Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

Filter by
Sorted by
Tagged with
0
votes
2answers
97 views

Access control to anonymous users

What is the formal name -- and description -- of the problem of giving users access to a resource exactly once each while not requiring them to identify themselves? In other words, to have a system ...
1
vote
1answer
94 views

Why do we need security measure likes control flow integrity and buffer overflow guard if we have good access control protocol in place?

Reading into information security, I noticed two branches. Access control when communication with external device by using some type of cryptographic authentication and encryption mechanism and things ...
3
votes
3answers
130 views

AWS S3 resource access control through IAM permissions or bucket policies?

The way we create buckets in our org and ensure sane ACLs around it is by providing an automated tool (that internally uses Terraform) to provision an S3 bucket. So say when a user requests for a new ...
1
vote
2answers
82 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
9
votes
2answers
9k views

How to handle refresh tokens

I'm trying to wrap my head around JWT (JSON Web Token) based authentication for securing API endpoints using access tokens. I'm protecting these endpoints by requiring the user to have a valid access ...
1
vote
2answers
170 views

Does turning off my modem before leaving home significantly improve security?

Like many, most of my time is spent away from home: at work, the gym, out socializing, etc. I'd estimate I use my internet a few hours a night. I never turn my modem off unless I travel for longer ...
5
votes
2answers
78 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
0
votes
0answers
54 views

Bell-LaPadula permissions

I have to find Read/Write permissions in this exercise. Security Levels = Low < Medium < High Categories = A, B Subject: Alice label(Alice) = (M, {A}) Objects: label(o1) = (L, {A,B}) label(...
0
votes
3answers
10k views

Prevent a server side script from a direct URL access

There is a server side script written in php(say backend_file.php) or coldfusion(say backend_file.cfm). Lets say, i am using Apache and I have a sample web folder (on my Localhost) like: ...
3
votes
1answer
8k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
1
vote
1answer
181 views

Linux: Whitelist device file access to programs

Is there a way to allow only a specific program to access a device file (e.g. serial interface) in Linux? Could I maybe create a user that is the only one with access to the file and set that user ...
1
vote
1answer
893 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
1answer
306 views

What are the risks resulting from having a switch without strong access control directly facing the Internet?

At home I have a connection to my provider via glass fiber that provides two VLANs: IPTV and Internet. The structure of the network is exactly as shown in the following image, except for the phone ...
0
votes
1answer
650 views

Difference between Non-discretionary and Role-based Access control?

What's the difference between Non-discretionary access control and Role-based Access Control? In CISSP book both mentioned in the different paragraph as in different entity. But In some other place (...
0
votes
0answers
43 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
0
votes
3answers
92 views

How to securely transmit data (user access info) from node server to react client

Just for a little background. We have a express based server and a React app which uses HTTPS connection with JWT tokens to authenticate user and send appropriate information over Authentication ...
0
votes
1answer
38 views

How to secure an offline resource using offline software but with occasional server access?

My application is a (Windows) desktop application that is required to operate fully offline. To enable this, I have a local data cache that keeps a synced copy of server data. How can I secure this ...
1
vote
1answer
62 views

Attribute certificate to model subject-object-action for access control

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on ...
6
votes
1answer
4k views

Windows mandatory access control: How to remove “mandatory level” label from the file?

1) How to remove "mandatory level" label from the file? I have two files, for the first one icacls returns Mandatory Label\Medium Mandatory Level:(NW) for the second icacls doesn't return anything ...
3
votes
1answer
1k views

I'm using a Cisco ASA as a VPN endpoint. Where do the VPN clients get firewalled?

I've got this ASA in front of a network that I didn't set up. It's been configured with the clicky GUI (the ASDM), not the CLI, but I'm willing to use the CLI if it makes more sense. One of the ...
1
vote
1answer
46 views

Is it good or bad to use group in sudoers file instead of using aliases?

I have used user groups heavily while designing access control policies. I find user groups very convenient as it's very easy to implement with PAM. Another reason I have organized the users with ...
33
votes
8answers
6k views

If password expiration is applied, should door-lock expiration be applied too?

After reading some topics on here about password expiration, and also after reading this comment, a question arose in my mind: if we apply password expiration for the safety of users, should our door ...
66
votes
8answers
50k views

Comparison Between AppArmor and Selinux

I was reviewing several different comparisons of AppArmor and SELinux which include: Why I Like AppArmor More Than SELinux SELinux and AppArmor: An Introductory Comparison From these articles I ...
2
votes
2answers
182 views

Why does Windows allow non-parent processes to read/write the memory of a process?

I recently learned that in Windows a process is generally allowed to alter the the memory of another process as long as it is running under the same user. I tried running the following code with ...
1
vote
2answers
3k views

Rights vs permissions vs privileges

I have to write a node module for handling role-based access control. Users are stored in database, there are user groups, and there are system assets or functionality that users and groups can be ...
6
votes
3answers
10k views

Role-Based Access Control Disadvantages

According to NIST, RBAC models are the most widely used schemes among enterprises of 500 or more. What happens if the size of the enterprises are much larger in number of individuals involved. In ...
10
votes
3answers
5k views

What's the difference between an access control method, security model, and security policy?

