#access-control — Public Fediverse posts

Inactive User Account Enables Hackers to Control City's Water System

A simple mistake of leaving a former employee's user account active allowed hackers to take control of a city's water system, highlighting the importance of promptly disabling access for departed staff. This "zombie" account proved to be the vulnerable entry point that attackers exploited to wreak havoc on…

https://osintsights.com/inactive-user-account-enables-hackers-to-control-citys-water-system?utm_source=mastodon&utm_medium=social

#InactiveUserAccount #ZombieAccount #MunicipalWaterSystem #InsiderThreat #AccessControl

🎉 Ah, formal verification for AI coding loops—because nothing says "cutting-edge" like rehashing access control strategies from the Stone Age! 🙄 We're all eagerly awaiting AI that can outsmart a paperclip, while the real heroes valiantly juggle 'structural backpressure' to keep Alice from raiding Bob's diary. 🏆
https://reubenbrooks.dev/blog/structural-backpressure-beats-smarter-agents/ #formalverification #AIcoding #accesscontrol #structuralbackpressure #techhumor #HackerNews #ngated

🎉 Ah, formal verification for AI coding loops—because nothing says "cutting-edge" like rehashing access control strategies from the Stone Age! 🙄 We're all eagerly awaiting AI that can outsmart a paperclip, while the real heroes valiantly juggle 'structural backpressure' to keep Alice from raiding Bob's diary. 🏆
https://reubenbrooks.dev/blog/structural-backpressure-beats-smarter-agents/ #formalverification #AIcoding #accesscontrol #structuralbackpressure #techhumor #HackerNews #ngated

Access to frontier AI will soon be limited by economic and security constraints

https://writing.antonleicht.me/p/cut-off

#HackerNews #frontierAI #economicconstraints #securitylimits #accesscontrol

Access to frontier AI will soon be limited by economic and security constraints

https://writing.antonleicht.me/p/cut-off

#HackerNews #frontierAI #economicconstraints #securitylimits #accesscontrol

Upgrade from traditional locks to smart access control 🔑
Rosslare offers scalable and secure solutions for modern businesses.

📞 Contact SARC Infosolution
📱 +91-9594283444
📧 [email protected]

📢 WhatsApp Channel: https://zurl.co/tmzeQ

#SmartLocks #AccessControl #Rosslare #Automation #SARC

Finalizing the slides for today’s session on Zero Trust controls. PAM is often the missing piece of the puzzle for many orgs. Looking forward to breaking down how to limit the "blast radius" when things go sideways. 💥🛡️
See you there!

#CyberSecurity #InfoSec #ZeroTrust #PAM #AccessControl #TechPost

Finalizing the slides for today’s session on Zero Trust controls. PAM is often the missing piece of the puzzle for many orgs. Looking forward to breaking down how to limit the "blast radius" when things go sideways. 💥🛡️
See you there!

#CyberSecurity #InfoSec #ZeroTrust #PAM #AccessControl #TechPost

Security is no longer optional — it’s critical.
With Rosslare Access Control Systems, ensure only authorized access across your facility.

✔️ Smart Controllers
✔️ RFID & Biometric Integration
✔️ Centralized Monitoring

📞 Contact SARC Infosolution
📱 +91-9594283444
📧 [email protected]

📢 WhatsApp Channel: https://zurl.co/k3gHX

#AccessControl #Rosslare #SecuritySolutions #SmartSecurity #SARC #SARCInfosolution

🔐 Cyber Tip: Regularly audit admin accounts for unauthorized access.

Limit who has elevated privileges and remove access that is no longer required. Admin accounts are prime targets.

https://zurl.co/9g1DY

#Zevonix #CyberSecurity #AccessControl #PalmCoast

No One Said No – Overprivileged AI Systems
https://youtu.be/SFvZ_KjjAPA #AIsecurity #CyberSecurity #ArtificialIntelligence #AIrisks #AgenticAI #ZeroTrust #LeastPrivilege #AccessControl #InfoSec #CyberRisk #DataSecurity #EnterpriseSecurity #AIgovernance #SecurityLeadership

No One Said No – Overprivileged AI Systems
https://youtu.be/SFvZ_KjjAPA #AIsecurity #CyberSecurity #ArtificialIntelligence #AIrisks #AgenticAI #ZeroTrust #LeastPrivilege #AccessControl #InfoSec #CyberRisk #DataSecurity #EnterpriseSecurity #AIgovernance #SecurityLeadership

🚨 CVE-2026-34570 (CVSS 10): CRITICAL improper access control in ci4ms < 0.31.0.0 lets deleted accounts retain access via active sessions. Patch to 0.31.0.0+ ASAP! Details: https://radar.offseq.com/threat/cve-2026-34570-cwe-284-improper-access-control-in--917f2c32 #OffSeq #CVE202634570 #AccessControl #Infosec

A little work kvetching here, but willing to be contradicted by people in the know:

It is my experience that there are only two tiers of physical access control integrators: certifiably high-security operations, and everyone else.

