Questions tagged [user-management]
The user-management tag has no usage guidance.
1
vote
1answer
99 views
My boss installs software using domain admin. Should I show that this is bad?
At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
3
votes
1answer
71 views
Encrypt User specific Information without a password
Given scenario:
I have an application (NodeJS) running on Heroku, the database is RDS on Amazon and I use Auth0 for authentication. I don't have access to passwords of the users, some users use social ...
1
vote
1answer
37 views
What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?
From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token.
➥ What ...
3
votes
2answers
58 views
Using SessionStorage for Some User Info
I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
2
votes
2answers
172 views
Separation of duties for user account creation
Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
1
vote
1answer
29 views
Center for Internet Security Version 6.1 Critical Security Control 16-10
My project is implementing The CIS Critical Security Controls, Version 6.1
Can anyone please give me some advice on how we can address sub-control 16.10 which says.....
"Profile each user’s typical ...
7
votes
1answer
562 views
How can utilities with setuid set to root be secure if they are debuggable?
Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:
I can freely debug all programs I have the permission to run, even those that have ...
7
votes
2answers
233 views
Win10: Access other logged on users' memory
How easily can admin users access the data of other users' running processes on Windows 10?
Especially webpages loaded by Chrome.
Example
Context
Bob and Alice share a single Windows 10 ...
0
votes
3answers
116 views
Anything particularly wrong with putting an auth code in marketing emails?
I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
5
votes
3answers
247 views
As “Head of IT” is it reasonable not to have access to Email or backup management as could contain sensitive information
I work for a medium sized company of around 100 people or so - and I am employed to be Head of IT responsible for backups, security, sorting out technical issues, among other things etc etc.
However ...
1
vote
1answer
79 views
Dealing with shared credentials when an employee leaves
We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
21
votes
5answers
5k views
Is there a security advantage or risk in removing disabled user accounts?
So I'm having a debate with someone about whether or not to remove disabled accounts. My stance is that it is good network hygiene, reduces the amount of noise to sift through, etc. However, the ...
2
votes
2answers
206 views
Password same-account indicators on websites
I am creating a user system which will be used across multiple websites without the use of SSO (the extra hassle really isn't worth it at the minute).
I am looking at ways of telling users that they ...
5
votes
1answer
153 views
Is there any danger in subpages that can be called by url but cannot compile due to missing includes?
I have a webpage that basically uses the following structure:
index.php
functions.php
pages/a.php
pages/b.php
...
When I call index.php, the user is prompted to login or is logged in automatically ...
1
vote
2answers
105 views
Self-Coded User Authentication Security
We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some ...
2
votes
1answer
210 views
User Credentials for Accessing Network Resources
I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
1
vote
1answer
79 views
Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?
When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system?
Is it ...
3
votes
3answers
176 views
What attacks are possible if you can scrape a list of users?
Have there been any attacks (or can you think of a potential attack) that hinged on being able to figure out if a user exists in a system?
For example, in a web app there is a "Reset password" page ...
1
vote
1answer
210 views
Rubber ducky windows mitigation
So I am familiar with badusb or rubber ducky attacks, I lack possession of one currently to test any of my questions.
Essentially my question is can you mitigate rubber ducky attacks using windows ...
-6
votes
1answer
208 views
Why threat modelling and risk planning does not consider the sex of users? [closed]
Isn't it scientifically proven that men and women have very different psychologies? So that, at least they must have different attitudes towards security policies and guidelines compliance. All of ...
0
votes
1answer
46 views
Jira external users verification
I have a Jira site where my customers' employees can open bugs, view bug statuses and so on.
I manage these users inside my Jira (external users) and they have username and password with limited ...
3
votes
1answer
132 views
Is it good practice if all programs have their own user ID? [closed]
Typically, each physical user on a system has an ID, and a running process is run as the user who starts it. This means the process is able to access all of the user's files, even those that not ...
-1
votes
1answer
262 views
plutil -p /Library/Preferences/com.apple.preferences.account.plist
plutil -p /Library/Preferences/com.apple.preferences.accounts.plist shows some deleted usernames that I am in the same school with. Am I hacked by them?? I am really concerned.
Additional information:...
2
votes
2answers
114 views
storing user's information without been able to access it
For a university project of mine I am making a password manager online and I want to be able to store user's passwords on my server without being able to access it myself. Here is what I intend to do:
...
1
vote
2answers
89 views
How to safely setup user rights inside a backup folder?
I use a Synology NAS that has full Linux based user rights control and I want to setup a root shared folder called backup where I'll save backups from different technologies: Time Machine and Windows ...
1
vote
1answer
54 views
Should I have two accounts in my NAS (ex.: Bob as user and Poseidon as admin, both controlled by me)?
I have a Synology NAS running in a SOHO network and I'd like to maintain it secure. First thing I did was disable the default admin and guest accounts, second I created some accounts and this is what ...
4
votes
1answer
122 views
IT Contractor with domain administrator credentials best practice?
