CSA SDP Working Group
|
|
- Meredith Nelson
- 8 years ago
- Views:
Transcription
1 CSA SDP Working Group An Open Source Code Project for a Software Defined Perimeter to Defend Cloud Applications from DDoS CSA Conference - Berlin November 2015
2 DHS Problem Addressing the Changing Perimeter Addressing Monitoring & Logging Current Solutions are Workarounds ID Verification & Packet Inspection Does not scale Open Source Software- Defined Perimeter Current Solutions are Infrequent Not On-demand Compliance-driven Addressing Mitigation & Resilience Current Mitigations are too Complex Multiple Point Products 2
3 Goals Allow medium-sized orgs. to withstand 1tbps DDoS In SDP Control & ID Planes are separate Redundant components in the cloud DDoS Signatures Open Source Software- Defined Perimeter Information Sharing Provide Metrics to Measure Performance Monitoring Service & Logging is part of the specification - Volume of Data Pushed - Connec4on close events - Number of open connec4ons over a given 4me interval - Messages per second being handled - Message queue sizes - Etc. Supports Compliance CSA & SDP Working Group OWASP Working Groups 3
4 SDP What s Different Standardiza4on of "Need- to- know" access model Deployed with DoD for many years but rarely seen in the commercial world Device agesta4on before authen4ca4on First published by NSA a decade ago but never commercialized Mutual TLS (Transport Layer Security) A great idea & standard but not being adopted
5 Single Packet Authorization SPA can use RFC 4226 (HOTP) Single Packet Authoriza4on (SPA) is used to ini4ate any and all communica4on Benefits: Blackens the server: The server will not respond to any connec4ons from any clients un4l they have provided an authen4c SPA. Mi1gates Denial of Service a7acks on TLS: Internet- facing servers running the hgps protocol are highly suscep4ble to Denial- of- Service (DoS) agacks. SPA mi4gates these agacks because it allows the server to discard the TLS DoS agempts before entering the TLS handshake. A7ack detec1on: The first packet to an AH from any other host must be an SPA. If an AH receives any other packet, it should be viewed as an agack. Therefore, the SPA enables the SDP to determine an agack based on a single malicious packet.
6 Mutual Transport Layer Security Provides device authen4ca4on prior to enabling confiden4al communica4on over the Internet. Typical usage does not authen4cate clients to servers. Two- way cryptographic authen4ca4on. Benefits: Device Authen1ca1on: The connec4ons between all hosts must use TLS or Internet Key Exchange (IKE) with mutual authen4ca4on to validate the device as an authorized member of the SDP prior to further device valida4on and/or user authen4ca4on. Disallows forged cer1ficates: The root cer4ficate for both the TLS (IPsec) client and server will be pinned to a known valid root and should not consist of the hundreds of root cer4ficates trusted by most consumer browsers. This mi4gates impersona4on agacks whereby an agacker can forge a cer4ficate from a compromised cer4ficate authority. Disallows Man- in- the- middle a7acks: The TLS (IPsec) server shall use online cer4ficate status protocol (OCSP) response stapling as defined by the IETF working dra_ X.509v3 Extension: OCSP stapling Required dra_- hallambaker- muststaple- 00, which references the stapling implementa4on in RFC 4366 Transport Layer Security (TLS) Extensions. OCSP response stapling mi4gates DoS agacks on the OCSP responders and also mi4gates man- in- the- middle agacks using obsolete OCSP responses before the server cer4ficate was revoked.
7 Open source SDP - Anti-DDoS Assumptions Easy to spoof millions of IP addresses Not as easy to spoof millions of phone numbers or authenticated devices Stack multiple factors together to verify access
8 Use Case Benefits 1 All Internet facing servers of US government sites are hidden by SDP gateway. (ie. default drop all packets) 2 Internet users who desire access to a protected site would be on- boarded with a unique ID (eg. client CERT, encryp4on keys, etc.) PKI/ Authenticati on Service Mutual TLS CONTROL ABAC/ Authorizati on Service Geo Location Service SDP Controller ACCESS IdP AD/ Service Internet-facing Servers Application Servers False creden1al IRS (stealing tax refunds) If a hacker tried to impersonate a tax filer their device id would not match the filers name thus no access would be granted. Stolen creden1al OPM (stealing employee files) If an agacker stole a creden4al it would not work as the device id would be different. Hackers could try to re onboard themselves but their device id would be wrong thus no access Trusted Client Fingerprint Token Identity Verification Geo Location Verification Mutual TLS DATA Critical Servers Cyber Command & Control Servers APT Titan Rain (device breach) SDP does not stop APT data the_ from device at network layer. However SDP could be used to ensure that encrypted data is only accessible on the users device (if the key management system was only accessible via a SDP).
