A blog about Information Security and other ramblings.
I somewhat freestyled this writeup originally to help developers at work with some concepts used in authorization frameworks. But, upon reflection I thought a genericized version of this could be generally useful to anyone diving into technologies that use ReBAC or PARC (what are those? find out below!).
The goals are to have an article to point to, to illustrate to people when SAML (Security Assertion Markup Language) group attributes are sufficient and when SCIM (System for Cross-domain Identity Management) is also required to achieve security needs.
Back in the days of 2016 I worked for BlackBerry, they don’t make phones anymore but they were doing Android phones back then!. A security issue that I was very unhappy about in AOSP was the security of data transferred across applications via the Global Clipboard.
I don’t care about the tech stuff skip to the safety recommendations.
What would be the pre-requisites for using such a concept? What is the problem I’d like to have a better solution for? Solution Overview So what does this solution look like to a developer? Closing thoughts Last post I wrote about some overview thoughts about data-protection in a programming environment, in this one though I want to zoom in on the last item in that post on custom “boxing” of…
What’s better? They want to reference the data but don’t need to immediately do anything with it They want to move it to some other data store that is aware of your data-store’s existence They want to read, maybe modify some aspects of the data and then store elsewhere Conclusion People (me) often forget that Information Security (the field that I work in) has the word “ Information ” at the front…
Why was this so hard to do…?
Problem Statement Inspiration Missing Pieces Benefits Taking it further No doubt, when I write this (assuming someone reads it) someone might say: “Oh, you should have used Garibaldi…. or Ozymandias or Plato.js” …or some other framework. Please let me know in the comments, I couldn’t find anything on this and must have been searching for the wrong keywords. When that happens I’ll add an ‘edit’…
I’ve seen so much variance on this in reviewing designs for software systems that it would be good to have a reference to point to of what I like to see and why I think it’s beneficial.
I was thinking that this could be useful, I’ve worked security for large and small businesses and think I can have a stab at what the smaller category should be concerned with.