TNC Endpoint Compliance and Network Access Control Profiles
|
|
|
- Jayson Hutchinson
- 8 years ago
- Views:
Transcription
1 TNC Endpoint Compliance and Network Access Control Profiles TCG Members Meeting June 2014 Barcelona Prof. Andreas Steffen Institute for Internet Technologies andapplications HSR University of Applied Sciences Rapperswil
2 Where the heck is Rapperswil? Steffen, , tcg_barcelona_2014.pptx 2
3 HSR - Hochschule für Technik Rapperswil University of Applied Sciences with about 1500 students Faculty of Information Technology ( students) Bachelor Course (3 years), Master Course (+1.5 years) Steffen, , tcg_barcelona_2014.pptx 3
4 strongswan the OpenSource VPN Solution Windows Active Directory Server Corporate Network Linux FreeRadius Server High-Availability strongswan VPN Gateway Internet Windows 7/8 Agile VPN Client strongswan Linux Client Steffen, , tcg_barcelona_2014.pptx 4
5 TNC Network Access Control and Endpoint Compliance Profiles TCG Members Meeting June 2014 Barcelona TNC Network Access Control Profile
6 Network Access Control (NAC) allow NAC Policy Enforcement Point block NAC Server Corporate Network Computer with NAC Client isolate Policy Manager Isolation Network Attribute Requests Measurement Results Measurement Policy Steffen, , tcg_barcelona_2014.pptx 6
7 Network Access Control (NAC) User Authentication Layer 2: IEEE 802.1X (LAN switches and WLAN access points) Layer 3: IPsec-based VPN (IKEv2) Layer 4: TLS-based VPN (proprietary methods) Configuration Assessment Configuration measurement before network access is granted (e.g. installed software like antivirus scanner and firewall) Compare measurements to network access policies Integrity check of computer platform Re-assess computer platforms in regular intervals Policy Enforcement Enforce security policies onto no-compliant computer platforms Steffen, , tcg_barcelona_2014.pptx 7
8 Trusted Network Connect (TNC) Architecture RFC 5792 RFC 5793 RFC 6876 RFC 7171 Lying Endpoint VPN Client VPN Gateway Steffen, , tcg_barcelona_2014.pptx 8
9 Network Endpoint Assessment (RFC 5209) Posture Posture Posture Collectors (1 (1.... N) N) (1.. N) Posture Broker Client Posture Posture Posture Transport Clients Clients Clients (1 (1.... K) K) (1.. K) NEA Client PA RFC 5792 PA-TNC PB RFC 5793 PB-TNC PT RFC 6876 PT-TLS RFC 7171 PT-EAP Posture Posture Posture Validators Collectors (1 (1.... N) N) (1.. N) Posture Broker Server Posture Posture Posture Transport Transport Clients Servers Clients (1 (1.... K) K) (1.. K) NEA Server Steffen, , tcg_barcelona_2014.pptx 9
10 Layered TNC Protocol Stack IF-T Transport Protocol PT-EAP (RFC 7171) [NET] received packet: from [50871] to [4500] (320 bytes) [ENC] parsed IKE_AUTH request 8 [ EAP/RES/TTLS ] [IKE] received tunneled EAP-TTLS AVP [EAP/RES/PT] IF-TNCCS TNC Client-Server Protocol PB-TNC (RFC 5793) [TNC] received TNCCS batch (160 bytes) for Connection ID 1 [TNC] PB-TNC state transition from 'Init' to 'Server Working' [TNC] processing PB-TNC CDATA batch [TNC] processing PB-Language-Preference message (31 bytes) [TNC] processing PB-PA message (121 bytes) [TNC] setting language preference to 'en IF-M Measurement Protocol PA-TNC (RFC 5792) [TNC] handling PB-PA message type 'IETF/Operating System' 0x000000/0x [IMV] IMV 1 "OS" received message for Connection ID 1 from IMC 1 [TNC] processing PA-TNC message with ID 0xec41ce1d [TNC] processing PA-TNC attribute type 'IETF/Product Information' 0x000000/0x [TNC] processing PA-TNC attribute type 'IETF/String Version' 0x000000/0x [TNC} processing PA-TNC attribute type 'ITA-HSR/Device ID' 0x00902a/0x TNC Measurement Data [IMV] operating system name is 'Android' from vendor Google [IMV] operating system version is '4.2.1 [IMV] device ID is cf5e4cbcc6e6a2db Steffen, , tcg_barcelona_2014.pptx 10
![batch (160 bytes) for Connection ID 1 [TNC] PB-TNC state transition from 'Init' to 'Server Working' [TNC] processing PB-TNC CDATA batch [TNC] processing PB-Language-Preference message (31 bytes)](/docs-images/43/11209956/images/page_10.jpg "[TNC] processing PB-PA message (121 bytes) [TNC] setting language preference to 'en IF-M Measurement Protocol PA-TNC (RFC 5792) [TNC] handling PB-PA message type 'IETF/Operating System'")
11 TNC Network Access Control and Endpoint Compliance Profiles TCG Members Meeting June 2014 Barcelona strongswan Android Client with TNC Support
12 strongswan Android VPN Client Steffen, , tcg_barcelona_2014.pptx 12
13 Allow Download from Unknown Sources Steffen, , tcg_barcelona_2014.pptx 13
14 Install Blacklisted Android Web Server Package Steffen, , tcg_barcelona_2014.pptx 14
