Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

40 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
2answers
80 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
4
votes
0answers
93 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
4
votes
0answers
83 views

What's The Easiest Way To Maintain Remote Users Access to a Webapp

Here is a real world case: A chain of high schools (several hundreds) has many websites (~ 3x number of Schools) that are content driven by users (the students). Every school maintains about 2-4 ...
3
votes
0answers
109 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
3
votes
0answers
75 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
2
votes
0answers
102 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
2
votes
0answers
53 views

Storing user's private files on S3 and securing access using signed URLs - good idea?

I will be storing private user's files on S3. The files will be PDFs, possibly containing private financial information. I'm considering letting users directly access the files on S3, without ...
2
votes
0answers
289 views

Minimum set of ACS features to secure remote PCIe devices

According to a Google blog post from 2017, Google has been experimenting with providing raw access to PCIe devices in a remote environment. They set out to discover what Access Control Service ...
2
votes
0answers
495 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
2
votes
0answers
383 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
2
votes
0answers
32 views

Unique assignment of permissions to objects seems to also require the role?

So my understanding of RBAC is that Users have Roles, and Roles have Permissions and there should be a Permission Object mapping. I'm having a bit of a business logic problem though concerning RBAC. ...
2
votes
0answers
213 views

How to access files or getting rights access with NJrat

When I'm using NJrat to control my own computer, I can't delete, open or move some files. Are there some kind of security access I need to stop first? How can I change this to allow full access?
2
votes
1answer
61 views

Terminology (analogy?) for losing control of a secret due to re-sharing

Regarding sharing a password/access/secret to someone... and then you don't have control whether they will also share this on, and potentially it could/will end up publicly known, thus insecure. The ...
1
vote
0answers
29 views

The benefit of JWT refresh token if authorization and resource server are merged?

Is there any benefit in using refresh tokens if your auth and resource server are combined? I understand the benefit when they are separate: The refresh token is never sent to the resource server, ...
1
vote
1answer
908 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
1
vote
0answers
61 views

Hybrid cloud access controls

In a hybrid cloud setup, where we have a cloud component which writes data into an on premise component, is it necessary to have separate access controls between the cloud and on premise? Our ...
1
vote
0answers
56 views

Security model for availability of information

I have read about different security models that ensure the confidentiality and integrity of information such as the Chinese wall (confidentiality), Biba (integrity) and Clark-Wilson (integrity). ...
1
vote
0answers
1k views

What's the difference between Graham-Denning model and Harrison, Ruzzo, Ullman (HRU) model

I have trouble understanding the differences between these models. My understanding: HRU and Graham-Denning are both computer security models that define the interaction between subjects, objects ...
1
vote
0answers
144 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
1
vote
0answers
396 views

How can access to a certain named pipe be denied or logged on Windows Server?

Suppose a system administrator became aware of a service running on their server that both created a named pipe that allowed access by remote clients (e.g., ordinary domain users), and that had an ...
1
vote
0answers
25 views

Restricting allowed app signers

Android requires apps to be signed and since Nougat the signature acctualy guards all the parts of the APK file. However it seems that anyone can sign their app, and verifing the signature would ...
1
vote
0answers
45 views

Content Delivery Security

An application has 2 servers - Server1 and Server2. Server1 stores db and image+video files. Server2 stores a copy of all image+video files. According to the geographical location of a user, if ...
1
vote
0answers
43 views

How to submit scores securely from app that uses only Facebook login?

Our android app only has Facebook login. Here's what happens on the server: A user is created when a POST request is sent using Facebook's user access token in the body. Whenever a user gets created ...
1
vote
1answer
181 views

Linux: Whitelist device file access to programs

Is there a way to allow only a specific program to access a device file (e.g. serial interface) in Linux? Could I maybe create a user that is the only one with access to the file and set that user ...
1
vote
0answers
19 views

Do any visual editors exist for claims-based access control, with several parallel evaluators?

This MSDN video at marker 14:20, describes a scenario where an employee can access a building if They are a valid badge carrying FTE They are in possession of a "sticker of shame", temporary badge ...
1
vote
0answers
39 views

Why doesn't homebrew fix file access problems by itself?

Before I took ownership of /usr/local, "brew link" caused a "/usr/local/..." not writeable. Is there any particular security reason why the program didn't say something like "The operating system won'...
1
vote
0answers
102 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
1
vote
0answers
537 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...
1
vote
0answers
404 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
0
votes
0answers
56 views

Bell-LaPadula permissions

I have to find Read/Write permissions in this exercise. Security Levels = Low < Medium < High Categories = A, B Subject: Alice label(Alice) = (M, {A}) Objects: label(o1) = (L, {A,B}) label(...
0
votes
0answers
46 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
0
votes
0answers
60 views

Sony Access Log (Playstation Network) does not exists

Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv. The purchased items is a ...
0
votes
0answers
23 views

AD Security Group hunting

I have a problem that I have been pondering off and on for a while and I want to see if anyone has a better answer: Is there a way to see where an AD security group is used in an enterprise WITHOUT ...
0
votes
0answers
81 views

Having one OIDC provider and multiple APIs from third parties, how can I federate logins?

If I have an app which authenticates against one OIDC provider eg. Google but then uses the provided id- and access-token to make request against a 1. app-api and 2. a third-party-api using the tokens ...
0
votes
0answers
54 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
0
votes
0answers
52 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
0
votes
0answers
319 views

Filter/Block OpenVPN clients' access to a specific website

As stated in the title I would like to restrict VPN clients' access to specific websites. More specifically, I push the route for 5 websites to the clients via the server config. However, I would ...
0
votes
0answers
79 views

How can security models be relevant to the current environment?

I am trying to understand the Clark-Wilson and Brewer Nash Security Models. After deep research, I couldn't find any solution or idea to find out the relevance of these models in the current ...
0
votes
1answer
214 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...
-1
votes
1answer
179 views

Is Linux protection mechanism implemented using capability lists?

I often get confused whether a particular protection mechanism is ACL or CL by definition. As an example to clarify this, I would like to consider the case of Linux. I believe Linux uses capability ...