Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

Filter by
Sorted by
Tagged with
0
votes
0answers
59 views

How to secure my organisations codebase? [closed]

We are a small tech startup. Currently, we have the entire codebase hosted in a private GitHub repository. Is this a good solution going forward (as we're planning to expand the team rapidly) or ...
0
votes
0answers
15 views

Determine path of app prompting for access to macOS keychain item [migrated]

Context On macOS, when an app requests permission to access a keychain item, a prompt like this is presented: git-credential-osxkeychain wants to use your confidential information stored in "...
0
votes
1answer
73 views

What is the equivalent of “forgot password” in password-less login applications using FIDO2 / Webauthn or later?

I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
0
votes
0answers
33 views

Multiple accounts per user for different devices

I'm dealing with a system which users will access from multiple devices, with potentially different components of the system being used via each device. For example, a user may be accessing component ...
2
votes
2answers
66 views

Access Control for REST APIs - OWASP recommendation

OWASP states: Non-public REST services must perform access control at each API endpoint. Web services in monolithic applications implement this by means of user authentication, authorisation logic ...
1
vote
1answer
59 views

Is my website vulnerable if I use Access-Control-Allow-Origin * for a section?

I have a map (openlayers) which is integrated in a website made on wordpress. So, the wordpress has almost nothing to do with the map. The map is only included in an article. The wordpress site is on ...
0
votes
1answer
132 views

Can my company track my laptop if I've reinstalled the operating system?

I was given a laptop by my company. I reinstalled everything and now I occasionally open Whatsapp web in the background to reply to messages. Most of the times my laptop is connected to the Company's ...
1
vote
1answer
45 views

Refreshing access token using access token

Is it safe to refresh your access token using your access token (assuming of course it is still valid)? And, if not, what makes a refresh token that much more special that it is safe to be used as a ...
0
votes
1answer
31 views

Use case where MAC and DAC complement each other

We can implement MAC and DAC together and they can complement each other. My understanding is when MAC is there it overrides everything. Can anyone help me understand how they can work together?
1
vote
1answer
71 views

Prevent a remote privilege escalation when the root/admin password is known

Consider the following Linux system: root account is disabled (passwd -l root, passwd -d root), there is an account 'admin', with sudo rights, there is an account 'webservice', with limited ...
9
votes
2answers
2k views

How is MAC useful?

I know what mandatory access control (MAC) is, but I don't see how it helps. Often it seems to be said that if you have something like SELinux or AppArmor enabled you are magically more secure. And ...
3
votes
2answers
100 views

Encryption as bijective data masking function

Context I'm building data lake from scratch within a small team (3-6 data engineers). I want to mask PII data when copying data from prod to dev/test environments. I'm particularly interested in the ...
0
votes
0answers
35 views

Bell-LaPadula looking for real code example

I cannot find a single code example of Bell-LaPadula security model. There are pleanty of questions but none got concluded. Does anyone have a clear example in any language that demonstrate it?
3
votes
1answer
92 views

Should users be allowed to to login with the same email when an email change is requested but not completed?

I've found a very similar question: Should users be allowed to log in with the same password when a password change is requested but not changed?. But the key difference here is that requesting an ...
74
votes
8answers
10k views

Why is email often used as the ultimate verification?

In many services, email can be used to reset the password, or do something that is sensitive. Sensitive data is also quite often sent to you by email, e.g. long links that enable access to your ...
0
votes
1answer
166 views

How does Chromium's sandboxing compare to Firejail's?

I am increasingly being requested to join videoconferences through Zoom, which I don't trust to run on my machine. I understand that there are two common ways of sandboxing this software: you can ...
0
votes
2answers
69 views

It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?

To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes. I noticed that most of the time X ...
0
votes
3answers
157 views

Is my login script secure – how to improve it?

I have a login system for my website that works as follows: In the database I have a table called users with the fields user, password and authentication_token. user gets set manually by request in ...
2
votes
1answer
130 views

Encrypting links between registered users and their sensitive data

I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database. Furthermore, if a user has multiple pieces of sensitive data, ...
0
votes
1answer
73 views

How to protect against a user using many different IP addresses and creating many accounts? [closed]

Is it even possible? I have an application that is susceptible of a same person creating many different accounts on different IP addresses. How to fight against this the best? Using 2-step ...
0
votes
1answer
1k views

In what cases people know that I see their stories on instagram or mystalk? [closed]

I don't have an instagram account, but I always look to my friends' profiles on instagram or mystalk and see their stories. BTW my google account is always signed in when I check their stories on ...
0
votes
0answers
61 views

security implications of libvirt socket access

In most Linux distributions it is possible to manage virtual machines as a regular user if that user has access to /run/libvirt/libvirt-sock and is a member of the libvirt group. I understand that we ...
0
votes
1answer
44 views

Difference between access control systems that can/can't be compromised without valid credentials?

Take the following examples: When I run sshd, it can in theory grant access to anything that the process itself has access to, regardless of provided credentials. For example, I could in theory ...
0
votes
2answers
242 views

Is SSH server secure from internet access outside private network?

I have a desktop computer in my home network with SSH server running on it. Using another computer in my private and local network (class C IP addresses: e.g., 192.168.0.2, etc) I sometimes use SSH to ...
0
votes
0answers
45 views

Break-Glass Access Control Systems for Medical Devices in Usage

I am looking for information on break-glass access control systems for medical devices that are in actual usage at the moment. I have already read a bunch of papers on this, e.g. papers on cloakers, ...
0
votes
1answer
70 views

EXECUTE AS impersonation

I wrote a web application that is using AD authentication (Windows) and has it's own authorization module (RBAC like). Backend is SQL Server. A DBA on my team is not happy with us using a service ...
0
votes
0answers
64 views

To prevent BadUSB attacks - can't you just block a connection to the specific vulnerable microcontrollers?

