Questions tagged [isolation]

Any means of preventing data transfer between two systems. Typically this means isolating processes or VMs through sandboxing, or isolating network or physical resources through firewalls or air-gapping.

Filter by
Sorted by
Tagged with
0 votes
0 answers
21 views

Is it a database security hazard to let multiple Oracle databases UTL_FILE the same filesystem?

I'm looking at a scenario in which it would be convenient to let 3 different cloud-rented Linux boxes (server A is the "scheduler control server", server B runs "database 1" on ...
user avatar
  • 101
2 votes
2 answers
123 views

Security of untrusted Docker containers

If I want to run untrusted code inside a Docker container, or an untrusted Docker container for that matter, how can I restrict it? I'd like to make sure it has no access to the host filesystem. ...
user avatar
0 votes
0 answers
575 views

Is there a more convenient, yet safe, way to run DOSBox-X than I'm currently doing it?

I recently learned about DOSBox-X. It's basically a somewhat less awful version of the basically-abandoned DOSBox. I currently have it installed inside a Windows 10 VM inside of my Windows 10 bare ...
user avatar
  • 1
0 votes
0 answers
229 views

Why use three routers for security purposes instead of two?

I bought a new router to isolate devices in my network, but then I found that famous Steve Gibdson's Three Dumb Routers episode. I have read the whole transcript but even so I didn't get why only two ...
user avatar
  • 747
1 vote
0 answers
74 views

Isolating permissions available to browser JS via oauth and referer

This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions. ...
user avatar
1 vote
1 answer
200 views

Does streaming a game from a dedicated gaming VM still expose my PCs to significant privacy/security concerns from installed games?

So the plan is to make a Windows 10 guest, give it lots of vCPUs and memory, perform GPU passthrough to achieve maximal performance, and then load my games onto this guest. The aim of this would be to ...
user avatar
1 vote
1 answer
175 views

How do I isolate/compartmentalize different use cases on one machine?

I have a decently powerful desktop running Windows that I use for 2 different use cases: playing games and storing/processing my personal data. As a security-aware person this makes me uncomfortable. ...
user avatar
0 votes
1 answer
91 views

Would putting important information on a flash drive that never touches the internet be secure?

First off, I'm not even sure if this question belongs on this site, but I am a programmer and I usually just ask stack overflow questions like this, and I know for a fact this one doesn't belong there....
user avatar
0 votes
1 answer
369 views

Is a VirtualBox guest isolated from the host?

I have a Linux machine running Kubuntu 20.10. I have installed VirtualBox 6.1. I then created a virtual machine on which I have installed Windows 10. Suppose an hacker enters in my Windows 10 guest. ...
user avatar
0 votes
1 answer
394 views

Linux: Can unprivileged users tamper with processes running under their own identity?

Having the following pseudocode executed by a superuser, is it safe to assume that it is secure on Linux? if fork() == 0: # drop privileges to an unprivileged user, let's say "nobody" #...
user avatar
0 votes
2 answers
484 views

Is a LAN to LAN with different subnet configuration secure?

I plan to implement the following network configuration : Internet [(cable A)] Router A (192.168.0.x)[(WAN:cable A)(LAN1:cable B)(LAN2:)(LAN3:)(LAN4:)] Router B (192.168.1.x)[(WAN:)(LAN1:cable B)(LAN2:...
user avatar
  • 151
1 vote
2 answers
187 views

Best Way to Isolate Company Data

I work in a Software Company. Currently, we don't have any security software to secure our data in an employee laptop. Now we want to make a policy where any data stored or created on the company ...
user avatar
2 votes
1 answer
304 views

Ideas for subdomains isolation

Consider a blogging platform - example.com and we want to host untrusted content in subdomain1.example.com and subdomain2.example.com. By default, same origin policy doesn't allow communication ...
user avatar
1 vote
1 answer
601 views

Is it safe to disable SATA ports in the BIOS to isolate the corresponding hard drives from malware?

