253
votes
Accepted
Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)
So this is an interesting question with a few points into why you not only should WANT to do this, but should do this for your own safety and security. It helps first if you understand that companies ...
- 7,006
153
votes
Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)
As a guy who writes and enforces these types of corporate policies, I can tell you this: it is perfectly normal, and a perfectly reasonable policy.
I do NOT want your equipment on my network, ever. ...
- 128k
148
votes
Why avoid shared user accounts?
Alice and Eve work for Bob. Alice is a very good worker who does exactly what Bob asks her to do. Eve is a criminal mastermind hell-bent on destroying Bob's company.
Alice and Eve both share the same ...
90
votes
Why is it bad to connect internal systems to the Internet?
First, it might be best to fully understand the client (your boss's) needs. It's possible he or she only needs access to one small subset of the data on this server from anywhere and not necessarily ...
- 14.2k
79
votes
Accepted
Global variables and information security
Boycott Globals!
I'm stealing from Steffen Ullrich's comment, but the main issue with global variables is that they make it difficult to keep code well organized and maintainable. His link is a fine ...
- 30.9k
77
votes
Accepted
Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)
Yes, they can.
Simple answer: You authenticate in some way to your identity provider, usually via username and password. The bad admin can store the transmitted credentials and just re-use them. This ...
- 3,382
76
votes
Accepted
Why is email often used as the ultimate verification?
This seems like a very wrong medium to send such information via.
Email is used for the same reasons Social Security Numbers get re-used as account identifiers in the US: Ubiquity.
Not everyone has a ...
- 72.7k
60
votes
Accepted
How can I prevent a user from copying files to another hard drive?
You can disable USB storage on Linux by blacklisting the module.
modprobe -r usb-storage
echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf
echo blacklist uas >> /...
- 15.4k
58
votes
Accepted
Can the root user be removed from a *nix system to prevent privilege-escalation?
Even if you wanted to, I don't think you can remove the root user. From Wikipedia:
On Unix-like systems, for example, the user with a user identifier (UID) of zero is the superuser, regardless of ...
- 58.8k
54
votes
Is it a bad idea to bypass login wall for a specified IP address?
You don't have to worry about spoofing the IP from a different connection, because returned TCP packets would not make it to the attacker in that scenario.
So all you have to worry about is how easy ...
- 14k
51
votes
Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)
In addition to all the other reasons given:
Software licences. You and other employees need certain programs to do your work. These programs are usually licensed for a limited number of users.
The ...
- 2,433
44
votes
How to prevent admins to access logs from their own activity?
The accepted solution to this is to not store the logs locally, but on a log server. Once the logs are there, you can restrict or limit access as you see fit.
In some log server/aggregator solutions,...
- 128k
42
votes
Accepted
Authentication versus Authorisation
once A gets falsely authenticated as B...
On any minimally secure system, this isn't how it happens. From the system's point of view, User B is authenticating himself, not User A. It was not falsely ...
- 53.5k
40
votes
If password expiration is applied, should door-lock expiration be applied too?
You asked, ‘if passwords should expire periodically, then should door locks expire periodically?’. Well, from a false premise you can derive any conclusion! The premise of periodic password ...
- 2,656
38
votes
Accepted
How can I publish data from a private network without adding a bidirectional link to another network
You can use a serial port. By default there are two data lines, one per each direction, plus a ground wire (which is irrelevant here). By disconnecting the appropriate line you can prevent ...
- 12.8k
38
votes
If password expiration is applied, should door-lock expiration be applied too?
Password rotation policies are in place to reduce specific risks which allow an attacker to get (and use) the user’s password. These risks are password reuse, credential phishing or other forms of ...
- 198k
30
votes
Why avoid shared user accounts?
Real story, happened at a friends workplace (jurisdiction: Germany):
A coworker of his rudely insulted clients via her company e-mail. She was fired for this. She did go to court. There, her lawyer ...
- 401
27
votes
Can the root user be removed from a *nix system to prevent privilege-escalation?
As argued by others, it makes no sense to "remove" the root UID (which is represented on UNIX as the UID 0). I would go even further and state that it makes no sense to freeze a system into not having ...
- 6,848
27
votes
Accepted
Accessing document using a 6 letter token
Brute forcing
So you have an alphabet of size 36 and 6 characters. That gives you about two billion different tokens. Lets say you have a thousand different documents. That gives you a chanse of one ...
- 65.4k
27
votes
Why is email often used as the ultimate verification?
While you correctly identified problems with e-mail, a mail based verification is still considered sufficiently secure for many cases. While there are alternatives like SMS based verification, ...
- 198k
25
votes
The teacher logged me in as administrator for doing a short task, is the whole system now compromised?
The teacher logged me in as administrator for doing a short task, is the whole system now compromised?
No.
but I was able to reset the administrator password with lusrmgr.
Now it is, ...
- 367
24
votes
Reading physical memory frame previously owned by another process to read contents of its memory page
I was curious of this myself once, and wrote a small program under linux that malloc'ed all available memory and dumped it to disk.
It turned out that it was all zeroed out before it was handed to my ...
- 5,799
24
votes
Why is it bad to connect internal systems to the Internet?
Are there some reasons that connecting internal systems directly to the internet is a bad thing?
You're unnecessarily increasing the attack surface.
Here are problems to consider:
An attacker who ...
- 44.6k
23
votes
Reading physical memory frame previously owned by another process to read contents of its memory page
In Linux, processes is able to read another process memory when any of the following conditions applies:
The process had root permission or it can read /proc/$PID/mem or /dev/mem, by default /proc/$...
- 31.4k
21
votes
How can I prevent a user from copying files to another hard drive?
Client-server architecture
This is another approach that could make copying files much harder, but it requires investing more effort from your side.
Access to the information could be setup on a ...
- 1,234
20
votes
Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)
TL;DR:
A bad Facebook admin who can spoof your Facebook login can post bad stuff under your name on Facebook, and that is usually considered worse than posting a question on Stack Exchange.
My more ...
- 1,559
19
votes
How to handle refresh tokens
The point of having access tokens is that they can be used without checking for invalidation. You can have 10000 frontend servers users can access with the token without the need to ever ask some ...
- 5,963
19
votes
How can I prevent a user from copying files to another hard drive?
In addition to blocking USB (see other answers above):
Disable networking, because...
... otherwise user will use remote access to your machine, e.g. via scp or ftp, and copy files from your machine....
- 12.2k
18
votes
How can I publish data from a private network without adding a bidirectional link to another network
I love how much my search performance increases as soon as I am done posting my question ;D
Wikipedia to the rescue:
"Sneakernet is an informal term describing the transfer of electronic information ...
- 513
Only top scored, non community-wiki answers of a minimum length are eligible