Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
0
votes
1answer
36 views

How to secure an offline resource using offline software but with occasional server access?

My application is a (Windows) desktop application that is required to operate fully offline. To enable this, I have a local data cache that keeps a synced copy of server data. How can I secure this ...
1
vote
1answer
46 views

Is it good or bad to use group in sudoers file instead of using aliases?

I have used user groups heavily while designing access control policies. I find user groups very convenient as it's very easy to implement with PAM. Another reason I have organized the users with ...
33
votes
8answers
6k views

If password expiration is applied, should door-lock expiration be applied too?

After reading some topics on here about password expiration, and also after reading this comment, a question arose in my mind: if we apply password expiration for the safety of users, should our door ...
2
votes
2answers
175 views

Why does Windows allow non-parent processes to read/write the memory of a process?

I recently learned that in Windows a process is generally allowed to alter the the memory of another process as long as it is running under the same user. I tried running the following code with ...
1
vote
1answer
73 views

How an AP blocks Admin Page through Wi-Fi connection?

Some home routers (AP) have the ability to block connections to the admin page if it's being accessed through a Wi-Fi connection. In order to login to the admin page you need to get a cable and ...
18
votes
12answers
5k views

Authentication versus Authorisation

I have referred this link and I know that Authentication = login + password (who you are) Authorization = permissions (what you are allowed to do) My question is: Suppose A gets the login id ...
0
votes
0answers
59 views

Sony Access Log (Playstation Network) does not exists

Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv. The purchased items is a ...
0
votes
1answer
34 views

Custom Access control using OAuth 2.0

I'm designing a enterprise infrastructure monitoring application which has customized needs of access control, beyond roles and authorities. The architecture include multiple nodes of REST API being ...
1
vote
0answers
28 views

The benefit of JWT refresh token if authorization and resource server are merged?

Is there any benefit in using refresh tokens if your auth and resource server are combined? I understand the benefit when they are separate: The refresh token is never sent to the resource server, ...
2
votes
0answers
90 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
2
votes
1answer
60 views

Access Control Lists - Why block a port rather than block a protocol?

I am studying for my Security + exam. I have just learned that ACLs can be designed to block ports and/or entire protocols. The book I am reading states an example: "if you want to block HTTP traffic,...
0
votes
2answers
81 views

Access control to anonymous users

What is the formal name -- and description -- of the problem of giving users access to a resource exactly once each while not requiring them to identify themselves? In other words, to have a system ...
1
vote
2answers
258 views

JWT(Json Web Token) Tampering

I'm reading OWASP Top 10 - 2017 The Ten Most Critical Web Application Security Risks, and came across the following risk, under Broken Access Control vulnerabilities: Metadata manipulation, such as ...
4
votes
1answer
139 views

What's the reason of both “Allow-Origin: *” and “Allow-Credentials: true” headers?

MDN says that attempting to use Access-control-allow-origin: * with credentials should result in an error. Taking this into account, why so many major companies' APIs (spotify, twilio, among many ...
3
votes
1answer
184 views

Does Nextcloud installation gives passwordless access to all files by default?

I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, ...
47
votes
10answers
16k views

Global variables and information security

I get the impression that it is a programming best practice to create variables in specific scopes (like a function scope) and avoid global scope to make things more modular and better organized. ...
4
votes
2answers
110 views

How to design an Access Control system that is quick to implement and understand, yet maintainable and flexible enough?

We're currently redesigning our access control system for our SaaS startup (over the past two years it has grown alongside the business and decided to clean it up at this point). The access control ...
37
votes
5answers
14k views

The teacher logged me in as administrator for doing a short task, is the whole system now compromised? [closed]

I worked today with our teacher who logged me into a computer as admin. We had a task that required admin rights. A few seconds later he was talking to other students in our classroom, but I was able ...
0
votes
0answers
23 views

AD Security Group hunting

I have a problem that I have been pondering off and on for a while and I want to see if anyone has a better answer: Is there a way to see where an AD security group is used in an enterprise WITHOUT ...
0
votes
1answer
213 views

What are things we look to find Access Control Database?

Currently Working on HP Fortify Access Control Database category. Source: userId = request.getParameter(Constants.USERID).trim(); Sink: pstm1.setString(3,userId.trim()); I saw the definition ...
0
votes
0answers
47 views

I’ve been scammed! Fake Microsoft tech services [duplicate]

I was under the assumption that my IP address was hacked last night because of this movie website I was on. Thanks to the good people of “stackexchange.com”, I learned that they tried to con me by ...
5
votes
1answer
68 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
1
vote
1answer
70 views

Attribute-based access control standard definition

While reading a number of definitions of attribute-based access control (ABAC), I found that there are two different definitions: Access control decisions are made using the attributes of users, ...
3
votes
3answers
297 views

How do you protect against your IT domain admins accessing your data?

