ISA 674 Intrusion Detection
|
|
|
- Joy Shaw
- 10 years ago
- Views:
Transcription
1 ISA 674 Intrusion Detection Inviting the attacker to come to you: HoneyPots & HoneyClients! Angelos Stavrou, George Mason University!
2 Honeypots Honeypots are real or emulated vulnerable systems ready to be attacked.! Definition: " Honeypot is an information system resource whose value lies in unauthorized or illicit use of that resource! Primary value of honeypots is to collect information.! This information is used to better identify, understand and protect against threats.! Honeypots add little direct value to protecting your network.!!
3 Why use HoneyPots A great deal of the security profession and the IT world depend on honeypots.! Honeypots are used to! Build anti-virus signatures! Build SPAM signatures and filters! Identify compromised systems! Assist law-enforcement to track criminals! Hunt and shutdown botnets! Malware collection and analysis!
4 Advantages and Disadvantages Advantages! Collect only small data sets(only when interacted), which is valuable and easier to analyze.! Reduce false positives because any activity with the honeypot is unauthorized by definition! Reduce false negatives honeypots are designed to identify and capture new attacks! Capture encrypted activity because honeypots act as endpoints, where the activity is decrypted! Work with IPv6! Highly flexible extremely adaptable and can be used in a variety of environments! Require minimal resources!
5 Advantages and Disadvantages Disadvantages! Honeypots have a limited field of view see only what interacts with them. Can t be used to detect attacks on other systems.! However, there are some techniques to redirect attackers activities to honeypots.! Risk attacker may take over the honeypot and use it to attack other systems.!
6 Types of Honeypots Server: Put the honeypot on the Internet and let the bad guys come to you.! Client: Honeypot initiates and interacts with servers! Other: Proxies!
7 Types of Honeypots Low-interaction! Emulates services, applications, and OS s! Low risk and easy to deploy/maintain! But capture limited information attackers activities are contained to what the emulated systems allow!! High-interaction! Real services, applications, and OS s! Capture extensive information, but high risk and time intensive to maintain! Can capture new, unknown, or unexpected behavior!
8 Examples of Honeypots Low Interaction BackOfficer Friendly! KFSensor! Honeyd! Honeynets!! High Interaction
9 Uses of Honeypots Preventing attacks! Automated attacks (e.g. worms)! n Attacker randomly scan entire network and find vulnerable systems! n Sticky honeypots monitor unused IP spaces, and slows down the attacker when probed! n Use a variety of TCP tricks, such as using 0 window size! Human attacks! n Use deception/deterrence! n Confuse the attackers, making them waste their time and resources! n If the attacker knows your network has honeypot, he may not attack the network!
10 Uses of Honeypots Detecting attacks! Traditional IDSs generate too much logs, large percentage of false positives and false negatives! Honeypots generate small data, reduce both false positives and false negatives! Traditional IDSs fail to detect new kind of attacks, honeypots can detect new attacks! Traditional IDSs may be ineffective in IPv6 or encrypted environment!
11 Uses of Honeypots Responding to attacks! Responding to a failure/attack requires in-depth information about the attacker! If a production system is hacked (e.g. mail server) it can t be brought offline to analyze! Besides, there may be too much data to analyze, which will be difficult and time-consuming! Honeypots can be easily brought offline for analysis.! Besides, the only information captured by the honeypot is related to the attack so easy to analyze.!
12 Uses of Honeypots Research purposes! How can you defend yourself against an enemy when you don t know who your enemy is?! Research honeypots collect information on threats.! Then researchers can!! n Analyze trends! n Identify new tools or methods! n Identify attackers and their communities! n Ensure early warning and prediction! n Understand attackers motivations!
13 Honeynets High-interaction honeypot designed to capture in-depth information.! Information has different value to different organizations.! Its an architecture you populate with live systems, not a product or software.! Any traffic entering or leaving is a suspect.!
14 Honeynet Architecture
15 How It Works A highly controlled network! where every packet entering or leaving is monitored, captured, and analyzed.! Should satisfy two critical requirements:! Data Control: defines how activity is contained within the honeynet, without an attacker knowing it! Data Capture: logging all of the attacker s activity without the attacker knowing it! Data control has priority over data capture!
