Questions tagged [access-control]
A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.
579
questions
0
votes
0
answers
35
views
How do hackers hack into private network device? [duplicate]
As a picture show above, how do hackers use PC0 to hack into PC1? They are in different private network. As far as I know, we can use VPN to communicate two different private networks, so do hackers ...
- 1
0
votes
0
answers
16
views
Permission model for automated infrastructure provisioning
I am trying to secure automatic infrastructure provisioning but I am having a hard time designing a proper access policy that would not create a single point of failure (I tried and failed about a ...
- 101
1
vote
1
answer
303
views
CVSS3 Scope change question
Let's say I have an e-commerce organization. My organization has two security authorities A and B. The authority A manages access to data related to user orders, and the authority B manages access to ...
- 85
0
votes
1
answer
75
views
Is there a problem to store user permissions in the database instead of in a external auth service?
In AWS Cognito we could define a role/permissions as a custom attribute in the user pool, but we could have a User table and a caching database and fetch roles each time the user does a request.
Of ...
0
votes
2
answers
259
views
What is a proper way to prevent parameter tampering and to make parameter secure
I'm developing a HTTP web server. I've used HTTPS as the protocol between client and server but I know that HTTPS can't prevent parameter tampering.
As we know, we can set parameters in URL, in HTTP ...
- 341
0
votes
0
answers
22
views
I want to join our organisation AD with a recently acquired company's AD for federated access. What are the security risks I should consider?
As per the title. What risks and controls should I consider? Are there any questions i need to ask the external party AD before setting up the 'Trust' between the 2 ADs?
- 651
2
votes
1
answer
137
views
Is this considered Privilege Escalation?
Suppose I have an Admin account and a normal user account. There is some functionality that is only accessible to the admin only, like promoting other users. In this scenario, I captured a request ...
1
vote
0
answers
83
views
Is it a good idea to combine DAC with RBAC in this way?
I am not an infosec professional, but I'm working on a project that requires designing and implementing a permission system for a customer. The system the customer proposes is as follows:
Users are ...
- 11
2
votes
1
answer
194
views
Oauth: redirect uri validation [duplicate]
As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/
we should validate the redirect url at 3 points:
at time of app registration
when the auth flow ...
- 283
3
votes
2
answers
101
views
Any obvious pitfalls of modeling access control policies using subject, scope, object?
Context
A small web application with REST API and postgres as db, that has users, documents and teams. A user can do basic CRUD operations on document.
A user is always a part of a team. A team is ...
- 33
1
vote
0
answers
140
views
Link that allows access to documents without authentication
I am testing an app and I found a link in source code that permit me to access a document without authenticating to the application on which that document is present.
The url has a key in the get and ...
- 117
1
vote
1
answer
199
views
How do AppArmor and systemd access controls compare?
This may be comparing chalk with cheese, but I'm wondering how these tools compare: pros and cons, similarities and differences, and situations where you would use one vs the other.
- 143
3
votes
1
answer
316
views
AMD SEV - attack through the hypervisor console
AMD SEV enables creating a trusted encrypted VM where the memory of the whole VM is encrypted using cryptographic keys and features on the CPU and thus not visible to the cloud provider (in theory if ...
- 31
2
votes
1
answer
186
views
Can a subject in Bell-LaPadula model write to other files with different compartments but same classification?
my question is based on the post made Toaster which never got a reply (Bell-LaPadula Model Compartments). In BLP If a subject has a classification level General and compartment Land (General, {Land}), ...
- 31
0
votes
0
answers
31
views
What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?
Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
- 194
0
votes
0
answers
28
views
ACL management (file access) & security
I'll start by saying I'm not sure which stack community I'd ask my question, but I'm looking into using ACLs to manage file access on our server because of specific IT security requirements.
We mostly ...
- 1
2
votes
1
answer
119
views
Linux access control policies sudoers
I'm learning about linux hardening and I'm creating a sudoers file. My idea is to separate things. There will be a user to see log files, another that can sudo to manage system processes, another for ...
- 21
-1
votes
1
answer
68
views
how to fully secure web/mobile/desktop application connected the same backend server [closed]
I have a React/Express application, I want to fully secure it. I'm looking for best practices for these features:
data encryption/decryption
end-to-end communication
access control
role management
...
0
votes
0
answers
16
views
Application to archive a file with multiple passwords [duplicate]
Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords?
For example the password protected archive "example.7z" can be ...
- 1
0
votes
2
answers
227
views
can virtualbox be used to access a locked website without being tracked and without getting detected of using a virtual machine?
I need to open a website where access is denied in my country. I would like to know if virtualbox can be used to solve this issue. my concern is if they can detect that I am using a virtual machine. ...
0
votes
0
answers
80
views
How to secure an API end point when using javascipt
I'm struggling to understand how one can secure an API endpoint using JavaScript.
I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
1
vote
1
answer
144
views
Remote access at the will of my tech support service
My tech support company now has access to my computer 24/7... instead of our old system where I would email them, set an appointment, and then I would grant them permission to access my computer. A ...
- 21
0
votes
1
answer
125
views
RAM as a attack target
What is the simplest or most common method to read a value, for example a text, from the RAM of a personal computer?
What access requirements are necessary for this? Is a search in a hex dump always ...
- 256
0
votes
1
answer
127
views
Github.com token authorisation since 13th August, impractical?
Gihub removed password authentication:
remote: Please see https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ for more information.
fatal: unable to access 'https://...
- 125
5
votes
4
answers
9k
views
How to prevent spoofing of X-Forwarded-For header?
X-Forwarded-For header can capture the IP of the client and use this IP to implement access control.
However, the X-Forwarded-For header can be easily spoofed or manipulated.