15 Minor Non-Compliance: Isolate Client Steffen, , tcg_barcelona_2014.pptx 15
16 Start the Android Web Server Steffen, , tcg_barcelona_2014.pptx 16
17 Major Non-Compliance: Block Client Steffen, , tcg_barcelona_2014.pptx 17
18 TNC Network Access Control and Endpoint Compliance Profiles TCG Members Meeting June 2014 Barcelona strongtnc Policy Manager
19 strongtnc Policy Manager Steffen, , tcg_barcelona_2014.pptx 19
20 Measurement Policies and Enforcements Currently supported policy types: PWDEN FWDEN Factory Default Password Enabled Forwarding Enabled TCPOP TCP Ports allowed to be Open Closed Port Default Policy TCPBL TCP Ports to be Blocked Open Port Default Policy UDPOP UDP Ports allowed to be Open Closed Port Default Policy UDPBL UDP Ports to be Blocked Open Port Default Policy PCKGS Installed Packages UNSRC Unknown Sources SWIDT Software ID (SWID) Tag Inventory FREFM File Reference Measurement SHA1/SHA256 Hash FMEAS File Measurement SHA1/SHA256 Hash FMETA File Metadata Create/Modify/Access Times DREFM Directory Reference Measurement SHA1/SHA256 Hashes DMEAS Directory Measurement SHA1/SHA256 Hashes DMETA Directory Metadata Create/Modify/Access Times TPMRA TPM-based Remote Attestation Steffen, , tcg_barcelona_2014.pptx 20
21 Add/Edit Policies Steffen, , tcg_barcelona_2014.pptx 21
22 Define Enforcements Steffen, , tcg_barcelona_2014.pptx 22
23 TNC Network Access Control and Endpoint Compliance Profiles TCG Members Meeting June 2014 Barcelona Linux Integrity Measurement Architecture (IMA)
24 Linux Integrity Measurement Architecture Linux Security Summit 2012 Paper Presented in September 2012 at LinuxCon in San Diego Remote attestation based on IMA is feasible: The transfer and database lookup of 1200 file measurements amounting to about 120 kb of IMA measurements and certified by a Quote2 TPM signature takes about 20 seconds. Update: strongswan can handle the IMA-NG SHA-1 and SHA-256 hash formats introduced with the Linux 3.13 kernel in order to support TPM 2.0 devices. Steffen, , tcg_barcelona_2014.pptx 24
25 Linux IMA - BIOS Measurements BIOS is measured during the boot process Many Linux distributions enable BIOS measurement by default when a TPM hardware device is detected. BIOS measurement report with typically entries is written to /sys/kernel/security/tpm0/ascii_bios_measurements BIOS measurements are extended into PCRs #0..7 PCR SHA-1 Measurement Hash Comment 0 4d894eef0ae7cb124740df4f6c5c35aa0fe7dae8 08 [S-CRTM Version] 0 f2c846e7f335f7b9e9dd0a44f48c48e c7 01 [POST CODE] ca78e7450a b3e52c5c25299e [] 4 c1e25c3f6b0dc78d57296aa2870ca6f782ccf80f 05 [Calling INT 19h] 4 67a0a98bc4d a4d938b342f6959c1a9 05 [Booting BCV Device 80h, - Hitachi HTS723216L9A360] 4 06d60b3a0dee9bb9beb2f0b04aff2e75bd1d2860 0d [IPL] 5 1b87003b6c7d c90100cca3e62392b9bc 0e [IPL Partition Data] Steffen, , tcg_barcelona_2014.pptx 25
26 Linux IMA - Runtime Measurements Executable files, dynamic libraries and kernel modules are measured when loaded during runtime. With some Linux distributions (e.g. Ubuntu 14.04) IMA can be activated via the ima_tcb boot parameter but usually the kernel must first be manually compiled with CONFIG_IMA enabled The IMA runtime measurement report with about 1200 entries is written to /sys/kernel/security/ima/ascii_runtime_measurements IMA runtime measurements are extended into TPM PCR #10 PCR SHA-1 Measurement Hash SHA-1 File Data Hash Filename 10 d0bb59e83c371ba6f3adad f9a ima 365a7adf8fa89608d381d9775ec2f29563c2d0b8 boot_aggregate a5c456124c908c36bf9e398c08d11 ima f39e77957b909f3f81f891c ef3ac2ca /bin/sleep 10 df27e df0d5b43400ad71cc28f7f898e ima 78a85b50138c481679fe4100ef2b3a0e6e53ba50 ld-2.15.so fa7707af01a670fc353386fcc95440e011b08b ima 72ebd589aa ff3764c27dbdda fe parport.ko Steffen, , tcg_barcelona_2014.pptx 26
27 strongtnc - Remote Attestation Results Steffen, , tcg_barcelona_2014.pptx 27
28 strongtnc - Reference Values for File Hashes Steffen, , tcg_barcelona_2014.pptx 28
29 TNC Network Access Control and Endpoint Compliance Profiles TCG Members Meeting June 2014 Barcelona TNC Endpoint Compliance Profile
30 Endpoint Compliance Endpoint scan report Compliance Service CMDB Interface Configuration Management Data Base SWID Collector SWID Verifier CMDB TNC Client TNC Server Steffen, , tcg_barcelona_2014.pptx 30
31 Endpoint Compliance Endpoints initially report a complete Software Inventory to the Compliance Service which stores the inventory in a Configuration Management Data Base (CMDB) covering all hosts within an organization or network. Changes in the software inventory are continuously reported. The tracking of the installed software is based on standardized Software Identification (SWID) Tags. Due to the huge bandwidth requirements (2000+ SWID tags, some of them > 1 MB), the preferred TNC transport protocol for endpoint compliance reporting is IF-T for TLS (RFC 6876 PT-TLS). With the CMDB it becomes possible to establish at any time which software (including the exact version) was installed on what endpoints during which time interval. Steffen, , tcg_barcelona_2014.pptx 31