16 Data Control Mitigate risk of honeynet! being used to harm non-honeynet systems! Tradeoff! need to provide freedom to attacker to learn about him! More freedom greater risk that the system will be compromised! Some controlling mechanisms! Restrict outbound connections (e.g. limit to 1)! IDS (Snort-Inline)! Bandwidth Throttling!
17 No Data Control Internet No Restrictions Honeypot No Restrictions Honeypot
18 Data Control No Restrictions Internet Honeypot Honeywall Connections Limited Packet Scrubbed Honeypot
19 Data Control : Issues Must have both automated and manual control! System failure should leave the system in a closed state (fail-close)! Admin should be able to maintain state of all inbound and outbound connections! Must be configurable by the admin at any time! Activity must be controlled so that attackers can t detect! Automated alerting when honeypots compromised!
20 Data Capture Capture all activity at a variety of levels.! Network activity.! Application activity.! System activity.! Issues! No captured data should be stored locally on the honeypot! No data pollution should contaminate! Admin should be able to remotely view honeynet activity in real time! Must use GMT time zone!
21 Risks Harm! Compromised honeynet can be used to attack other honeynets or non-honeynet systems! Detection! Its value will dramatically decreased if detected by hacker! Hacker may ignore or bypass it! Hacker may inject false information to mislead! Disabling honeynet functionality! Attacker disables the data control & capture! Violation! Using the compromised system for criminal activity!
22 Types of honeynets Gen-I! Gen-II! Virtual! Distributed!
23 Gen-II Honeynet Architecture
24 Virtual Honeynet source:
25 Hybrid Virtual Honeynet Source:
26 What are Honeyclients? High-interaction (active)!!!client-side!!!!!honeypots!!used for detecting and characterizing" malicious sites by driving a system" in a way that mimics human users!
27 Low/Medium/High Interaction Low Medium High Transport layer virtualization Application layer virtualization Real, vulnerable systems 27
28 Trade-offs Speed! Ease of! Implementation! Maintenance! Reuse! Detection (fingerprinting)! Depth of information gathered! Reality vs. simulation! Resources required!!
29 Server-side vs. Client-side
30 Why client-side is so important Threats triggered by end-user behavior! Security is fundamentally a human problem! Criminal focus on soft-targets "!
31 Honeyclient Uses Evaluating/characterizing web sites! Testing endpoint security! Detecting zero-day browser exploits! Mapping malicious neighborhoods! Obtaining unique malware and exploit samples!
32 Examples Drive-by downloads! Adware/spyware! Exploitation websites! Phishing?! Typo-squatting! Zero-day exploits against browsers!
33 Honeyclients vs. Crawlers 33 Honeyclients! Vulnerable to attack! Utilize a mechanized browser when surfing! Must be monitored to detect compromise! Blackbox (MS Strider)! Integrity checks! Scans (AV, AS, etc)! Intrusion Detection! Sandbox (Sandboxie)! Crawlers! Not supposed to be compromised! Crawlers programmatically surf websites to retrieve content! Simulation can be used to determine if content is malicious (sandbox)!
34 Issues with Crawlers Simulation! Exploit may not trigger! Active/dynamic content! Chain reactions! Secondary vulnerabilities! Ease of detection! Fingerprinting! Maliciousness detection! Signatures! Interpretation!
35 Issues with Honeyclients Speed! More complexity = slower! Stability! Infected systems are slow! Maintenance! Reset after infection! Maliciousness detection! Sandbox, IDS, scanners!
36 Projects Utilizing Honeyclient or Crawler Technology MS Strider HoneyMonkey (Microsoft Research)! Honeyclient.org (Kathy Wang)! Mitre Honeyclient Project (Mitre)! Client-side Honeypots (Univ. of Mannheim)! Collapsar/Reverse Honeyfarm (Purdue Univ.)! Phileas (Webroot)! Websense (Hubbard)! SiteAdvisor (McAfee)!
37 Projects Utilizing Honeyclient or Crawler Technology Cont d StillSecure/Pezzonavante (Danford)! SPECTRE (Sunbelt)! Shadow Honeypots (Anagnostakis)! quarantine systems (Columbia Univ.)! Spycrawler (Univ. of Washington)! XPLIntel (Exploit Prevention Labs)! Irish Honeynet Project (Espion)!
