New answers tagged access-control
0
How secure do you need to go?
This is probably as "secure" as you can make it. It's not technically safe. As Rook said, there are still things here than can be exploited. These are a few steps you can take to try and harden the system:
Setup the web server on a physical server on the office LAN. Do NOT use NAT to connect any outside traffic to the ...
2
There's a couple of things you can do to help restrict the use of the application to a specific office location and specific devices, although as other answers point out none of them are absolute protection
Setup a firewall in front of the application to restrict the IP addresses allowed to access the application to the clients external IP address range. ...
0
What you're trying to achieve is not possible. HTTP isn't designed to provide hardware-specific identifiers, the only "identifier" is the User-Agent which isn't identifying at all, and it can be spoofed, so the browsers don't even access that information.
Even with a client certificate, it just can be exported from the browser to another device.
Tell your ...
1
You just have to host the web app on a server on the intranet that is not connected to the internet.
Proper routing and firewall measure should ensure that no one that is not connected to the local network has access to the web app.
If people outside the network needs access to the web app, have them setup a VPN connection to your local network.
1
Check out Dark Reading. They have quite a few blog entries about this sort of thing and they offer daily and weekly e-mail subscriptions (They'll also sign you up for subscriptions to some of their partner publications). Not all of it on Dark Reading is news, and a bit of it is white papers you have to log in in order to download. Overall they've had some ...
5
There are different ways of tackling this:
Disable unused ports (which should obviusly be the first line of defense)
Using port security on your switch makes it at least necessary that an attacker finds out a certain MAC address and connects to a specific port, which will stop most people from plugging their home devices into the company network. In ...
0
NAP would be your best bet and is available for Linux and Mac clients. You can also "register" devices that do not have NAP capability manually or mostly automated with a portal page. Either way, you should, as others have pointed out, work on your physical security if users are able to freely unplug machines.
0
Just disable unused ports on the switch, on this way if the attacker plugs in a cable it won't connect to the intranet because that port was disabled.
Obviously, if he unplugs some device and plugs its device there, he can connect to the intranet. But in this point get in the game another question, how is your physical security?
0
Ideal setup is to treat employees differently and the outsiders who come to office differently.All the employees should be put on a different network in a different firewall zone say trust(10.2.0.0/16) and the outsiders on another network on another firewall zone say trust2 (10.3.0.0/16)
You can provide access to the internet from trust and then whitelist ...
0
You can either add the individual user or use built-in groups. The simplest way would be to assign the group read/write permissions to the parent directory the application needs permission to and propagate permissions down to the children via inheritance (usually automatic).
As far as groups there are many built-in groups as well as custom groups you can ...
0
Leaked FTP passwords are all very common and are one of the most common ways that source files are removed, malware installed on the developers websites is very common and recently develops gave began witnessing spear phishing attacks against them in an attempt for hackers to gain intellectual property.
One of the not so common ways and from what I'm aware ...
0
As long as things are setup correctly on the server, PHP files should be registered as scripts and the web server should have them interpreted by PHP when requested and only display the results of that interpretation.
That said, any number of issues can result in files being exposed. Some of these issues can also expose data regardless of if they are in a ...
6
In order to read PHP code you need a directory traversal vulnerability. file_get_contents() or other file system functions that are exploitable.
SQL Injection under mysql can be used to read source code. For example:
select load_file("/var/www/index.php")
To combat this make sure file_privs are disabled for the MySQL user account used by PHP. If ...
10
In addition to server-side vulnerabilities of all varieties, leaked FTP passwords are also a significant concern. There is a class of client-side infections that harvest your saved FTP passwords from programs like CuteFTP, FileZilla, and DreamWeaver, sending the login credentials to an attacker. This is very common. I've personally seen hundreds, maybe ...
0
As others answered, this shouldn't be possible. However, you can't say that there's absolutely no way for an attacker to read your PHP source code.
For example, there may be a vulnerability that allows an attacker to view files in the web server, including raw PHP code. Or an attacker may be able to discover your FTP password, which also could be done in ...
2
There are two possible ways that an attacker would be able to read this file as text, rather than execute it.
If your web server is misconfigured, then the php might not be executed. You obviously need to have php installed and running server-side, as well as have a web server in place that supports this. If, for some reason, something goes wrong with your ...
1
I remember hearing about LoJack for laptops in the past. I did some research, and they claim they have some BIOS-integrated feature that would allow tracking, I'm not sure if this could be succesfully combined with full disk encryption
From a PC Mag Review:
Persistence Furthers Along with the main application agent, LoJack
includes an invisible ...
5
Disk encryption is about preventing access to data, unless a specific authentication token (e.g. a password) is presented. Full disk encryption is about doing that on the whole disk, including the OS, so the machine won't even boot without the password. If it does not boot, then, in particular, Prey won't work.
What you can do is to allow the machine to ...
2
If the mullion is (as your description suggests) a decent hunk of steel, then attacks that involve breaking it aren't really a problem. If the frame is solid (some kind of steel framing is preferable) and the mullion is secured with bolts that are:
a reasonable length (the majority of which should be in the doorframe)
a proper thickness
properly secured
...
2
I'd ask why the need for a mullion in a double door way when you could just have a single large doorway instead? It would be preferable to have one single high-strength and high-security door as part of a solid frame/wall rather than two potentially weaker doors and a corresponding weak point.
Certainly the mullion can be bolted in and made of solid steel. ...
1
This is often known as a service or API key. You are trying to setup a web service. Generally, the client site will submit a request for some action to be done with a publicly shareable identifier that lets your system identify who sent the traffic your way. It should likely be paired with a private code that is used for your server to respond back to ...
2
There's a little detail here on how Paypal issue Application IDs for issuing on servers which will host applications making API calls to PayPal on behalf of merchants/service providers - https://www.x.com/developers/paypal/documentation-tools/going-live-with-your-application#register
The approach you're taking above is similar so it's a way of providing ...
0
I see little wrong in the situation you currently face; if the following conditions are true:-
Under system / workstation security policy in the section of roles and responsibility manager can have access to domain accounts.
The changes made by your manager is in line with the corporate change control procedures.
If your systems are properly audited to ...
Top 50 recent answers are included