32 Software Identification (SWID) Tags Standardized by ISO/IEC :2014 <?xml version='1.0' encoding='utf-8'?> <SoftwareIdentity xmlns=" name="strongswan" uniqueid="strongswan-5-2-0rc1" version="5.2.0rc1" versionscheme="alphanumeric"> <Entity name="strongswan Project" regid="regid org.strongswan" role="publisher licensor tagcreator"/> <Payload> <File location="/usr/sbin" name="ipsec"/> <File location="/usr/libexec/ipsec" name="charon"/> <File location="/usr/lib/ipsec" name="libcharon.so.0"/> <File location="/usr/lib/ipsec" name="libstrongswan.so.0"/> </Payload> </SoftwareIdentity> Steffen, , tcg_barcelona_2014.pptx 32
33 swidgenerator - an Open Source Tool The swid_generator tool allows to generate a complete inventory of the software packages installed on a Linux endpoint consisting either of ISO/IEC SWID Tags or concise unique Software IDs. Supported Linux package managers: dpkg Debian, Ubuntu, etc. rpm Use: pacman RedHat, Fedora, SuSE, etc. Arch Linux swid_generator software-id swid_generator swid [--pretty] [--full] \ [--software-id <id>] \ [--package <name>] Download: Steffen, , tcg_barcelona_2014.pptx 33
34 SWID Log for a given Endpoint I Steffen, , tcg_barcelona_2014.pptx 34
35 SWID Log for a given Endpoint II Steffen, , tcg_barcelona_2014.pptx 35
36 List of Endpoints for a given SWID Tag Steffen, , tcg_barcelona_2014.pptx 36
37 Thank you for your attention! Questions? Steffen, , tcg_barcelona_2014.pptx 37
Android BYOD Security using Trusted Network Connect Protocol Suite
Android BYOD Security using Trusted Network Connect Protocol Suite Prof. Andreas Steffen HSR University of Applied Sciences Rapperswil andreas.steffen@hsr.ch Where the heck is Rapperswil? 2 HSR Hochschule
strongswan TNC Activities Update
strongswan TNC Activities Update TCG Members Meeting June 2013 Dublin Prof. Andreas Steffen Institute for Internet Technologies and Applications HSR University of Applied Sciences Rapperswil andreas.steffen@hsr.ch
The strongswan IPsec Solution
The strongswan IPsec Solution with TNC Support TCG Members Meeting June 2011 Munich Prof. Dr. Andreas Steffen Institute for Internet Technologies andapplications HSR University of Applied Sciences Rapperswil
TNC: Open Standards for Network Security Automation. Copyright 2010 Trusted Computing Group
TNC: Open Standards for Network Security Automation Copyright 2010 Trusted Computing Group Agenda Introduce TNC and TCG Explanation of TNC What problems does TNC solve? How does TNC solve those problems?
The Linux Integrity Measurement Architecture and TPM-Based Network Endpoint Assessment
The Linux Integrity Measurement Architecture and TPM-Based Network Endpoint Assessment Andreas Steffen ITA Institute for Internet Technologies and Applications HSR University of Applied Sciences Rapperswil
Network Access Control (NAC) and Network Security Standards
Network Control (NAC) and Network Security Standards Copyright 2011 Trusted Computing Group Other names and brands are properties of their respective owners. Slide #1 Agenda Goals of NAC Standards What
Trusted Network Connect (TNC) 4th European Trusted Infrastructure Summer School August / September 2009
Trusted Network Connect (TNC) 4th European Trusted Infrastructure Summer School August / September 2009 Josef von Helden University of Applied Sciences and Arts, Hanover josef.vonhelden@fh-hannover.de
Trusted Network Connect (TNC)
Trusted Network Connect (TNC) Josef von Helden josef.vonhelden@inform.fh-hannover.de Martin Schmiedel Daniel Wuttke First European Summer School on Trusted Infrastructure Technologies September 2006 1
SOFTWARE ASSET MANAGEMENT Continuous Monitoring. September 16, 2013
SOFTWARE ASSET MANAGEMENT Continuous Monitoring September 16, 2013 Tim McBride National Cybersecurity Center of Excellence timothy.mcbride@nist.gov David Waltermire Information Technology Laboratory david.waltermire@nist.gov
Network Access Security It's Broke, Now What? June 15, 2010
Network Access Security It's Broke, Now What? June 15, 2010 Jeffrey L Carrell Network Security Consultant Network Conversions SHARKFEST 10 Stanford University June 14-17, 2010 Network Access Security It's
Unified Security TNC EVERYWHERE. Wireless security. Road Warrior. IT Security. IT Security. Conference Room. Surveillance.
