252 votes
Accepted

Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)

So this is an interesting question with a few points into why you not only should WANT to do this, but should do this for your own safety and security. It helps first if you understand that companies ...
user avatar
152 votes

Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)

As a guy who writes and enforces these types of corporate policies, I can tell you this: it is perfectly normal, and a perfectly reasonable policy. I do NOT want your equipment on my network, ever. ...
user avatar
  • 123k
147 votes

Why avoid shared user accounts?

Alice and Eve work for Bob. Alice is a very good worker who does exactly what Bob asks her to do. Eve is a criminal mastermind hell-bent on destroying Bob's company. Alice and Eve both share the same ...
user avatar
90 votes

Why is it bad to connect internal systems to the Internet?

First, it might be best to fully understand the client (your boss's) needs. It's possible he or she only needs access to one small subset of the data on this server from anywhere and not necessarily ...
user avatar
  • 14.1k
79 votes
Accepted

Global variables and information security

Boycott Globals! I'm stealing from Steffen Ullrich's comment, but the main issue with global variables is that they make it difficult to keep code well organized and maintainable. His link is a fine ...
user avatar
76 votes
Accepted

Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)

Yes, they can. Simple answer: You authenticate in some way to your identity provider, usually via username and password. The bad admin can store the transmitted credentials and just re-use them. This ...
user avatar
  • 3,108
76 votes
Accepted

Why is email often used as the ultimate verification?

This seems like a very wrong medium to send such information via. Email is used for the same reasons Social Security Numbers get re-used as account identifiers in the US: Ubiquity. Not everyone has a ...
user avatar
  • 71.8k
60 votes
Accepted

How can I prevent a user from copying files to another hard drive?

You can disable USB storage on Linux by blacklisting the module. modprobe -r usb-storage echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf echo blacklist uas >> /...
user avatar
  • 12.5k
57 votes
Accepted

Can the root user be removed from a *nix system to prevent privilege-escalation?

Even if you wanted to, I don't think you can remove the root user. From Wikipedia: On Unix-like systems, for example, the user with a user identifier (UID) of zero is the superuser, regardless of ...
user avatar
54 votes

Is it a bad idea to bypass login wall for a specified IP address?

You don't have to worry about spoofing the IP from a different connection, because returned TCP packets would not make it to the attacker in that scenario. So all you have to worry about is how easy ...
user avatar
  • 13.8k
51 votes

Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)

In addition to all the other reasons given: Software licences. You and other employees need certain programs to do your work. These programs are usually licensed for a limited number of users. The ...
user avatar
  • 2,403
44 votes

How to prevent admins to access logs from their own activity?

The accepted solution to this is to not store the logs locally, but on a log server. Once the logs are there, you can restrict or limit access as you see fit. In some log server/aggregator solutions,...
user avatar
  • 123k
42 votes
Accepted

Authentication versus Authorisation

once A gets falsely authenticated as B... On any minimally secure system, this isn't how it happens. From the system's point of view, User B is authenticating himself, not User A. It was not falsely ...
user avatar
  • 50.3k
40 votes

If password expiration is applied, should door-lock expiration be applied too?

You asked, ‘if passwords should expire periodically, then should door locks expire periodically?’. Well, from a false premise you can derive any conclusion! The premise of periodic password ...
user avatar
39 votes

If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker?

The answer to your question is that it depends on a number of factors. What disk encryption product is in use? Does it make use of full disk encryption, or does it just encrypt parts of the disk (e....
user avatar
  • 60.7k
38 votes

If password expiration is applied, should door-lock expiration be applied too?

Password rotation policies are in place to reduce specific risks which allow an attacker to get (and use) the user’s password. These risks are password reuse, credential phishing or other forms of ...
user avatar
37 votes
Accepted

How can I publish data from a private network without adding a bidirectional link to another network

You can use a serial port. By default there are two data lines, one per each direction, plus a ground wire (which is irrelevant here). By disconnecting the appropriate line you can prevent ...
user avatar
  • 12.7k
34 votes

If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker?

Yes. With a cold boot attack. Depending on the software used to encrypt your data and when the attacker gets a hold of your laptop, there is a good chance that they can get access to whatever they ...
user avatar
  • 511
32 votes
Accepted

Is Linux really that secure, with only root password denying external access?

"Linux" (as some aggregate of all the installations) typically has quite a bit more than just a password denying external access. First, there's a uniform set of discretionary access controls: read/...
user avatar
  • 4,522
30 votes

Why avoid shared user accounts?

Real story, happened at a friends workplace (jurisdiction: Germany): A coworker of his rudely insulted clients via her company e-mail. She was fired for this. She did go to court. There, her lawyer ...
user avatar
  • 401
28 votes
Accepted

Server for School Coding Assignments

What you need is relatively simple: you need to ensure that your students' unprivileged accounts are well confined. If you don't have a graphical environment involved, your situation is relatively ...
user avatar
27 votes

Can the root user be removed from a *nix system to prevent privilege-escalation?

As argued by others, it makes no sense to "remove" the root UID (which is represented on UNIX as the UID 0). I would go even further and state that it makes no sense to freeze a system into not having ...
user avatar
27 votes
Accepted

Accessing document using a 6 letter token

Brute forcing So you have an alphabet of size 36 and 6 characters. That gives you about two billion different tokens. Lets say you have a thousand different documents. That gives you a chanse of one ...
user avatar
  • 64.2k
27 votes

Why is email often used as the ultimate verification?

While you correctly identified problems with e-mail, a mail based verification is still considered sufficiently secure for many cases. While there are alternatives like SMS based verification, ...
user avatar
25 votes

The teacher logged me in as administrator for doing a short task, is the whole system now compromised?

The teacher logged me in as administrator for doing a short task, is the whole system now compromised? No. but I was able to reset the administrator password with lusrmgr. Now it is, ...
user avatar
  • 367
24 votes

Reading physical memory frame previously owned by another process to read contents of its memory page

I was curious of this myself once, and wrote a small program under linux that malloc'ed all available memory and dumped it to disk. It turned out that it was all zeroed out before it was handed to my ...
user avatar
24 votes

Why is it bad to connect internal systems to the Internet?

Are there some reasons that connecting internal systems directly to the internet is a bad thing? You're unnecessarily increasing the attack surface. Here are problems to consider: An attacker who ...
user avatar
  • 43.7k
23 votes

Reading physical memory frame previously owned by another process to read contents of its memory page

In Linux, processes is able to read another process memory when any of the following conditions applies: The process had root permission or it can read /proc/$PID/mem or /dev/mem, by default /proc/$...
user avatar
  • 31k
21 votes

How can I prevent a user from copying files to another hard drive?

Client-server architecture This is another approach that could make copying files much harder, but it requires investing more effort from your side. Access to the information could be setup on a ...
user avatar
  • 1,224

Only top scored, non community-wiki answers of a minimum length are eligible