Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

-1
votes
0answers
12 views

How to best handle a user revoking their own roles / access?

Suppose we have roles A, B, C where C can add other C, B, A while B can only add other A, and A can’t really add anyone. Now what if a B or C acts rashly and revokes their own role? They have to ...
0
votes
1answer
53 views

How is Privileged identity management (PIM) different from privileged access management (PAM)?

I am very confused about those two, I was trying to understand the difference but it all sounds the same from what I read online.
0
votes
0answers
12 views

Know the identity behind an AWS canonical ID [migrated]

Today while auditing a friends security settings, I found that an Amazon Folder (s3 bucket) with his most personal files had an unrecognised ACL entry. A person (with id ending in f6995f) had "Write" ...
1
vote
0answers
78 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
1
vote
1answer
66 views

Could it be possible to diminish the damage of having one's VPS inspected by the host?

I'm planning to run/have some quite sensitive data on a VPS, however, knowing well that the host could at any time access the data (rare but as long as it could happen in theory, I would very much ...
2
votes
2answers
39 views

RBAC: how to separately scope two resources that have a many-to-many relationship

I'm working on an application that needs access control. Basically, the problem I'm facing is this (heavily simplified): The application has two main sections: Files = File[] Contacts = Contact[] ...
5
votes
2answers
205 views

How to convince users that security is a good thing?

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
2
votes
3answers
133 views

Are there examples of implementing security as a side effect?

I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
68
votes
10answers
14k views

Why avoid shared user accounts?

I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
0
votes
1answer
91 views

Question about access control with RBAC and DAC

Here is the problem A company has 1250 employees and the employees have been trained to handle 4 job duties: Clerks: 1200 of the employees have been approved to work as clerks. To do ...
0
votes
0answers
33 views

Hybrid cloud access controls

In a hybrid cloud setup, where we have a cloud component which writes data into an on premise component, is it necessary to have separate access controls between the cloud and on premise? Our ...
0
votes
0answers
25 views

How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?

I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent: A Javascript client call of XMLHttpRequest.withCredentials A server response of ...
1
vote
3answers
51 views

Is “permission (role) granting” safer, than giving direct access to primary account?

The role assignment is excellent feature over the various platforms (Google, GitHub, Facebook, etc. ). However, I've been thinking about a specific security "threat" which might arise from that. Let'...
0
votes
0answers
35 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
0
votes
0answers
78 views

Filter/Block OpenVPN clients' access to a specific website

As stated in the title I would like to restrict VPN clients' access to specific websites. More specifically, I push the route for 5 websites to the clients via the server config. However, I would ...
0
votes
1answer
31 views

How to track network file share accesses on workstations

I shared a folder created in my C drive with a colleague over the network and he was able to access it. Is there any log that will track this kind of activity? I am aware of Windows Security Event ID ...
2
votes
1answer
44 views

What is the impact of leaving disabled root key on AWS instance?

I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance. When asked to remove the root key, he said it's disabled now so what's the ...
1
vote
1answer
41 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...
0
votes
1answer
59 views

Bell LaPadula with Empty Set Causing Severe Headaches

I've been answering some questions about the Bell LaPadula model in my book, but I don't seem to get the correct answer on b). Below I've tried to explain my thought process on how I've attemped to ...
0
votes
1answer
258 views

Google Chrome Linux with Activity of Unknown Device

I've recently noticed a strange comportment on my Google Chrome Browser with GMail, where suddenly appeared a connected Unknown Device, with a double connection and with the same IP than mine, looking ...
0
votes
1answer
95 views

What are the risks resulting from having a switch without strong access control directly facing the Internet?

At home I have a connection to my provider via glass fiber that provides two VLANs: IPTV and Internet. The structure of the network is exactly as shown in the following image, except for the phone ...
2
votes
1answer
104 views

Websites that can connect with Gmail

I'm currently job searching, and came across a site that knows when I'm signed into G-mail. A quick look at the login page shows that I can use my Gmail account to login. Looking at the Google API, ...
1
vote
1answer
25 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
0
votes
2answers
311 views

Why is linux filesystem considered DAC and not MAC

Citing wikipedia's MAC article: With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the ...
0
votes
1answer
38 views

How to securely transmit data (user access info) from node server to react client

Just for a little background. We have a express based server and a React app which uses HTTPS connection with JWT tokens to authenticate user and send appropriate information over Authentication ...
3
votes
4answers
156 views

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security? In a "Policy as Code" system ...
1
vote
1answer
54 views

Addressing availability element of CIA triad using technical controls

When looking at the availability element of the CIA triad, most definitions mention that availability is addressed through ensuring system up-time by using controls such as disaster recovery, business ...
1
vote
1answer
132 views

Am I traceable if the VPN I am using keeps turning on and off?

