New answers tagged

1

Each system is used for a different overriding security requirement. The three main security requirements are confidentiality, integrity, and availability. MAC supports a security requirement of confidentiality more so than the others. DAC supports the security requirement of availability more so than the others. RBAC supports the security requirement of ...


3

Either option can work, if done correctly. In general, I would prefer to use the same application because it is simpler to maintain, particularly if the two applications share a lot of common code. However, there are some considerations which could tip the scales in favor of two distinct applications, mainly: It is easier to lock down a separate HR ...


2

You can definitely use a single application. While it may be slightly more complex to implement than two separate apps, using a single app with multiple access levels is common practice and acceptable. Authentication is important for both approaches, but with a single app you'll have to make sure all the admin functionality is protected. Check the user ...


0

Axiomatics provides an authorization policy lifecycle that will help you formulate your ABAC policy. Define the use case Define the use case’s authorization requirements in natural language statements Identify the attributes that are used in the natural language statements Identify where the attributes comes from Rework the natural language statements as ...


0

Not meaningful for levels, but fine for categories. Assume O1 is from company X, 02 is from company Y, and I have different levels between X and Y. The underlying difficulty this exposes is that a unit of information is much smaller than a file: how are we to compose the two?


1

Most OSes has to be certified to be used for certain purposes/in certain organisations. Most of them use the Common Criteria framework to different assurance levels and some levels require the OS to clear a page before handing it to another process. An indirect reference to this requirement, which states: One reason zero-initialized pages are required is ...


-1

There are a few ways to protect RDP. Don't use public port #3389. Allow only certain IPs(or range of IPs) address to public IP. Configure firewall to block any attempts to contact the server. Use third party tools to block the traffic. A free tools is bfguard.com. There are several more but I like this one.


2

Technically, an operating system could recycle pages from processes that had the same security context, because any information the new process could gather from that would also be accessible to the process directly. This is however completely impractical, because the security context of a process may change over time, and when privileges are dropped (which ...


8

The attack you describe doesn't work on Windows. Starving the page-zeroing thread doesn't prevent zeroing, it only delays it. The existence of the page-zeroing background task is a performance optimization. Basically, a naive memory manager with a privacy guarantee works like this: reserve a page from the freed list zero it make it available to ...


0

The only working way to perform what are you talking about is a Cold Boot Attack, when you're destroying kernel by powering it off. OR you can try to play with kexec() calls, but it will not work in most of the cases.


23

I was curious of this myself once, and wrote a small program under linux that malloc'ed all available memory and dumped it to disk. It turned out that it was all zeroed out before it was handed to my application. Later, I also checked the kernel code, and could confirm it was the kernel who did it. -- I think it makes perfectly sense that it is the OS ...


17

In Linux, processes is able to read another process memory when any of the following conditions applies: The process had root permission or it can read /proc/$PID/mem or /dev/mem, by default /proc/$PID/mem and /dev/mem are only accessible by root Parent process can fork()/clone() in such a way that allows it to read some or all memory of its child ...


5

It is absolutely possible to read the memory of another process but this is only possible with administrative privileges and of course the OS won't allow any process to access any space of the memory that isn't assigned to that process. For Administrative users this is of course possible. In Windows for example this functionality is implemented by default ...



Top 50 recent answers are included