Corporate Governance Employee Cube Road Warrior Surveillance Surveillance IT Security Data Center IT Security Conference Room Wireless security Manufacturing and Control TNC EVERYWHERE Unified Security
VPN with Windows 7 and Linux strongswan using IKEv2
Swiss Cyber Storm II Hack & Learn VPN with Windows 7 and Linux strongswan using IKEv2 Prof. Dr. Andreas Steffen andreas.steffen@hsr.ch Andreas Steffen, 19.04.2009, CyberStormII.pptx 1 The Road Warrior
HW (Fat001) TPM. Figure 1. Computing Node
1. Overview Two major components exist in our current prototype systems: the management node, including the Cloud Controller, Cluster Controller, Walrus and EBS, and the computing node, i.e. the Node Controller
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
Trusted Network Connect (TNC)
Trusted Network Connect (TNC) Open Standards for Integrity-based Network Access Control and Coordinated Network Security April 2011 Trusted Computing Group 3855 SW 153rd Drive, Beaverton, OR 97006 Tel
SOFTWARE ASSET MANAGEMENT
BUILDING BLOCK WHITE PAPER SOFTWARE ASSET MANAGEMENT Continuous Monitoring V.2 This revision incorporates comments from the public. David Waltermire Information Technology Laboratory david.waltermire@nist.gov
NETWORK ACCESS CONTROL
RIVIER ACADEMIC JOURNAL, VOLUME 3, NUMBER 2, FALL 2007 NETWORK ACCESS CONTROL Arti Sood * Graduate Student, M.S. in Computer Science Program, Rivier College Abstract Computers connected to the Internet
NETWORK ACCESS CONTROL AND CLOUD SECURITY. Tran Song Dat Phuc SeoulTech 2015
NETWORK ACCESS CONTROL AND CLOUD SECURITY Tran Song Dat Phuc SeoulTech 2015 Table of Contents Network Access Control (NAC) Network Access Enforcement Methods Extensible Authentication Protocol IEEE 802.1X
Security Technical. Overview. BlackBerry Enterprise Service 10. BlackBerry Device Service Solution Version: 10.2
BlackBerry Enterprise Service 10 BlackBerry Device Service Solution Version: 10.2 Security Technical Overview Published: 2014-09-10 SWD-20140908123239883 Contents 1 About BlackBerry Device Service solution
How To Install Storegrid Server On Linux On A Microsoft Ubuntu 7.5 (Amd64) Or Ubuntu (Amd86) (Amd77) (Orchestra) (For Ubuntu) (Permanent) (Powerpoint
StoreGrid Linux Server Installation Guide Before installing StoreGrid as Backup Server (or) Replication Server in your machine, you should install MySQL Server in your machine (or) in any other dedicated
A Virtualized Linux Integrity Subsystem for Trusted Cloud Computing
A Virtualized Linux Integrity Subsystem for Trusted Cloud Computing Stefan Berger Joint work with: Kenneth Goldman, Dimitrios Pendarakis, David Safford, Mimi Zohar IBM T.J. Watson Research Center 09/21/2011
Embedded Trusted Computing on ARM-based systems
1 / 26 Embedded Trusted Computing on ARM-based systems Martin Schramm, M.Eng. 10.04.2014 Agenda 2 of 26 martin.schramm@th-deg.de Embedded computing platforms have become omnipresent intend to alleviate
TNC is an open architecture for network access control. If you re not sure what NAC is, we ll cover that in a second. For now, the main point here is
1 2 This slide shows the areas where TCG is developing standards. Each image corresponds to a TCG work group. In order to understand Trusted Network Connect, it s best to look at it in context with the
Architecture and Data Flow Overview. BlackBerry Enterprise Service 10 721-08877-123 Version: 10.2. Quick Reference
Architecture and Data Flow Overview BlackBerry Enterprise Service 10 721-08877-123 Version: Quick Reference Published: 2013-11-28 SWD-20131128130321045 Contents Key components of BlackBerry Enterprise
Cisco Secure ACS. By Igor Koudashev, Systems Engineer, Cisco Systems Australia ivk@cisco.com. 2006 Cisco Systems, Inc. All rights reserved.
