Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
246

So this is an interesting question with a few points into why you not only should WANT to do this, but should do this for your own safety and security. It helps first if you understand that companies point of view before we talk about how it can benefit you. Why would a company want to do this? Many reasons. It makes it assured that your computer can ...


148

As a guy who writes and enforces these types of corporate policies, I can tell you this: it is perfectly normal, and a perfectly reasonable policy. I do NOT want your equipment on my network, ever. I can't control it, I have no insight into how patched it is, how virus-ridden it is, and I do NOT want you to keep company data on your personal device when ...


148

Alice and Eve work for Bob. Alice is a very good worker who does exactly what Bob asks her to do. Eve is a criminal mastermind hell-bent on destroying Bob's company. Alice and Eve both share the same account. Eve logs into the account and uses it to sabotage an important business process. The audit log captures this action. How does Bob know who sabotaged ...


104

The file and folder/directory permissions on an operating system are managed and enforced by... you guessed it right, that operating system (OS). When the operating system is taken out of the picture (booting a different operating system), then those permissions become meaningless. One way to think of it: You hire a big bodyguard (OS) to protect your house. ...


89

First, it might be best to fully understand the client (your boss's) needs. It's possible he or she only needs access to one small subset of the data on this server from anywhere and not necessarily all of it. Where possible, instead of saying no in this situation come back with a few options. VPN so people travelling, can access the data wherever they ...


86

No, there's no way to do it. Without setting connection parameter limits, there's even no way to make it relatively difficult. If a legitimate user can access your website, they can copy its contents, and if they can do it normally with a browser, then they can script it. You might setup User-Agent restrictions, cookie validation, maximum connections, and ...


75

Yes, they can. Simple answer: You authenticate in some way to your identity provider, usually via username and password. The bad admin can store the transmitted credentials and just re-use them. This attack does not depend on how the backend is implemented. In general your password for the identity provider isn't used for authentication to third-party ...


63

At every place I have worked (as a contract developer) developers are given local admin rights on their desktops. The reasons are: 1) Developers toolsets are often updated very regularly. Graphics libraries, code helpers, visual studio updates; they end up having updates coming out almost weekly that need to be installed. Desktop support usually gets ...


61

Most probably the blocker is designed to let images through, maybe because they are hotlinking some images on the page where they ask for you to login. Appending ?.jpg to the URL makes the blocker think that the URL is an image. On the other hand, anything after the ? doesn't change the actual webpage requested, it only changes the GET headers. (so http://...


58

Even if you wanted to, I don't think you can remove the root user. From Wikipedia: On Unix-like systems, for example, the user with a user identifier (UID) of zero is the superuser, regardless of the name of that account. and a lot of the kernel code that vulnerabilities exploit does stuff like // become root uid = 0; ... if (uid == 0) // do some ...


54

You don't have to worry about spoofing the IP from a different connection, because returned TCP packets would not make it to the attacker in that scenario. So all you have to worry about is how easy it is for the attacker to make use of that IP: Is that IP shared between multiple computers in the office? Can that IP be used on WiFi? How well is the ...


51

The problem isn't with this situation in particular. Let's assess the situation here: You're a trustworthy person to them The password is very likely securing trivial data Giving you the password isn't that big of a deal in this case. The problem (like you stated in your question) is that getting him in the habit of giving out passwords. I'd definitely go ...


48

In addition to all the other reasons given: Software licences. You and other employees need certain programs to do your work. These programs are usually licensed for a limited number of users. The company want to control this and the easiest way is by controlling the machines. Letting employees install these programs on their own computers would be both a ...


45

The accepted solution to this is to not store the logs locally, but on a log server. Once the logs are there, you can restrict or limit access as you see fit. In some log server/aggregator solutions, you can limit a user from seeing entries that contain references to certain data (like their user accounts or machine IPs). This means that you can enable ...


41

These security systems provide tools to isolate applications from each other... and in turn isolate an attacker from the rest of the system when an application is compromised. SELinux rule sets are incredibly complex but with this complexity you have more control over how processes are isolated. Generating these policies can be automated. A strike ...


