Questions tagged [user-management]
The user-management tag has no usage guidance.
91
questions
0
votes
0
answers
13
views
To SCIM or not to SCIM [closed]
SCIM is a protocol for on- and offboarding of employee accounts in external systems (e.g. e-mail systems, HR- and payroll, etc). While elegant, there is a non-zero cost in setup and maintenance of ...
- 99
1
vote
2
answers
74
views
How to non-intrusively monitor my team's MacBooks secure configuration?
I'm managing a small remote team. We care about security and I want to be sure that our MacBooks comply with at least basic security standards, such as CIS benchmark.
These are the ways I see I could ...
1
vote
1
answer
63
views
Is it safe for website to generate fake profile pages?
Today I found a website which generates a fake profile when asked if said profile exists. Example: www.site.com/user/mycoolname doesn't exist yet. But if I put it in the browser for the site I get a ...
- 11
0
votes
0
answers
50
views
Are hashed passwords transferred to a server for user authentication? [duplicate]
A question I came up with while reading in my information security class. Let's say website ABC which uses username and password combinations to authenticate users and has a user John. When John goes ...
- 1
1
vote
1
answer
57
views
Securely adding new users to account
In a multi-tenant application, I'm thinking of the right way to let a tenant add users to its account. Assume the "root" user (that signed up and created the tenant) already exists. At some ...
- 143
0
votes
1
answer
93
views
Is there a secure way of handling online payments without user accounts and logging in?
I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...
1
vote
3
answers
142
views
Is it more or less secure to use IAM (AWS user management) if you only have one user?
This is an edge case, and as soon as multiple users are accessing the AWS Console in anyway, IAM is the only good option, but what if you only have one user?
I've always assumed that if only one ...
- 302
0
votes
1
answer
102
views
Is there an effective way to disable root access on linux in an office setting
I'm currently working for SaaS a company and as part of a security audit we were advised to remove all administrative access from all laptops/end-user pc's for a Principle of Least Permissions.
Is ...
- 101
1
vote
0
answers
86
views
How can OAuth2 (tokens) fit into dynamic sites that still wants to call protected API's via JavaScript?
(I try to understand different concepts regarding web development in general)
Most information I find is about Single Page Applications, but how does a dynamic site make use of (for example) OAuth2/...
- 111
2
votes
1
answer
131
views
Risk associated with Exchange email address as username when AD authentication is enabled
In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
- 25
4
votes
0
answers
633
views
Maximum password length for user accounts on Ubuntu
I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
- 165
65
votes
2
answers
12k
views
How can I prevent a computer from turning ON?
I was reading this question on Stack Exchange Workplace community and it indicates that an IT team was able to prevent a user from turning their laptop on (power on).
My laptop access has been shut ...
- 1,403
2
votes
0
answers
215
views
Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?
We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
- 343
0
votes
3
answers
460
views
Associate API key with user
I am creating a public API that will require API key authentication. When a user wants to register a new API key, they send a request to one of our endpoints with a list of permissions they want. We ...
1
vote
0
answers
110
views
How can I stop an authorized user from consuming all the bandwidth on my home network? [closed]
Me and my neighbours share a home network managed by me, paid for by the landlord.
This person overloads the bandwidth on the regular, jitter spikes up to the 300s,down speed fluctuates, overall ...
10
votes
2
answers
2k
views
When should user invite links (tokens) expire?
We have a system in which external users can be invited to our identity management system.
The users are not employees of our company, but of our customers. The administrators of the
customer do not ...
0
votes
1
answer
115
views
Should admin user be visible to regular users
When building a system, where all users belong to the same organisation, should regular users be able to see admin users?
On one hand one could argue that there is no need for this information to be ...
1
vote
0
answers
99
views
using public key crypto instead of password for authentication [closed]
I'm the head of IT and development in a small group of enthusiasts spending their free time with a bit of hobby development. We don't have an office yet, but maybe consider to rent some small office ...
- 31
2
votes
2
answers
184
views
How to provide personal User Page after User already signed up without Password?
I created a small website where participants can sign up with some data (name, email, birthdate, ...) but they don't have to set username and password.
After a while it would be useful to provide ...
- 21
6
votes
2
answers
424
views
How to convince users that security is a good thing?
So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
- 211
70
votes
10
answers
21k
views
Why avoid shared user accounts?
I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
- 739
0
votes
1
answer
156
views
How to catch people creating many accounts on the same website using very unique credentials?
Nowadays e-commerce is the new trend compared to the retail stores, but some sellers will manipulate their rankings through false purchases of their own items to boost rankings significantly. The ...
- 109
0
votes
0
answers
67
views
Most accessible yet secure way to verify a user over the phone who has an account online
We have a service where people register online and log fairly sensitive records. They might want to phone up and ask for a status update on these records.
At the time they are calling, they may not ...
1
vote
2
answers
160
views
Should a system require a password confirmation for accounts managed by an administrator?
Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I'm wondering, is it fine if such ...
- 11
1
vote
1
answer
158
views
My boss installs software using domain admin. Should I show that this is bad?
