248

So this is an interesting question with a few points into why you not only should WANT to do this, but should do this for your own safety and security. It helps first if you understand that companies point of view before we talk about how it can benefit you. Why would a company want to do this? Many reasons. It makes it assured that your computer can ...


179

Was the teacher right to do this? Yes and no. One might be tempted to say that giving a student administrative rights is highly problematic, and leaving them unattended even more so. And to some degree, I even agree with it. You may have added a new administrative user, changed the admin credentials, installed a rootkit or more. But... Acting maliciously ...


150

As a guy who writes and enforces these types of corporate policies, I can tell you this: it is perfectly normal, and a perfectly reasonable policy. I do NOT want your equipment on my network, ever. I can't control it, I have no insight into how patched it is, how virus-ridden it is, and I do NOT want you to keep company data on your personal device when ...


147

Alice and Eve work for Bob. Alice is a very good worker who does exactly what Bob asks her to do. Eve is a criminal mastermind hell-bent on destroying Bob's company. Alice and Eve both share the same account. Eve logs into the account and uses it to sabotage an important business process. The audit log captures this action. How does Bob know who sabotaged ...


105

The file and folder/directory permissions on an operating system are managed and enforced by... you guessed it right, that operating system (OS). When the operating system is taken out of the picture (booting a different operating system), then those permissions become meaningless. One way to think of it: You hire a big bodyguard (OS) to protect your house. ...


89

First, it might be best to fully understand the client (your boss's) needs. It's possible he or she only needs access to one small subset of the data on this server from anywhere and not necessarily all of it. Where possible, instead of saying no in this situation come back with a few options. VPN so people travelling, can access the data wherever they ...


88

No, there's no way to do it. Without setting connection parameter limits, there's even no way to make it relatively difficult. If a legitimate user can access your website, they can copy its contents, and if they can do it normally with a browser, then they can script it. You might setup User-Agent restrictions, cookie validation, maximum connections, and ...


79

Boycott Globals! I'm stealing from Steffen Ullrich's comment, but the main issue with global variables is that they make it difficult to keep code well organized and maintainable. His link is a fine one, but you won't have any trouble finding countless articles about the problems with global variables online. When you use global variables, it becomes easy ...


75

Yes, they can. Simple answer: You authenticate in some way to your identity provider, usually via username and password. The bad admin can store the transmitted credentials and just re-use them. This attack does not depend on how the backend is implemented. In general your password for the identity provider isn't used for authentication to third-party ...


62

At every place I have worked (as a contract developer) developers are given local admin rights on their desktops. The reasons are: 1) Developers toolsets are often updated very regularly. Graphics libraries, code helpers, visual studio updates; they end up having updates coming out almost weekly that need to be installed. Desktop support usually gets ...


62

Most probably the blocker is designed to let images through, maybe because they are hotlinking some images on the page where they ask for you to login. Appending ?.jpg to the URL makes the blocker think that the URL is an image. On the other hand, anything after the ? doesn't change the actual webpage requested, it only changes the GET headers. (so http://...


58

You can disable USB storage on Linux by blacklisting the module. modprobe -r usb-storage echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf echo blacklist uas >> /etc/modprobe.d/10-usbstorage-blacklist.conf If your users have physical access to the machine, and knows the encryption keys, the game is up no matter what ...


57

Even if you wanted to, I don't think you can remove the root user. From Wikipedia: On Unix-like systems, for example, the user with a user identifier (UID) of zero is the superuser, regardless of the name of that account. and a lot of the kernel code that vulnerabilities exploit does stuff like // become root uid = 0; ... if (uid == 0) // do some ...


54

You don't have to worry about spoofing the IP from a different connection, because returned TCP packets would not make it to the attacker in that scenario. So all you have to worry about is how easy it is for the attacker to make use of that IP: Is that IP shared between multiple computers in the office? Can that IP be used on WiFi? How well is the ...


51

The problem isn't with this situation in particular. Let's assess the situation here: You're a trustworthy person to them The password is very likely securing trivial data Giving you the password isn't that big of a deal in this case. The problem (like you stated in your question) is that getting him in the habit of giving out passwords. I'd definitely go ...