I have three SATA hard drives that I use every day. Suppose I disable the corresponding SATA ports of these hard drives through my BIOS, add another storage device to my PC, install another instance ...
user avatar
  • 11
2 votes
0 answers
131 views

Patch management for production servers

I'm trying to implement an automated patching program at a small SaaS provider. When a customer signs up for our software, we provision them a Linux VM in our primary datacenter. Each customer also ...
user avatar
  • 17
2 votes
2 answers
2k views

Hardening VM for Malware Analysis

I'm starting out in Malware Research / Malware Analysis. I am reading a book called "Practical Guide to Malware Analysis," which touches this in the 2nd chapter, before approaching Dynamical Analysis (...
user avatar
  • 21
0 votes
0 answers
839 views

Isolate devices on the same network

I asked a similar question on this topic and some guys recommended use VLANs or guest network, so I asked to a friend and he will give to me a router with guest network function. However, there is a ...
user avatar
  • 747
0 votes
0 answers
77 views

standards reference to perimeter security

I have the following problematic that I am currently dealing with. I have two zones/perimeters that need to be interconnected, some standards protocols have to be whitelisted such as HTTP, FTP, SSH ...
user avatar
  • 1
1 vote
2 answers
164 views

Secure browsing on any device without limiting the browser

The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation. Employees depend ...
user avatar
1 vote
2 answers
495 views

Is AWS subnets enough for segregation of networks? or do we need VPC?

Is AWS subnets enough for segregation of networks with the all security groups? or do we need VPC to really issolate two application from each other?
user avatar
  • 53
1 vote
1 answer
468 views

Secure architecture for isolated printer network

I am very new to "networking" and security, but I realize that it would be more secure to have printers on their own "isolated network". How do I secure my networked printers? What kind of printers ...
user avatar
  • 558
3 votes
1 answer
107 views

Prevent reflecting page modified by browser extension

Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc) I don't want anyone but me to see the page modified by this ...
user avatar
  • 387
0 votes
1 answer
113 views

Would it be possible for a malicious user to change the LAN IP address of an uncompromised device?

I have a local network and an IPCam (with its own storage) in it. Due to some practical limitations, I cannot use technologies such as AP isolation or VLAN to isolate low-integrity and high-integrity ...
user avatar
1 vote
2 answers
915 views

What kind of safety does software isolation (e.g. in operating systems) offer (e.g. between OS and browser)?

What kind of safety does software isolation (e.g. in operating systems) offer (e.g. between OS and browser)? Particularly, what kind of safety mechanisms are there and how secure are they? By ...
user avatar
  • 119
1 vote
2 answers
211 views

Is a host OS more vulnerable to a hypervisor escape if the guest OS knows the root password to the host?

This is assuming that escaping the hypervisor is the only way the guest OS could compromise the host-- e.g. it's not networked, isn't sharing folders or the clipboard, etc. Does knowledge about the ...
user avatar
  • 110
1 vote
1 answer
189 views

Islanding vs server lockdown

TL;DR: We're considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the ...
user avatar
  • 111
4 votes
1 answer
220 views

Local server applications using a web frontend on multi-user desktop environments

Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment. But I'm a bit concerned about the increasing popularity of ...
user avatar
  • 41
7 votes
2 answers
12k views

What is the easiest way to sandbox an application in a *NIX environment?

I have a significant number of untrusted binary applications that need to be executed on a *nix box. I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
user avatar
3 votes
1 answer
276 views

Allow only single aplication to access files on USB stick with Linux namespaces

It looks like i found a way to allow only single application to access files in USB storage. This script must be run with sudo. #!/bin/bash # create namespace unshare -m<<EOF # mount device ...
user avatar
  • 31
2 votes
1 answer
240 views

Protecting folder contents from processes

Let's consider the following: Linux is the platform I am referencing here There exists a partition on the system that's encrypted with a strong password (via the LUKS mechanism, if it's relevant to ...
user avatar
  • 67
7 votes
1 answer
1k views

Do any non-GNU/Linux display managers provide the same isolation as Wayland?

In discussions around the ongoing transition from X.org to Wayland, I regularly come across comments along the lines of "Linux security is not there yet". This refers to Wayland's promise of better (...
user avatar
  • 3,530
7 votes
2 answers
4k views

Does Windows Subsystem for Linux provide additional security (VM-like isolation) over running native Windows programs?