I work at a small company and we use an external company to take care of all our IT needs (a "managed IT service provider"). This includes managing our windows domain, our network, and everything else....
1
vote
1answer
47 views

Why do we need the refresh_token OAuth flow?

In OAuth 2.0, I'm confused about hwy we need a refresh token flow. Per my understanding, when you submit a "refresh_token" grant type, you receive an access token, its expiration, and a refresh token....
0
votes
1answer
72 views

Block SMTP Connection That Doesn't Have Credentials

I am able to do the following and connect successfully without any type of credentials: telnet <IP Address> 25 When I am in I can verfiy emails, send emails, etc. I feel like this is a ...
0
votes
2answers
298 views

What is Cloud KMS? What's it's purpose/benefit of KMS? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)

What is Cloud KMS? What's it's purpose/benefit of KMS? Is there a concrete example of a problem I solve using it? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault) Whenever I've ...
2
votes
0answers
52 views

Storing user's private files on S3 and securing access using signed URLs - good idea?

I will be storing private user's files on S3. The files will be PDFs, possibly containing private financial information. I'm considering letting users directly access the files on S3, without ...
39
votes
8answers
10k views

How can I prevent a user from copying files to another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
1
vote
1answer
84 views

AWS S3 resource access control through IAM permissions or bucket policies?

The way we create buckets in our org and ensure sane ACLs around it is by providing an automated tool (that internally uses Terraform) to provision an S3 bucket. So say when a user requests for a new ...
0
votes
0answers
73 views

Having one OIDC provider and multiple APIs from third parties, how can I federate logins?

If I have an app which authenticates against one OIDC provider eg. Google but then uses the provided id- and access-token to make request against a 1. app-api and 2. a third-party-api using the tokens ...
2
votes
1answer
169 views

How do ISPs send their own pages when a user is trying to access a blocked site?

I know that some ISPs send block pages(like "This site has been blocked because ... ") over HTTP by sending a fake 301/302 redirect. I also know that instead of sending a block page, some ISPs simple ...
0
votes
0answers
53 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
0
votes
1answer
196 views

How is Privileged identity management (PIM) different from privileged access management (PAM)?

I am very confused about those two, I was trying to understand the difference but it all sounds the same from what I read online.
1
vote
1answer
787 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
1
vote
1answer
99 views

Could it be possible to diminish the damage of having one's VPS inspected by the host?

I'm planning to run/have some quite sensitive data on a VPS, however, knowing well that the host could at any time access the data (rare but as long as it could happen in theory, I would very much ...
3
votes
3answers
102 views

RBAC: how to separately scope two resources that have a many-to-many relationship

I'm working on an application that needs access control. Basically, the problem I'm facing is this (heavily simplified): The application has two main sections: Files = File[] Contacts = Contact[] ...
5
votes
2answers
341 views

How to convince users that security is a good thing?

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
2
votes
3answers
161 views

Are there examples of implementing security as a side effect?

I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
69
votes
10answers
16k views

Why avoid shared user accounts?

I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
0
votes
1answer
216 views

Question about access control with RBAC and DAC

Here is the problem A company has 1250 employees and the employees have been trained to handle 4 job duties: Clerks: 1200 of the employees have been approved to work as clerks. To do ...
1
vote
0answers
59 views

Hybrid cloud access controls

In a hybrid cloud setup, where we have a cloud component which writes data into an on premise component, is it necessary to have separate access controls between the cloud and on premise? Our ...
0
votes
0answers
85 views

How does SupportsCredentials, Access-Control-Allow-Credentials, and CORS Origin=* relate?

I'm investigating CSRF implementations in ASP.NET, MVC, WebAPI the relationship between the headers that are sent: A Javascript client call of XMLHttpRequest.withCredentials A server response of ...
1
vote
3answers
67 views

Is “permission (role) granting” safer, than giving direct access to primary account?

The role assignment is excellent feature over the various platforms (Google, GitHub, Facebook, etc. ). However, I've been thinking about a specific security "threat" which might arise from that. Let'...
0
votes
0answers
50 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
0
votes
0answers
294 views

Filter/Block OpenVPN clients' access to a specific website

As stated in the title I would like to restrict VPN clients' access to specific websites. More specifically, I push the route for 5 websites to the clients via the server config. However, I would ...
1
vote
1answer
57 views

How to track network file share accesses on workstations

I shared a folder created in my C drive with a colleague over the network and he was able to access it. Is there any log that will track this kind of activity? I am aware of Windows Security Event ID ...
2
votes
1answer
45 views

What is the impact of leaving disabled root key on AWS instance?

I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance. When asked to remove the root key, he said it's disabled now so what's the ...
1
vote
1answer
70 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...