Security in Plan 9. Russ Cox, MIT LCS Eric Grosse, Bell Labs Rob Pike, Bell Labs Dave Presotto, Avaya Labs and Bell Labs Sean Quinlan, Bell Labs
|
|
|
- Jordan Reynolds
- 8 years ago
- Views:
Transcription
1 Security in Plan 9 Russ Cox, MIT LCS Eric Grosse, Bell Labs Rob Pike, Bell Labs Dave Presotto, Avaya Labs and Bell Labs Sean Quinlan, Bell Labs plan9.bell labs.com
2 What comprises a security architecture?... An interface for applications to authenticate users and services establish secure channels A mechanism to manage authentication secrets (keys) Lots of code to implement cryptographic protocols and functions OS protection: user id, access permission, etc.
3 Plan 9... Research operating system developed at Bell Labs development since late 1980s base for other research since 1995 Easy for us to work on: we wrote and control all the source simple design makes everything easier
4 Plan 9 principles (and security implications)...
5 Plan 9 principles (and security implications)... Everything is a file uniform access control mechanism: file permissions alrwxrwxrwx, a is append-only, l is exclusive use system logs are a rw rw rw no syslog daemon: programs write directly to log mail spool files are alrw w w to deliver mail, just open mailbox and write a message
6 Plan 9 principles (and security implications)... Everything is a file uniform access control mechanism: file permissions alrwxrwxrwx, a is append-only, l is exclusive use system logs are a rw rw rw no syslog daemon: programs write directly to log mail spool files are alrw w w to deliver mail, just open mailbox and write a message All file systems are presented to kernel using one file protocol: 9P authentication is only in one place: 9P
7 Plan 9 principles (and security implications)... Everything is a file uniform access control mechanism: file permissions alrwxrwxrwx, a is append-only, l is exclusive use system logs are a rw rw rw no syslog daemon: programs write directly to log mail spool files are alrw w w to deliver mail, just open mailbox and write a message All file systems are presented to kernel using one file protocol: 9P authentication is only in one place: 9P Each process has its own private, malleable name space easy to remove resources from a process: unmount /net. easy to keep a process from adding resources: rfork(rfnomnt) disallows mounting new resources into the name space easy sandboxing
8 Plan 9 host owner... Local machine resources owned by the host owner normal user account no a priori special privileges (not root) on terminals, the user who booted the terminal on CPU servers, a pseudo-user
9 Problems with Plan 9 authentication (now fixed)...
10 Problems with Plan 9 authentication (now fixed)... One security domain can t be rsc in one place and rcox in another can t have different passwords
11 Problems with Plan 9 authentication (now fixed)... One security domain can t be rsc in one place and rcox in another can t have different passwords Auth protocol hard wired into 9P fixing an auth bug would require redefining 9P
12 Problems with Plan 9 authentication (now fixed)... One security domain can t be rsc in one place and rcox in another can t have different passwords Auth protocol hard wired into 9P fixing an auth bug would require redefining 9P Auth code in all servers, clients, kernels fixing an auth bug would require extensive code changes
13 Problems with Plan 9 authentication (now fixed)... One security domain can t be rsc in one place and rcox in another can t have different passwords Auth protocol hard wired into 9P fixing an auth bug would require redefining 9P Auth code in all servers, clients, kernels fixing an auth bug would require extensive code changes Needham-Schroeder-like shared key authentication passwords, DES keys short: vulnerable to eavesdropper dictionary attack
14 Redesign around an agent... Factotum, from the OED: a. In L. phrases: Dominus factotum, used for one who controls everything, a ruler with uncontrolled power; Johannes factotum, a Jack of all trades, a would-be universal genius. Also fig. b. One who meddles with everything, a busybody. c. In mod. sense: A man of all-work; also, a servant who has the entire management of his master s affairs.
