. Prey)?
In other words, is it feasible to have both strong ...
