Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

2
votes
0answers
48 views

Default value of ACLs mask

This is the question I faced in an interview as a system administrator. If we didn't set the mask value, what is the default value of mask? I was thinking that if we didn't set the mask, it ...
2
votes
1answer
35 views

Does the subject HAVE to dominate the object in order to access the object?

Lets say Paul, is cleared for (TOP SECRET, {A,C}) where top secret is his clearance and A & C privledges. He wants to access a Document classified (Secret,{B,C}).. Top secret trumps Secret but in ...
1
vote
1answer
41 views

Comparison between Firejail and Apparmor

I'd like to understand how Apparmor and Firejail compare to each other: advantages, pros and cons, purposes, similarities, etc. I might be asking to compare apples with oranges, however I've noticed ...
1
vote
1answer
38 views

Data extraction, temporary storage and audit log - Advice needed

At work, we are planning to take down a database for 24 hours. We are not going down the track of creating a "Hot standby", the DB will be completely offline throughout. During the downtime, we would ...
1
vote
0answers
41 views

How to handle refresh tokens

I'm trying to wrap my head around JWT (JSON Web Token) based authentication for securing API endpoints using access tokens. I'm protecting these endpoints by requiring the user to have a valid access ...
0
votes
0answers
66 views

what is the step for converting Bell-LaPadula Model lattice using Access Control Matrix

O1 O2 O3 O4 S1 w r w rw S2 rw r S3 w w r S4 w w w r S5 rw rw ...
26
votes
7answers
5k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
3
votes
3answers
856 views

How to deny access to my server end points ? (PHP)

I've developed some software installed e.g. on www.example.com. It's accessed via an HTML web page. Some HTML buttons can call PHP end points which are also on that domain. I use JWT to secure login. ...
2
votes
1answer
215 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
0
votes
1answer
20 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
3
votes
1answer
62 views

Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github

I have been working on a code review of a project. The source code is publicly available on Github. I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
2
votes
0answers
31 views

Minimum set of ACS features to secure remote PCIe devices

According to a Google blog post, Google has been experimenting with providing raw access to PCIe devices in a remote environment. They set out to discover what Access Control Service features (ACS, ...
1
vote
0answers
220 views

What's the difference between Graham-Denning model and Harrison, Ruzzo, Ullman (HRU) model

I have trouble understanding the differences between these models. My understanding: HRU and Graham-Denning are both computer security models that define the interaction between subjects, objects ...
0
votes
0answers
26 views

File size attribute gets access denied on accessible file

Going nuts on the following access control issue! I've googled high and low, and can't find anything pertinent. Any help appreciated. I have a windows 7 starter edition netbook. It has two users, ...
0
votes
2answers
90 views

Is it acceptable “allowed by default, disallowed for specific data/actions”?

A friend told me that in the agile paradigm it is said that users are allowed by default to do anything but then they are blocked or disallowed to access or do certain identified actions. Just the ...
3
votes
0answers
71 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
1
vote
0answers
37 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
0
votes
1answer
48 views

Limited remote access to a web application [closed]

I would like to set up a very simple node.js web application on raspberry pi and access it remotely, from outside the LAN. There are no other hosts in that LAN with the Raspberry. I only need to ...
2
votes
1answer
199 views

How to get better IAM understanding

I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong. I began with ...
3
votes
1answer
75 views

How should privileged users keep each other in check? [duplicate]

In order to protect systems from insider attacks, companies can apply policies restricting their access. In the case of an employee's termination, the IT department can disable their account before ...
2
votes
0answers
31 views

Access control to allocated buffer [closed]

I have a system which contains a process which allocates memory to other processes from its internal memory buffer , each process that needs memory allocation has to enroll with the allocating process ...
77
votes
4answers
10k views

Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)

There are multiple mechanisms (some now defunct) that allow me to access service A (the Relying Party / RP) using a token granted by service B (the Identity Provider / IdP). Typically these replace a ...
2
votes
1answer
208 views

Are Bell-LaPadula and Biba models used in real big software security design?

I am currently studying both Bell-LaPadula and Biba models, I found this models too theoretical as I see the examples and I can see that there are used for designing particular services that needs ...
1
vote
1answer
95 views

SUID exploit and patch

I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
0
votes
2answers
95 views

Cryptography in simple words anout one idea?

I'm a student and have one challenge about cryptography. I need clear definition or simple definition to better understand cryptography and related security. I’ve been reading lots of material, seeing ...
1
vote
0answers
100 views

Can I use HashiCorp Vault to restrict access to credentials based on CIDR? [closed]

This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet: A python script gets populated by configuration management ...
1
vote
1answer
49 views

What are the security risks of running a daemon as root even though SELinux is enforcing?

On an board running Linux I see a daemon and an utility run under root when started. The SELinux is enforcing for this system. Are there any potential threats of running as root, even if the SELinux ...
4
votes
4answers
213 views

How do large organisations manage access for their Instagram account?