...and my ongoing ~2 decades worth of experience with varied providers of the latter category is that they all seem to be awful without exception.

#PhysicalSecurity #AccessControl #Security

A little work kvetching here, but willing to be contradicted by people in the know:

It is my experience that there are only two tiers of physical access control integrators: certifiably high-security operations, and everyone else.

...and my ongoing ~2 decades worth of experience with varied providers of the latter category is that they all seem to be awful without exception.

#PhysicalSecurity #AccessControl #Security

🏨 Creating Safer Hospitality Environments

Hotels today require smart surveillance, access control, and integrated security.

SARC Infosolution delivers complete solutions including:

• CCTV – Vicon
• Access Control – Rosslare
• Smart Building Systems – https://zurl.co/OJz2O

Helping hotels protect guests while improving operational efficiency.

Hashtags

#HotelSecurity
#HospitalityTechnology
#SmartHotels
#AccessControl
#GuestSafety

Every staffing decision affects security and compliance. Access control, onboarding, and offboarding processes must be designed carefully to reduce risk in 2026.

#ITCompliance #SecurityOperations #RiskManagement #AccessControl

Discover How Access Management System Works in Odoo

Explore the powerful Access Management System in Odoo and understand how businesses can control user permissions, restrict models, secure fields, and manage record-level access with precision.

Odoo’s access control mechanism helps organizations define who can read, write, create, or delete records using groups, roles, record rules, and access rights.

Watch Now: https://youtu.be/k5XQGd6G9MU

#OdooERP #OdooFunctional #AccessControl
#ERPSystem

Incident Overview:
• Accidental disclosure via incorrect link sharing
• Recipient knowingly accessed confidential police documents
• Refusal to delete without compensation
• Arrest under suspected computer trespass provisions

Security Takeaways:
– Operational errors remain a primary breach vector
– Access control workflows must differentiate upload vs. download permissions
– User awareness and response protocols are critical
– Legal frameworks increasingly address post-error exploitation

This case illustrates a subtle but important principle: accidental exposure does not equate to authorized access.

From a governance and control perspective, what technical safeguards would you implement to prevent similar incidents?

Engage below.
Follow @technadu for cybersecurity intelligence and policy analysis.

#Infosec #DataGovernance #AccessControl #CyberLaw #SecurityOperations #IncidentResponse #RiskManagement #PrivacyCompliance #TechNadu

15 vulns disclosed in OpenClaw (1 critical, 9 high).
Auth bypasses, pipeline abuse, SSRF & command injection risks.

AI agents with system access demand stronger access controls.

https://www.technadu.com/15-openclaw-security-flaws-disclosed-as-ai-agent-platform-sees-rapid-enterprise-adoption/620374/

#AIAgents #AccessControl #ThreatIntel #CyberSecurity

Bitwarden introduces “Cupid Vault” — a 2-user shared Organization vault available on the free plan.

Security considerations:
• End-to-end encryption
• Vault isolation from personal storage
• Fingerprint phrase verification (anti-ATMIT enrollment control)
• Bidirectional sharing
• Revocable access

Limitations: 2 users, 2 collections. No RBAC granularity (reserved for paid tiers).

Question for practitioners:
Is secure shared vault architecture preferable to federated identity or delegated access models for small trust groups?

Source: https://www.bleepingcomputer.com/news/security/bitwarden-introduces-cupid-vault-for-secure-password-sharing/

Join the discussion below.
Follow @technadu for actionable security insights.

#InfoSec #PasswordManagement #ZeroTrust #Encryption #AccessControl #CyberDefense #Authentication #SecurityArchitecture #BlueTeam #PrivacyEngineering

Bitwarden introduces “Cupid Vault” — a 2-user shared Organization vault available on the free plan.

Security considerations:
• End-to-end encryption
• Vault isolation from personal storage
• Fingerprint phrase verification (anti-ATMIT enrollment control)
• Bidirectional sharing
• Revocable access

Limitations: 2 users, 2 collections. No RBAC granularity (reserved for paid tiers).

Question for practitioners:
Is secure shared vault architecture preferable to federated identity or delegated access models for small trust groups?

Source: https://www.bleepingcomputer.com/news/security/bitwarden-introduces-cupid-vault-for-secure-password-sharing/

Join the discussion below.
Follow @technadu for actionable security insights.

