Skip to main content

Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

Filter by
Sorted by
Tagged with
60 votes
4 answers
16k views

Are there DRM techniques to effectively prevent pirating?

A question on Skeptics.SE asks whether current DRM techniques effectively prevent pirating: Is DRM effective? The question for IT Security is: Can DRM be made effective, and are there any examples? ...
MrHen's user avatar
  • 703
33 votes
11 answers
41k views

Prevent my site from being copied

Is it possible to protect my site from HTTrack Website Copier or any similar program? Without setting a max number of HTTP request from users.
h4ck3r's user avatar
  • 464
34 votes
5 answers
239k views

Can someone steal money from my bank account if they know my IBAN and personal details?

To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
Gess's user avatar
  • 341
32 votes
20 answers
8k views

How can I prevent my kids from bypassing my computer restrictions?

My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions: Can this damage my computer or corrupt my files? (I have lots of pictures) Is ...
user avatar
8 votes
1 answer
2k views

Concrete example of how can Access-Control-Allow-Origin:* cause security risks?

I have done some research but have not found an absolute answer to my specific question. I understand the basic concept of how this header will allow or disallow website A from sending request and ...
SamTest's user avatar
  • 715
80 votes
4 answers
11k views

Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)

There are multiple mechanisms (some now defunct) that allow me to access service A (the Relying Party / RP) using a token granted by service B (the Identity Provider / IdP). Typically these replace a ...
lofidevops's user avatar
  • 3,610
77 votes
1 answer
71k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...
AviD's user avatar
  • 73.4k
15 votes
2 answers
26k views

How to handle refresh tokens

I'm trying to wrap my head around JWT (JSON Web Token) based authentication for securing API endpoints using access tokens. I'm protecting these endpoints by requiring the user to have a valid access ...
Sam's user avatar
  • 253
2 votes
1 answer
2k views

Is a long, random string in a URL considered adequate protection from unauthorised access? [duplicate]

I have recently had to submit a number of confidential PDF documents to a website. These documents contain more than enough information to use in identity theft, and I can conceive how others using ...
Cybergibbons's user avatar
  • 1,251
1 vote
2 answers
1k views

Preventing malicious usage from users with access tokens

So I have a web page running a JavaScript application, and a web service that the application makes HTTP PUT requests against. The service uses access tokens to verify the user’s identity, but now I’m ...
C. Russell's user avatar
124 votes
12 answers
25k views

Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)

I just got a new job at a medium-sized (~100 employees) company and one of the first things I was told is that I cannot use my own computer, because I need to be able to connect to their network, ...
Marcus McLean's user avatar
82 votes
8 answers
21k views

Risks of giving developers admin rights to their own PCs

I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
carolineggordon's user avatar
13 votes
8 answers
67k views

How to restrict access to a web application to authorized devices only?

I have developed an MVC web app. Right now, the client using this app in office area. The client has requested that no one should use this app on any device except the office's PC/tablets. Now ...
bnil's user avatar
  • 305
9 votes
2 answers
6k views

Bell-LaPadula and Biba Together

Theoretically, could the Bell-Lapaluda security model be implemented with the Biba integrity model in an Operating System? Or do are they mutually exclusive? [Edit: Follow up from this question on ...
Rose Kunkel's user avatar
28 votes
7 answers
5k views

Reading physical memory frame previously owned by another process to read contents of its memory page

I had a conversation with @anger32 who states that zeroing a physical memory page frame when passing the page backed by that frame to another process is not the responsibility of OSes like Windows and ...
KOLANICH's user avatar
  • 900
27 votes
4 answers
9k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to data ownership? For example: Bob is a doctor and has the role ...
Jacco's user avatar
  • 7,712
25 votes
7 answers
4k views

How can I publish data from a private network without adding a bidirectional link to another network

I was just wondering how I could build a private network where it is physically impossible to gain access from outside but still have the option to publish data to some remote server. As an example: ...
Klamann's user avatar
  • 513
24 votes
4 answers
12k views

Protection against account lockout DoS

Any ideas on how to protect against the following scenario? Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
Josh Brower's user avatar
  • 1,387
15 votes
2 answers
26k views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
unknownprotocol's user avatar
13 votes
2 answers
1k views

How is UAC a security improvement?

What does User Account Control on Windows offer in terms of security? It's just an extra click to potentially run a virus.
Moshe's user avatar
  • 1,861
8 votes
3 answers
4k views

Practical non-government uses of Biba, Bell-LaPadula, etc. models

For example, the Biba model is now hanging out in current versions of Windows. Things downloaded from the Internet are tagged as such. Internet (low) stuff can't alter user (medium) stuff which isn't ...
Jeff Ferland's user avatar
  • 38.3k
8 votes
2 answers
3k views

Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?

I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
Harry Collins's user avatar
6 votes
4 answers
722 views

Are there a standard method(s) for me to give someone else read-only access to my data?

Are there a standard method(s) for me to give someone else read-only access to my data? There are several situations where I may want to give a few people read-only access to some data, but I would ...
David Cary's user avatar
  • 2,740
3 votes
1 answer
4k views

Can I use HashiCorp Vault to restrict access to credentials based on CIDR ranges?