At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
- 11
3
votes
3
answers
347
views
Encrypt User specific Information without a password
Given scenario:
I have an application (NodeJS) running on Heroku, the database is RDS on Amazon and I use Auth0 for authentication. I don't have access to passwords of the users, some users use social ...
- 131
1
vote
1
answer
90
views
What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?
From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token.
➥ What ...
- 137
3
votes
2
answers
611
views
Using SessionStorage for Some User Info
I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
- 171
2
votes
2
answers
535
views
Separation of duties for user account creation
Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
- 155
1
vote
1
answer
79
views
Center for Internet Security Version 6.1 Critical Security Control 16-10
My project is implementing The CIS Critical Security Controls, Version 6.1
Can anyone please give me some advice on how we can address sub-control 16.10 which says.....
"Profile each user’s typical ...
- 113
8
votes
1
answer
892
views
How can utilities with setuid set to root be secure if they are debuggable?
Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:
I can freely debug all programs I have the permission to run, even those that have ...
- 5,587
7
votes
2
answers
685
views
Win10: Access other logged on users' memory
How easily can admin users access the data of other users' running processes on Windows 10?
Especially webpages loaded by Chrome.
Example
Context
Bob and Alice share a single Windows 10 ...
- 73
0
votes
4
answers
212
views
Anything particularly wrong with putting an auth code in marketing emails?
I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
5
votes
3
answers
342
views
As "Head of IT" is it reasonable not to have access to Email or backup management as could contain sensitive information
I work for a medium sized company of around 100 people or so - and I am employed to be Head of IT responsible for backups, security, sorting out technical issues, among other things etc etc.
However ...
- 183
1
vote
1
answer
284
views
Dealing with shared credentials when an employee leaves
We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
- 10.4k
20
votes
6
answers
10k
views
Is there a security advantage or risk in removing disabled user accounts?
So I'm having a debate with someone about whether or not to remove disabled accounts. My stance is that it is good network hygiene, reduces the amount of noise to sift through, etc. However, the ...
- 330
2
votes
2
answers
248
views
Password same-account indicators on websites
I am creating a user system which will be used across multiple websites without the use of SSO (the extra hassle really isn't worth it at the minute).
I am looking at ways of telling users that they ...
- 149
5
votes
1
answer
204
views
Is there any danger in subpages that can be called by url but cannot compile due to missing includes?
I have a webpage that basically uses the following structure:
index.php
functions.php
pages/a.php
pages/b.php
...
When I call index.php, the user is prompted to login or is logged in automatically ...
- 51
1
vote
2
answers
175
views
Self-Coded User Authentication Security
We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some ...
- 111
1
vote
1
answer
414
views
User Credentials for Accessing Network Resources
I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
- 129
1
vote
1
answer
178
views
Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?
When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system?
Is it ...
- 287
2
votes
3
answers
241
views
What attacks are possible if you can scrape a list of users?
Have there been any attacks (or can you think of a potential attack) that hinged on being able to figure out if a user exists in a system?
For example, in a web app there is a "Reset password" page ...
- 397
1
vote
1
answer
483
views
Rubber ducky windows mitigation
So I am familiar with badusb or rubber ducky attacks, I lack possession of one currently to test any of my questions.
Essentially my question is can you mitigate rubber ducky attacks using windows ...
- 28
-5
votes
1
answer
265
views
Why threat modelling and risk planning does not consider the sex of users? [closed]
Isn't it scientifically proven that men and women have very different psychologies? So that, at least they must have different attitudes towards security policies and guidelines compliance. All of ...
- 263
0
votes
1
answer
94
views
Jira external users verification
I have a Jira site where my customers' employees can open bugs, view bug statuses and so on.
I manage these users inside my Jira (external users) and they have username and password with limited ...
- 11
3
votes
1
answer
218
views
Is it good practice if all programs have their own user ID? [closed]
Typically, each physical user on a system has an ID, and a running process is run as the user who starts it. This means the process is able to access all of the user's files, even those that not ...
- 1,613
-1
votes
1
answer
535
views
plutil -p /Library/Preferences/com.apple.preferences.account.plist
plutil -p /Library/Preferences/com.apple.preferences.accounts.plist shows some deleted usernames that I am in the same school with. Am I hacked by them?? I am really concerned.
Additional information:...
2
votes
2
answers
266
views
storing user's information without been able to access it
For a university project of mine I am making a password manager online and I want to be able to store user's passwords on my server without being able to access it myself. Here is what I intend to do:
...
- 148
1
vote
2
answers
176
views
How to safely setup user rights inside a backup folder?
I use a Synology NAS that has full Linux based user rights control and I want to setup a root shared folder called backup where I'll save backups from different technologies: Time Machine and Windows ...
- 125
1
vote
1
answer
108
views
Should I have two accounts in my NAS (ex.: Bob as user and Poseidon as admin, both controlled by me)?
I have a Synology NAS running in a SOHO network and I'd like to maintain it secure. First thing I did was disable the default admin and guest accounts, second I created some accounts and this is what ...
- 125