The privileged-account tag has no wiki summary.
2
votes
1answer
70 views
Will “upgrading” www-data user open up known security issues?
On a isolated local test/dev server I have elevated the nature of the www-data user to enable a smooth workflow for using Dropbox in a web/webapp development pipeline.
It has worked quite smoothly in ...
14
votes
8answers
607 views
Should the requirement of admin privileges be extended?
Seeing this comic from xkcd.com made me thinking:
Is extending the requirement of admin privileges to things such as connecting to the internet, running the web browser, reading browser and other ...
2
votes
2answers
92 views
Database security: Remove superuser role
I've recently heard on some IT-SEC conference, that good idea to secure database (probably against privilege-escalation attack) is to remove superuser role, and leave only user roles.
I imagine that ...
1
vote
2answers
218 views
How is it possible that a virus can infect the system if the browser is started with non-admin rights
If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
6
votes
2answers
280 views
Is privilege escalation possible when shell is under www user?
So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?
1
vote
3answers
142 views
Maintain User Privileges After Shutdown in Windows XP?
Is it possible, in Windows XP, to maintain user privileges of a command shell after a reboot?
For example, I'm running as a non-privileged account LocalMachine\Pete, but have a shell running as ...
1
vote
1answer
141 views
Privilege usage checks
What does it mean that "the permission system does not include checks for transitive privilege usage" (quote from a paper on Privilege Escalation Attacks on Android).
Android grants app privileges ...
6
votes
2answers
251 views
Should an admin user be able to edit passwords?
For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
2
votes
3answers
408 views
Do you give local administrator account password to notebook users?
My notebook users need to travel a lot.
Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings.
Should I give them local administrator's ...
2
votes
3answers
996 views
Privilege Escalation Ubuntu
I am trying to learn how an attacker can escalate privileges in Ubuntu 10.04. I have heard that this can be done but no one has ever said how to do it. The best defense is knowing how it is done and ...
3
votes
1answer
223 views
How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?
I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
8
votes
2answers
479 views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
24
votes
6answers
1k views
Is it OK to tell or give your password to an admin?
I'm working in a small company (20 employees) as a senior software engineer.
After some email problems, our newly employed IT administrator asked me for the password to our hosting company to see why ...
14
votes
3answers
404 views
Is it OK to tell your password to an admin? [duplicate]
Possible Duplicate:
From a security point : Is it OK to tell your password to an admin?
I am working in a small company (20 employees) as a senior SW engineer.
After having some email ...
8
votes
4answers
427 views
Security policy for system administrators
I've been in charge of systems administration for a small company for a couple of years and am now training some new collaborators to take over. So far, there has been no security policy, but I would ...
5
votes
3answers
2k views
What differences are there between built-in Administrator and other Administrators?
Are there any significant differences in the rights, privileges, permissions, or other powers held by the built-in Administrator account, and those held by non-built-in Administrator accounts?
2
votes
1answer
143 views
OBSD X11 as non-root?
If running X11 as root is not a very good idea, then can anyone mention a method/solution, how to still use a GUI, and not having X11 as root?
10
votes
3answers
324 views
What security requirements do you have for Domain Administrators?
With regard to managing a Windows network, what security polices and processes do you use? For example
Do you require/support Smart Card
Authentication?
Restrict logins
from a particular ...