9 Use Case Benefits Bandwidth Denial of Service 3 When users wish to access a protected site they would click on the SDP client on their personal device SDP would make it impossible for foreign spies to conduct remote surveillance on systems. Foreign governments could do a APT agack on a single user but their visibility would be limited to what the user could see. Trusted Client PKI/ Authenticati on Service Mutual TLS CONTROL ABAC/ Authorizati on Service Mutual TLS Geo Location Service SDP Controller ACCESS IdP AD/ Service Internet-facing Servers Application Servers 4 5 Info in the unique SPA packet must match id of user. This is the key that opens the gateway to the client (ie. port on firewall) If the device and user iden4ty are valid the users will be granted access. (IP address can be verified to match the stored loca4on for dedicated clients) Fingerprint Token Identity Verification Geo Location Verification DATA Critical Servers Cyber Command & Control Servers
10 System Layout iptables ( DROP ALL ) Linux Server (CentOS) fwknop Panther Monitor Apache (hos4ng PantherGUI)
11 Server Cannot be Scanned nmap port scan Nmap scan report for x.x.x.x Host is up (0.033s latency). All scanned ports on x.x.x.x are filtered iptables ( DROP ALL ) Linux Server (CentOS) fwknop Panther Monitor Apache (hos4ng PantherGUI)
12 Attempt to Reach Website HTTPS Request (want to see PantherGUI site) iptables ( DROP ALL ) Linux Server (CentOS) fwknop Panther Monitor Apache (hos4ng PantherGUI)
13 Website Unreachable
14 Website Unreachable iptables has no rule to allow access to this machine HTTPS Request (want to see PantherGUI site) Lis4ng rules in fwknopd iptables chains... Chain FWKNOP_INPUT (1 references) num target prot opt source des4na4on iptables ( DROP ALL ) STOP Linux Server (CentOS) fwknop Panther Monitor Apache (hos4ng PantherGUI)
15 SPA The Magic Word Single Packet Authoriza4on (SPA) UDP Encrypted Cryptographically Signed SPA Packet Lis4ng rules in fwknopd iptables chains... Chain FWKNOP_INPUT (1 references) num target prot opt source des4na4on iptables ( DROP ALL ) Linux Server (CentOS) fwknop Panther Monitor Apache (hos4ng PantherGUI)
16 Gateway Answers the Door fwknop adds a rule to iptables to allow only that machine and only on the desired port SPA Packet Lis4ng rules in fwknopd iptables chains... iptables ( DROP ALL ) Linux Server (CentOS) fwknop Panther Monitor Apache (hos4ng Panther GUI) Chain FWKNOP_INPUT (1 references) num target prot opt source des4na4on 1 ACCEPT tcp - - X.X.X.X /0 tcp dpt:443 /* _exp_ */
17 Gateway Answers the Door Quietly NOTE: The server does not send any response to the requestor. SPA Packet Lis4ng rules in fwknopd iptables chains... iptables ( DROP ALL ) Linux Server (CentOS) fwknop Panther Monitor Apache (hos4ng PantherGUI) Chain FWKNOP_INPUT (1 references) num target prot opt source des4na4on 1 ACCEPT tcp - - X.X.X.X /0 tcp dpt:443 /* _exp_ */
18 Attempt to Reach Website Again Linux Server (CentOS) HTTPS Request (want to see PantherGUI site) Lis4ng rules in fwknopd iptables chains... iptables ( DROP ALL ) fwknop Panther Monitor Apache (hos4ng PantherGUI) Chain FWKNOP_INPUT (1 references) num target prot opt source des4na4on 1 ACCEPT tcp - - X.X.X.X /0 tcp dpt:443 /* _exp_ */
19 Mutual TLS Session Established Apache is now reachable, BUT Apache requires a client cer4ficate, making this a Mutual TLS (MTLS) session Lis4ng rules in fwknopd iptables chains... iptables ( DROP ALL ) Linux Server (CentOS) fwknop Panther Monitor Apache (hos4ng PantherGUI) Chain FWKNOP_INPUT (1 references) num target prot opt source des4na4on 1 ACCEPT tcp - - X.X.X.X /0 tcp dpt:443 /* _exp_ */
20 Client Certificate Required Mul4factor Authen4ca4on client cer4ficate (something I have) combined with username and password (something I know)