On a Windows 10 machine, is it safer to run the Linux version of a browser using Windows Subsystem for Linux instead of running the Windows version? I'm asking because I've read the Wikipedia article ...
user avatar
5 votes
1 answer
419 views

VLAN Device Isolation - Feasibility

To mitigate the risk of malware propagating through a network, how reasonable is it to place each and every device on its own VLAN (complete isolation)? Note: The devices do not need to communicate ...
user avatar
4 votes
1 answer
545 views

Will wireless isolation/AP isolation protect from KRACK?

Will using AP isolation on an Access Point protect connected clients from the KRACK vulnerability on that network?
user avatar
  • 141
306 votes
9 answers
50k views

What makes Docker more secure than VMs or bare metal?

I recently had a discussion with a Docker expert about the security of Docker vs. virtual machines. When I told that I've read from different sources that it's easier for code running within a Docker ...
user avatar
25 votes
6 answers
10k views

Cheapest and tiniest acoustic isolation for smartphone?

What is the cheapest/convenient way to isolate a mobile phone from recording with microphone? My constraints: The cellphone has to stay in the room, I can't put it outside Maximum 100$ solution Must ...
user avatar
  • 351
1 vote
2 answers
131 views

Are there tools to isolate protocols on major operating systems?

Isolation is a pretty effective method against malware. There are tools to isolate running code in various ways(qubes-os, bromium, fireglass), i.e. using a micro-vm for each task, either locally or ...
user avatar
1 vote
1 answer
101 views

How to ensure the traffic between vm and host doesn't mix in Windows?

I'm looking forward to using a volatile VM. And according to this source : By default, network address translation (NAT) is configured by the virtualization software such that the guest OS shares ...
user avatar
  • 2,253
2 votes
5 answers
1k views

Designing a sandbox or how to "perfectly" isolate an app?

I have been thinking on how an app could be "perfectly" isolated from the rest of the system. Now I know we will never achieve "perfect" in practice, but in theory, how could one go about it? I put ...
user avatar
0 votes
1 answer
7k views

unifi AP how to issolate the guest network

How do I isolate my "Guest" network on my Unifi Access Point(AP) so they can't see all the computers on the network and thereby prohibiting access to our computers/data on other networks on same AP. ...
user avatar
5 votes
1 answer
750 views

VM vs System Call Interposition vs Software Fault Isolation

I have an exe file that I don't trust (maybe its infected with malware). I know that running it in a VM will isolate the exe file from my system, but what about using mechanisms such as System Call ...
user avatar
  • 51
3 votes
1 answer
150 views

Is there any technology that allows to run code in untrusted environment?

Imagine, your computer is controlled and your traffic is watched (MitM) . For example environment can create a snapshot of process and record a traffic. Is there any chance to run code and prevent it ...
user avatar
  • 141
1 vote
2 answers
1k views

Isolate Raspberry Pi Server

I am thinking about using a raspberry pi, or some other SBC, to open a simple node.js based web server and a ssh server. I know that when opening ports there are always security vulnerabilities ...
user avatar
0 votes
1 answer
573 views

Level of isolation that Chromium's "Guest Browsing" provides?

When using "add user" in guest browsing, what level of "isolation" does one get? If any? That is, I can log into google or facebook etc multiple times so I assume that at least cookies are separated ...
user avatar
2 votes
2 answers
2k views

If I run an infected DOS .COM file in DOSBox on C: directory will my main OS be damaged?

I want to test some DOS viruses. If I run them from C: will my computer be damaged?
user avatar
4 votes
2 answers
582 views

Sandbox escape of an isolated turing complete language?

Ethereum's Solidity documentation states: The Ethereum Virtual Machine or EVM is the runtime environment for smart contracts in Ethereum. It is not only sandboxed but actually completely isolated, ...
user avatar
3 votes
2 answers
269 views

Why is there no smartphone OS-style app isolation on PC systems?

Smartphones OSes like Android and iOS come with a lot of security features, one of the most useful to me being app isolation. In my understanding, each app installed has a space reserved, and can ...
user avatar
  • 1,905