Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

Filter by
Sorted by
Tagged with
1
vote
2answers
93 views

JWT(Json Web Token) Tampering

I'm reading OWASP Top 10 - 2017 The Ten Most Critical Web Application Security Risks, and came across the following risk, under Broken Access Control vulnerabilities: Metadata manipulation, such as ...
4
votes
1answer
100 views

What's the reason of both “Allow-Origin: *” and “Allow-Credentials: true” headers?

MDN says that attempting to use Access-control-allow-origin: * with credentials should result in an error. Taking this into account, why so many major companies' APIs (spotify, twilio, among many ...
3
votes
1answer
60 views

Does Nextcloud installation gives passwordless access to all files by default?

I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, ...
47
votes
10answers
16k views

Global variables and information security

I get the impression that it is a programming best practice to create variables in specific scopes (like a function scope) and avoid global scope to make things more modular and better organized. ...
3
votes
2answers
75 views

How to design an Access Control system that is quick to implement and understand, yet maintainable and flexible enough?

We're currently redesigning our access control system for our SaaS startup (over the past two years it has grown alongside the business and decided to clean it up at this point). The access control ...
36
votes
5answers
14k views

The teacher logged me in as administrator for doing a short task, is the whole system now compromised? [closed]

I worked today with our teacher who logged me into a computer as admin. We had a task that required admin rights. A few seconds later he was talking to other students in our classroom, but I was able ...
0
votes
0answers
23 views

AD Security Group hunting

I have a problem that I have been pondering off and on for a while and I want to see if anyone has a better answer: Is there a way to see where an AD security group is used in an enterprise WITHOUT ...
0
votes
1answer
51 views

What are things we look to find Access Control Database?

Currently Working on HP Fortify Access Control Database category. Source: userId = request.getParameter(Constants.USERID).trim(); Sink: pstm1.setString(3,userId.trim()); I saw the definition ...
0
votes
0answers
46 views

I’ve been scammed! Fake Microsoft tech services [duplicate]

I was under the assumption that my IP address was hacked last night because of this movie website I was on. Thanks to the good people of “stackexchange.com”, I learned that they tried to con me by ...
4
votes
1answer
48 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
1
vote
1answer
60 views

Attribute-based access control standard definition

While reading a number of definitions of attribute-based access control (ABAC), I found that there are two different definitions: Access control decisions are made using the attributes of users, ...
3
votes
3answers
286 views

How do you protect against your IT domain admins accessing your data?

I work at a small company and we use an external company to take care of all our IT needs (a "managed IT service provider"). This includes managing our windows domain, our network, and everything else....
1
vote
1answer
41 views

Why do we need the refresh_token OAuth flow?

In OAuth 2.0, I'm confused about hwy we need a refresh token flow. Per my understanding, when you submit a "refresh_token" grant type, you receive an access token, its expiration, and a refresh token....
0
votes
1answer
62 views

Block SMTP Connection That Doesn't Have Credentials

I am able to do the following and connect successfully without any type of credentials: telnet <IP Address> 25 When I am in I can verfiy emails, send emails, etc. I feel like this is a ...
0
votes
2answers
127 views

What is Cloud KMS? What's it's purpose/benefit of KMS? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)

What is Cloud KMS? What's it's purpose/benefit of KMS? Is there a concrete example of a problem I solve using it? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault) Whenever I've ...
1
vote
0answers
47 views

Storing user's private files on S3 and securing access using signed URLs - good idea?

I will be storing private user's files on S3. The files will be PDFs, possibly containing private financial information. I'm considering letting users directly access the files on S3, without ...
39
votes
8answers
10k views

How can I prevent a user from copying files to another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
1
vote
1answer
65 views

AWS S3 resource access control through IAM permissions or bucket policies?

The way we create buckets in our org and ensure sane ACLs around it is by providing an automated tool (that internally uses Terraform) to provision an S3 bucket. So say when a user requests for a new ...
0
votes
0answers
57 views

Having one OIDC provider and multiple APIs from third parties, how can I federate logins?

If I have an app which authenticates against one OIDC provider eg. Google but then uses the provided id- and access-token to make request against a 1. app-api and 2. a third-party-api using the tokens ...
2
votes
1answer
165 views

How do ISPs send their own pages when a user is trying to access a blocked site?

I know that some ISPs send block pages(like "This site has been blocked because ... ") over HTTP by sending a fake 301/302 redirect. I also know that instead of sending a block page, some ISPs simple ...
0
votes
0answers
53 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
0
votes
1answer
111 views

How is Privileged identity management (PIM) different from privileged access management (PAM)?