15 Redesign around an agent... Factotum, from the OED: a. In L. phrases: Dominus factotum, used for one who controls everything, a ruler with uncontrolled power; Johannes factotum, a Jack of all trades, a would-be universal genius. Also fig. b. One who meddles with everything, a busybody. c. In mod. sense: A man of all-work; also, a servant who has the entire management of his master s affairs. This is Plan 9: factotum is a file server % cd /mnt/factotum % ls l lrw gre gre 0 Jul 31 10:14 confirm rw gre gre 0 Jul 31 10:14 ctl lr gre gre 0 Jul 31 10:14 log lrw gre gre 0 Jul 31 10:14 needkey r r r gre gre 0 Jul 31 10:14 proto rw rw rw gre gre 0 Jul 31 10:14 rpc %
16 Overview...
17 Overview... Factotum holds keys uses keys to execute authentication protocols host owner s factotum moderates identity changes on that machine user can run his own factotum; programs use whatever is mounted at /mnt/factotum
18 Overview... Factotum holds keys uses keys to execute authentication protocols host owner s factotum moderates identity changes on that machine user can run his own factotum; programs use whatever is mounted at /mnt/factotum Secstore provides safe for holding keys consulted by factotum to retrieve keys
19 Overview... Factotum holds keys uses keys to execute authentication protocols host owner s factotum moderates identity changes on that machine user can run his own factotum; programs use whatever is mounted at /mnt/factotum Secstore provides safe for holding keys consulted by factotum to retrieve keys Kernel allows host owner s factotum to issue identity change capabilities
20 Example...
21 Example... Boot time Factotum fetches keys fromsecstore user[none]: gre secstore password: ****** STA PIN+SecurID: **********
22 Example... Boot time Factotum fetches keys fromsecstore Apop mail client C connects to server S authenticates by proxying messages between factotum and network F S S start proto=apop role=server C F C start proto=apop role=client
23 Example... Boot time Factotum fetches keys fromsecstore Apop mail client C connects to server S authenticates by proxying messages between factotum and network F S S start proto=apop role=server C F C start proto=apop role=client F S S C F C +OK POP3 challenge
24 Example... Boot time Factotum fetches keys fromsecstore Apop mail client C connects to server S authenticates by proxying messages between factotum and network F S S start proto=apop role=server C F C start proto=apop role=client F S S C F C +OK POP3 challenge F S S C F C APOP gre response
25 Example... Boot time Factotum fetches keys fromsecstore Apop mail client C connects to server S authenticates by proxying messages between factotum and network F S S start proto=apop role=server C F C start proto=apop role=client F S S C F C +OK POP3 challenge F S S C F C APOP gre response F S S C F C +OK welcome
26 Example... Boot time Factotum fetches keys fromsecstore Apop mail client C connects to server S authenticates by proxying messages between factotum and network F S S start proto=apop role=server C F C start proto=apop role=client F S S C F C +OK POP3 challenge F S S C F C APOP gre response F S S C F C +OK welcome F S S authinfo F S S ok client=gre capability=capability C F C authinfo C F C ok
27 Example... Boot time Factotum fetches keys from secstore Apop mail client C connects to server S authenticates by proxying messages between factotum and network Apop server process changes identity to gre before proceeding passes capability (issued by server factotum) to kernel
28 Keys... Key is a list of attribute=value pairs: key proto=p9sk1 dom=cs.xyz.com user=gre!password=xyzzy confirm=yes key proto=apop server=comcast.net user=gre12345!password=boo The! prefix means don t print this value when displaying keys. Attributes are free-form, but some have meaning to: factotum itself: proto,confirm the protocols:password,user,server,dom the user: anything else
29 Factotum and keys... Keys are added tofactotum by writing them to thectl file. % cd /mnt/factotum % cat >ctl key dom=bell labs.com proto=p9sk1 user=gre!password= don t tell key proto=apop server=x.y.com user=gre!password= bite me ^D % cat ctl key dom=bell labs.com proto=p9sk1 user=gre!password? key proto=apop server=x.y.com user=gre!password? %
30 Key patterns... Key patterns are attribute=value pairs. The key must be a superset of the pattern. % cat ctl key dom=bell labs.com proto=p9sk1 user=gre!password? key proto=apop server=x.y.com user=gre!password? % echo delkey proto=apop >ctl % cat ctl key dom=bell labs.com proto=p9sk1 user=gre!password? %