38
39
40 MS Strider HoneyMonkey Project
41 2nd Generation Honeyclients
42 Honeyclient.org Honeyclient
43 Issues to Overcome Constant supply of URLs! Preventing infected clients from infecting the planet (honeywall)! Surf tracking (URL Server)! Results from each visit! Coordinate across clients! Limited retries! Correlating infections! Avoid being blacklisted!
44 Pezzonavante Honeyclient
45 Deployment Experience October 2005 March ,000 URLs surfed 7 million links harvested 600+ virus infections 750+ spyware-related events 1,500 malware samples 500+ malicious URLs submitted for takedown
46 Issues Found Speed! Coordination! Correlation! Information Overload! Candidate URLs! Anti-VMware techniques! Infected PCs are slow and unstable. Duh!!
47 Characterizing URLs Potentially malicious websites need to be identified in advance (guided search)! Avoid surfing.mil,.gov, and froogle all day!
48 Methods for Determining Candidate URLs 1. Compare IP/hostname against blacklists! 2. Filename ends in an executable suffix (*.scr, *.exe, *.pif)! 3. Known-bad strings (ie0502.htm, cartao, cmd.txt)! 4. Obfuscated URLs! 5. Known redirectors (from previous squid logs)! 6. McAfee SiteAdvisor ranking! 7. Site logged in the Norman Sandbox! 8. Site or URL substring shows up in virus descriptions!
49 URL Sources URLs harvested from unsolicited ! Google API! Harvested links! SANS ISC URL list! Blacklists!
50 Detecting Malicious Activity Pezzonavante used a hybrid, asynchronous approach to detection"! Osiris integrity checking! Security tool scans! Snort network IDS alerts! Traffic analysis! Snapshot comparisons!!
51 Sandboxes and Integrity Checking CWSandbox! Sandboxie " Others?!
52 Integrity Checking
53 Anti-Virus Running an anti-virus product after the fact will produce some results But
54 Intrusion Detection (Snort) NIDS was most helpful in monitoring for postinfection behavior.!! However, occasional gems were found..!
55 Squid is Your Friend Log entry for site access referenced in previous slide!
56 Network Traffic Analysis (IPTables) Basic visualization needs similar to other honeynet projects! New visualization tools needed to observe near real-time activity on the client!
57 57
58 58
59 Anti-honeyclient Methods 1. Blacklisting! Try to look normal and not get blacklisted! Distributed honeyclient farms! 2. Dialog boxes! GUI automation needed (ex. Windpysend)! 3. Anti-crawler techniques! 4. Time-bombs! Wait 10 sec in case of delayed exploit! 5. Page-close events! Load a blank page to trigger event (delayed exploit)!
60 Anti-honeyclient Methods Cont d 6. Non-deterministic URL behavior! Pool stats with other farms. Overlap surfing! 7. Links no human would click! Background color hyperlinks! IMG links with don t click on them! 8. Timing analysis! 9. Surf behavior! Timing analysis! Paths through a site! - Depth-first vs. breadth-first! - Referer information (deep linking)!
61 Anti-honeyclient Methods Cont d 10. Dynamic and relative URLs! JavaScript $*&#*! 11. Cookies! 12. Session IDs! 13. Encoded URLs, foreign character sets! 14. URL redirection!
62 Malware Analysis Evasion Current trend in certain malware code-bases for detecting debugger or virtual machine environments! More study required to determine what percentage of infections virtual honeyclients may miss! Physical machines plus a disk imager like Ghost may be needed!
63 Anti-VMware and VMware Detection Methods 1. Nopill (Smith)! 2. Vmdetect (Lallous)! 3. Redpill (Rutkowska)! 4. Scoopy Doo (Klein)! 5. Jerry (Klein)! 6. Vmtools (Kato)!
64 Malware Analysis Frameworks Analysis requires automation! Sandboxes and fully instrumented lab networks! Tools for building your own!
65 Resources
66 The Future Data aggregation! Data sharing! Distributed Honeyclient Farms! Correlate honeyclient and honeynet data! Analysis (SANS ISC, CastleCops PIRT)! Coordinated take-downs!