Let's say Bob is on network A and he decided to use a VPN service. Unfortunately he is using a poor VPN service which keeps turning on and off. But the Active downloads of packets are still ongoing ...
2
votes
1answer
102 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
3
votes
1answer
234 views

Why do capability-based security systems protect against the confused deputy problem?

According to Wikipedia (https://en.wikipedia.org/wiki/Confused_deputy_problem): In information security, the confused deputy problem is often cited as an example of why capability-based security ...
2
votes
2answers
234 views

Separation of duties for user account creation

Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
1
vote
0answers
38 views

Security model for availability of information

I have read about different security models that ensure the confidentiality and integrity of information such as the Chinese wall (confidentiality), Biba (integrity) and Clark-Wilson (integrity). ...
0
votes
2answers
78 views

How should I interpret, "access controls on the presentation layer are enforced on the server side?

This question is with reference to the OWASP standard (Access control rules on the presentation layer are enforced on the server side - OWASP ASVS 3.0 - 4.9) I'm trying to deeply understand what it ...
1
vote
1answer
34 views

Center for Internet Security Version 6.1 Critical Security Control 16-10

My project is implementing The CIS Critical Security Controls, Version 6.1 Can anyone please give me some advice on how we can address sub-control 16.10 which says..... "Profile each user’s typical ...
3
votes
1answer
222 views

Default value of ACLs mask

This is the question I faced in an interview as a system administrator. If we didn't set the mask value, what is the default value of mask? I was thinking that if we didn't set the mask, it ...
2
votes
1answer
53 views

Does the subject HAVE to dominate the object in order to access the object?

Lets say Paul, is cleared for (TOP SECRET, {A,C}) where top secret is his clearance and A & C privledges. He wants to access a Document classified (Secret,{B,C}).. Top secret trumps Secret but in ...
1
vote
1answer
611 views

Comparison between Firejail and Apparmor

I'd like to understand how Apparmor and Firejail compare to each other: advantages, pros and cons, purposes, similarities, etc. I might be asking to compare apples with oranges, however I've noticed ...
2
votes
1answer
50 views

Data extraction, temporary storage and audit log - Advice needed

At work, we are planning to take down a database for 24 hours. We are not going down the track of creating a "Hot standby", the DB will be completely offline throughout. During the downtime, we would ...
6
votes
2answers
2k views

How to handle refresh tokens

I'm trying to wrap my head around JWT (JSON Web Token) based authentication for securing API endpoints using access tokens. I'm protecting these endpoints by requiring the user to have a valid access ...
26
votes
7answers
5k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
3
votes
3answers
1k views

How to deny access to my server end points ? (PHP)

I've developed some software installed e.g. on www.example.com. It's accessed via an HTML web page. Some HTML buttons can call PHP end points which are also on that domain. I use JWT to secure login. ...
2
votes
1answer
907 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
1
vote
1answer
42 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
3
votes
2answers
96 views

Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github

I have been working on a code review of a project. The source code is publicly available on Github. I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
2
votes
0answers
74 views

Minimum set of ACS features to secure remote PCIe devices

According to a Google blog post, Google has been experimenting with providing raw access to PCIe devices in a remote environment. They set out to discover what Access Control Service features (ACS, ...
1
vote
0answers
641 views

What's the difference between Graham-Denning model and Harrison, Ruzzo, Ullman (HRU) model

I have trouble understanding the differences between these models. My understanding: HRU and Graham-Denning are both computer security models that define the interaction between subjects, objects ...
0
votes
2answers
100 views

Is it acceptable “allowed by default, disallowed for specific data/actions”?

A friend told me that in the agile paradigm it is said that users are allowed by default to do anything but then they are blocked or disallowed to access or do certain identified actions. Just the ...
3
votes
0answers
79 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
1
vote
0answers
83 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
0
votes
1answer
49 views

Limited remote access to a web application [closed]

I would like to set up a very simple node.js web application on raspberry pi and access it remotely, from outside the LAN. There are no other hosts in that LAN with the Raspberry. I only need to ...