I'm studying for the CISSP exam and I'm getting confused about the differences between access control methods, security models, and security policies. When I was originally studying Mandatory Access ...
1
vote
1answer
74 views

How an AP blocks Admin Page through Wi-Fi connection?

Some home routers (AP) have the ability to block connections to the admin page if it's being accessed through a Wi-Fi connection. In order to login to the admin page you need to get a cable and ...
7
votes
3answers
7k views

Bell-LaPadula imlementation example

I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example. I understand how the model works, but I have difficulties implementing it in a programming language (...
18
votes
12answers
5k views

Authentication versus Authorisation

I have referred this link and I know that Authentication = login + password (who you are) Authorization = permissions (what you are allowed to do) My question is: Suppose A gets the login id ...
8
votes
3answers
4k views

Restrict network access for a single process with SELinux or AppArmor

I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with ...
0
votes
0answers
60 views

Sony Access Log (Playstation Network) does not exists

Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv. The purchased items is a ...
5
votes
1answer
2k views

RBAC0 RBAC1 RBAC2 RBAC3 — What do they mean?

I am familiar with the concept of role-based access control but have heard the terms RBAC0 etc. being thrown around. What do these really mean? I found this quote on a NIST website: In 1996, Sandhu,...
0
votes
1answer
34 views

Custom Access control using OAuth 2.0

I'm designing a enterprise infrastructure monitoring application which has customized needs of access control, beyond roles and authorities. The architecture include multiple nodes of REST API being ...
1
vote
1answer
81 views

Bell LaPadula with Empty Set

I've been answering some questions about the Bell LaPadula model in my book, but I don't seem to get the correct answer on b). Below I've tried to explain my thought process on how I've attemped to ...
11
votes
1answer
726 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
1
vote
0answers
29 views

The benefit of JWT refresh token if authorization and resource server are merged?

Is there any benefit in using refresh tokens if your auth and resource server are combined? I understand the benefit when they are separate: The refresh token is never sent to the resource server, ...
2
votes
0answers
102 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
2
votes
1answer
63 views

Access Control Lists - Why block a port rather than block a protocol?

I am studying for my Security + exam. I have just learned that ACLs can be designed to block ports and/or entire protocols. The book I am reading states an example: "if you want to block HTTP traffic,...
1
vote
2answers
324 views

JWT(Json Web Token) Tampering

I'm reading OWASP Top 10 - 2017 The Ten Most Critical Web Application Security Risks, and came across the following risk, under Broken Access Control vulnerabilities: Metadata manipulation, such as ...
1
vote
1answer
59 views

How to track network file share accesses on workstations

I shared a folder created in my C drive with a colleague over the network and he was able to access it. Is there any log that will track this kind of activity? I am aware of Windows Security Event ID ...
3
votes
1answer
188 views

Does Nextcloud installation gives passwordless access to all files by default?

I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, ...
4
votes
1answer
162 views

What's the reason of both “Allow-Origin: *” and “Allow-Credentials: true” headers?

MDN says that attempting to use Access-control-allow-origin: * with credentials should result in an error. Taking this into account, why so many major companies' APIs (spotify, twilio, among many ...
47
votes
10answers
16k views

Global variables and information security

I get the impression that it is a programming best practice to create variables in specific scopes (like a function scope) and avoid global scope to make things more modular and better organized. ...
2
votes
0answers
289 views

Minimum set of ACS features to secure remote PCIe devices

According to a Google blog post from 2017, Google has been experimenting with providing raw access to PCIe devices in a remote environment. They set out to discover what Access Control Service ...
4
votes
2answers
119 views

How to design an Access Control system that is quick to implement and understand, yet maintainable and flexible enough?

We're currently redesigning our access control system for our SaaS startup (over the past two years it has grown alongside the business and decided to clean it up at this point). The access control ...
0
votes
1answer
137 views

Packet Filter with Access Control List

Can anyone explain how to read and understand row 1,2 and 3? My understanding for row 1 is : If any inside packets want to go to outside via any source port to destination port number 80 using HTTP ...
4
votes
1answer
5k views

How to determine which program accessed the Mac Camera?

The green light on my laptop's camera just flashed on and then off after 1 second. I am extremely concerned about this since I am not running any programs which could have enabled the camera. I ...
22
votes
10answers
15k views

In Healthcare IT, is a “break glass” mode to bypass access controls commonly required?

I've seen referenced in literature the need to have a "break glass" mode in Healthcare IT applications. In this mode, the access controls in an application can be bypassed for an emergency when it is ...
37
votes
5answers
14k views

The teacher logged me in as administrator for doing a short task, is the whole system now compromised? [closed]

I worked today with our teacher who logged me into a computer as admin. We had a task that required admin rights. A few seconds later he was talking to other students in our classroom, but I was able ...

1 2 3 4 5 11