Since only a select amount of amount of microcontrollers in the USBs can be reprogrammed, isn't it just possible to block that certain kinds of microcontroller containing devices?
1
vote
2answers
72 views

Terminology question - authentication through encryption

I came across a number of somewhat similar solutions, which are based on the knowledge factor related to a symmetric key in particular: If a party was able to generate correct message authentication ...
0
votes
1answer
78 views

Azure Ad B2C Users access resources in other directory

I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
0
votes
0answers
48 views

Low-Power Keyless Entry

When I get within a meter of my car with the key in my pocket, the door unlocks automatically. A standard 200mAh 3V coin cell powers the key for about two years. To think about this easily, let me ...
0
votes
1answer
124 views

Linux security modules (LSM) and reference monitor implementation

as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision. Furthermore, I think the Linux ...
1
vote
1answer
72 views

Does UHF RFID implement any security at all?

Feel free to correct my below logic. As far as I can tell, HF RFID tags (specifically I've tested MiFare Classic 1kb) have a 48-bit encryption key (default to 0xFFFFFFFFFFFF or something) to protect ...
0
votes
1answer
118 views

Lateral movement while on VPN [closed]

Now that everyone is working from home using VPN, if infected by any malware, is lateral movement possible?
2
votes
0answers
211 views

How do EDR prevent you from uninstalling even as local admin?

I have an CrowdStrike EDR and it seems like the only way to disable this on all OS is to provide maintenance-token or ask CrowdStrike to disable the defences so you can uninstall it. I also have a ...
1
vote
1answer
78 views

How to implement MySQL query fo RBAC authorization with fine grained business restrictions in role?

When implementing an authorization system like RBAC/DAC, or XACML, or the AWS IAM authorization model, I see that I can't totally decouple business logic from authorization when there are fine-grained ...
0
votes
0answers
56 views

Devs running IDE's remotely…risks and how to remediate

I have a few developers who - well, let's just say I don't have much faith in their operational security. Time was, in the pre-COVID world, it was well understood that they didn't run IDEs directly ...
1
vote
1answer
110 views

How can we limit access to a single computer?

We would like to limit access to our web servers (and eventually other services on the computer) to individuals that have been authorized access. Of course we don't trust passwords so we think ...
0
votes
0answers
78 views

Random URLs to hide assets [duplicate]

Say I own a domain name www.example.com and I'd like to host some resources on it, but being reasonably hidden from the public. Since a 256 bits has a sufficiently large entropy to prevent an ...
0
votes
0answers
94 views

Is there any Windows HIPS software that supports file and registry access control?

I Have been using COMODO Firewall and HIPS for many years, which can block writes and executes but not reads. My threat model has changed to include spyware with trusted digital signature, which by ...
3
votes
1answer
174 views

Risk around “Allow log on locally” for Domain Service Accounts

My organisation mandated that Windows Domain Service accounts internally should not have the "Allow log on locally" permission, and essentially be non-interactive. What exactly is the potential risk ...
1
vote
1answer
52 views

Access-Control-Allow-Origin and security behind it [duplicate]

I have some troubles to understand how the header "Access-Control-Allow-Origin" can really be secure. Let me explain what I have in mind: Let's say I have an API on api.contoso.com setting this ...
-1
votes
1answer
49 views

Automatically reconfigure router when it is reset

Is it possible to automatically reconfigure a router when the router is reset? My 13-year old son is resetting the router to bypass time controls (set to go off at midnight). I can configure the ...
2
votes
1answer
66 views

Can linux abstract sockets using a psk as name be found by another user?

If an abstract unix socket is named "\0some random secret", can it be guessed or retrieved somehow from the abstract socket namespace beyond using brute force? Are there more security related ...
2
votes
1answer
6k views

“X-Original-URL” and “X-Rewrite-URL” Related Vulnerabilities

I am going through the Burpsuite Academy Training on Access Control and I came across a section I still don't fully understand. In their reading, they explain: Some application frameworks support ...
0
votes
4answers
131 views

Does routing internet traffic via VPN through a company proxy gain any more security?

There is currently an ongoing discussion in our company about what security measures to put in place regarding workstation access to the company network and the internet. Situation: Employees have ...
2
votes
0answers
60 views

Concrete example of how can Access-Control-Allow-Origin:* cause security risks?

I have done some research but have not found an absolute answer to my specific question. I understand the basic concept of how this header will allow or disallow website A from sending request and ...
1
vote
1answer
1k views

Block WireGuard clients' access to specific websites

I have installed a WireGuard VPN server on a Raspberry Pi (running Raspbian) using PiVPN and I would like to either block the VPN clients to access specific websites (i.e. block them access https://...
1
vote
1answer
116 views

Why do we need security measure likes control flow integrity and buffer overflow guard if we have good access control protocol in place?

Reading into information security, I noticed two branches. Access control when communication with external device by using some type of cryptographic authentication and encryption mechanism and things ...
1
vote
2answers
226 views

Does turning off my modem before leaving home significantly improve security?

Like many, most of my time is spent away from home: at work, the gym, out socializing, etc. I'd estimate I use my internet a few hours a night. I never turn my modem off unless I travel for longer ...
1
vote
1answer
392 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...

1
2 3 4 5
12