50

In addition to all the other reasons given: Software licences. You and other employees need certain programs to do your work. These programs are usually licensed for a limited number of users. The company want to control this and the easiest way is by controlling the machines. Letting employees install these programs on their own computers would be both a ...


44

The accepted solution to this is to not store the logs locally, but on a log server. Once the logs are there, you can restrict or limit access as you see fit. In some log server/aggregator solutions, you can limit a user from seeing entries that contain references to certain data (like their user accounts or machine IPs). This means that you can enable ...


43

These security systems provide tools to isolate applications from each other... and in turn isolate an attacker from the rest of the system when an application is compromised. SELinux rule sets are incredibly complex but with this complexity you have more control over how processes are isolated. Generating these policies can be automated. A strike ...


41

MAC filtering is not a part of the 802.11 spec, and is instead shoved into wireless routers by (most) vendors. The reason why it's not a part of the 802.11 spec is because it provides no true security (via kerckhoff's principle). In order for wireless to work, MAC addresses are exchanged in plaintext (Regardless of whether you're using WEP, WPA, WPA2, or ...


41

once A gets falsely authenticated as B... On any minimally secure system, this isn't how it happens. From the system's point of view, User B is authenticating himself, not User A. It was not falsely authenticated, it was using the real login and password. It's simple case of Credential Theft. You could harden the system using any form of 2FA, but the system ...


39

The answer to your question is that it depends on a number of factors. What disk encryption product is in use? Does it make use of full disk encryption, or does it just encrypt parts of the disk (e.g. the users home directory) Are there any known vulnerabilities in the disk encryption product in use? What strength of password was used by the user of the ...


39

You asked, ‘if passwords should expire periodically, then should door locks expire periodically?’. Well, from a false premise you can derive any conclusion! The premise of periodic password expiration is foolish and counterproductive and damages security by imposing pointless administrivia on users for feeble defense against hypothetical attack vectors. ...


38

Password rotation policies are in place to reduce specific risks which allow an attacker to get (and use) the user’s password. These risks are password reuse, credential phishing or other forms of social attacks to get the password, compromise of a server and thus access to the hashed passwords or brute forcing. None of these risks really apply for physical ...


37

You can use a serial port. By default there are two data lines, one per each direction, plus a ground wire (which is irrelevant here). By disconnecting the appropriate line you can prevent communication in a certain direction. It's really easy to use it, at the very basic level I think you can run something like echo hello >> /dev/ttyS0 and receive it ...


35

You have covered the main ones. In short: it's very hard, if not impossible, to effectively block a site you want. You can make it hard by using the techniques you've mentioned: blocking IPs, redirecting DNS, blocking HTTP requests to certain sites / containing certain keywords. These methods are thwartable by proxies (in the case of deep packet inspection,...


34

Yes. With a cold boot attack. Depending on the software used to encrypt your data and when the attacker gets a hold of your laptop, there is a good chance that they can get access to whatever they want, if they know how. The problem lies in the fact that many disk-encryption tools, including BitLocker, store the keys in RAM. The trick to the attack is to ...


33

Protect the part of the site you want to protect with a username and password. Then only assign a username and password to people who sign an NDA, (or similar) that says they won't extract or copy information from your site. Another trick is to make all your content load from AJAX... and make the AJAX data URL load from paths that change (such as ~/todays-...


32

"Linux" (as some aggregate of all the installations) typically has quite a bit more than just a password denying external access. First, there's a uniform set of discretionary access controls: read/write/execute permissions, for user/group/everybody else. Traditionally, these permissions are actually used, rather than ignored and/or worked around. ...


31

As has @Adnan already pointed out in his answer, there is really no way of stopping a determined person from copying snapshots of your website. I used the word snapshots here, because that's what such content scrapers (or harvesters) are really copying. They don't (or at least shouldn't) have access to your backend where your website contents are actually ...


30

Real story, happened at a friends workplace (jurisdiction: Germany): A coworker of his rudely insulted clients via her company e-mail. She was fired for this. She did go to court. There, her lawyer made the court aware of the fact that the employees shared their passwords (for instance, for answering a client´s mail in the absence of a certain colleague). ...


Only top voted, non community-wiki answers of a minimum length are eligible