Hot answers tagged

205

So this is an interesting question with a few points into why you not only should WANT to do this, but should do this for your own safety and security. It helps first if you understand that companies point of view before we talk about how it can benefit you. Why would a company want to do this? Many reasons. It makes it assured that your computer can ...


127

As a guy who writes and enforces these types of corporate policies, I can tell you this: it is perfectly normal, and a perfectly reasonable policy. I do NOT want your equipment on my network, ever. I can't control it, I have no insight into how patched it is, how virus-ridden it is, and I do NOT want you to keep company data on your personal device when ...


101

The file and folder/directory permissions on an operating system are managed and enforced by... you guessed it right, that operating system (OS). When the operating system is taken out of the picture (booting a different operating system), then those permissions become meaningless. One way to think of it: You hire a big bodyguard (OS) to protect your house. ...


76

No, there's no way to do it. Without setting connection parameter limits, there's even no way to make it relatively difficult. If a legitimate user can access your website, they can copy its contents, and if they can do it normally with a browser, then they can script it. You might setup User-Agent restrictions, cookie validation, maximum connections, and ...


58

Even if you wanted to, I don't think you can remove the root user. From Wikipedia: On Unix-like systems, for example, the user with a user identifier (UID) of zero is the superuser, regardless of the name of that account. and a lot of the kernel code that vulnerabilities exploit does stuff like // become root uid = 0; ... if (uid == 0) // do some ...


55

Most probably the blocker is designed to let images through, maybe because they are hotlinking some images on the page where they ask for you to login. Appending ?.jpg to the URL makes the blocker think that the URL is an image. On the other hand, anything after the ? doesn't change the actual webpage requested, it only changes the GET headers. (so ...


54

At every place I have worked (as a contract developer) developers are given local admin rights on their desktops. The reasons are: 1) Developers toolsets are often updated very regularly. Graphics libraries, code helpers, visual studio updates; they end up having updates coming out almost weekly that need to be installed. Desktop support usually gets ...


49

RBAC (Role based access control) is based on defining a list of business roles, and adding each user in the system to one or more roles. Permissions and privileges are then granted to each role, and users receive them via their membership in the role (pretty much equivalent to a group). Applications will typically test the user for membership in a specific ...


49

The problem isn't with this situation in particular. Let's assess the situation here: You're a trustworthy person to them The password is very likely securing trivial data Giving you the password isn't that big of a deal in this case. The problem (like you stated in your question) is that getting him in the habit of giving out passwords. I'd definitely ...


42

In addition to all the other reasons given: Software licences. You and other employees need certain programs to do your work. These programs are usually licensed for a limited number of users. The company want to control this and the easiest way is by controlling the machines. Letting employees install these programs on their own computers would be both a ...


38

MAC filtering is not a part of the 802.11 spec, and is instead shoved into wireless routers by (most) vendors. The reason why it's not a part of the 802.11 spec is because it provides no true security (via kerckhoff's principle). In order for wireless to work, MAC addresses are exchanged in plaintext (Regardless of whether you're using WEP, WPA, WPA2, or ...


37

The answer to your question is that it depends on a number of factors. What disk encryption product is in use? Does it make use of full disk encryption, or does it just encrypt parts of the disk (e.g. the users home directory) Are there any known vulnerabilities in the disk encryption product in use? What strength of password was used by the user of the ...


33

You have covered the main ones. In short: it's very hard, if not impossible, to effectively block a site you want. You can make it hard by using the techniques you've mentioned: blocking IPs, redirecting DNS, blocking HTTP requests to certain sites / containing certain keywords. These methods are thwartable by proxies (in the case of deep packet ...


32

Yes. With a cold boot attack. Depending on the software used to encrypt your data and when the attacker gets a hold of your laptop, there is a good chance that they can get access to whatever they want, if they know how. The problem lies in the fact that many disk-encryption tools, including BitLocker, store the keys in RAM. The trick to the attack is to ...