Taxonomy of Hybrid Honeypots
2011 International Conference on Network and Electronics Engineering IPCSIT vol.11 (2011) (2011) IACSIT Press, Singapore Taxonomy of Hybrid Honeypots Hamid Mohammadzadeh.e.n 1, Masood Mansoori 2 and Roza
Second-generation (GenII) honeypots
Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. [email protected] Abstract Honeypots are security resources which trap malicious activities, so they
HONEYPOT SECURITY. February 2008. The Government of the Hong Kong Special Administrative Region
HONEYPOT SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without
Securing the system using honeypot in cloud computing environment
Volume: 2, Issue: 4, 172-176 April 2015 www.allsubjectjournal.com e-issn: 2349-4182 p-issn: 2349-5979 Impact Factor: 3.762 M. Phil Research Scholar, Department of Computer Science Vivekanandha College
Banking Security using Honeypot
Banking Security using Honeypot Sandeep Chaware D.J.Sanghvi College of Engineering, Mumbai [email protected] Abstract New threats are constantly emerging to the security of organization s information
Contents. vii. Preface. P ART I THE HONEYNET 1 Chapter 1 The Beginning 3. Chapter 2 Honeypots 17. xix
Honeynet2_bookTOC.fm Page vii Monday, May 3, 2004 12:00 PM Contents Preface Foreword xix xxvii P ART I THE HONEYNET 1 Chapter 1 The Beginning 3 The Honeynet Project 3 The Information Security Environment
LASTLINE WHITEPAPER. Large-Scale Detection of Malicious Web Pages
LASTLINE WHITEPAPER Large-Scale Detection of Malicious Web Pages Abstract Malicious web pages that host drive-by-download exploits have become a popular means for compromising hosts on the Internet and,
Dynamic Honeypot Construction
Dynamic Honeypot Construction 2nd Annual Alaska Information Assurance Workshop Christopher Hecker U. of Alaska, Fairbanks 9-5-2006 Presentation l Brief Introduction l Project Overview l Future Work l References
How to build and use a Honeypot. Ralph Edward Sutton, Jr. DTEC 6873 Section 01
How to build and use a Honeypot By Ralph Edward Sutton, Jr DTEC 6873 Section 01 Abstract Everybody has gotten hacked one way or another when dealing with computers. When I ran across the idea of a honeypot
Εmerging Ways to Protect your Network
Εmerging Ways to Protect your Network From Vulnerability Scanning to Real-time Monitoring and Detection of Cyber-attacks Konstantinos Xinidis Software Engineer [email protected] Development Dept.,
Fighting Advanced Threats
Fighting Advanced Threats With FortiOS 5 Introduction In recent years, cybercriminals have repeatedly demonstrated the ability to circumvent network security and cause significant damages to enterprises.
INCREASINGLY, ORGANIZATIONS ARE ASKING WHAT CAN T GO TO THE CLOUD, RATHER THAN WHAT CAN. Albin Penič Technical Team Leader Eastern Europe
INCREASINGLY, ORGANIZATIONS ARE ASKING WHAT CAN T GO TO THE CLOUD, RATHER THAN WHAT CAN Albin Penič Technical Team Leader Eastern Europe Trend Micro 27 years focused on security software Headquartered
Keywords Intrusion detection system, honeypots, attacker, security. 7 P a g e
HONEYPOTS IN NETWORK SECURITY Abhishek Sharma Research Scholar Department of Computer Science and Engineering Lovely Professional University (Punjab) - India Abstract Computer Network and Internet is growing
Honeypots & Honeynets Overview. Adli Wahid Security Specialist, APNIC.net [email protected]
Honeypots & Honeynets Overview Adli Wahid Security Specialist, APNIC.net [email protected] 1 Contents 1. ObjecCves 2. DefiniCon of Honeypot & Honeynets 3. Benefits & Risk consideracon 4. Example of Honeypot
Cyber Security in Taiwan's Government Institutions: From APT To. Investigation Policies
Cyber Security in Taiwan's Government Institutions: From APT To Investigation Policies Ching-Yu, Hung Investigation Bureau, Ministry of Justice, Taiwan, R.O.C. Abstract In this article, we introduce some
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
The Hillstone and Trend Micro Joint Solution
The Hillstone and Trend Micro Joint Solution Advanced Threat Defense Platform Overview Hillstone and Trend Micro offer a joint solution the Advanced Threat Defense Platform by integrating the industry
Networking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013
CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
DETECTING AND ANALYZING NETWORK ATTACKS USING VIRTUAL HONEYNET NUR ATIQAH BT. HASAN 2003470954
DETECTING AND ANALYZING NETWORK ATTACKS USING VIRTUAL HONEYNET By NUR ATIQAH BT. HASAN 2003470954 In partial fulfillment of requirement for the BACHELOR OF SCIENCE (Hons.) IN DATA COMMUNICATION AND NETWORKING
Lesson 5: Network perimeter security
Lesson 5: Network perimeter security Alejandro Ramos Fraile [email protected] Tiger Team Manager (SIA company) Security Consulting (CISSP, CISA) Perimeter Security The architecture and elements that provide
Web Security School Final Exam
Web Security School Final Exam By Michael Cobb 1.) Which of the following services is not required to run a Windows server solely configured to run IIS and publish a Web site on the Internet? a. IIS Admin
Honeypots / honeynets
Honeypots / honeynets presentatie naam 1 Agenda Honeypots Honeynets Honeywall presentatie naam 2 Traffic Problem: Vast quantities of normal traffic Find suspect bits presentatie naam 3 Honeypot Machine
IDS / IPS. James E. Thiel S.W.A.T.
IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods
Trend Micro Cloud App Security for Office 365. October 27, 2015 Trevor Richmond
Trend Micro Cloud App Security for Office 365 October 27, 2015 Trevor Richmond Too many malware incidents >90% Targeted Attacks Start with Email Attackers: Target specific companies or individuals Research
HoneyBOT User Guide A Windows based honeypot solution
HoneyBOT User Guide A Windows based honeypot solution Visit our website at http://www.atomicsoftwaresolutions.com/ Table of Contents What is a Honeypot?...2 How HoneyBOT Works...2 Secure the HoneyBOT Computer...3
ESET Endpoint Security 6 ESET Endpoint Antivirus 6 for Windows
ESET Endpoint Security 6 ESET Endpoint Antivirus 6 for Windows Products Details ESET Endpoint Security 6 protects company devices against most current threats. It proactively looks for suspicious activity
Firewall and UTM Solutions Guide
Firewall and UTM Solutions Guide Telephone: 0845 230 2940 e-mail: [email protected] Web: www.lsasystems.com Why do I need a Firewall? You re not the Government, Microsoft or the BBC, so why would hackers
Honeypots and Honeynets Technologies
New Mexico State University Honeypots and Honeynets Technologies Hussein Al-Azzawi Final Paper CS 579 Special Topics / Computer Security Nov. 27, 2011 Supervised by Mr. Ivan Strnad Table of contents: 1.
Use of Honeypots to Increase Awareness regarding Network Security
Use of Honeypots to Increase Awareness regarding Network Security Bhumika, Vivek Sharma Abstract Honeypots are closely monitored decoys that are employed in a network to study the trail of hackers and
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router
Advanced Honeypot Architecture for Network Threats Quantification
Advanced Honeypot Architecture for Network Threats Quantification Mr. Susheel George Joseph M.C.A, M.Tech, M.Phil(CS) (Associate Professor, Department of M.C.A, Kristu Jyoti College of Management and Technology,
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology. Project Proposal 1
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology Project Proposal 1 Project Proposal 2 Abstract Honeypot systems are readily used by organizations large and
F-Secure Internet Security 2012
F-Secure Internet Security 2012 F-Secure Internet Security 2012 TOC 3 Contents Chapter 1: Getting started...7 How to use automatic updates...8 Check the update status...8 Change the Internet connection
McAfee. Firewall Enterprise. Application Note TrustedSource in McAfee. Firewall Enterprise. version 8.1.0 and earlier
Application Note TrustedSource in McAfee Firewall Enterprise McAfee version 8.1.0 and earlier Firewall Enterprise This document uses a question and answer format to explain the TrustedSource reputation
Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka
Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques
Configuration Information
This chapter describes some basic Email Security Gateway configuration settings, some of which can be set in the first-time Configuration Wizard. Other topics covered include Email Security interface navigation,
APPLICATION PROGRAMMING INTERFACE
DATA SHEET Advanced Threat Protection INTRODUCTION Customers can use Seculert s Application Programming Interface (API) to integrate their existing security devices and applications with Seculert. With
Release Notes for Websense Email Security v7.2
Release Notes for Websense Email Security v7.2 Websense Email Security version 7.2 is a feature release that includes support for Windows Server 2008 as well as support for Microsoft SQL Server 2008. Version
Getting Ahead of Malware
IT@Intel White Paper Intel Information Technology Security December 2009 Getting Ahead of Malware Executive Overview Since implementing our security event monitor and detection processes two years ago,
How To Protect A Network From Attack From A Hacker (Hbss)
Leveraging Network Vulnerability Assessment with Incident Response Processes and Procedures DAVID COLE, DIRECTOR IS AUDITS, U.S. HOUSE OF REPRESENTATIVES Assessment Planning Assessment Execution Assessment