This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet: A python script gets populated by configuration management ...
Nathan Basanese's user avatar
3 votes
1 answer
699 views

How do automated systems store their keys securely?

As with many systems (primarily websites) there are automatic components that run on a server and are not user based (such as crons) that don't have the opportunity for a real person to input a secret ...
topherg's user avatar
  • 229
86 votes
9 answers
83k views

Comparison Between AppArmor and Selinux

I was reviewing several different comparisons of AppArmor and SELinux which include: Why I Like AppArmor More Than SELinux SELinux and AppArmor: An Introductory Comparison From these articles I ...
Ali Ahmad's user avatar
  • 4,844
72 votes
10 answers
24k views

Why avoid shared user accounts?

I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
Steve Venton's user avatar
53 votes
8 answers
6k views

You're an IT consultant. Should you discourage a client from telling you their password?

I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
unforgettableidSupportsMonica's user avatar
50 votes
5 answers
13k views

How does a country block its citizens from accessing a site?

Following Turkey's recent social site blocks, I am wondering how can you efficiently accomplish that as a country. Similar for a big company. Blocking IPs → easy to circumvent, (proxys, tunnels, etc)...
blended's user avatar
  • 2,871
31 votes
6 answers
45k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
Ali Ahmad's user avatar
  • 4,844
16 votes
2 answers
3k views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...
Prashanth's user avatar
  • 163
12 votes
2 answers
7k views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
magnattic's user avatar
  • 345
11 votes
1 answer
10k views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
raghu's user avatar
  • 283
11 votes
2 answers
8k views

Comparison between Firejail and Apparmor

I'd like to understand how Apparmor and Firejail compare to each other: advantages, pros and cons, purposes, similarities, etc. I might be asking to compare apples with oranges, however I've noticed ...
reed's user avatar
  • 15.8k
11 votes
1 answer
2k views

How to prepare for protecting identity after death?

In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
matt wilkie's user avatar
10 votes
2 answers
2k views

What is the procedure to follow against a security breach?

Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information. One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
ILikeTacos's user avatar
10 votes
3 answers
7k views

What's the difference between an access control method, security model, and security policy?

I'm studying for the CISSP exam and I'm getting confused about the differences between access control methods, security models, and security policies. When I was originally studying Mandatory Access ...
Mike B's user avatar
  • 3,458
9 votes
2 answers
7k views

How do I log everything a certain program is doing?

i have a program which is pretty simple. Its just a simple login form. Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting (...
planIT's user avatar
  • 375
9 votes
5 answers
3k views

What is the practical difference between MAC and Capabilities

Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user. Is there any ...
Sonny Ordell's user avatar
  • 3,596
8 votes
3 answers
12k views

Bell-LaPadula imlementation example

I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example. I understand how the model works, but I have difficulties implementing it in a programming language (...
user1019710's user avatar
7 votes
4 answers
17k views

how safe is a home NAS with ssh access?

I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files. Some extras include: ssh, ftp, telnet, mail servers photo gallery (...
fduff's user avatar
  • 725
6 votes
4 answers
6k views

encryption vs access control comparison

I have a very basic and simple question about two security concepts. Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
b24's user avatar
  • 161
6 votes
1 answer
1k views

How to get better IAM understanding

I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong. I began with ...
Bytemare's user avatar
  • 163
5 votes
5 answers
14k views

Is it possible to restrict USB keys to only certified ones, and block that key's access on other computers

I am working on security for an organisation, we have purchased some encrypted USB keys but wanted to stop any employees leaking data. is there any way to stop their laptop accepting any key but the ...
Harris Mirza's user avatar
3 votes
1 answer
441 views

Access based on type of information requested and access grant

The simple solution to access restriction when number of users are small is Access Control Matrix. Here the rows are the users and columns are different types of asset. In my case, I have a document ...
prakharjain's user avatar
3 votes
2 answers
5k views

DMZ and LAN data exchange - what direction should connections be made?

When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure: DMZ service pushes data to LAN service or LAN service pulls data from DMZ service ...
m1k3y02's user avatar
  • 133
3 votes
1 answer
357 views

Protecting a database against insiders

Consider a network for a web-application with 1 webserver and 1 MySQL database, both on physically different servers and both running Linux. The database stores mission critical data and this data is ...
NSSec's user avatar
  • 469
3 votes
1 answer
3k views

Covert Channels Exploit and the Bell-LaPadula MAC Model

I'm wrapping my head around Mandatory Access Control (MAC) and the well-known Bell-LaPadula model. One limitation that is mentioned with this model is covert channel exploitation. The one example I ...
Jonathan's user avatar
  • 155
3 votes
2 answers
1k views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
Bob Ortiz's user avatar
  • 6,685
2 votes
4 answers
728 views

Help to account all the points of physical access to a rack server to steal software

Let's say I want to move my 1U Dell server to co-location site with a hostile company who will try to steal my code (this is almost 90% probability if I dont take steps)... The limitation for their ...
Boppity Bop's user avatar