A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

2
votes
0answers
19 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
-1
votes
0answers
16 views

Impossible to modify Windows 10 drives from other OSs [migrated]

I'm here to describe an interesting issue I've been facing today, in order to get some hints or solutions. My goal : access and modify one of my computer's Windows (10) system hard drive in order to ...
3
votes
1answer
64 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
1
vote
0answers
35 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
4
votes
1answer
39 views

What are best practices for secure admin access management to critical 3rd party cloud application in big companies?

I've always wondered how can we manage admin access to critical 3rd party resources (social media, SaaS CRM, etc) in big companies to mitigate: The administrator might leave the company without ...
3
votes
0answers
89 views

Work wants to create an admin account on my system that I don't have access to? [closed]

This is on a Windows 10 system, and they want to create an administrator account that only my manager will have the password to. This is apparently to enforce some new "security policies" that haven't ...
1
vote
1answer
32 views

Defense-In-Depth With Common Security Controls

Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
0
votes
0answers
27 views

idevicerestore installation trouble

Can anyone help me figure out what im doing wrong to install this software? ``` root@kali:~/libimobiledevice# sudo apt-get install libusbmuxd-dev libplist-dev libplist++ Reading package lists... Done ...
1
vote
1answer
15 views

What are the tools/frameworks/techniques for authorizing a device accessing a web app?

I've a password protected web application (ASP.NET 4.5), and a requirement that when a registered user accesses the site from a device for the first time, I should authorize that access by sending an ...
-1
votes
1answer
50 views

Is Linux protection mechanism implemented using capability lists?

I often get confused whether a particular protection mechanism is ACL or CL by definition. As an example to clarify this, I would like to consider the case of Linux. I believe Linux uses capability ...
0
votes
1answer
172 views

Authorization on complex ownership

I have problem with object ownership in my web application. In my web application. There are object types: 1. Faculty 2. Student 3. Student Group 4. Student Lesson The following user roles are ...
3
votes
2answers
53 views

Is ignoring share permissions ok?

For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according ...
0
votes
0answers
10 views

Implementation of security policy using BLP

I'm studying for an exam that covers BLP (Bell-Lapadula) and I was wondering if the following could be represented using this policy. All the examples I've found online are of a simple hierarchical ...
1
vote
0answers
35 views

Why doesn't homebrew fix file access problems by itself?

Before I took ownership of /usr/local, "brew link" caused a "/usr/local/..." not writeable. Is there any particular security reason why the program didn't say something like "The operating system ...
3
votes
2answers
49 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
3
votes
1answer
80 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...
5
votes
2answers
74 views

How to secure shared user on build server?

We have a CI server which is installed as the builduser and all tasks are executed as that respective user at the OS level. We have many teams sharing the build server which means the build user and ...
5
votes
1answer
466 views

Storing a password securely as part of a webservice

Say I'm creating a public web service which needs to write files to a Dropbox account (just an example). It needs to write files to one central account, not one per user. This service needs to access ...
4
votes
1answer
56 views

Are Linux System Capabilities Considered Mandatory Access Controls?

DAC is not mandatory because access permissions are left up to the resource owner's discretion. Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a ...
4
votes
2answers
79 views

Using a single application for user and admin (with different auth methods) vs separating them into two applications

I am creating a human resource management application that allows access from both employee and HR administrator. Now, I'm faced with a best practice issue. There would definitely be two users: ...
1
vote
1answer
112 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
0
votes
1answer
46 views

Bell-LaPadula no read no write

I'm reading about the Bell-LaPadula model. I understand the Simple Security Property and the Star Property, and I see that the model also incorporates a Discretional Security Property. My question is: ...
21
votes
7answers
3k views

Reading physical memory frame previously owned by another process to read contents of its memory page

I had a conversation with @anger32 who states that zeroing physical memory page frame when passing the page backed by that frame to another process is not the responsibility of OSes like Windows and ...
4
votes
2answers
86 views

Using identifiers in URLs to authenticate users

Someone I know is registered on a community website where they can exchange messages etc. Taking a look at the email notification they receive when something new has been posted, contains an image ...
3
votes
1answer
55 views

Access via link in Email - How can I make this most secure?

I need your professional opinion on this matter, please. The app I'm building has 2 parts: Teachers & students. Teachers use the app to build a project and attach students to it. Then, the ...
5
votes
1answer
98 views

Using a single number instead of an IP address or a DNS name, which are concrete uses? [closed]

My question: I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to ...
0
votes
1answer
66 views

Security concerns for image server?

