Tag Info

New answers tagged


Short version: You want Mandatory Access Control Real-world Industry Best Practices use of MAC is rare The use of bastions is the most common widely-accessible alternative Long version: The ability to apply fine-grained controls over not only the users but the processes able to access data is generally only found in Mandatory Access Control systems. ...


The best practice is exactly the same as for every privileged account (administrator, root, etc.): don't use it as a standard account. All you need to do is NOT grant access to the DUDE.NAME account to the sensitive data and use HIGHSEC.DUDE.NAME instead. You can effectively couple that with some form of isolation if necessary. For instance, you can ...

Top 50 recent answers are included