Tunisia s experience in building an ISAC. Haythem EL MIR Technical Manager NACS Head of the Incident Response Team cert-tcc
Tunisia s experience in building an ISAC Haythem EL MIR Technical Manager NACS Head of the Incident Response Team cert-tcc 1 Agenda Introduction ISAC objectives and benefits Tunisian approach SAHER system
Technology Blueprint. Secure Your Virtual Desktop Infrastructure. Optimize your virtual desktop infrastructure for performance and protection
Technology Blueprint Secure Your Virtual Desktop Infrastructure Optimize your virtual desktop infrastructure for performance and protection LEVEL 1 2 3 4 5 SECURITY CONNECTED REFERENCE ARCHITECTURE LEVEL
K7 Mail Security FOR MICROSOFT EXCHANGE SERVERS. v.109
K7 Mail Security FOR MICROSOFT EXCHANGE SERVERS v.109 1 The Exchange environment is an important entry point by which a threat or security risk can enter into a network. K7 Mail Security is a complete
Protecting Your Business from Online Banking Fraud
Protecting Your Business from Online Banking Fraud Robert Comella, Greg Farnham, John Jarocki October 2009 Objective According to Brian Krebs of The Washington Post, smaller organizations are suffering
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
Technology Blueprint. Protect Your Email Servers. Guard the data and availability that enable business-critical communications
Technology Blueprint Protect Your Email Servers Guard the data and availability that enable business-critical communications LEVEL 1 2 3 4 5 SECURITY CONNECTED REFERENCE ARCHITECTURE LEVEL 1 2 4 5 3 Security
ENABLING FAST RESPONSES THREAT MONITORING
ENABLING FAST RESPONSES TO Security INCIDENTS WITH THREAT MONITORING Executive Summary As threats evolve and the effectiveness of signaturebased web security declines, IT departments need to play a bigger,
Malicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
Firewalls & Intrusion Detection
Firewalls & Intrusion Detection CS 594 Special Topics/Kent Law School: Computer and Network Privacy and Security: Ethical, Legal, and Technical Consideration 2007, 2008 Robert H. Sloan Security Intrusion
Driving Company Security is Challenging. Centralized Management Makes it Simple.
Driving Company Security is Challenging. Centralized Management Makes it Simple. Overview - P3 Security Threats, Downtime and High Costs - P3 Threats to Company Security and Profitability - P4 A Revolutionary
Unit 3 Research Project. Eddie S. Jackson. Kaplan University. IT540: Management of Information Security. Kenneth L. Flick, Ph.D.
Running head: UNIT 3 RESEARCH PROJECT 1 Unit 3 Research Project Eddie S. Jackson Kaplan University IT540: Management of Information Security Kenneth L. Flick, Ph.D. 10/07/2014 UNIT 3 RESEARCH PROJECT 2
Defending Against Cyber Attacks with SessionLevel Network Security
Defending Against Cyber Attacks with SessionLevel Network Security May 2010 PAGE 1 PAGE 1 Executive Summary Threat actors are determinedly focused on the theft / exfiltration of protected or sensitive
Intelligent, Scalable Web Security
Solution Overview Citrix and Trend Micro Intelligent, Scalable Web Security Application-Level Control, Load Balancing, High-Traffic Capacity Table of Contents The Challenge... 3 The Solution: Citrix NetScaler
Honeypot as the Intruder Detection System
Honeypot as the Intruder Detection System DAVID MALANIK, LUKAS KOURIL Department of Informatics and Artificial Intelligence Faculty of Applied Informatics, Tomas Bata University in Zlin nam. T. G. Masaryka
Intrusion Detection Systems
Intrusion Detection Systems Advanced Computer Networks 2007 Reinhard Wallner [email protected] Outline Introduction Types of IDS How works an IDS Attacks to IDS Intrusion Prevention Systems
How to Identify Phishing E-Mails
How to Identify Phishing E-Mails How to recognize fraudulent emails and avoid being phished. Presented by : Miguel Fra, Falcon IT Services ([email protected]) http://www.falconitservices.com
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework [email protected] keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.
