148

Alice and Eve work for Bob. Alice is a very good worker who does exactly what Bob asks her to do. Eve is a criminal mastermind hell-bent on destroying Bob's company. Alice and Eve both share the same account. Eve logs into the account and uses it to sabotage an important business process. The audit log captures this action. How does Bob know who sabotaged ...


58

You can disable USB storage on Linux by blacklisting the module. modprobe -r usb-storage echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf echo blacklist uas >> /etc/modprobe.d/10-usbstorage-blacklist.conf If your users have physical access to the machine, and knows the encryption keys, the game is up no matter what ...


45

The accepted solution to this is to not store the logs locally, but on a log server. Once the logs are there, you can restrict or limit access as you see fit. In some log server/aggregator solutions, you can limit a user from seeing entries that contain references to certain data (like their user accounts or machine IPs). This means that you can enable ...


30

Real story, happened at a friends workplace (jurisdiction: Germany): A coworker of his rudely insulted clients via her company e-mail. She was fired for this. She did go to court. There, her lawyer made the court aware of the fact that the employees shared their passwords (for instance, for answering a client´s mail in the absence of a certain colleague). ...


21

Client-server architecture This is another approach that could make copying files much harder, but it requires investing more effort from your side. Access to the information could be setup on a client-server architecture basis with information being stored in a database (such as MySQL or PostgreSQL) on a remote server in a secure location. Then, provide ...


20

In addition to blocking USB (see other answers above): Disable networking, because... ... otherwise user will use remote access to your machine, e.g. via scp or ftp, and copy files from your machine. ... otherwise logged in users will be able to transfer file via net from your machine to some other machine via scp, ftp, samba, http.


15

You should use separated account in all contexts (security on the top). Adonalsium example show you because it's required. There are some rare situations where it is "not possible" or "not usefull" ... Examples: "not possible" (legacy protocols/applications) "no relevant" (anonymous actions) If it is no possible, but you need to identify, you have to ...


13

OK, I'm totally not a security expert and maybe this is completely off the mark (let me know in the comments!), but... If you can secure the box physically (otherwise all bets are off), then maybe you can let the user log on only with user A. All the sensitive files however would belong to user B and inaccessible to user A. EXCEPT for one program "PDF ...


12

Any logs on a compromised host are suspect. You need a centralized logging platform, either a central syslog server/ splunk / logrhythm / whatever. Keep a different set of administrators and accounts. That's the whole idea. Once you get a platform in place you can delegate the rights to view their actions, either their own or other admins - can be ...


10

VNC Your files could be stored on a computer in a secure location. Setup a VNC server on it and disable file transfer capability. Per this question on ServerFault it can be done in TightVNC. Ensure no other ports are open on the computer that stores your files. Provide a VNC client station and lock it down by: disabling I/O ports in the OS and on the ...


9

The typical answer is accountability, traceability, etc; In other words to be able to know who exactly did what. A shared account has n potential people doing something but all that you have points to one account doing that thing. This problem is usually lifted by making sure someone is legally responsible for the activities of this account. This may or ...


6

"Only available to certain users" is not a measure of "availability". That's "confidentiality". Making sure that information is available to users who need it is a measure of "availability". Redundancy, backups, load balancing, parallelism are technical controls that address availability. Access control and encryption do not affect availability but affect ...


6

First, regarding what you have tried already: header('Access-Control-Allow-Origin: https://www.example.com'); This will fail for a number of reasons: This a client-level control that doesn't stop anyone from making requests to your endpoint anyway. This is, in fact, a flag for CORS in a browser, and isn't actually relevant to your use case. It would not ...


6

I don't think the granularity of permissions that can be achieved is relevant here. It doesn't matter if permission can be assigned to specific users, it matters which users can change permissions. Perhaps the DAC article is more clear about this: In computer security, discretionary access control (DAC) is a type of access control defined by the Trusted ...


5

The point of having access tokens is that they can be used without checking for invalidation. You can have 10000 frontend servers users can access with the token without the need to ever ask some database if it is invalid. But after some time, the token expires. The user needs a new access token, sends her refresh token and this refresh token is checked in ...