41

MAC filtering is not a part of the 802.11 spec, and is instead shoved into wireless routers by (most) vendors. The reason why it's not a part of the 802.11 spec is because it provides no true security (via kerckhoff's principle). In order for wireless to work, MAC addresses are exchanged in plaintext (Regardless of whether you're using WEP, WPA, WPA2, or ...


39

The answer to your question is that it depends on a number of factors. What disk encryption product is in use? Does it make use of full disk encryption, or does it just encrypt parts of the disk (e.g. the users home directory) Are there any known vulnerabilities in the disk encryption product in use? What strength of password was used by the user of the ...


37

You can use a serial port. By default there are two data lines, one per each direction, plus a ground wire (which is irrelevant here). By disconnecting the appropriate line you can prevent communication in a certain direction. It's really easy to use it, at the very basic level I think you can run something like echo hello >> /dev/ttyS0 and receive it ...


36

DRM works pretty well for anything that you do not hand out to the users. Let's take Second Life as example. Second life is an 3d online game in which avatars are rather simple on their own in the sense that they cannot do anything beside moving around and using objects. Objects consists of a shape and texture, and they may contain scripts. Those scripts ...


34

You have covered the main ones. In short: it's very hard, if not impossible, to effectively block a site you want. You can make it hard by using the techniques you've mentioned: blocking IPs, redirecting DNS, blocking HTTP requests to certain sites / containing certain keywords. These methods are thwartable by proxies (in the case of deep packet inspection,...


34

Yes. With a cold boot attack. Depending on the software used to encrypt your data and when the attacker gets a hold of your laptop, there is a good chance that they can get access to whatever they want, if they know how. The problem lies in the fact that many disk-encryption tools, including BitLocker, store the keys in RAM. The trick to the attack is to ...


32

Protect the part of the site you want to protect with a username and password. Then only assign a username and password to people who sign an NDA, (or similar) that says they won't extract or copy information from your site. Another trick is to make all your content load from AJAX... and make the AJAX data URL load from paths that change (such as ~/todays-...


32

"Linux" (as some aggregate of all the installations) typically has quite a bit more than just a password denying external access. First, there's a uniform set of discretionary access controls: read/write/execute permissions, for user/group/everybody else. Traditionally, these permissions are actually used, rather than ignored and/or worked around. ...


30

As has @Adnan already pointed out in his answer, there is really no way of stopping a determined person from copying snapshots of your website. I used the word snapshots here, because that's what such content scrapers (or harvesters) are really copying. They don't (or at least shouldn't) have access to your backend where your website contents are actually ...


30

Real story, happened at a friends workplace (jurisdiction: Germany): A coworker of his rudely insulted clients via her company e-mail. She was fired for this. She did go to court. There, her lawyer made the court aware of the fact that the employees shared their passwords (for instance, for answering a client´s mail in the absence of a certain colleague). ...


29

This issue has come up on a couple SE forums already, so most of this is going to just be echoing my existing answers. How can I prevent someone from accessing a Windows XP system via boot disk? How to secure my Windows 7 PC? A couple of fairly major issues exist here, which are really working against you: Unless there's something you haven't mentioned, ...


29

What you need is relatively simple: you need to ensure that your students' unprivileged accounts are well confined. If you don't have a graphical environment involved, your situation is relatively simple. You should start by implementing the following actions: ensure users are created without administrative privileges (no sudo, no admin or wheel group) ...


27

This partly depends on the kind of software the dev team is expected to develop. Some types of software are easier to develop without administrative rights than others. For example, you can do a fair amount of web-based Java development using the likes of Eclipse with Maven artifacts, all installed locally (and typically tested on port 8080), without ...


27

In computer security, they are used interchangeably. In the context of rights, permission implies consent given to any individual or group to perform an action. Privilege is a permission given to an individual or group. Privileges are used to distinguish between different granted permissions (including no permission.) A privilege is a permission to ...


Only top voted, non community-wiki answers of a minimum length are eligible