WEB ATTACKS AND COUNTERMEASURES
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
Symantec Advanced Threat Protection: Network
Symantec Advanced Threat Protection: Network DR150218C April 2015 Miercom www.miercom.com Contents 1.0 Executive Summary... 3 2.0 Overview... 4 2.1 Products Tested... 4 2.2. Malware Samples... 5 3.0 How
24/7 Visibility into Advanced Malware on Networks and Endpoints
WHITEPAPER DATA SHEET 24/7 Visibility into Advanced Malware on Networks and Endpoints Leveraging threat intelligence to detect malware and exploitable vulnerabilities Oct. 24, 2014 Table of Contents Introduction
Protect Your IT Infrastructure from Zero-Day Attacks and New Vulnerabilities
Protect Your IT Infrastructure from Zero-Day Attacks and New Vulnerabilities Protecting a business s IT infrastructure is complex. Take, for example, a retailer operating a standard multi-tier infrastructure
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
How To Prevent Hacker Attacks With Network Behavior Analysis
E-Guide Signature vs. anomaly-based behavior analysis News of successful network attacks has become so commonplace that they are almost no longer news. Hackers have broken into commercial sites to steal
Intrusion Detection System (IDS)
Intrusion Detection System (IDS) Characteristics Systems User, Process predictable actions describing process under that actions what pattern subvert actions attack of correspond the systems processes
Contents. McAfee Internet Security 3
User Guide i Contents McAfee Internet Security 3 McAfee SecurityCenter... 5 SecurityCenter features... 6 Using SecurityCenter... 7 Fixing or ignoring protection problems... 16 Working with alerts... 21
Office 365 Cloud App Security MARKO DJORDJEVIC CLOUD BUSINESS LEAD EE TREND MICRO EMEA LTD.
Office 365 Cloud App Security MARKO DJORDJEVIC CLOUD BUSINESS LEAD EE TREND MICRO EMEA LTD. Your Valuable Data In The Cloud? How To Get The Best Protection! A world safe for exchanging digital information
End-user Security Analytics Strengthens Protection with ArcSight
Case Study for XY Bank End-user Security Analytics Strengthens Protection with ArcSight INTRODUCTION Detect and respond to advanced persistent threats (APT) in real-time with Nexthink End-user Security
Next Generation Firewalls and Sandboxing
Next Generation Firewalls and Sandboxing Joe Hughes, Director www.servicetech.co.uk Summary What is a Next Generation Firewall (NGFW)? Threat evolution Features Deployment Best practices What is Sandboxing?
MALWARE THREATS AND TRENDS. Chris Blow, Director Dustin Hutchison, Director
MALWARE THREATS AND TRENDS Chris Blow, Director Dustin Hutchison, Director WHAT IS MALWARE? Malicious Software Viruses Worms Trojans Rootkits Spyware Ransomware 2 MALWARE ORIGINS Users bring it from home
BitDefender Client Security Workstation Security and Management
BitDefender Client Security Workstation Security and Management BitDefender Client Security is an easy to use business security and management solution, which delivers superior proactive protection from
Contact details For contacting ENISA or for general enquiries on information security awareness matters, please use the following details:
Malicious software About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for
GOOD GUYS VS BAD GUYS: USING BIG DATA TO COUNTERACT ADVANCED THREATS. Joe Goldberg. Splunk. Session ID: SPO-W09 Session Classification: Intermediate
GOOD GUYS VS BAD GUYS: USING BIG DATA TO COUNTERACT ADVANCED THREATS Joe Goldberg Splunk Session ID: SPO-W09 Session Classification: Intermediate About Me Joe Goldberg Current: Splunk - Security Evangelist
Top tips for improved network security
Top tips for improved network security Network security is beleaguered by malware, spam and security breaches. Some criminal, some malicious, some just annoying but all impeding the smooth running of a
Environment. Attacks against physical integrity that can modify or destroy the information, Unauthorized use of information.
