Skip to main content

Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

Filter by
Sorted by
Tagged with
2 votes
3 answers
2k views

Allow access to a directory for certain application only

I would like to restrict an access to a directory. For example, on my system there is ~/.thunderbird directory that contains settings, letters, caches, etc of Thunderbird mail client. Obviously, other ...
flaz14's user avatar
  • 121
1 vote
1 answer
159 views

How to prevent access based on MAC Address in local network and internet?

I have one server with source code of softwares. I want to give access based on certain MAC address to developers in my office. And also want to give access to some other employee who can also work ...
Devendra Maniar's user avatar
2 votes
1 answer
583 views

Access control for embedded device

We develop a protocol for computer remote control of a certain kind of toy. It's basically a sensor and actor network that is usually connected to the user PC via serial port or USB. Now some users ...
Bergi's user avatar
  • 287
1 vote
1 answer
119 views

Will granting access to data without owner approval set a bad precedent?

I work for a small company that does contract work that involves storing customer data on our servers for the duration of a project. We recently adopted more strict folder security in which each team ...
Bad Neighbor's user avatar
1 vote
1 answer
386 views

Solution to hide a shared password to users

I am looking for a solution to a business / security need. All our users use a shared login and password to access a web application. we cannot have an account by user we can not change the web ...
vjeantet's user avatar
  • 111
57 votes
11 answers
11k views

Why is it bad to connect internal systems to the Internet?

We have an intranet system we use to book, track and process invoices for our core business. My boss would like to move this system to the Internet to make it "accessible everywhere". However, I feel ...
Toby Leorne's user avatar
24 votes
2 answers
15k views

What are the security risk of enabling cors on localhost?

I have a Cordova based mobile app that is hitting some API via a local server on mobile. The mobile app sets origin as Localhost. Here cors kicks in and I can't make the request. Now these API's can ...
aWebDeveloper's user avatar
1 vote
1 answer
295 views

Limiting a standard user on Windows

I'm setting up a limited user account. I would like it as limited as possible, while retaining the capabilities of: running a handful of programs, and saving files into one folder. Can I use ACL ...
Smiith's user avatar
  • 157
1 vote
0 answers
110 views

How to submit scores securely from app that uses only Facebook login?

Our android app only has Facebook login. Here's what happens on the server: A user is created when a POST request is sent using Facebook's user access token in the body. Whenever a user gets created ...
jimmypage's user avatar
  • 111
0 votes
2 answers
129 views

Is no access control on file upload/file download of safe types considered a vulnerability [closed]

Under the theoretical assumption that file uploads were correctly protected (i.e no malicious file types, extensions, scanning etc.), what are the concerns with having no access control on file upload/...
Cyassin's user avatar
  • 525
1 vote
2 answers
629 views

Is there a security reason to disable a leavers account instead of deleting it? [duplicate]

Well the title says it all really. Obviously if they return it's easy to enable but I'm talking specifically about leavers where there is no intention of returning. Many places simply disable ...
Arlix's user avatar
  • 1,489
5 votes
1 answer
15k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
Bondolin's user avatar
  • 187
11 votes
2 answers
2k views

If a CORS request doesn't need authentication, why can't I send it without the cookies?

Many times over the past N years, I've needed my own page (ABC.com) to get some data from a different origin (XYZ.com) and display it (all in JavaScript, no server fetching). This doesn't work ...
viggity's user avatar
  • 211
2 votes
4 answers
11k views

Why delete user accounts, when no longer needed - business

I was reading that for business's it is essential that they remove the user's account as soon as that person leaves the company. So, my question is why? I understand the need to remove accounts ...
Anonymous5642's user avatar
8 votes
3 answers
16k views

Role-Based Access Control Disadvantages

According to NIST, RBAC models are the most widely used schemes among enterprises of 500 or more. What happens if the size of the enterprises are much larger in number of individuals involved. In ...
user505's user avatar
  • 81
0 votes
1 answer
1k views

Limit file access to admin and application on Windows 10?

I'm looking for a way to secure special made config files on an Windows 10 installation: A user without admin rights must not have direct access to the unencrypted text file. A closed source ...
Cali1011's user avatar
1 vote
1 answer
215 views

Access Control Primitives

The basic security services are: confidentiality, integrity, authentication, non-repudiation and access control. A primitive for integrity is hash functions, and for authentication is asymmetric ...
naster's user avatar
  • 13
2 votes
1 answer
1k views

Isn't RBAC just an implementation of MAC?