#InfoSec #PasswordManagement #ZeroTrust #Encryption #AccessControl #CyberDefense #Authentication #SecurityArchitecture #BlueTeam #PrivacyEngineering

Think agentic AI is hard to secure today? Just wait a few months https://www.csoonline.com/article/4123246/think-agentic-ai-is-hard-to-secure-today-just-wait-a-few-months.html #IdentityandAccessManagement #ArtificialIntelligence #AccessControl #Security

Cloudflare zero-day: Accessing any host globally

https://fearsoff.org/research/cloudflare-acme

#HackerNews #Cloudflare #ZeroDay #CloudSecurity #CyberThreats #Vulnerability #Research #AccessControl

Wi-Fi evolution tightens focus on access control https://www.helpnetsecurity.com/2026/01/09/wba-wi-fi-access-control/ #WirelessBroadbandAlliance #authentication #accesscontrol #cybersecurity #predictions #standards #wireless #network #News

Passwords are still breaking compliance programs https://www.helpnetsecurity.com/2026/01/06/passwords-compliance-control/ #passwordmanagement #accesscontrol #compliance #Don'tmiss #Hotstuff #Passwork #News

Wenn ihr euch mal das komplette Brett zu #AccessControl in #Linux (oder anderen Unixoiden) geben wollt: bin heute über https://venam.net/blog/unix/2023/02/28/access_control.html gestolpert. Long read, hab auch noch ein paar neue Dinge gelernt...

Is there anybody at #39c3 who would be willing to discuss an #nfc #iso15693 copy Problem? Anybody with experience in #cloning of such tags? Specifically for #accesscontrol systems?

Ubisoft’s Rainbow Six Siege disruption underscores the security complexity of large live-service platforms.

User reports suggest unauthorized backend activity impacting bans, in-game currency, and marketplace functions. Ubisoft has paused services and initiated rollbacks while investigating.

For InfoSec teams, this incident highlights the importance of access governance, monitoring of privileged systems, and clear incident communication - especially where digital economies are involved.

Thoughts from practitioners are welcome.
Follow @technadu for neutral, practitioner-focused cybersecurity coverage.

Source: https://cyberinsider.com/rainbox-six-siege-disrupted-by-breach-forcing-marketplace-shut-down/

#InfoSec #IncidentResponse #GameSecurity #PlatformRisk #AccessControl #CyberOperations

Permission Systems for Enterprise That Scale

https://eliocapella.com/blog/permission-systems-for-enterprise/

#HackerNews #PermissionSystems #EnterpriseScaling #Cybersecurity #AccessControl #TechTrends

🔔 CRITICAL: Plesk 18.0 (CVE-2025-66430) suffers from incorrect access control, risking unauthorized admin actions. No exploit yet, but review roles, restrict access, and monitor logs ASAP. Patch pending. https://radar.offseq.com/threat/cve-2025-66430-na-91279388 #OffSeq #Plesk #Vuln #AccessControl

SAML authentication broken almost beyond repair https://www.csoonline.com/article/4105030/saml-authentication-broken-almost-beyond-repair.html #IdentityandAccessManagement #Authentication #AccessControl #Security

Fortinet admins urged to update software to close FortiCloud SSO holes https://www.csoonline.com/article/4104499/fortinet-admins-urged-to-update-software-to-close-forticloud-sso-holes.html #IdentityandAccessManagement #Vulnerabilities #AccessControl #SingleSign-on #Security

Hybrid 2FA phishing kits are making attacks harder to detect https://www.csoonline.com/article/4100393/hybrid-2fa-phishing-kits-are-making-attacks-harder-to-detect.html #IdentityandAccessManagement #MultifactorAuthentication #SocialEngineering #Authentication #AccessControl #Cybercrime #Phishing #Security

What zero trust looks like when you build it step by step https://www.helpnetsecurity.com/2025/12/01/incremental-zero-trust-adoption-video/ #identitymanagement #securitymetrics #authentication #accesscontrol #cybersecurity #KeyDataCyber #Don'tmiss #zerotrust #Video #video #News

Server Security Checklist — Essential Hardening Guide

Securing your servers isn’t optional — it’s your first line of defense against data breaches, ransomware, insider threats, and lateral movement. Use this checklist as a baseline for Linux, Windows, cloud, hybrid, or on-prem servers.

⸻

🔧 1. System & OS Hardening
• Keep OS & packages updated (apply security patches frequently).
• Remove / disable unused services & software.
• Enforce secure boot + BIOS/UEFI passwords.
• Disable auto-login and guest accounts.
• Use minimal OS images only (reduce attack surface).

⸻

🔐 2. Access Control
• Enforce strong passwords & MFA everywhere.
• Use RBAC & least privilege access.
• Disable root/Administrator login over SSH/RDP.
• Rotate credentials & keys regularly.
• Implement just-in-time access for privileged users.

⸻

🌐 3. Network Security
• Restrict inbound/outbound traffic via firewalls.
• Segment critical servers from general LANs/VLANs.
• Disable unused ports & protocols.
• Enable DoS/DDoS protection.
• Apply zero-trust network principles.