Cisco Secure ACS Overview By Igor Koudashev, Systems Engineer, Cisco Systems Australia ivk@cisco.com 2006 Cisco Systems, Inc. All rights reserved. 1 Cisco Secure Access Control System Policy Control and
Table of Contents. Cisco Cisco VPN Client FAQ
Table of Contents Cisco VPN Client FAQ...1 Questions...1 Introduction...2 Q. Why does the VPN Client disconnect after 30 minutes? Can I extend this time period?...2 Q. I upgraded to Mac OS X 10.3 (known
Building Blocks Towards a Trustworthy NFV Infrastructure
Building Blocks Towards a Trustworthy NFV Infrastructure IRTF NFVRG Adrian L. Shaw Hewlett-Packard Laboratories / July 22 nd, 2015 1 Why security and trust? Big requirement for critical
Index. BIOS rootkit, 119 Broad network access, 107
Index A Administrative components, 81, 83 Anti-malware, 125 ANY policy, 47 Asset tag, 114 Asymmetric encryption, 24 Attestation commercial market, 85 facts, 79 Intel TXT conceptual architecture, 85 models,
SapphireIMS 4.0 Asset Management Feature Specification
SapphireIMS 4.0 Asset Management Feature Specification v1.4 All rights reserved. COPYRIGHT NOTICE AND DISCLAIMER No parts of this document may be reproduced in any form without the express written permission
How To Configure Apple ipad for Cyberoam L2TP
How To Configure Apple ipad for Cyberoam L2TP VPN Connection Applicable to Version: 10.00 (All builds) Layer 2 Tunneling Protocol (L2TP) can be used to create VPN tunnel over public networks such as the
Data Sheet. NCP Secure Enterprise Management. Next Generation Network Access Technology
Centrally Managed VPN Fully Automatic Operation of a Remote Access VPN via a Single Console Enables easy rollout and operation of secure remote access infrastructures Central creation of client configuration
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
Novell Access Manager SSL Virtual Private Network
White Paper www.novell.com Novell Access Manager SSL Virtual Private Network Access Control Policy Enforcement Compliance Assurance 2 Contents Novell SSL VPN... 4 Product Overview... 4 Identity Server...
Guidance Regarding Skype and Other P2P VoIP Solutions
Guidance Regarding Skype and Other P2P VoIP Solutions Ver. 1.1 June 2012 Guidance Regarding Skype and Other P2P VoIP Solutions Scope This paper relates to the use of peer-to-peer (P2P) VoIP protocols,
Attestation-based Policy Enforcement for Remote Access
Attestation-based Policy Enforcement for Remote Access Reiner Sailer, Trent Jaeger, Leendert van Doorn, Xiaolan Zhang IBM Thomas J. Watson Research Center Hawthorne, NY (ACM Conference on Computer and
TCG. TCG Trusted Network Connect TNC Architecture for Interoperability. TCG PUBLISHED Copyright TCG 2004-2006
TCG Trusted Network Connect TNC Architecture for Interoperability Revision 2 1 May 2006 Published Contact: admin@trustedcomputinggroup.org Copyright TCG 2004-2006 TCG Copyright 2005-2006 Trusted Computing
NCP Secure Enterprise Management Next Generation Network Access Technology
Data Sheet NCP Secure Enterprise Management Next Generation Network Access Technology Centrally Managed VPN fully Automatic Operation of a Remote Access VPN via a Single Console Enables easy rollout and
ReadyNAS Remote White Paper. NETGEAR May 2010
ReadyNAS Remote White Paper NETGEAR May 2010 Table of Contents Overview... 3 Architecture... 3 Security... 4 Remote Firewall... 5 Performance... 5 Overview ReadyNAS Remote is a software application that
Configure Posture. Note. Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.1 1
The AnyConnect Secure Mobility Client offers an ASA Posture Module and an ISE Posture Module. Both provide the Cisco AnyConnect Secure Mobility Client with the ability to assess an endpoint's compliance
Cisco Intercloud Fabric Security Features: Technical Overview
White Paper Cisco Intercloud Fabric Security Features: Technical Overview White Paper May 2015 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 1 of
Acronis Backup & Recovery 10 Server for Linux. Update 5. Installation Guide
Acronis Backup & Recovery 10 Server for Linux Update 5 Installation Guide Table of contents 1 Before installation...3 1.1 Acronis Backup & Recovery 10 components... 3 1.1.1 Agent for Linux... 3 1.1.2 Management
Symantec Endpoint Protection 11.0 Architecture, Sizing, and Performance Recommendations
Symantec Endpoint Protection 11.0 Architecture, Sizing, and Performance Recommendations Technical Product Management Team Endpoint Security Copyright 2007 All Rights Reserved Revision 6 Introduction This
Vidder PrecisionAccess
Vidder PrecisionAccess Security Architecture February 2016 910 E HAMILTON AVENUE. SUITE 410 CAMPBELL, CA 95008 P: 408.418.0440 F: 408.706.5590 WWW.VIDDER.COM Table of Contents I. Overview... 3 II. Components...