So I've been reading up on MAC vs DAC vs RBAC and there is something which I do not understand. Everywhere you read, it tells you that these types are different (disjoint) but isn't RBAC just a type (...
Nu Nunu's user avatar
  • 121
0 votes
2 answers
357 views

Accessing another host in an wifi network

In a public wi-fi network if I know the IP of another host/laptop on that network I can add a default route in my host to that IP. Will this allow me to access services (or even the corporate network ...
Manohar's user avatar
  • 175
0 votes
2 answers
301 views

Security Trade-offs in Hardtoken vs Softtoken VPN connections

A company I worked with has what seems to me to be a bit of an odd security policy, for working remotely all people need to connect through a corporate VPN to reach the internal networks. The process ...
mercurial's user avatar
  • 908
2 votes
1 answer
122 views

Terminology (analogy?) for losing control of a secret due to re-sharing

Regarding sharing a password/access/secret to someone... and then you don't have control whether they will also share this on, and potentially it could/will end up publicly known, thus insecure. The ...
Hicsy's user avatar
  • 121
0 votes
2 answers
616 views

Lattice vs Level with regard to access control

With regard to access control, is "lattice" the same as "level"? Is "Multi-level access control" just another name of "lattice-based access control"? Are Biba and Bell-LaPadula Security Models ...
Infinite's user avatar
  • 330
25 votes
7 answers
4k views

How can I publish data from a private network without adding a bidirectional link to another network

I was just wondering how I could build a private network where it is physically impossible to gain access from outside but still have the option to publish data to some remote server. As an example: ...
Klamann's user avatar
  • 513
3 votes
1 answer
274 views

Is it good practice if all programs have their own user ID? [closed]

Typically, each physical user on a system has an ID, and a running process is run as the user who starts it. This means the process is able to access all of the user's files, even those that not ...
Cyker's user avatar
  • 1,693
5 votes
1 answer
2k views

Do AppArmor/SELinux provide any security for workstation?

I decided to harden security on my primary workstation a bit. Before I used to use firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well ...
Lapsio's user avatar
  • 217
1 vote
2 answers
556 views

On the Android platform, is it secure to use a custom URI scheme to receive a OAuth 2.0 authorization response from the Google Identity Platform?

Assuming I developed an Android app using the Google Identify Platform as its ID system. In Google's Identify Platform doc (https://developers.google.com/identity/protocols/OAuth2InstalledApp), it ...
ytw's user avatar
  • 111
0 votes
1 answer
123 views

Should a webserver's access to certain directories be limited?

There was a security update to Roundcubemail today and I just patched my web/mail -server. Within the update files, there was some recommendations to restrict webserver's access to certain directories....
bkoodaa's user avatar
  • 440
1 vote
2 answers
515 views

Linux: Whitelist device file access to programs

Is there a way to allow only a specific program to access a device file (e.g. serial interface) in Linux? Could I maybe create a user that is the only one with access to the file and set that user ...
maqp's user avatar
  • 73
1 vote
2 answers
181 views

Is there any way of making an SQL server think I'm accessing from localhost?

The title is pretty much self explanatory If a SQL server only allows connections from localhost, is there any way I can access from the outside by making it think I'm actually accessing from ...
sysfiend's user avatar
  • 2,384
2 votes
1 answer
5k views

How does Windows Active Directory verify a computer's identity?

It seems a simple question but I can't find the answer on Google or Windows support pages/forums. If a domain administrator decides to remove the automatic right for domain users to be able to add ...
David Scholefield's user avatar
2 votes
2 answers
385 views

Restrict access to REST web application to authorized computers?

I have developed a REST web application. The client only wants authorized computers to access the application. We have gone with 2-way TLS implementation where the client approves or rejects ...
Dot Batch's user avatar
  • 121
2 votes
1 answer
1k views

What is the meaning of 'Default to Zero' that must be keep in mind in Authorization?