I am very confused about those two, I was trying to understand the difference but it all sounds the same from what I read online.
1
vote
1answer
522 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
1
vote
1answer
90 views

Could it be possible to diminish the damage of having one's VPS inspected by the host?

I'm planning to run/have some quite sensitive data on a VPS, however, knowing well that the host could at any time access the data (rare but as long as it could happen in theory, I would very much ...
3
votes
3answers
92 views

RBAC: how to separately scope two resources that have a many-to-many relationship

I'm working on an application that needs access control. Basically, the problem I'm facing is this (heavily simplified): The application has two main sections: Files = File[] Contacts = Contact[] ...
5
votes
2answers
310 views

How to convince users that security is a good thing?

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
2
votes
3answers
158 views

Are there examples of implementing security as a side effect?

I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
69
votes
10answers
15k views

Why avoid shared user accounts?

I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
0
votes
1answer
159 views

Question about access control with RBAC and DAC

Here is the problem A company has 1250 employees and the employees have been trained to handle 4 job duties: Clerks: 1200 of the employees have been approved to work as clerks. To do ...
1
vote
0answers
57 views

Hybrid cloud access controls

In a hybrid cloud setup, where we have a cloud component which writes data into an on premise component, is it necessary to have separate access controls between the cloud and on premise? Our ...
0
votes
0answers
68 views

How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?

I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent: A Javascript client call of XMLHttpRequest.withCredentials A server response of ...
1
vote
3answers
57 views

Is “permission (role) granting” safer, than giving direct access to primary account?

The role assignment is excellent feature over the various platforms (Google, GitHub, Facebook, etc. ). However, I've been thinking about a specific security "threat" which might arise from that. Let'...
0
votes
0answers
41 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
0
votes
0answers
128 views

Filter/Block OpenVPN clients' access to a specific website

As stated in the title I would like to restrict VPN clients' access to specific websites. More specifically, I push the route for 5 websites to the clients via the server config. However, I would ...
1
vote
1answer
50 views

How to track network file share accesses on workstations

I shared a folder created in my C drive with a colleague over the network and he was able to access it. Is there any log that will track this kind of activity? I am aware of Windows Security Event ID ...
2
votes
1answer
45 views

What is the impact of leaving disabled root key on AWS instance?

I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance. When asked to remove the root key, he said it's disabled now so what's the ...
1
vote
1answer
49 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...
0
votes
1answer
67 views

Bell LaPadula with Empty Set Causing Severe Headaches

I've been answering some questions about the Bell LaPadula model in my book, but I don't seem to get the correct answer on b). Below I've tried to explain my thought process on how I've attemped to ...
0
votes
1answer
469 views

Google Chrome Linux with Activity of Unknown Device

I've recently noticed a strange comportment on my Google Chrome Browser with GMail, where suddenly appeared a connected Unknown Device, with a double connection and with the same IP than mine, looking ...
0
votes
1answer
196 views

What are the risks resulting from having a switch without strong access control directly facing the Internet?

At home I have a connection to my provider via glass fiber that provides two VLANs: IPTV and Internet. The structure of the network is exactly as shown in the following image, except for the phone ...
2
votes
1answer
104 views

Websites that can connect with Gmail

I'm currently job searching, and came across a site that knows when I'm signed into G-mail. A quick look at the login page shows that I can use my Gmail account to login. Looking at the Google API, ...
1
vote
1answer
31 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
0
votes
2answers
749 views

Why is linux filesystem considered DAC and not MAC

Citing wikipedia's MAC article: With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the ...
0
votes
1answer
62 views

How to securely transmit data (user access info) from node server to react client

Just for a little background. We have a express based server and a React app which uses HTTPS connection with JWT tokens to authenticate user and send appropriate information over Authentication ...
3
votes
4answers
164 views

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security? In a "Policy as Code" system ...
1
vote
1answer
64 views

Addressing availability element of CIA triad using technical controls

When looking at the availability element of the CIA triad, most definitions mention that availability is addressed through ensuring system up-time by using controls such as disaster recovery, business ...
1
vote
1answer
156 views

Am I traceable if the VPN I am using keeps turning on and off?

Let's say Bob is on network A and he decided to use a VPN service. Unfortunately he is using a poor VPN service which keeps turning on and off. But the Active downloads of packets are still ongoing ...
2
votes
1answer
107 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
3
votes
1answer
411 views

Why do capability-based security systems protect against the confused deputy problem?

According to Wikipedia (https://en.wikipedia.org/wiki/Confused_deputy_problem): In information security, the confused deputy problem is often cited as an example of why capability-based security ...
2
votes
2answers
324 views

Separation of duties for user account creation

Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...