SSL VPN A look at UCD through the tunnel
SSL VPN A look at UCD through the tunnel Background Why? Who is it for? Stakeholders IET Library Schools and Colleges Key Requirements Integrate with existing authentication Flexible security groups within
Sygate Secure Enterprise and Alcatel
Sygate Secure Enterprise and Alcatel Sygate Secure Enterprise eliminates the damage or loss of information, cost of recovery, and regulatory violation due to rogue corporate computers, applications, and
OVAL+TPM. A Case Study in Enterprise Trusted Computing. Ariel Segall. June 21, 2011
OVAL+TPM A Case Study in Enterprise Trusted Computing Ariel Segall June 21, 2011 Approved for Public Release: 11-0144. Distribution Unlimited. c 2011. All Rights Reserved. (1/15) Motivation Goal: Demonstrate
ARCHITECT S GUIDE: Mobile Security Using TNC Technology
ARCHITECT S GUIDE: Mobile Security Using TNC Technology December 0 Trusted Computing Group 855 SW 5rd Drive Beaverton, OR 97006 Tel (50) 69-056 Fax (50) 644-6708 admin@trustedcomputinggroup.org www.trustedcomputinggroup.org
Configure ISE Version 1.4 Posture with Microsoft WSUS
Configure ISE Version 1.4 Posture with Microsoft WSUS Document ID: 119214 Contributed by Michal Garcarz, Cisco TAC Engineer. Aug 03, 2015 Contents Introduction Prerequisites Requirements Components Used
The Importance of Standards to Network Access Control
White Paper The Importance of Standards to Network Access Control Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, California 94089 USA 408.745.2000 1.888 JUNIPER www.juniper.net Part Number:
Cornerstones of Security
Internet Security Cornerstones of Security Authenticity the sender (either client or server) of a message is who he, she or it claims to be Privacy the contents of a message are secret and only known to
Release Notes. NCP Secure Entry Mac Client. 1. New Features and Enhancements. 2. Improvements / Problems Resolved. 3. Known Issues
NCP Secure Entry Mac Client Service Release 2.05 Build 14711 December 2013 Prerequisites Apple OS X Operating System: The following Apple OS X operating system versions are supported with this release:
Frequently Asked Questions
Frequently Asked Questions 1. Q: What is the Network Data Tunnel? A: Network Data Tunnel (NDT) is a software-based solution that accelerates data transfer in point-to-point or point-to-multipoint network
Patterns for Secure Boot and Secure Storage in Computer Systems
Patterns for Secure Boot and Secure Storage in Computer Systems Hans Löhr, Ahmad-Reza Sadeghi, Marcel Winandy Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany {hans.loehr,ahmad.sadeghi,marcel.winandy}@trust.rub.de
Secure Friendly Net Detection Server. July 2006
Secure FND Server Secure Friendly Net Detection Server July 2006 Disclaimer Considerable care has been taken in the preparation and publication of this manual, errors in content, typographical or otherwise
TheGreenBow IPsec VPN Client. Configuration Guide Cisco RV325 v1. Website: www.thegreenbow.com Contact: support@thegreenbow.com
TheGreenBow IPsec VPN Client Configuration Guide Cisco RV325 v1 Website: www.thegreenbow.com Contact: support@thegreenbow.com Table of Contents 1 Introduction... 3 1.1 Goal of this document... 3 1.2 VPN
Host Hardening. OS Vulnerability test. CERT Report on systems vulnerabilities. (March 21, 2011)
Host Hardening (March 21, 2011) Abdou Illia Spring 2011 CERT Report on systems vulnerabilities Source: CERT Report @ http://www.kb.cert.org/vuls/bymetric 2 OS Vulnerability test Source: http://www.omninerd.com/articles/2006_operating_system_vulnerabilit
Active Network Defense: Real time Network Situational Awareness and a Single Source of Integrated, Comprehensive Network Knowledge
Active Network Defense: Real time Network Situational Awareness and a Single Source of Integrated, Comprehensive Network Knowledge This paper will present a case study of Lumeta s participation in an open
ForeScout CounterACT. Device Host and Detection Methods. Technology Brief
ForeScout CounterACT Device Host and Detection Methods Technology Brief Contents Introduction... 3 The ForeScout Approach... 3 Discovery Methodologies... 4 Passive Monitoring... 4 Passive Authentication...
