Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

119
votes
12answers
23k views

Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)

I just got a new job at a medium-sized (~100 employees) company and one of the first things I was told is that I cannot use my own computer, because I need to be able to connect to their network, ...
78
votes
8answers
17k views

Risks of giving developers admin rights to their own PCs

I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
78
votes
4answers
10k views

Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)

There are multiple mechanisms (some now defunct) that allow me to access service A (the Relying Party / RP) using a token granted by service B (the Identity Provider / IdP). Typically these replace a ...
68
votes
10answers
14k views

Why avoid shared user accounts?

I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
64
votes
7answers
42k views

Comparison Between AppArmor and Selinux

I was reviewing several different comparisons of AppArmor and SELinux which include: Why I Like AppArmor More Than SELinux SELinux and AppArmor: An Introductory Comparison From these articles I ...
58
votes
1answer
54k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...
56
votes
11answers
9k views

Why is it bad to connect internal systems to the Internet?

We have an intranet system we use to book, track and process invoices for our core business. My boss would like to move this system to the Internet to make it "accessible everywhere". However, I feel ...
55
votes
4answers
12k views

Are there DRM techniques to effectively prevent pirating?

A question on Skeptics.SE asks whether current DRM techniques effectively prevent pirating: Is DRM effective? The question for IT Security is: Can DRM be made effective, and are there any examples? ...
54
votes
8answers
5k views

I'm an IT consultant. Should I discourage a client from telling me his password?

I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
50
votes
8answers
18k views

Why am I allowed to access protected Windows files when I boot Ubuntu from USB?

How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C ...
50
votes
5answers
10k views

How does a country block its citizens from accessing a site?

Following Turkey's recent social site blocks, I am wondering how can you efficiently accomplish that as a country. Similar for a big company. Blocking IPs → easy to circumvent, (proxys, tunnels, etc)...
49
votes
1answer
244k views

Why can you bypass restricted WiFis by adding “?.jpg” to the URL?

I recently read an article on Hacking a commercial airport WLAN. It's basically about circumventing paid airport WiFi redirections (they redirect you to a certain URL when you type something in the ...
43
votes
8answers
8k views

Is it a bad idea to bypass login wall for a specified IP address?

I have a website that is available on the public internet. The website requires authenticated login before any of the content can be accessed. I've been asked if I can remove the login wall for users ...
32
votes
6answers
94k views

Is it possible for a hacker to download a php file without executing it first?

I have a php website where everything is in the public_html\ folder, including an includes folder with config and classes. I told my developer to move it away from public folder but he said there is ...
31
votes
20answers
6k views

How can I prevent my kids from bypassing my computer restrictions?

My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions: Can this damage my computer or corrupt my files? (I have lots of pictures) Is ...
31
votes
5answers
176k views

Can someone steal money from my bank account if they know my IBAN and personal details?

To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
30
votes
4answers
4k views

Can the root user be removed from a *nix system to prevent privilege-escalation?

Once a *nix system is properly configured and hardened, is it a conceivable strategy to remove all super user/root users? Are there benefits to removing root from a system altogether to prevent super-...
29
votes
11answers
31k views

Prevent my site from being copied

Is it possible to protect my site from HTTrack Website Copier or any similar program? Without setting a max number of HTTP request from users.
29
votes
5answers
9k views

Is Linux really that secure, with only root password denying external access?

While I was searching online for information about Linux security, the most typical explanation was: Linux is secure, because the root password is required to access the kernel and install new ...
26
votes
7answers
5k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
26
votes
7answers
4k views

Reading physical memory frame previously owned by another process to read contents of its memory page

I had a conversation with @anger32 who states that zeroing a physical memory page frame when passing the page backed by that frame to another process is not the responsibility of OSes like Windows and ...
25
votes
7answers
4k views

My company policy states I must put all passwords in a password safe shared with management. Is this secure?