Cyber Security. Environment, Solutions and Case study. Special Telecommunications Service David Gabriel, Buciu Adrian Contact: [email protected] [email protected] Environment Network/services can be damaged
Radware s Behavioral Server Cracking Protection
Radware s Behavioral Server Cracking Protection A DefensePro Whitepaper By Renaud Bidou Senior Security Specialist,Radware October 2007 www.radware.com Page - 2 - Table of Contents Abstract...3 Information
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewall
Defending Against. Phishing Attacks
Defending Against Today s Targeted Phishing Attacks DeFending Against today s targeted phishing attacks 2 Introduction Is this email a phish or is it legitimate? That s the question that employees and
E-MAIL FILTERING FAQ
V8.3 E-MAIL FILTERING FAQ COLTON.COM Why? Why are we switching from Postini? The Postini product and service was acquired by Google in 2007. In 2011 Google announced it would discontinue Postini. Replacement:
OfficeScan 10 Enterprise Client Firewall Updated: March 9, 2010
OfficeScan 10 Enterprise Client Firewall Updated: March 9, 2010 What is Trend Micro OfficeScan? Trend Micro OfficeScan Corporate Edition protects campus networks from viruses, Trojans, worms, Web-based
Introducing IBM s Advanced Threat Protection Platform
Introducing IBM s Advanced Threat Protection Platform Introducing IBM s Extensible Approach to Threat Prevention Paul Kaspian Senior Product Marketing Manager IBM Security Systems 1 IBM NDA 2012 Only IBM
Modular Network Security. Tyler Carter, McAfee Network Security
Modular Network Security Tyler Carter, McAfee Network Security Surviving Today s IT Challenges DDos BOTS PCI SOX / J-SOX Data Exfiltration Shady RAT Malware Microsoft Patches Web Attacks No Single Solution
CS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis [email protected] 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.
Computer Viruses: How to Avoid Infection
Viruses From viruses to worms to Trojan Horses, the catchall term virus describes a threat that's been around almost as long as computers. These rogue programs exist for the simple reason to cause you
Countermeasures against Spyware
(2) Countermeasures against Spyware Are you sure your computer is not infected with Spyware? Information-technology Promotion Agency IT Security Center http://www.ipa.go.jp/security/ 1. What is a Spyware?
Quick Start. Installing the software. for Webroot Internet Security Complete, Version 7.0
Quick Start for Webroot Internet Security Complete, Version 7.0 This Quick Start describes how to install and begin using the Webroot Internet Security Complete 2011 software. This integrated suite delivers
Emerging Network Security Threats and what they mean for internal auditors. December 11, 2013 John Gagne, CISSP, CISA
Emerging Network Security Threats and what they mean for internal auditors December 11, 2013 John Gagne, CISSP, CISA 0 Objectives Emerging Risks Distributed Denial of Service (DDoS) Attacks Social Engineering
International Journal of Enterprise Computing and Business Systems ISSN (Online) : 2230-8849
WINDOWS-BASED APPLICATION AWARE NETWORK INTERCEPTOR Ms. Shalvi Dave [1], Mr. Jimit Mahadevia [2], Prof. Bhushan Trivedi [3] [1] Asst.Prof., MCA Department, IITE, Ahmedabad, INDIA [2] Chief Architect, Elitecore
Securing Your Business s Bank Account
Commercial Banking Customers Securing Your Business s Bank Account Trusteer Rapport Resource Guide For Business Banking January 2014 Table of Contents 1. Introduction 3 Who is Trusteer? 3 2. What is Trusteer
Symantec Endpoint Protection 12.1.4
Data Sheet: Endpoint Security Overview provides unrivaled security across physical and virtual platforms and support for the latest operating systems-mac OS X 10.9 and Windows 8.1. Powered by Symantec
Secure Clouds - Secure Services Trend Micro best-in-class solutions enable data center to deliver trusted and secure infrastructures and services
Secure Clouds - Secure Services Trend Micro best-in-class solutions enable data center to deliver trusted and secure infrastructures and services Udo Schneider Trend Micro [email protected] 26.03.2013
Symantec Endpoint Protection Enterprise Edition Best Practices Guidelines. Regional Product Management Team Endpoint Security
Symantec Endpoint Protection Enterprise Edition Best Practices Guidelines Regional Product Management Team Endpoint Security Agenda 1 2 SEPM Architecture and Settings Recommended Client Protection Technologies
Enterprise Anti-Virus Protection
Enterprise Anti-Virus APRIL - JUNE 2013 Dennis Technology Labs www.dennistechnologylabs.com This report aims to compare the effectiveness of anti-malware products provided by well-known security companies.