Tag Info

New answers tagged

0

Host based intrusion detection system should address your requirements. Can be agent-based or agentless (remote agent), in all cases you'd need to write appropriate policy to cover your requirements. Example of monitored events: file checksums, log events, network connections,processes running in memory etc. Example of host based IDS software: OSSEC (please ...


0

Separating by Tables Separating by tables seems like a good idea, especially if you can estimate the importance of tables to your security. For example a table with usernames and passwords is pretty important, while a table with blog comments is less important. If you have a different database user for those important tables, an injection into eg a query ...


3

Process-based access control only works on data in transient memory (e.g.: RAM). Once data is stored on a semi-permanent media (e.g.: hard drive, flash drive, DVD, etc.), that media can easily be connected to a system that will not honor any access restrictions that are enforced in its native environment. You could add process-based access control to the ...


1

Actually, Google is making it far more difficult for anyone to merely download a video because Google is parsing out the entire video and serving you only portions at a time. Thus your ideal single 'request URL' (AKA a GET request) is actually multiple GET requests. Because of this parsing, it becomes difficult to create a script/program that consistently ...


1

Assuming you're running a Linux system, have you considered iptables? Basically, you could use something like: iptables -A INPUT -p tcp -dport 80 -m limit --limit 20/second --limit-burst 50 -j ACCEPT And use some tweaks to whitelist/blacklist. This way you won't have to restart any service. See this resource or this one, and This anwser on ...


2

This is a great question and one that companies often struggle with. I would say that giving the contractors VPN access generally provides more security than exposing it externally. Consider that your code repositories likely contain secrets and API keys and the like, despite policies to the contrary. If you're like most environments, compromise of your ...


4

Given that you cannot use a dedicated, isolated network for this, I would suggest a modified version of option 1: Allow access over the web with rigorous security checks. If possible authorize git users using a cryptographic key (the way github does.) This will make brute forcing attacks very difficult. Use IP filtering. That is, find out the IP ...


2

This probably is not applicable to your specific situation, but is relevant for the more general question. If you have a second computer, and are able to sniff the traffic coming off of the computer you have doubts about, then you might be able to determine if the system is compromised by watching that traffic. Going into analyzing that traffic is far ...


0

Android essentials does when installing applications. Each app gets a group assigned to it, and only that group can access the data for the app. In a Unix based system this is rather simple to implement. Windows gets a bit harder. Access Control Lists What you can do is create a custom Discretionary Access Control List (DACL) for your application. ...


1

Applications on Windows Operating Systems run in the context of the user executing it and therefore inherit the ACL of that user. When looked at abstractly your program is doing nothing more than Word (winword.exe) or Excel (excel.exe) is doing with .doc or .xls files. You shouldn't need to restrict access of the data to only the application, risk reduction ...


0

On Unix, I would suggest that you run that application as a particular user or group and limit the permissions on that folder to the user and group. You could do the same on Windows, but not as easily. If you know all of the users who will run the application, can you add them to a particular group, then give the group full control over that file?



Top 50 recent answers are included