How to prevent this or is ...
- 173
0
votes
1
answer
161
views
Creating a unique password for each device/unit of the same product
We are currently working on an IoT product & having a hard time coming up with a strategy to create a unique password for each device/unit.
I do understand that password based on a function of { ...
1
vote
1
answer
307
views
What is the equivalent of "forgot password" in password-less login applications using FIDO2 / Webauthn or later?
I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
- 837
2
votes
2
answers
224
views
Access Control for REST APIs - OWASP recommendation
OWASP states:
Non-public REST services must perform access control at each API
endpoint. Web services in monolithic applications implement this by
means of user authentication, authorisation logic ...
1
vote
1
answer
105
views
Is my website vulnerable if I use Access-Control-Allow-Origin * for a section?
I have a map (openlayers) which is integrated in a website made on wordpress. So, the wordpress has almost nothing to do with the map. The map is only included in an article.
The wordpress site is on ...
- 13
0
votes
1
answer
1k
views
Can my company track my laptop if I've reinstalled the operating system?
I was given a laptop by my company. I reinstalled everything and now I occasionally open Whatsapp web in the background to reply to messages. Most of the times my laptop is connected to the Company's ...
2
votes
3
answers
178
views
Refreshing access token using access token
Is it safe to refresh your access token using your access token (assuming of course it is still valid)?
And, if not, what makes a refresh token that much more special that it is safe to be used as a ...
- 123
0
votes
1
answer
204
views
Use case where MAC and DAC complement each other
We can implement MAC (Mandatory Access Control) and DAC (Discretionary Access Control) together and they can complement each other. My understanding is when MAC is there it overrides everything. Can ...
1
vote
1
answer
256
views
Prevent a remote privilege escalation when the root/admin password is known
Consider the following Linux system:
root account is disabled (passwd -l root, passwd -d root),
there is an account 'admin', with sudo rights,
there is an account 'webservice', with limited ...
- 111
9
votes
2
answers
2k
views
How is MAC useful?
I know what mandatory access control (MAC) is, but I don't see how it helps. Often it seems to be said that if you have something like SELinux or AppArmor enabled you are magically more secure. And ...
- 973
3
votes
2
answers
194
views
Encryption as bijective data masking function
Context
I'm building data lake from scratch within a small team (3-6 data engineers). I want to mask PII data when copying data from prod to dev/test environments.
I'm particularly interested in the ...
- 225
3
votes
1
answer
169
views
Should users be allowed to to login with the same email when an email change is requested but not completed?
I've found a very similar question: Should users be allowed to log in with the same password when a password change is requested but not changed?. But the key difference here is that requesting an ...
- 133
76
votes
8
answers
11k
views
Why is email often used as the ultimate verification?
In many services, email can be used to reset the password, or do something that is sensitive. Sensitive data is also quite often sent to you by email, e.g. long links that enable access to your ...
- 973
1
vote
1
answer
729
views
How does Chromium's sandboxing compare to Firejail's?
I am increasingly being requested to join videoconferences through Zoom, which I don't trust to run on my machine. I understand that there are two common ways of sandboxing this software: you can ...
- 655
0
votes
2
answers
328
views
It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?
To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes.
I noticed that most of the time X ...
- 1,074
0
votes
3
answers
270
views
Is my login script secure – how to improve it?
I have a login system for my website that works as follows:
In the database I have a table called users with the fields user, password and authentication_token.
user gets set manually by request in ...
- 101
3
votes
1
answer
247
views
Encrypting links between registered users and their sensitive data
I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database.
Furthermore, if a user has multiple pieces of sensitive data, ...
- 131
0
votes
1
answer
124
views
How to protect against a user using many different IP addresses and creating many accounts? [closed]
Is it even possible? I have an application that is susceptible of a same person creating many different accounts on different IP addresses. How to fight against this the best? Using 2-step ...
- 461
0
votes
1
answer
2k
views
In what cases people know that I see their stories on instagram or mystalk? [closed]
I don't have an instagram account, but I always look to my friends' profiles on instagram or mystalk and see their stories.
BTW my google account is always signed in when I check their stories on ...
- 103
0
votes
1
answer
87
views
Difference between access control systems that can/can't be compromised without valid credentials?
Take the following examples:
When I run sshd, it can in theory grant access to anything that the process itself has access to, regardless of provided credentials. For example, I could in theory ...
- 103
0
votes
2
answers
1k
views
Is SSH server secure from internet access outside private network?
I have a desktop computer in my home network with SSH server running on it. Using another computer in my private and local network (class C IP addresses: e.g., 192.168.0.2, etc) I sometimes use SSH to ...
- 103
2
votes
2
answers
150
views
Is using EXECUTE AS impersonation for user authentication in a web application a good idea?
I wrote a web application that is using AD authentication (Windows) and has its own authorization module (RBAC-like). Back-end is Microsoft SQL Server.
A DBA on my team is not happy with us using a ...
- 21
0
votes
0
answers
133
views
To prevent BadUSB attacks - can't you just block a connection to the specific vulnerable microcontrollers?
Since only a select amount of amount of microcontrollers in the USBs can be reprogrammed, isn't it just possible to block that certain kinds of microcontroller containing devices?
- 1,546
1
vote
2
answers
119
views
Terminology question - authentication through encryption
I came across a number of somewhat similar solutions, which are based on the knowledge factor related to a symmetric key in particular:
If a party was able to generate correct message authentication ...
- 672
0
votes
1
answer
339
views
Azure Ad B2C Users access resources in other directory
I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
2
votes
1
answer
500
views
Linux security modules (LSM) and reference monitor implementation
as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision.
Furthermore, I think the Linux ...
- 171