30

"Linux" (as some aggregate of all the installations) typically has quite a bit more than just a password denying external access. First, there's a uniform set of discretionary access controls: read/write/execute permissions, for user/group/everybody else. Traditionally, these permissions are actually used, rather than ignored and/or worked around. ...


29

DRM works pretty well for anything that you do not hand out to the users. Let's take Second Life as example. Second life is an 3d online game in which avatars are rather simple on their own in the sense that they cannot do anything beside moving around and using objects. Objects consists of a shape and texture, and they may contain scripts. Those scripts ...


29

What you need is relatively simple: you need to ensure that your students' unprivileged accounts are well confined. If you don't have a graphical environment involved, your situation is relatively simple. You should start by implementing the following actions: ensure users are created without administrative privileges (no sudo, no admin or wheel group) ...


28

This issue has come up on a couple SE forums already, so most of this is going to just be echoing my existing answers. How can I prevent someone from accessing a Windows XP system via boot disk? How to secure my Windows 7 PC? A couple of fairly major issues exist here, which are really working against you: Unless there's something you haven't mentioned, ...


27

As argued by others, it makes no sense to "remove" the root UID (which is represented on UNIX as the UID 0). I would go even further and state that it makes no sense to freeze a system into not having any means to provide new privileges. Note that this answer is very opiniated and vague, because the topic to cover is enormous. Let's first go through what ...


25

Protect the part of the site you want to protect with a username and password. Then only assign a username and password to people who sign an NDA, (or similar) that says they won't extract or copy information from your site. Another trick is to make all your content load from AJAX... and make the AJAX data URL load from paths that change (such as ...


25

As has @Adnan already pointed out in his answer, there is really no way of stopping a determined person from copying snapshots of your website. I used the word snapshots here, because that's what such content scrapers (or harvesters) are really copying. They don't (or at least shouldn't) have access to your backend where your website contents are actually ...


24

This partly depends on the kind of software the dev team is expected to develop. Some types of software are easier to develop without administrative rights than others. For example, you can do a fair amount of web-based Java development using the likes of Eclipse with Maven artifacts, all installed locally (and typically tested on port 8080), without ...


23

I was curious of this myself once, and wrote a small program under linux that malloc'ed all available memory and dumped it to disk. It turned out that it was all zeroed out before it was handed to my application. Later, I also checked the kernel code, and could confirm it was the kernel who did it. -- I think it makes perfectly sense that it is the OS ...


20

I'd suggest plan B to him, but not push it if he doesn't want to bother. You will have unsupervised physical access to the laptop - unless there's a disk encryption password you haven't mentioned, that's almost certainly enough for you to do whatever you want without any account passwords anyway, including installing backdoors for later remote access, and ...


19

None of the reasons you've given are valid reasons for escrowing your password. There's only a couple valid reasons for escrowing any sort of "authenticator" information. A couple others have touched on these, but I'll try to clarify a bit. Encryption Keys: It makes absolute sense for the organization to have access to escrow copies of your encryption ...


18

In computer security, they are used interchangeably. In the context of rights, permission implies consent given to any individual or group to perform an action. Privilege is a permission given to an individual or group. Privileges are used to distinguish between different granted permissions (including no permission.) A privilege is a permission ...


17

Let me preface what will probably be a longish answer with "There is no simple solution". Solving this will take some strategic work (which is why I recommended not moving this to SF). Now I will explain why. Windows, at its core, is mostly based on the DAC model of access control. Everything in the OS is securable with an ACL - files, folders, ...


17

In Linux, processes is able to read another process memory when any of the following conditions applies: The process had root permission or it can read /proc/$PID/mem or /dev/mem, by default /proc/$PID/mem and /dev/mem are only accessible by root Parent process can fork()/clone() in such a way that allows it to read some or all memory of its child ...



Only top voted, non community-wiki answers of a minimum length are eligible