21 Gateway Removes Expired Firewall Rule The firewall rule is removed seconds a_er it was created The MTLS session persists while the firewall is dark once again Lis4ng rules in fwknopd iptables chains... Chain FWKNOP_INPUT (1 references) num target prot opt source des4na4on iptables ( DROP ALL ) Linux Server (CentOS) fwknop Panther Monitor Apache (hos4ng PantherGUI)
22 Hard Problems to Solve - Filtering - need to drop packets fast - APIs between Components - Using exis4ng Open Source Components
23 Identify, quantify, prioritize & know how to mitigate your dynamic cyber risk everyday. Juanita Koilpillai
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) In this video you will learn the quite a bit about Public Key Infrastructure and how it is used to authenticate clients and servers. The purpose of Public Key Infrastructure
More informationSoftware Defined Perimeter
So#ware Defined Perimeter Software Defined Perimeter A new approach to access control Junaid Islam, Co Chair Before we start, two ideas we believe strongly Complexity is the primary reason security systems
More informationSoftware Defined Perimeter: Securing the Cloud to the Internet of Things
Software Defined Perimeter: Securing the Cloud to the Internet of Things SESSION ID: CDS-T08 Jim Reavis Chief Executive Officer Cloud Security Alliance @cloudsa About Cloud Security Alliance Global, not-for-profit
More informationThe Pitfalls of Encrypted Networks in Banking Operations Compliance Success in two industry cases
The Pitfalls of Encrypted Networks in Banking Operations Compliance Success in two industry cases Elba Horta Regional Sales Manager, Southern Europe SSH Communica1ons Security elba.horta@ssh.com ENABLE,
More informationVidder PrecisionAccess
Vidder PrecisionAccess Security Architecture February 2016 910 E HAMILTON AVENUE. SUITE 410 CAMPBELL, CA 95008 P: 408.418.0440 F: 408.706.5590 WWW.VIDDER.COM Table of Contents I. Overview... 3 II. Components...
More informationSoftware Defined Perimeter Working Group. SDP Hackathon Whitepaper
Software Defined Perimeter Working Group SDP Hackathon Whitepaper April 2014 2014 Cloud Security Alliance All Rights Reserved. All rights reserved. You may download, store, display on your computer, view,
More informationVoIP Security How to prevent eavesdropping on VoIP conversa8ons. Dmitry Dessiatnikov
VoIP Security How to prevent eavesdropping on VoIP conversa8ons Dmitry Dessiatnikov DISCLAIMER All informa8on in this presenta8on is provided for informa8on purposes only and in no event shall Security
More informationRecommended IP Telephony Architecture
Report Number: I332-009R-2006 Recommended IP Telephony Architecture Systems and Network Attack Center (SNAC) Updated: 1 May 2006 Version 1.0 SNAC.Guides@nsa.gov This Page Intentionally Left Blank ii Warnings
More informationNetwork Security. Computer Security & Forensics. Security in Compu5ng, Chapter 7. l Network Defences. l Firewalls. l Demilitarised Zones
Network Security Security in Compu5ng, Chapter 7 Topics l Network AAacks l Reconnaissance l AAacks l Spoofing l Web Site Vulnerabili5es l Denial of Service l Network Defences l Firewalls l Demilitarised
More informationContents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008
Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Contents Authentication and Identity Assurance The Identity Assurance continuum Plain Password Authentication
More informationCS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
More informationInformation Security Basic Concepts
Information Security Basic Concepts 1 What is security in general Security is about protecting assets from damage or harm Focuses on all types of assets Example: your body, possessions, the environment,
More informationSecurity Protocols: SSH. Michael E. Locasto University of Calgary
Security Protocols: SSH Michael E. Locasto University of Calgary Agenda Philosophy: data protec?on on the network Discussion of SSH SSH history Authen?ca?on Mechanisms SSH2 design overview / architecture
More informationinformation security and its Describe what drives the need for information security.