I am new to the concept of security. I have a simple image server that takes in username and an image to be uploaded. Given a username on a different URL, all images can be viewed as a slide-show on ...
0
votes
1answer
65 views

How to remove Write-Only on 'encrypted USB' from Laptop [closed]

My laptop has been policy enforced to write only on Encrypted USBs like Kingston DataTraveler 4000. Other USBs are read-only and not writable. Are there any tweaks to have this removed. I read one ...
29
votes
4answers
3k views

Can the root user be removed from a *nix system to prevent privilege-escalation?

Once a *nix system is properly configured and hardened, is it a conceivable strategy to remove all super user/root users? Are there benefits to removing root from a system altogether to prevent ...
5
votes
1answer
107 views

How to grant permission to read a text file to a specific application run by a regular user?

A text file is situated in /opt/somefolder. It contains a pair login - password read by an application when authenticating on a server. The application is run by a regular user, so that the file can ...
1
vote
1answer
69 views

What kind of answer is this textbook question looking for in access control model?

I'm going over a practice question and I have trouble understanding what it's asking. Draw an access control matrix for the following Linux file system. Group A1 contains S1 and S3, group A2 ...
5
votes
1answer
307 views

Mandatory vacation as a security control?

I recently came across the concept of mandatory vacation as a management security control. Employees are forced to take at least one week of consecutive vacation to provide the company to audit their ...
3
votes
2answers
58 views

Where do Access Controls Fit into the Parkerian Hexad?

The security elements of the Parkerian Hexad are: Confidentiality Possession or Control Integrity Authenticity Availability Utility Where do access controls (mandatory, discretionary and ACL) fit ...
0
votes
1answer
107 views

Difference Between MAC and DAC

Are the only difference between DAC and MAC: the fact that MAC can also dictate DAC-type permissions to processes, not just users and name space objects? (files,etc) And there's no concept of ...
5
votes
2answers
296 views

Keeping passwords out of source code

Secrets should not be in source code and in version control because of two reasons: External threat: An attacker can exploit a vulnerability to get access to files/source of your ...
2
votes
0answers
49 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

What are the most common ways to Architect the verification process of the access tokens between resource server and authentication server using OAUTH 2.0? I am trying to build a web application ...
2
votes
1answer
79 views

Protecting a database against insiders

Consider a network for a web-application with 1 webserver and 1 MySQL database, both on physically different servers and both running Linux. The database stores mission critical data and this data is ...
95
votes
12answers
19k views

Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)

I just got a new job at a medium-sized (~100 employees) company and one of the first things I was told is that I cannot use my own computer, because I need to be able to connect to their network, ...
2
votes
0answers
25 views

Unique assignment of permissions to objects seems to also require the role?

So my understanding of RBAC is that Users have Roles, and Roles have Permissions and there should be a Permission Object mapping. I'm having a bit of a business logic problem though concerning RBAC. ...
0
votes
1answer
55 views

Should I set up a VPN for these services?

I'm developing a personal project with a few people. I need to setup Continuous Integration service, Jenkins, version control service, Perforce, repository manager service, Nexus, and a Web server. ...
0
votes
1answer
63 views

Convert customer tracking system from web access to REST

Intro:In our company there is a service tracking website for our clients, where they can monitor the progress made in their cases with us. Our users are required to log in to that website (admin ...
2
votes
1answer
106 views

Attribute Certificates and Access Management

I recently came across Attribute Certificates (RFC 5755), which can be used as a means for authorisation. I like the idea but I have spent a lot of time searching for information how this works in a ...
0
votes
1answer
109 views

“If encryption has not been implemented, a comparable alternative has been implemented” [closed]

What constitutes as a comparable alternative to encryption? I know that password keepers and other services are not comparable and are not considered encryption. If the context is authorized access ...
0
votes
1answer
75 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...
1
vote
2answers
126 views

Online Marketing company want me to share my Google Account login details?

We are a small business and use "Google Apps for Work" and my google apps account was used to set up the business's "Google My Business" and related Google+ pages We have now engaged an online ...
3
votes
0answers
55 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
1
vote
1answer
235 views

How to determine which program accessed the Mac Camera?

The green light on my laptop's camera just flashed on and then off after 1 second. I am extremely concerned about this since I am not running any programs which could have enabled the camera. I ...
1
vote
3answers
192 views

How do I allow only app to view/download files from server?

I have an Android app that uploads and downloads pictures from my dedicated server. However, before I go live, I want to know if there is some way I can secure the server to allow only my app to ...
3
votes
1answer
67 views

Why is it a terrible idea to implement restrictive measures in .bashrc?

Asking this because apparently there are multiple people who genuinely don't realize just how bad of an idea this is, and I want there to be a single, easy-to-find place for them to go / be sent.
-3
votes
1answer
103 views

Session hijacking [closed]

I know one way of doing session hijacking 1.copying the session value from the chrome browser and pasting the cookie value to firefox browser Is there any other way of doing session hijacking ? If ...