Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

0
votes
0answers
35 views

What are the risks resulting from having a switch without strong access control directly facing the Internet?

At home I have a connection to my provider via glass fiber that provides two VLANs: IPTV and Internet. The structure of the network is exactly as shown in the following image, except for the phone ...
2
votes
1answer
95 views

Websites that can connect with Gmail

I'm currently job searching, and came across a site that knows when I'm signed into G-mail. A quick look at the login page shows that I can use my Gmail account to login. Looking at the Google API, ...
1
vote
1answer
19 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
0
votes
2answers
119 views

Why is linux filesystem considered DAC and not MAC

Citing wikipedia's MAC article: With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the ...
0
votes
1answer
25 views

How to securely transmit data (user access info) from node server to react client

Just for a little background. We have a express based server and a React app which uses HTTPS connection with JWT tokens to authenticate user and send appropriate information over Authentication ...
2
votes
3answers
100 views

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security? In a "Policy as Code" system ...
1
vote
1answer
43 views

Addressing availability element of CIA triad using technical controls

When looking at the availability element of the CIA triad, most definitions mention that availability is addressed through ensuring system up-time by using controls such as disaster recovery, business ...
1
vote
1answer
82 views

Am I traceable if the VPN I am using keeps turning on and off?

Let's say Bob is on network A and he decided to use a VPN service. Unfortunately he is using a poor VPN service which keeps turning on and off. But the Active downloads of packets are still ongoing ...
1
vote
1answer
53 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
0
votes
0answers
24 views

Emailed URL authentication

I'm working on an application where I need to grant temporary limited access via email to users who are not going to create accounts/passwords, but I have a small amount of personal information about ...
3
votes
1answer
80 views

Why do capability-based security systems protect against the confused deputy problem?

According to Wikipedia (https://en.wikipedia.org/wiki/Confused_deputy_problem): In information security, the confused deputy problem is often cited as an example of why capability-based security ...
2
votes
2answers
129 views

Separation of duties for user account creation

Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
0
votes
0answers
29 views

Desktop login - Security about private keys

Simplified case of usage: I've been developing a desktop application storing a pair of public and private keys, which are completly encrypted as soon as they are created by a given user password ...
0
votes
0answers
16 views

What is an Entrance REX?

I'm working with the Axis A1001 door controller and the Axis Entry Manager software. The door I'm working on has a REX button, a PIR REX, Wiegand reader, and a mag lock. During the hardware config of ...
1
vote
0answers
27 views

Security model for availability of information

I have read about different security models that ensure the confidentiality and integrity of information such as the Chinese wall (confidentiality), Biba (integrity) and Clark-Wilson (integrity). ...
0
votes
2answers
37 views

How should I interpret, "access controls on the presentation layer are enforced on the server side?

This question is with reference to the OWASP standard (Access control rules on the presentation layer are enforced on the server side - OWASP ASVS 3.0 - 4.9) I'm trying to deeply understand what it ...
1
vote
1answer
29 views

Center for Internet Security Version 6.1 Critical Security Control 16-10

My project is implementing The CIS Critical Security Controls, Version 6.1 Can anyone please give me some advice on how we can address sub-control 16.10 which says..... "Profile each user’s typical ...
3
votes
1answer
93 views

Default value of ACLs mask

This is the question I faced in an interview as a system administrator. If we didn't set the mask value, what is the default value of mask? I was thinking that if we didn't set the mask, it ...
2
votes
1answer
44 views

Does the subject HAVE to dominate the object in order to access the object?

Lets say Paul, is cleared for (TOP SECRET, {A,C}) where top secret is his clearance and A & C privledges. He wants to access a Document classified (Secret,{B,C}).. Top secret trumps Secret but in ...
1
vote
1answer
156 views

Comparison between Firejail and Apparmor

I'd like to understand how Apparmor and Firejail compare to each other: advantages, pros and cons, purposes, similarities, etc. I might be asking to compare apples with oranges, however I've noticed ...
2
votes
1answer
46 views

Data extraction, temporary storage and audit log - Advice needed

At work, we are planning to take down a database for 24 hours. We are not going down the track of creating a "Hot standby", the DB will be completely offline throughout. During the downtime, we would ...
2
votes
2answers
159 views

How to handle refresh tokens

I'm trying to wrap my head around JWT (JSON Web Token) based authentication for securing API endpoints using access tokens. I'm protecting these endpoints by requiring the user to have a valid access ...
0
votes
0answers
86 views

what is the step for converting Bell-LaPadula Model lattice using Access Control Matrix

O1 O2 O3 O4 S1 w r w rw S2 rw r S3 w w r S4 w w w r S5 rw rw ...
26
votes
7answers
5k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
3
votes
3answers
927 views

