Tag Info

New answers tagged

3

It's far from complete, but a group of teammates from my University are developing Mumuki. The English version seems to be broken doesn't have English content at the moment, but you can read it's intention there. You can also join the project and make it run C++ (I've started with C). The idea of the platform is to create exercises with unit tests that ...


2

Yes there are. For a start, it's not a bad idea to use SSH but to improve security you can do the following: Use chroot jails to lock all 'student' users who log in via SSH into a limited environment. Do not give them sudo access, instead use specific scripts / commands in the sudoers list to allow a limited subset of the administration commands. Make ...


28

What you need is relatively simple: you need to ensure that your students' unprivileged accounts are well confined. If you don't have a graphical environment involved, your situation is relatively simple. You should start by implementing the following actions: ensure users are created without administrative privileges (no sudo, no admin or wheel group) ...


4

This can be a particularly tricky problems. You're approach should match the size of your business (will your solution scale), and the sensitivity of the information. If you look at a company like Trello, they won't change Administrators for you. If I had to guess their reason for this, it is because the risk of them exposing your data doesn't justify ...


1

These are two separate concepts, and I'll attempt to make an analogy. Imagine access control mechanisms are like locking windows and doors in a house. You have to make sure that all of them are locked down to create a secure house, but breaking them is still possible for entry. For some things in the house this level of security is all you need. But ...


4

Encryption is used to provide confidentiality of data that may or will be accessed by an untrusted entity. Access control is used to limit or otherwise control an entity's access to an object. Asking "when do we use them" is an open question. Access controls can be anything from a padlock on a gate to a permission set on a filesystem. They can be simple or ...


3

Encryption mechanisms can be used to achieve specific outcomes: Making some data illegible, with the ability for specific individuals to retransform it into a legible format later: this can be used to implement confidentiality within some technical limitations Providing an authentic signature related to a specific blob of data: this can be used to provide ...


3

A security administrator shouldn't need to have any access to any system within a production environment and certainly not any administrative access. Their function needs to be logically separate and independent to the roles of those users who perform administrative functions. A security administrator should be able to run vulnerability scans, have access ...


1

My suggestion would be to send something to the companies registered address e.g. a code they can read back to you, or a URL to create a new account. I would address the letter to the job title of the previous administrator e.g. "To The Technical Director". This gives it the best possible change of reaching the person performing the duties of the previous ...


1

You haven't mentioned whether you have tried the request with cookies (or other authentication data) withheld. If the request still works without authentication for the same scheme and you've removed caching headers like If-Modified-Since and If-None-Match then it is "A4 – Insecure Direct Object References". If the request works only when you haven't ...


1

The web server seems to apply different security control whether the access comes from HTTPS and from HTTP. Most probable is that the designers thought that this file would be accessible only to HTTPS users, and missed the fact that this URL can also be served through HTTP. In your question you refer to: A7 – Missing Function Level Access Control: This ...


0

according to bellow mentioned paper, Bell-Lapadula Model is not compatible with Composite services: Incompatible Access Control Models: Access control of a composition is dependent on the access control capabilities of the individual services. Where different component services use different access control models, the result could be a violation of any of ...



Top 50 recent answers are included