5

Best practices are nowhere "defined", that's what the term means. A best practice is simply an established way of doing things that most people think is the best way. It goes the other way around. Once a "best practice" is dominant, usually someone on a standards board decides to put it into some ISO or other norm. It then rests there, usually without ...


4

In a discretionary access control system the owner of the source decides who can access data. In a mandatory access control system an admin decides who can access data, which is then typically determined by policy. For example, all files in the ABC directory can only be read by XYZ users. In a MAC system no non-XYZ users could read the file. In a DAC ...


4

I only know one exception to that rule. There is one single machine that is shared by several users, and the following assertions are all true: one and only one of those users is in charge of this machine at any moment the account can only be used on the local machine - disabled via network This may happen on 7/7 24/24 systems. In that use case, you still ...


4

You aren't going to be able to "win" this per se, most people have an adversarial attitude towards technology at best. They got their current understanding mostly through guess-work, trial-and-error, and a healthy dollop of luck, and they know it. Any change means going through that all over again. That being said, most of the objections you are getting are ...


4

The search string you are looking for is "SMTP server require authentication" (or just "<server product name> authentication"). To be clear, what you're establishing isn't really a "Telnet Connection", it's an SMTP connection that you're typing in by hand using telnet. If you tried to send anything that wasn't valid SMTP traffic, the server would ...


3

Kerckhoff's principle applies here: it should not. In theory, the list of user's privilege should match what the user is authorised to do. In practice, some oversight may cause you to grant a user more privilege than they really need, and disclosing authorisation information just makes it easier for them to figure that out. The only drawback here is if the ...


3

You have asked a high-level question, so I'll provide a high-level answer. Don't think about the problem in terms of "decreasing security" (which is undefined at best), but think in terms of "vulnerability" and "hazard". What vulnerabilities (system and control weaknesses) are exposed through the disclosure of the information? What hazards (unsafe ...


3

Your idea on the domains is rather wrong. You need to understand one essential thing about a web server. There is no such thing like "an access from a domain". It is not a "software" which is sending requests to endpoints but a client (which is usually a browser). A client may read some information from your server first, but it's unnecessary. Long story ...


3

That is a complete different paradigm where for a new application you identify what generic users cannot do and implement that security, not the contrary. That sounds like an awful and insecure paradigm, too! What a huge design and development burden! The secure paradigm is to block everyone from everything at the start, then add the privileges they ...


3

You're perhaps conflating GMail API and Google Auth (which is used by GMail). The site cannot see whether you're logged in or not (it can be worked out with a bit of trouble), and cannot access your email address, much less your inbox. You can give Google permission to give the site information about your Google login. At that point the site'll know your ...


3

If the CN (or other parts of the certificate like SAN) is usable for authentication depends on how much you can trust the one who put the CN there to properly verify the value. For example with a self-signed certificates you cannot trust the CN at all since you cannot verify who created the certificate in the first place (anybody could) and thus cannot trust ...


3

In a sensitive system, user accounts should never be shared. This is for liability, auditability, nonrepudiation, and compliance reasons. So giving out the main account is out of the question.


3

Another issue not yet mentioned is that if someone receives notification that their account is being accessed or has been accessed at a time when they're aren't/weren't accessing it and wouldn't expect anyone else to do so, they're much more likely to sound an alarm than they would be if they thought that the account might have been accessed by someone whom ...


3

Here are a few bullet points for easier understanding and a quick review. Accountability Accountability is another important principle of information security that refers to the possibility of tracing actions and events back in time to the users, systems, or processes that performed them, to establish responsibility for actions or omissions. Compliance ...


3

ISPs cannot inject their own pages into HTTPS traffic. They can block the traffic and cause the page to fail to load, or they can attempt to hijack a HTTP->HTTPS redirect before the encrypted connection is made, but they cannot modify the contents of the page itself once the connection is established. The only way for them to do this would be if you had ...


Only top voted, non community-wiki answers of a minimum length are eligible