How to deny access to my server end points ? (PHP)

I've developed some software installed e.g. on www.example.com. It's accessed via an HTML web page. Some HTML buttons can call PHP end points which are also on that domain. I use JWT to secure login. ...
2
votes
1answer
507 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
0
votes
1answer
27 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
3
votes
1answer
63 views

Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github

I have been working on a code review of a project. The source code is publicly available on Github. I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
2
votes
0answers
36 views

Minimum set of ACS features to secure remote PCIe devices

According to a Google blog post, Google has been experimenting with providing raw access to PCIe devices in a remote environment. They set out to discover what Access Control Service features (ACS, ...
1
vote
0answers
344 views

What's the difference between Graham-Denning model and Harrison, Ruzzo, Ullman (HRU) model

I have trouble understanding the differences between these models. My understanding: HRU and Graham-Denning are both computer security models that define the interaction between subjects, objects ...
0
votes
0answers
28 views

File size attribute gets access denied on accessible file

Going nuts on the following access control issue! I've googled high and low, and can't find anything pertinent. Any help appreciated. I have a windows 7 starter edition netbook. It has two users, ...
0
votes
2answers
100 views

Is it acceptable “allowed by default, disallowed for specific data/actions”?

A friend told me that in the agile paradigm it is said that users are allowed by default to do anything but then they are blocked or disallowed to access or do certain identified actions. Just the ...
3
votes
0answers
71 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
1
vote
0answers
48 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
0
votes
1answer
48 views

Limited remote access to a web application [closed]

I would like to set up a very simple node.js web application on raspberry pi and access it remotely, from outside the LAN. There are no other hosts in that LAN with the Raspberry. I only need to ...
3
votes
1answer
266 views

How to get better IAM understanding

I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong. I began with ...
3
votes
1answer
77 views

How should privileged users keep each other in check? [duplicate]

In order to protect systems from insider attacks, companies can apply policies restricting their access. In the case of an employee's termination, the IT department can disable their account before ...
2
votes
0answers
31 views

Access control to allocated buffer [closed]

I have a system which contains a process which allocates memory to other processes from its internal memory buffer , each process that needs memory allocation has to enroll with the allocating process ...
78
votes
4answers
10k views

Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)

There are multiple mechanisms (some now defunct) that allow me to access service A (the Relying Party / RP) using a token granted by service B (the Identity Provider / IdP). Typically these replace a ...
3
votes
1answer
318 views

Are Bell-LaPadula and Biba models used in real big software security design?

I am currently studying both Bell-LaPadula and Biba models, I found this models too theoretical as I see the examples and I can see that there are used for designing particular services that needs ...
1
vote
1answer
122 views

SUID exploit and patch

I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
0
votes
2answers
97 views

Cryptography in simple words anout one idea?

I'm a student and have one challenge about cryptography. I need clear definition or simple definition to better understand cryptography and related security. I’ve been reading lots of material, seeing ...
1
vote
0answers
119 views

Can I use HashiCorp Vault to restrict access to credentials based on CIDR? [closed]

This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet: A python script gets populated by configuration management ...
1
vote
1answer
57 views

What are the security risks of running a daemon as root even though SELinux is enforcing?

On an board running Linux I see a daemon and an utility run under root when started. The SELinux is enforcing for this system. Are there any potential threats of running as root, even if the SELinux ...
4
votes
4answers
256 views

How do large organisations manage access for their Instagram account?

A platform like Facebook has fairly standard access management for Facebook pages - where multiple individual user accounts can be assigned to roles with varying privileges on the Facebook page, and ...
5
votes
1answer
113 views

Is it acceptable for security engineers to have admin access to production servers?

In my organization, our server infrastructure team has historically held all admin access to production servers. We're recently trying to strengthen our security posture, so we have hired several new ...
0
votes
1answer
49 views

How do you handle untrusted software installation / runtime?

If you need to install software from a third party and frequently run it on your PC, but you do not trust the software, although antivirus doesn't rise any flags: Is it possible to install software ...
1
vote
0answers
198 views

How can access to a certain named pipe be denied or logged on Windows Server?

Suppose a system administrator became aware of a service running on their server that both created a named pipe that allowed access by remote clients (e.g., ordinary domain users), and that had an ...
3
votes
1answer
388 views

Webgoat missing function level access control lesson

I've recently installed WebGoat 8.00M12 on my computer and I tried to solve the "Access Control" section for a demonstration in my class. Everything was simple and smooth till I got stuck at the last ...
1
vote
2answers
119 views

Severity and priority rank of Insecure Direct Object Reference bug

Recently, I found bug in an e-commerce web app and I will report it. The bug I found can: delete and edit the favorite products list for all users delete all notifications for all users What ...