⸻

🔑 4. Secure Remote Access
• Use SSH key-based authentication (disable password login).
• Enforce VPN for admin access.
• Log & monitor all remote access sessions.
• Disable legacy protocols (Telnet, FTP, SMBv1).
• Require bastion/jump host for critical access.

⸻

📊 5. Logging & Monitoring
• Enable centralized logging (syslog / SIEM).
• Track failed login attempts & anomalies.
• Configure alerts for privilege escalation or config changes.
• Monitor log tampering.
• Retain logs securely for audits & forensics.

⸻

🔒 6. Data Protection
• Encrypt data at rest (LUKS, BitLocker, etc.).
• Encrypt data in transit (TLS 1.2+).
• Strict database access policies.
• Regular, offline, immutable backups.
• Test restore procedures (don’t assume backups work).

⸻

🔁 7. Application & Patch Management
• Keep middleware, frameworks, and apps patched.
• Delete default credentials & sample files.
• Enable code signing for software packages.
• Use secure coding practices (OWASP Top 10).
• Implement dependency scanning (Snyk, Trivy, etc.).

⸻

🛡️ 8. Malware & Intrusion Defense
• Deploy EDR/AV on endpoints.
• Enable IDS/IPS at network edge.
• Automatic vulnerability scans (schedule weekly/monthly).
• Monitor persistence techniques (cron, startup scripts).
• Block known malicious IP ranges & TLDs.

⸻

🏢 9. Physical & Cloud Security
• Restrict physical access to server racks/rooms.
• Enable provider security tools (AWS Security Groups, Azure NSG, IAM).
• Harden cloud images (CIS benchmarks).
• Review cloud logging & audit trails regularly.
• Disable unused cloud API keys / roles.

⸻

📜 10. Policy & Compliance
• Use CIS / NIST / ISO-27001 benchmarks.
• Track & document every access change.
• Force annual access reviews & key rotation.
• Perform regular security training for admins.
• Maintain disaster recovery & incident plans.

⸻

➕ Additional 5 Critical Controls (Advanced Hardening)

🧠 11. Privileged Access Management (PAM)
• Use jump hosts & session recording.
• Just-In-Time access for admins.
• Store keys in secure vaults (HashiCorp Vault, CyberArk).

🚨 12. Real-Time Threat Detection
• Use behavioral analytics → UEBA/XDR.
• AI-based anomaly detection recommended.
• Block suspicious IPs automatically.

🧪 13. Red Team & Pentesting
• Run regular internal pentests.
• Validate configuration weaknesses.
• Simulate phishing + lateral movement scenarios.

🧱 14. Container / VM Isolation
• Use AppArmor, SELinux, Seccomp profiles.
• Limit Docker socket access & root containers.
• Scan images before deployment.

📦 15. Automated Configuration Management
• Use IaC (Terraform, Ansible, Puppet) for repeatable and secure builds.
• Detect drift using compliance scanning.
• Version control all infrastructure.

⸻

🧠 Core Reminder

A server is only as secure as the team who maintains it.
Hardening isn’t one task — it’s an ongoing

#ServerSecurity #SystemHardening #InfoSec #CyberSecurity #BlueTeam
#DevSecOps #SysAdmin #ThreatDetection #AccessControl #NetworkSecurity
#LinuxSecurity #SecureArchitecture #RiskMitigation #SecurityChecklist
#CloudSecurity #InfrastructureSecurity #ZeroTrust #SecurityMonitoring

Intellivix Data Breach: VIXpass Access Control Source Code Stolen https://dailydarkweb.net/intellivix-data-breach-vixpass-access-control-source-code-stolen/ #SurveillanceTechnology #sourcecodeleak #AccessControl #DataBreaches #Biometrics #databreach #Intellivix #SouthKorea #VisionAI #VIXpass #AI

Telecom security reboot: Why zero trust is the only way forward https://www.csoonline.com/article/4095382/telecom-security-reboot-why-zero-trust-is-the-only-way-forward.html #IdentityandAccessManagement #TelecommunicationsIndustry #AccessControl #ZeroTrust #Industry #Security #Markets

How an AI meltdown could reset enterprise expectations https://www.helpnetsecurity.com/2025/11/25/graham-mcmillan-redgate-software-ai-security-future/ #Artificialintelligence #incidentresponse #RedgateSoftware #accesscontrol #cybersecurity #regulation #Don'tmiss #Features #Hotstuff #strategy #News #CISO #tips #CIO

Supply chain sprawl is rewriting security priorities https://www.helpnetsecurity.com/2025/11/25/isc2-vendor-security-gaps-report/ #thirdpartycompromise #riskmanagement #accesscontrol #cybersecurity #supplychain #databreach #report #News #ISC2