Computer Information Systems (Forensics Classes) Objectives for Course Challenges CIS 200 Intro to Info Security: Includes managerial and Describe information security and its critical role in business.
More informationNetworking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
More information642 552 Securing Cisco Network Devices (SND)
642 552 Securing Cisco Network Devices (SND) Course Number: 642 552 Length: 1 Day(s) Course Overview This course is part of the training for the Cisco Certified Security Professional, Cisco Firewall Specialist,
More informationCer$ficates- as- an- Insurance (CaaI): Incen$vizing Accountability in SSL/TLS
Cer$ficates- as- an- Insurance (CaaI): Incen$vizing Accountability in SSL/TLS Stephanos Matsumoto (CMU/ETH Zurich) Raphael M. Reischuk (ETH Zurich) Workshop on the Security of Emerging Network Technologies
More informationCYBER ATTACKS EXPLAINED: THE MAN IN THE MIDDLE
CYBER ATTACKS EXPLAINED: THE MAN IN THE MIDDLE Due to the encouraging feedback this series of articles has received, we decided to explore yet another type of cyber intrusionthe Man In The Middle (MITM)
More informationThe Benefits of SSL Content Inspection ABSTRACT
The Benefits of SSL Content Inspection ABSTRACT SSL encryption is the de-facto encryption technology for delivering secure Web browsing and the benefits it provides is driving the levels of SSL traffic
More informationAbout Firewall Protection
1. This guide describes how to configure basic firewall rules in the UTM to protect your network. The firewall then can provide secure, encrypted communications between your local network and a remote
More informationCyber Security In High-Performance Computing Environment Prakashan Korambath Institute for Digital Research and Education, UCLA July 17, 2014
Cyber Security In High-Performance Computing Environment Prakashan Korambath Institute for Digital Research and Education, UCLA July 17, 2014 Introduction: Cyber attack is an unauthorized access to a computer
More informationIntroduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
More information2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected
More informationNetop Environment Security. Unified security to all Netop products while leveraging the benefits of cloud computing
Netop Environment Security Unified security to all Netop products while leveraging the benefits of cloud computing Contents Introduction... 2 AWS Infrastructure Security... 3 Standards - Compliancy...
More informationSecurity vulnerabilities in the Internet and possible solutions
Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished in
More information20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7
20-CS-6053-00X Network Security Spring, 2014 An Introduction To Network Security Week 1 January 7 Attacks Criminal: fraud, scams, destruction; IP, ID, brand theft Privacy: surveillance, databases, traffic
More informationWhere every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
More informationREPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB
REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB Conducted: 29 th March 5 th April 2007 Prepared By: Pankaj Kohli (200607011) Chandan Kumar (200607003) Aamil Farooq (200505001) Network Audit Table of
More informationSecuring IP Networks with Implementation of IPv6
Securing IP Networks with Implementation of IPv6 R.M.Agarwal DDG(SA), TEC Security Threats in IP Networks Packet sniffing IP Spoofing Connection Hijacking Denial of Service (DoS) Attacks Man in the Middle
More informationAppendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
More informationBlackRidge Technology Transport Access Control: Overview
2011 BlackRidge Technology Transport Access Control: Overview 1 Introduction Enterprises and government agencies are under repeated cyber attack. Attacks range in scope from distributed denial of service
More informationNETWORK ACCESS CONTROL AND CLOUD SECURITY. Tran Song Dat Phuc SeoulTech 2015
NETWORK ACCESS CONTROL AND CLOUD SECURITY Tran Song Dat Phuc SeoulTech 2015 Table of Contents Network Access Control (NAC) Network Access Enforcement Methods Extensible Authentication Protocol IEEE 802.1X
More informationAllSeen Summit 2015: IoT: Taking PKI Where No PKI Has Gone Before Presented by: Scott Rea DigiCert Sr. PKI Architect ALLSEEN ALLIANCE
AllSeen Summit 2015: IoT: Taking PKI Where No PKI Has Gone Before Presented by: Scott Rea DigiCert Sr. PKI Architect Agenda Slide Title 3 Trust and PKI 9 Web Security - PKI example 26 Traditional PKI Principles
More informationSolution of Exercise Sheet 5
Foundations of Cybersecurity (Winter 15/16) Prof. Dr. Michael Backes CISPA / Saarland University saarland university computer science Protocols = {????} Client Server IP Address =???? IP Address =????