I learned that in authorization there are some things to keep in mind, there are: Authorization Creep this happens when an employee switch roles and the previous authorization isnt removed. Default ...
Vlanzyvinz's user avatar
1 vote
3 answers
2k views

Limit access to shares on fileserver based on client subnet

I recently segmented a network and the only hosts that are accessable from every subnet are the AD-Server and the fileserver. Now I want to limit the access to specific shares on that servers to a ...
davidb's user avatar
  • 4,323
3 votes
2 answers
2k views

Privileged access management vs named accounts

What are the relative merits / deficiencies of a Privileged Access Management (PAM) service compared with a strict policy of named users (no account sharing)? By PAM, I'm specifically referring to ...
symcbean's user avatar
  • 18.7k
1 vote
1 answer
297 views

VPN Access to PCI Environment Edge Devices

Does it violate PCI DSS requirements to provide a third party company with a Site-to-Site VPN connection for full management (SSH & HTTPS) access to network security equipment (such as a Web ...
mkeenan's user avatar
  • 11
10 votes
2 answers
2k views

Does insert only db access offer any additional security

There are concerns that if our public facing web nodes are compromised, an attacker will gain access to all our data. It just so happens that data entered from outside users only needs to be ever ...
user3282193's user avatar
2 votes
2 answers
1k views

Access Control Techniques

Dear all members of Information Security, this is my first post here and I hope I came to the right place. I am currently studying about access control techniques and I am struggling to visualize and ...
e.doroskevic's user avatar
2 votes
1 answer
972 views

How the 'probability of verification' is inversely related to the 'false accept rate'?

I was reading a document discussing biometrics and came across this statement: Typical finger-print verification systems employed by FBI achieve 90% probability of verification at 1% false accept ...
ihoaxed's user avatar
  • 21
9 votes
3 answers
3k views

Accessing document using a 6 letter token

We are building a web app where users can insert 6 letters/digits (A_Z, 0-9) into a form to access a document. Every document has a randomly assigned access code like this: 1ABH5F. When the user ...
Peter's user avatar
  • 201
0 votes
1 answer
683 views

Restrict access to public URL many times

I have such situation. Imagine there is a public service (URL). What we don't want, is for someone, to be able to access this URL many times in short period of time, because they will be able to block ...
Abesalomi Gogatishvili's user avatar
2 votes
1 answer
1k views

How can I secure a NAS on my home network? [closed]

So I have a NAS enclosure on my home network (D-Link Share Centre) and I am worried about its security. It is hard wired into my Sky router (SR102) which I hear the firewall doesn't work on. There is ...
Matthew Parkes's user avatar
0 votes
1 answer
221 views

How reasonable is blocking IP address for web application

Given a web application with authorized users, suppose there are users, like trolls, it's possible to lock one account, but the user can create another account and continue trolling. Blocking IP not ...
Oto Shavadze's user avatar
4 votes
1 answer
428 views

IT Contractor with domain administrator credentials best practice?

We are going to be hiring an external contractor to do some work on our SharePoint server and they will need admin rights for kerberos setup and etc. What are the best practices of setting up the ...
llerdal's user avatar
  • 141
43 votes
8 answers
9k views

Is it a bad idea to bypass login wall for a specified IP address?

I have a website that is available on the public internet. The website requires authenticated login before any of the content can be accessed. I've been asked if I can remove the login wall for users ...
tommarshall's user avatar
5 votes
4 answers
3k views

Preventing tampering of ~/.ssh/authorized_keys

If a server is compromised, an attacker could add his own public key to authorized_keys. How is this prevented? Who should have what access to the file?
Awn's user avatar
  • 480
3 votes
2 answers
4k views

Separation of Duties using RBAC

I'm reading an article about Role based Access Control, in section 6 (Separation of Duties) I didn't understand this part : Separation of duty can be either static or dynamic. Compliance with ...
Bilal's user avatar
  • 133
2 votes
0 answers
170 views

How to maintain an access matrix? [closed]

How can I maintain an access matrix to enterprise's information systems? Most of this systems are specific and not widely-known. So there is no need to have complicated idm-solution with connectors, ...
PaWeLL's user avatar
  • 21
2 votes
1 answer
2k views

How to i disguise my phone as a tablet/computer? [closed]

Where I work, the wifi blocks phones. So currently, when I use my phone to help me complete my work it uses almost all of my "data". I can't afford a tablet or a larger data package. Is there any ...
cherry spoke's user avatar
1 vote
0 answers
74 views

Do any visual editors exist for claims-based access control, with several parallel evaluators?

This MSDN video at marker 14:20, describes a scenario where an employee can access a building if They are a valid badge carrying FTE They are in possession of a "sticker of shame", temporary badge ...
makerofthings7's user avatar
2 votes
2 answers
8k views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
mancuss's user avatar
  • 21

1
3 4
5
6 7
12