Chapter 4 Virtual Private Networking
Chapter 4 Virtual Private Networking This chapter describes how to use the virtual private networking (VPN) features of the FVL328 Firewall. VPN tunnels provide secure, encrypted communications between
Secure remote access to your applications and data. Secure Application Access
Secure Application Access Secure remote access to your applications and data Accops HySecure is an application access gateway that enables secure access to corporate applications, desktops and network
VPNSCAN: Extending the Audit and Compliance Perimeter. Rob VandenBrink rvandenbrink@metafore.ca
VPNSCAN: Extending the Audit and Compliance Perimeter Rob VandenBrink rvandenbrink@metafore.ca Business Issue Most clients have a remote access or other governing policy that has one or more common restrictions
Acronis Backup & Recovery 10 Server for Linux. Installation Guide
Acronis Backup & Recovery 10 Server for Linux Installation Guide Table of contents 1 Before installation...3 1.1 Acronis Backup & Recovery 10 components... 3 1.1.1 Agent for Linux... 3 1.1.2 Management
Stratusphere. Architecture Overview
Stratusphere Architecture Overview Introduction This guide has been authored by experts at Liquidware Labs in order to provide an architecture overview of Liquidware Labs Stratusphere product, the leading
Kaspersky Endpoint Security 8 for Linux INSTALLATION GUIDE
Kaspersky Endpoint Security 8 for Linux INSTALLATION GUIDE A P P L I C A T I O N V E R S I O N : 8. 0 Dear User! Thank you for choosing our product. We hope that this documentation will help you in your
Configuration Guide. BlackBerry Enterprise Service 12. Version 12.0
Configuration Guide BlackBerry Enterprise Service 12 Version 12.0 Published: 2014-12-19 SWD-20141219132902639 Contents Introduction... 7 About this guide...7 What is BES12?...7 Key features of BES12...
Multi-platform TNC with Radiator, XSupplicant and libtnc
May 1, 2007 Radiator Multi-platform TNC with Radiator, XSupplicant and libtnc Copyright (C) 2007 Open System Consultants Pty. Ltd. This white paper discusses the theory and application of Trusted Network
Snare System Version 6.3.3 Release Notes
Snare System Version 6.3.3 Release Notes is pleased to announce the release of Snare Server Version 6.3.3. Snare Server Version 6.3.3 Bug Fixes: Implemented enhanced memory management features within the
Data Sheet. NCP Secure Enterprise Management. General description. Highlights
Data Sheet NCP Secure Enterprise Management General description NCP Secure Enterprise Management is the central component of the NCP Next Generation Network Access technology with integrated RADIUS server
Introduction to Endpoint Security
Chapter Introduction to Endpoint Security 1 This chapter provides an overview of Endpoint Security features and concepts. Planning security policies is covered based on enterprise requirements and user
Security concept for gateway integrity protection within German smart grids
Security concept for gateway integrity protection within German smart grids Prof. Dr. Kai-Oliver Detken DECOIT GmbH, Fahrenheitstr. 9, D-28359 Bremen Email: detken@decoit.de Carl-Heinz Genzel, Olav Hoffmann,
NCP Secure Enterprise Management Next Generation Network Access Technology
Data Sheet NCP Secure Enterprise Management Next Generation Network Access Technology General description NCP Secure Enterprise Management is the central component of the NCP Next Generation Network Access
Technical Notes TN 1 - ETG 3000. FactoryCast Gateway TSX ETG 3021 / 3022 modules. How to Setup a GPRS Connection?
FactoryCast Gateway TSX ETG 3021 / 3022 modules How to Setup a GPRS Connection? 1 2 Table of Contents 1- GPRS Overview... 4 Introduction... 4 GPRS overview... 4 GPRS communications... 4 GPRS connections...
CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security
CTS2134 Introduction to Networking Module 8.4 8.7 Network Security Switch Security: VLANs A virtual LAN (VLAN) is a logical grouping of computers based on a switch port. VLAN membership is configured by
Snare System Version 6.3.4 Release Notes
Snare System Version 6.3.4 Release Notes is pleased to announce the release of Snare Server Version 6.3.4. Snare Server Version 6.3.4 New Features The behaviour of the Snare Server reflector has been modified
Enterprise Security Management CheckPoint SecuRemote VPN v4.0 for pcanywhere
Enterprise Security Management CheckPoint SecuRemote VPN v4.0 for pcanywhere White Paper 7KH#&KDOOHQJH Virtual Private Networks (VPNs) provides a powerful means of protecting the privacy and integrity
How To Set Up Mybpx Security Configuration Guide V1.2.2 (V1.3.2) On A Pc Or Mac)
MyPBX Security Configuration Guide Version: V1.2 Date: October 15 th, 2012 Yeastar Technology Co., Ltd. http://www.yeastar.com 1/11 Contents 1. Security Configuration for Web GUI... 3 1.1 Change the default
SnapLogic Sidekick Guide
SnapLogic Sidekick Guide Document Release: October 2013 SnapLogic, Inc. 2 West 5th Avenue, Fourth Floor San Mateo, California 94402 U.S.A. www.snaplogic.com Copyright Information 2011-2013 SnapLogic, Inc.