More informationSecure VidyoConferencing SM TECHNICAL NOTE. Protecting your communications. www.vidyo.com 1.866.99.VIDYO
TECHNICAL NOTE Secure VidyoConferencing SM Protecting your communications 2012 Vidyo, Inc. All rights reserved. Vidyo, VidyoTechnology, VidyoConferencing, VidyoLine, VidyoRouter, VidyoPortal,, VidyoRouter,
More informationLive Guide System Architecture and Security TECHNICAL ARTICLE
Live Guide System Architecture and Security TECHNICAL ARTICLE Contents 1. Introduction... 2 2. Hosting Environment... 2 2.1. Standards - Compliancy... 3 2.2. Business Continuity Management... 3 2.3. Network
More informationSemantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual. Document Version 1.0
Semantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual Document Version 1.0 Table of Contents 1 SWAF... 4 1.1 SWAF Features... 4 2 Operations and User Manual... 7 2.1 SWAF Administrator
More informationDivide and Conquer Real World Distributed Port Scanning
Divide and Conquer Real World Distributed Port Scanning Ofer Maor CTO Hacktics 16 Feb 2006 Hackers & Threats I, 3:25PM (HT1-302) Introduction Divide and Conquer: Real World Distributed Port Scanning reviews
More informationNATIONAL SECURITY AGENCY Ft. George G. Meade, MD
NATIONAL SECURITY AGENCY Ft. George G. Meade, MD Serial: I732-010R-2008 30 April 2008 Network Infrastructure Division Systems and Network Analysis Center Activating Authentication and Encryption for Cisco
More informationTwo Factor Authentication in SonicOS
Two Factor Authentication in SonicOS 1 Notes, Cautions, and Warnings NOTE: A NOTE indicates important information that helps you make better use of your system. CAUTION: A CAUTION indicates potential damage
More informationLinux MDS Firewall Supplement
Linux MDS Firewall Supplement Table of Contents Introduction... 1 Two Options for Building a Firewall... 2 Overview of the iptables Command-Line Utility... 2 Overview of the set_fwlevel Command... 2 File
More informationData Collection and Analysis: Get End-to-End Security with Cisco Connected Analytics for Network Deployment
White Paper Data Collection and Analysis: Get End-to-End Security with Cisco Connected Analytics for Network Deployment Cisco Connected Analytics for Network Deployment (CAND) is Cisco hosted, subscription-based
More informationVirtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN
Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts
More informationPowerChute TM Network Shutdown Security Features & Deployment
PowerChute TM Network Shutdown Security Features & Deployment By David Grehan, Sarah Jane Hannon ABSTRACT PowerChute TM Network Shutdown (PowerChute) software works in conjunction with the UPS Network
More informationMy FreeScan Vulnerabilities Report
Page 1 of 6 My FreeScan Vulnerabilities Report Print Help For 66.40.6.179 on Feb 07, 008 Thank you for trying FreeScan. Below you'll find the complete results of your scan, including whether or not the
More informationWeb Application Entity Session Management using the eid Card Frank Cornelis 03/03/2010. Fedict 2010. All rights reserved
Web Application Entity Session Management using the eid Card Frank Cornelis 03/03/2010 Fedict 2010. All rights reserved What is Entity Authentication? Entity authentication is the process whereby one party
More informationFrom Network Security To Content Filtering
Computer Fraud & Security, May 2007 page 1/10 From Network Security To Content Filtering Network security has evolved dramatically in the last few years not only for what concerns the tools at our disposals
More informationNetworking Basics and Network Security
Why do we need networks? Networking Basics and Network Security Shared Data and Functions Availability Performance, Load Balancing What is needed for a network? ISO 7-Layer Model Physical Connection Wired:
More informationCS 665: Computer System Security. Network Security. Usage environment. Sources of vulnerabilities. Information Assurance Module
CS 665: Computer System Security Network Security Bojan Cukic Lane Department of Computer Science and Electrical Engineering West Virginia University 1 Usage environment Anonymity Automation, minimal human
More informationSecure Substation Automation for Operations & Maintenance
Secure Substation Automation for Operations & Maintenance Byron Flynn GE Energy 1. Abstract Today s Cyber Security requirements have created a need to redesign the Station Automation Architectures to provide
More informationOverview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
More informationInternet Firewall CSIS 3230. Internet Firewall. Spring 2012 CSIS 4222. net13 1. Firewalls. Stateless Packet Filtering
Internet Firewall CSIS 3230 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 8.8: Packet filtering, firewalls, intrusion detection Ch
More informationProtec'ng Informa'on Assets - Week 10 - Identity Management and Access Control. MIS 5206 Protec/ng Informa/on Assets Greg Senko
Protec'ng Informa'on Assets - Week 10 - Identity Management and Access Control In the News Readings MIS5206 Week 10 Identity Management and Access Control Test Taking Tip Quiz In the News Discuss items
More informationBest Practices for SIP Security
Best Practices for SIP Security IMTC SIP Parity Group Version 21 November 9, 2011 Table of Contents 1. Overview... 33 2. Security Profile... 33 3. Authentication & Identity Protection... 33 4. Protecting
More informationHow To Attack A Website With An Asymmetric Attack
DEFENDING AGAINST LOW-BANDWIDTH, ASYMMETRIC DENIAL-OF-SERVICE ATTACKS David W. Holmes (@dholmesf5) F5 Networks Session ID: HT-R02 Session Classification: Intermediate AGENDA Introduction Why does this
More informationSSL BEST PRACTICES OVERVIEW
SSL BEST PRACTICES OVERVIEW THESE PROBLEMS ARE PERVASIVE 77.9% 5.2% 19.2% 42.3% 77.9% of sites are HTTP 5.2% have an incomplete chain 19.2% support weak/insecure cipher suites 42.3% support SSL 3.0 83.1%
More informationDid you know your security solution can help with PCI compliance too?
Did you know your security solution can help with PCI compliance too? High-profile data losses have led to increasingly complex and evolving regulations. Any organization or retailer that accepts payment
More informationHTTPS Inspection with Cisco CWS
White Paper HTTPS Inspection with Cisco CWS What is HTTPS? Hyper Text Transfer Protocol Secure (HTTPS) is a secure version of the Hyper Text Transfer Protocol (HTTP). It is a combination of HTTP and a
More informationTLS and SRTP for Skype Connect. Technical Datasheet
TLS and SRTP for Skype Connect Technical Datasheet Copyright Skype Limited 2011 Introducing TLS and SRTP Protocols help protect enterprise communications Skype Connect now provides Transport Layer Security
More informationGuidance Regarding Skype and Other P2P VoIP Solutions
Guidance Regarding Skype and Other P2P VoIP Solutions Ver. 1.1 June 2012 Guidance Regarding Skype and Other P2P VoIP Solutions Scope This paper relates to the use of peer-to-peer (P2P) VoIP protocols,
More informationA Guide to Common Cloud Security Concerns. Why You Can Stop Worrying and Start Benefiting from SaaS
A Guide to Common Cloud Security Concerns Why You Can Stop Worrying and Start Benefiting from SaaS T he headlines read like a spy novel: Russian hackers access the President s email. A cyber attack on
More information7.1. Remote Access Connection
7.1. Remote Access Connection When a client uses a dial up connection, it connects to the remote access server across the telephone system. Windows client and server operating systems use the Point to