A platform like Facebook has fairly standard access management for Facebook pages - where multiple individual user accounts can be assigned to roles with varying privileges on the Facebook page, and ...
5
votes
1answer
109 views

Is it acceptable for security engineers to have admin access to production servers?

In my organization, our server infrastructure team has historically held all admin access to production servers. We're recently trying to strengthen our security posture, so we have hired several new ...
0
votes
1answer
47 views

How do you handle untrusted software installation / runtime?

If you need to install software from a third party and frequently run it on your PC, but you do not trust the software, although antivirus doesn't rise any flags: Is it possible to install software ...
1
vote
0answers
169 views

How can access to a certain named pipe be denied or logged on Windows Server?

Suppose a system administrator became aware of a service running on their server that both created a named pipe that allowed access by remote clients (e.g., ordinary domain users), and that had an ...
2
votes
1answer
276 views

Webgoat missing function level access control lesson

I've recently installed WebGoat 8.00M12 on my computer and I tried to solve the "Access Control" section for a demonstration in my class. Everything was simple and smooth till I got stuck at the last ...
1
vote
2answers
108 views

Severity and priority rank of Insecure Direct Object Reference bug

Recently, I found bug in an e-commerce web app and I will report it. The bug I found can: delete and edit the favorite products list for all users delete all notifications for all users What ...
2
votes
2answers
81 views

How can a manager delegate work to their PA if password sharing is not authorised?

Everyone talks about the importance of delegation. But how can a manager delegate work if password sharing is verboten under the organisation’s IT Security Policy? This means that the PA would have no ...
2
votes
2answers
113 views

How do companies manage resources shared with 3rd parties on cloud platforms?

Over the years people at my company have shared resources on cloud platforms with 3rd many parties. This can be files on Google Drive, articles on Confluence, repositories on Github, slack channels, ...
2
votes
2answers
2k views

JWT access token and refresh token

We have two applications App1 and App2. A user uses a browser to communication withe apps. App1 supports different auth. mechanisms (SSO, usr/pwd, etc.) but App2 doesn't have any access to auth data ...
0
votes
1answer
286 views

Difference between Non-discretionary and Role-based Access control?

What's the difference between Non-discretionary access control and Role-based Access Control? In CISSP book both mentioned in the different paragraph as in different entity. But In some other place (...
2
votes
0answers
225 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
3
votes
4answers
197 views

How To give someone a shell in my local net without security risks?

I have a server A in my local network in my house. I want to allow someone to come to that server using a reverse ssh connection from my server to his server from which he can get to my server. I don'...
1
vote
1answer
208 views

what is a resource in UMA (OAuth2)?

I'm currently having a look at OAuth and UMA and I often read about resource and resource server. But I'm still unsure what exactly a resource can or can't represent. Most of the time in the examples, ...
2
votes
2answers
85 views

Is it possible for a network administrator to disable interactive elements on a webpage? (such as text boxes)

As part of my degree, we're currently looking at a hypothetical scenario in which internet access is introduced to prison cells. As part of the information risk assessment, I was wondering if it is ...
5
votes
0answers
221 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
-2
votes
1answer
32 views

Documents required by broker for forex [closed]

I've registered for bitcoin forrex,paid the initial 250 USD,now they require that I sign a form giving access to my bank account,they also request a copy of my ID,proof of residence and banking as ...
2
votes
2answers
369 views

How to stop people from bypassing firewall blocks by using Google cache?

I'm using a physical Stormshield Firewall to control connections of a private companies. There are rules to block some websites, like video games websites, Facebook, etc. However, these websites can ...
2
votes
2answers
711 views

What are the risks of allowing business users direct production database access?

I work for a small-ish company that currently allows almost everyone to access production databases and run SQL queries (it's a "culture" thing). I need to sell the C-Suite on why this is a bad idea ...
2
votes
1answer
119 views

Access based on type of information requested and access grant

The simple solution to access restriction when number of users are small is Access Control Matrix. Here the rows are the users and columns are different types of asset. In my case, I have a document ...
0
votes
3answers
110 views

More than one admin required on site to login to a database/resources

What is the terminology used in computer security where you need at least two admins at the same time to login/access a database/resources? Maybe by each having part of the password or key. This used ...
0
votes
1answer
201 views

Password write protect an external hard drive (DOK) without encryption [duplicate]

I'm handing out a usb sticks to students and want them to return after they copied the material to their personal computers. I want to make sure the usb's return without any damage/malware (...
2
votes
3answers
160 views

Example of decentralized access control?

Classical server-client architectures implement classical centralised access-control. The problem with that is that administrator with root access has full control over it what may represent ...
0
votes
2answers
56 views

Authorization / Access control in a client-side-encryption environment

I'm thinking about a client-side encryption concept where only the client knows the master secret (a user password). A correct implementation assumed, with KDF and authenticated encryption solutions ...