SECURE YOUR NETWORK WITH FIREWALL BUILDER
SECURE YOUR NETWORK WITH FIREWALL BUILDER firewall isolates a trusted, secure internal network from another network like the Internet, which is not regarded as either trusted or secure. Firewall Builder
Securing and Monitoring BYOD Networks using NetFlow
Securing and Monitoring BYOD Networks using NetFlow How NetFlow can help with Security Analysis, Application Detection and Traffic Monitoring Don Thomas Jacob Technical Marketing Engineer ManageEngine
FreeRADIUS server. Defining clients Access Points and RADIUS servers
FreeRADIUS server Freeradius (http://www.freeradius.org) is a very powerfull/configurable and freely available opensource RADIUS server. ARNES recommends it for the organisations that connect to ARNES
Ovation Security Center Data Sheet
Features Scans for vulnerabilities Discovers assets Deploys security patches transparently Allows only white-listed applications to run in workstations Provides virus protection for Ovation Windows workstations
ontune SPA - Server Performance Monitor and Analysis Tool
ontune SPA - Server Performance Monitor and Analysis Tool Product Components - ontune is composed of the Manager; the Agents ; and Viewers Manager - the core ontune component, and installed on the management/viewing
Massey University Follow Me Printer Setup for Linux systems
Massey University Follow Me Printer Setup for Linux systems RedHat and Debian based systems Requirements You must have an active Massey network account, i.e. you should already be able to log onto the
Configuration Guide BES12. Version 12.2
Configuration Guide BES12 Version 12.2 Published: 2015-07-07 SWD-20150630131852557 Contents About this guide... 8 Getting started... 9 Administrator permissions you need to configure BES12... 9 Obtaining
JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA
JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA To purchase Full version of Practice exam click below; http://www.certshome.com/jk0-022-practice-test.html FOR CompTIA JK0-022 Exam Candidates
Deploying Windows Streaming Media Servers NLB Cluster and metasan
Deploying Windows Streaming Media Servers NLB Cluster and metasan Introduction...................................................... 2 Objectives.......................................................
NETWORK ACCESS CONTROL TECHNOLOGIES
NETWORK ACCESS CONTROL TECHNOLOGIES Benny Czarny OPSWAT Inc., 640 2nd, 2nd Floor San Francisco, CA 94107, USA Tel +1 415 543 1534 # 301 Email benny@opswat.com ABSTRACT Cisco, Microsoft and the Trusted
Ovation Security Center Data Sheet
Features Scans for vulnerabilities Discovers assets Deploys security patches easily Allows only white-listed applications in workstations to run Provides virus protection for Ovation Windows stations Aggregates,
Release Notes. NCP Secure Entry Mac Client. Major Release 2.01 Build 47 May 2011. 1. New Features and Enhancements. Tip of the Day
NCP Secure Entry Mac Client Major Release 2.01 Build 47 May 2011 1. New Features and Enhancements Tip of the Day A Tip of the Day field for configuration tips and application examples is incorporated in
Using IKEv2 on Juniper Networks Junos Pulse Secure Access Appliance
Using IKEv2 on Juniper Networks Junos Pulse Secure Access Appliance Juniper Networks, Inc. 1 Table of Contents Before we begin... 3 Configuring IKEv2 on IVE... 3 IKEv2 Client Side Configuration on Windows
SysPatrol - Server Security Monitor
SysPatrol Server Security Monitor User Manual Version 2.2 Sep 2013 www.flexense.com www.syspatrol.com 1 Product Overview SysPatrol is a server security monitoring solution allowing one to monitor one or
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
Description of Actual State Sensor Types for the Software Asset Management (SWAM) Capability. 7 Jul 2014
Description of Actual State Sensor Types for the Software Asset Management (SWAM) Capability 7 Jul 2014 1 Purpose This document is intended to provide insight on the types of tools and technologies that
Trusted Virtual Datacenter Radically simplified security management
IBM T. J. Watson Research Center Trusted Virtual Datacenter Radically simplified security management Stefan Berger, Ramón Cáceres, Dimitrios Pendarakis, Reiner Sailer, Ray Valdez Secure Systems Department,
Trustworthy Computing
Stefan Thom Senior Software Development Engineer and Security Architect for IEB, Microsoft Rob Spiger, Senior Security Strategist Trustworthy Computing Agenda Windows 8 TPM Scenarios Hardware Choices with
Citrix XenServer 5.6 OpenSource Xen 2.6 on RHEL 5 OpenSource Xen 3.2 on Debian 5.0(Lenny)
Installing and configuring Intelligent Power Protector On Xen Virtualized Architecture Citrix XenServer 5.6 OpenSource Xen 2.6 on RHEL 5 OpenSource Xen 3.2 on Debian 5.0(Lenny) 1 Introduction... 3 1. Citrix
Viewing VPN Status, page 335. Configuring a Site-to-Site VPN, page 340. Configuring IPsec Remote Access, page 355
VPN This chapter describes how to configure Virtual Private Networks (VPNs) that allow other sites and remote workers to access your network resources. It includes the following sections: About VPNs, page
PrintFleet Enterprise Security Overview
PrintFleet Inc. is committed to providing software products that are secure for use in all network environments. PrintFleet software products only collect the critical imaging device metrics necessary
USER GUIDE. Snow Inventory Data Receiver Version 2.1 Release date 2013-04-26. Installation Configuration Document date 2014-12-02
USER GUIDE Product Snow Inventory Data Receiver Version 2.1 Release date 2013-04-26 Content Prerequisites Installation Configuration Document date 2014-12-02 CONTENT ABOUT THIS DOCUMENT... 3 PREREQUISITES...