More informationDefending Computer Networks Lecture 7: Port Scanning. Stuart Staniford Adjunct Professor of Computer Science
Defending Computer Networks Lecture 7: Port Scanning Stuart Staniford Adjunct Professor of Computer Science Logis;cs Aim to give out HW2 on Thursday Main Goals for Today TCP Portscanning Detec;on of
More informationCMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
More informationDomain 6.0: Network Security
ExamForce.com CompTIA Network+ N10-004 Study Guide 1 Domain 6.0: Network Security Chapter 6 6.1 Explain the function of hardware and software security devices Network based firewall, Host based firewall
More informationIBM. Vulnerability scanning and best practices
IBM Vulnerability scanning and best practices ii Vulnerability scanning and best practices Contents Vulnerability scanning strategy and best practices.............. 1 Scan types............... 2 Scan duration
More informationSecurity Type of attacks Firewalls Protocols Packet filter
Overview Security Type of attacks Firewalls Protocols Packet filter Computer Net Lab/Praktikum Datenverarbeitung 2 1 Security Security means, protect information (during and after processing) against impairment
More informationCloud Security: Yesterday, Today, and Tomorrow
Cloud Security: Yesterday, Today, and Tomorrow Presentation by Gunnar Peterson www.arctecgroup.net 2005-9 Arctec Group Everything we think of as a computer today is really just a device that connects to
More informationHTTPS is Fast and Hassle-free with CloudFlare
HTTPS is Fast and Hassle-free with CloudFlare 1 888 99 FLARE enterprise@cloudflare.com www.cloudflare.com In the past, organizations had to choose between performance and security when encrypting their
More informationIPv6 SECURITY. May 2011. The Government of the Hong Kong Special Administrative Region
IPv6 SECURITY May 2011 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without the express
More informationDescription: Objective: Attending students will learn:
Course: Introduction to Cyber Security Duration: 5 Day Hands-On Lab & Lecture Course Price: $ 3,495.00 Description: In 2014 the world has continued to watch as breach after breach results in millions of
More informationChapter 4 Firewall Protection and Content Filtering
Chapter 4 Firewall Protection and Content Filtering This chapter describes how to use the content filtering features of the ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN to protect your network.
More informationHow To Protect Your Network From A Hacker Attack On Zcoo Ip Phx From A Pbx From An Ip Phone From A Cell Phone From An Uniden Ip Pho From A Sim Sims (For A Sims) From A
Contents 1. Introduction... 3 2. Embedded Security Solutions... 4 2.1 SSH Access... 4 2.2 Brutal SIP Flood... 4 2.3 SIP Register Limitation... 5 2.4 Guest calls... 5 3. Manually configure system to raise
More informationNetwork Security Fundamentals
APNIC elearning: Network Security Fundamentals 27 November 2013 04:30 pm Brisbane Time (GMT+10) Introduction Presenter Sheryl Hermoso Training Officer sheryl@apnic.net Specialties: Network Security IPv6
More informationSecurity: Attack and Defense
Security: Attack and Defense Aaron Hertz Carnegie Mellon University Outline! Breaking into hosts! DOS Attacks! Firewalls and other tools 15-441 Computer Networks Spring 2003 Breaking Into Hosts! Guessing
More informationFinal exam review, Fall 2005 FSU (CIS-5357) Network Security
Final exam review, Fall 2005 FSU (CIS-5357) Network Security Instructor: Breno de Medeiros 1. What is an insertion attack against a NIDS? Answer: An insertion attack against a network intrusion detection
More informationFirewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA
Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..
More informationBlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
More informationVOICE OVER IP SECURITY
VOICE OVER IP SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without
More informationOverview. Packet filter
Computer Network Lab 2015 Fachgebiet Technische h Informatik, Joachim Zumbrägel Overview Security Type of attacks Firewalls Protocols Packet filter Security Security means, protect information (during
More informationAPNIC elearning: Network Security Fundamentals. 20 March 2013 10:30 pm Brisbane Time (GMT+10)
APNIC elearning: Network Security Fundamentals 20 March 2013 10:30 pm Brisbane Time (GMT+10) Introduction Presenter/s Nurul Islam Roman Senior Training Specialist nurul@apnic.net Specialties: Routing &
More informationFirewalls & Intrusion Detection
Firewalls & Intrusion Detection CS 594 Special Topics/Kent Law School: Computer and Network Privacy and Security: Ethical, Legal, and Technical Consideration 2007, 2008 Robert H. Sloan Security Intrusion
More informationSecurity Issues with Distributed Web Applications
Security Issues with Distributed Web Applications Device Connectivity We are entering the era of Device Connectivity, which is the fourth wave of evolution for Internet-enabled applications. The first
More informationKeyLock Solutions Security and Privacy Protection Practices
KeyLock Solutions Overview KeyLock Solutions hosts its infrastructure at Heroku. Heroku is a cloud application platform used by organizations of all sizes to deploy and operate applications throughout
More informationCS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
More informationRemote Access Security
Glen Doss Towson University Center for Applied Information Technology Remote Access Security I. Introduction Providing remote access to a network over the Internet has added an entirely new dimension to
More informationComputer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 9 Firewalls and Intrusion Prevention Systems First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Firewalls and Intrusion
More informationDMZ Network Visibility with Wireshark June 15, 2010
DMZ Network Visibility with Wireshark June 15, 2010 Ashok Desai Senior Network Specialist Intel Information Technology SHARKFEST 10 Stanford University June 14-17, 2010 Outline Presentation Objective DMZ
More informationSecurity Guide. BlackBerry Enterprise Service 12. for ios, Android, and Windows Phone. Version 12.0
Security Guide BlackBerry Enterprise Service 12 for ios, Android, and Windows Phone Version 12.0 Published: 2015-02-06 SWD-20150206130210406 Contents About this guide... 6 What is BES12?... 7 Key features
More informationGrandstream Networks, Inc. UCM6100 Security Manual
Grandstream Networks, Inc. UCM6100 Security Manual Index Table of Contents OVERVIEW... 3 WEB UI ACCESS... 4 UCM6100 HTTP SERVER ACCESS... 4 PROTOCOL TYPE... 4 USER LOGIN... 4 LOGIN TIMEOUT... 5 TWO-LEVEL
More informationExtended SSL Certificates
Introduction Widespread usage of internet has led to the growth of awareness amongst users, who now associate green address bar with security. Though people are able to recognize the green bar, there is
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Technical and Operational Requirements for Approved Scanning Vendors (ASVs) Version 1.1 Release: September 2006 Table of Contents Introduction...1-1 Naming
More informationTHE SMARTEST WAY TO PROTECT WEBSITES AND WEB APPS FROM ATTACKS
THE SMARTEST WAY TO PROTECT WEBSITES AND WEB APPS FROM ATTACKS INCONVENIENT STATISTICS 70% of ALL threats are at the Web application layer. Gartner 73% of organizations have been hacked in the past two
More informationHow To Protect Your Network From Attack From A Hacker On A University Server
Network Security: A New Perspective NIKSUN Inc. Security: State of the Industry Case Study: Hacker University Questions Dave Supinski VP of Regional Sales Supinski@niksun.com Cell Phone 215-292-4473 www.niksun.com
More informationAlaska Alternate Assessment. Website Security Assurances. June 2015. App3.6_Test_Site_Security
Alaska Alternate Assessment Website Security Assurances June 2015 App3.6_Test_Site_Security ISSUE 1: Secure access to http://ak.k12test.com The AK website makes use of the cryptographic protocols Transport
More informationPROFESSIONAL SECURITY SYSTEMS
PROFESSIONAL SECURITY SYSTEMS Security policy, active protection against network attacks and management of IDP Introduction Intrusion Detection and Prevention (IDP ) is a new generation of network security
More informationMedical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak Capture Link Server V1.00
Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak Capture Link Server V1.00 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents
More informationClient Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
More informationSync Security and Privacy Brief
Introduction Security and privacy are two of the leading issues for users when transferring important files. Keeping data on-premises makes business and IT leaders feel more secure, but comes with technical
More informationComputer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh10/
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh10/ Fall 2010 Sonja Buchegger buc@kth.se Lecture 6, Nov. 10, 2010 Firewalls, Intrusion Prevention, Intrusion Detection
More information