As the title says, my company has a policy that all passwords to e.g. our workstations and server logins must be stored in an online safe. I won't say which one but there are some out there you can ...
24
votes
6answers
30k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
24
votes
4answers
19k views

Router password vs MAC filtering?

I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
23
votes
7answers
3k views

How can I publish data from a private network without adding a bidirectional link to another network

I was just wondering how I could build a private network where it is physically impossible to gain access from outside but still have the option to publish data to some remote server. As an example: ...
22
votes
7answers
11k views

If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker? [closed]

In other words, how easy is it to break into Windows without having the passwords for any of the users configured in the computer?
22
votes
4answers
8k views

Protection against account lockout DoS

Any ideas on how to protect against the following scenario? Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
22
votes
4answers
2k views

Securing an area both physically and technically

I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security". Essentially this means that if any pictures/information/files/etc. of the product were ...
21
votes
9answers
14k views

In Healthcare IT, is a “break glass” mode to bypass access controls commonly required?

I've seen referenced in literature the need to have a "break glass" mode in Healthcare IT applications. In this mode, the access controls in an application can be bypassed for an emergency when it is ...
19
votes
5answers
53k views

Better techniques than url parameter encryption

I'm a programmer working on an application where the only choice/vs/deadline was to implement symmetric encryption on url parameter values. The data is insensitive in nature, but we needed to prevent ...
18
votes
3answers
95k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
18
votes
4answers
6k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership? For example: Bob is a doctor and has the role ...
17
votes
4answers
2k views

Server for School Coding Assignments

An introductory C++ course is offered every year in our university. In order for students to code in C++ and submit their assignments, we give them shell access to a Linux server. They use ssh to log ...
17
votes
3answers
11k views

Is there a secure way to have a publicly facing terminal server?

TL;DR We are looking at opening port 3389 for a terminal server all the advice I’ve seen is that its suicidal but without good explanations as to why. Is it really that bad? We are looking at setting ...
16
votes
2answers
23k views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
16
votes
2answers
3k views

Why do some Java APIs bypass standard SecurityManager checks?

In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
16
votes
3answers
1k views

Risks of Mullions in High Security Areas

I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
15
votes
2answers
2k views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...
14
votes
1answer
1k views

Are there Linux rootkits circulating that directly modify the kernel (without modules)?

It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
13
votes
3answers
688 views

Given SSH access, what should I do to protect a server and monitor (dangerous) user actions?

Context: Small business, mostly a software house for web applications but also some desktop software. Many external collaborators, so a variety of outside users with access to the servers. Single ...
13
votes
2answers
3k views

Best practices for implementation of role-based access control in healthcare applications

Amongst the open source EMRs, which ones may be good to learn from? Any references I can go to as a starting point?
13
votes
2answers
42k views

MAC vs DAC vs RBAC

Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
12
votes
3answers
10k views

Prevent acccess to the C drive on Windows systems

Is it possible to prevent regular users from accessing the C drive via Windows Explorer? they should be allowed to execute certain programs. This is to ensure that employees cannot steal or copy out ...
12
votes
3answers
18k views

What are the advantages/disadvantages of attribute-based access control?

An example attribute would be "employee is currently located in the US" and is trying to access a document that requires the person to be accessing the document in US territory.
12
votes
2answers
6k views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
12
votes
3answers
300 views

Different MySQL Users Security Benefits

Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
11
votes
7answers
44k views

How to prevent restrict access to a web application to authorized devices only?

I have developed an MVC web app. Right now, the client using this app in office area. The client has requested that no one should use this app on any device except the office's PC/tablets. Now ...
11
votes
2answers
757 views

How is UAC a security improvement?

What does User Account Control on Windows offer in terms of security? It's just an extra click to potentially run a virus.
11
votes
1answer
1k views

How to prepare for protecting identity after death?

In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
10
votes
7answers
3k views

Alternative to VPN

We have a network that is completely closed to the outside world. It needs to be. Problem is we need to remote into a server on this network once in a blue moon for diagnostics. We've discussed ways ...