We are going to be hiring an external contractor to do some work on our SharePoint server and they will need admin rights for kerberos setup and etc.
What are the best practices of setting up the ...
1
vote
1answer
341 views
Is an anonymous FTP user always a risk (even if this user doesn't have access to anything)?
I found some FTP servers in a network that seem to allow login with an anonymous FTP user. I confirmed this with the ftp-anon NSE script in Nmap.
PORT STATE SERVICE
21/tcp open ftp
|_ftp-anon: ...
0
votes
1answer
99 views
Should all local users with the same username have the same UID in all the machines of an organization?
We have a datacenter environment where there are servers with the username "java" that has the UID 5000. Now, we are creating the same local user, "java", in some thinclients.
Is it important that ...
0
votes
3answers
4k views
Identity and Access Management (IAM/IdAM) deployment guide
I'm working on a set of applications that require authentication and authorization.
Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
0
votes
1answer
80 views
Securing Macbooks in an Enterprise Environment [closed]
I have been looking online at different forums/websites but was not able to find a direct answer. Does a checklist/process or software exist to secure Macbook computers in a enterprise environment( ...
1
vote
2answers
319 views
Should users be allowed to reuse/recyle the same login credentials across a network for different systems?
Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
95
votes
6answers
5k views
Should passwords be automatically reset when the underlying method changes
I'm currently an engineer on a project in development phase. One 'module' on this project gives the ability for user authentication/authorization. However it's come to our concern that the password ...
3
votes
1answer
117 views
What are the security implications of having a dummy user account representing unauthenticated users?
In my web application, users are assigned to groups and groups are granted permissions on objects. The application exposes some objects to unauthenticated public users (i.e. people casually visiting ...
9
votes
1answer
605 views
How to protect a Wifi network from Microsoft WiFi Sense
Microsoft is deploying a new feature, WiFi Sense, which provides users a way to easily share passwords to wireless networks with all of their contacts. This introduces a new security failure mode: a ...
3
votes
1answer
102 views
Why is it a terrible idea to implement restrictive measures in .bashrc?
Asking this because apparently there are multiple people who genuinely don't realize just how bad of an idea this is, and I want there to be a single, easy-to-find place for them to go / be sent.
0
votes
1answer
447 views
Staying logged in as a user for remote access (such as Team Viewer) Pros & Cons
This company we newly help have no remote access policy for say, but they allow the users to use Team Viewer. I have noticed some user leave their PC logged in all night and weekends and just shut ...
4
votes
4answers
1k views
How to give rights to a System Administrator in an application?
I am designing a security model for a web application which restricts access to certain parts of the app depending on what rights and permissions the user has. These rights and permissions are grouped ...
0
votes
1answer
75 views
Custom publickey authentication
I'm working on a REST account management system over https that should support both username/password and username/publickey authentication schemes. I.e. when a user registers an account, they may ...
1
vote
0answers
52 views
Resources and Examples for Modeling Application Security Groups
I am searching for some resources and documentation on modeling security groups for a web application, but seem to be coming up rather dry.
I am interested in creating a visio-like diagram that ...
3
votes
1answer
7k views
Generating token for email validation and registration security
My boss gave me a list of 8K users in csv format and asking me to create accounts for them. The list have users with gmail, hotmail, and organization email addresses.
I am using MVC 5 and ASP.NET ...
2
votes
3answers
881 views
How secure is an Activation Email?
Is there any risk to an Activation Email?
My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL ...
3
votes
2answers
107 views
Ubuntu/Debian Is it okay to use a sudouser account as my primary on a workstation?
This question comes to you from the the common WindowsNT advice that "I", as the computer administrator, should login with a normal unprivileged user account for day to day use. Does this concept have ...
11
votes
4answers
5k views
Should email verification be followed by password-based login? Why?
[This is a duplicate, considered off-topic at https://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why]
A typical account creation process seems ...
3
votes
1answer
333 views
How to store a group password for multi-user server-client web-application?
In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database.
Data has to be encrypted for several groups of users, where one group ...
4
votes
2answers
535 views
Can I use stormpath user management service with a XACML library like BALANA?
I'm trying to implement some security access control in a software I'm building. I came across Stormpath for user management and they have somewhat an approach for RBAC yet what I was considering is ...
3
votes
1answer
685 views
Access rights management in large companies
I'm wondering how large companies with tens / hundred of applications are handling access-rights for their users. From what I've seen, it's a nightmare that never ends, and it requires full-time ...
0
votes
1answer
658 views
How should I validate an API key for a web service deployed via iframe?
I'm working on a small web service that provides some functionality that can be embedded in a web page with an iframe. As this is a subscription-based service, I'd like to be able to manage who can ...
1
vote
2answers
101 views
How many accounts should I have in an information system?
Is it a problem to have more than one account in an information system from security point of view?
Let me clarify a bit. It is a bank system. I wonder if having a CSO (customer service officer) ...
3
votes
6answers
8k views
Log in with email is more secure than a username?
Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or ...