31 Secstore... Secure, encrypted file store for small, precious files a safe to hold keys PAK protocol provides password-based access hash password to yield auth key actively attacking PAK is equivalent to computational Diffie- Hellman File encryption/decryption performed by client hash password another way to yield crypt key if server is compromised, attacker has to break the individual files
32 Secstore and factotum... Factotum fetches file namedfactotum from secstore at boot time. assumed to hold initial set of keys user[none]: gre secstore password: ****** STA PIN+SecurID: ********** can reload the secstore key file into factotum at any time secstore G factotum >/mnt/factotum/ctl can edit the key file (fetch to ramfs, edit, put back) User must remember only one password can be fairly high entropy stored keys can be arbitrarily high entropy
33 Factotum interface for programs... Auth_proxy executes RPCs over/mnt/factotum/rpc to proxy a conversation between factotum and a file descriptor. AuthInfo *ai; AuthGetkey *getkey; ai = auth_proxy(fd, getkey, "proto=p9any role=client"); Last argument is a key pattern Actually aprintf-style string: ai = auth_proxy(fd, getkey, "proto=p9any role=client server=%s", machine); AuthInfo holds user name and domain at other end nonce keys for the conversation possibly a capability to change user id
34 Identity changes via capabilities... User id changes are managed by capabilities string allows a process running as oldname to start running as newname single use Host owner sfactotum informs the kernel of newly issued capabilities by writing their SHA1 hashes to /dev/caphash echo rsc@rob@xyzzy sha1sum >/dev/caphash Factotum hands capability to another process, which then writes it to /dev/capuse echo rsc@rob@xyzzy >/dev/capuse /dev/caphash is removed once the host owner sfactotum starts, so other host owner processes can t use it.
35 Unprivileged, safe servers... Servers run as none, the opposite of a superuser. can t debug any processes explicitly excluded from some file systems (e.g., dump) (like everyone else,) requires a capability in order to become another user Bugs in servers are less critical on Unix, servers run as root: breaking a server gives you full access on Plan 9, servers run as none: breaking a server gives you hardly any access
36 Moving Factotum to Unix?... Still have source for (almost) everything no one group controls all the source in long term, would be good to convince owners to go along with you Factotum can t be user-level file system. RPCs over Unix socket named by environment variable lose the use of cat, echo to manage keys. Need simple replacements. Factotum must be separate process all authentication logic is encapsulated in one place buggy clients cannot compromise factotum only one program runs with special privileges Factotum must not be shared library shared libraries share memory space with buggy clients shared libraries require clients to run with special privileges
37 Moving Factotum to Unix?... Nothing Plan 9-specific about secstore Easy to write /dev/caphash kernel driver goodbye, setuid bit! even /bin/login and /bin/su don t need to run as root
38 Summary... More in paper: one line of code to start TLS on a file descriptor factotum protected against debuggers, swapping 9P auth protocol is now textual metaprotocol to choose real protocol links to more information in paper Everything is a file, so everything has a uniform access control mechanism: file permission bits Factotum, a protocol-agnostic trusted agent, handles both client and server authentication. Secstore provides convenient but secure storage of keys Clean separation of security and applications Mostly applicable to Unix
Security in Plan 9 ABSTRACT. and. factotum Factotum. Factotum. 1. Introduction. security. Proc. of the 2002 Usenix Security Symposium,
Security in Plan 9 Russ Cox, MIT LCS Eric Grosse, Bell Labs Rob Pike, Bell Labs Dave Presotto, Avaya Labs and Bell Labs Sean Quinlan, Bell Labs {rsc,ehg,rob,presotto,seanq}@plan9.bell labs.com ABSTRACT
Plan 9 Authentication in Linux
Plan 9 Authentication in Linux Ashwin Ganti University of Illinois at Chicago aganti@cs.uic.edu ABSTRACT This paper talks about the implementation of the Plan 9 authentication mechanisms for Linux. As
Persistent 9P Sessions for Plan 9
Persistent 9P Sessions for Plan 9 Gorka Guardiola, paurea@gmail.com Russ Cox, rsc@swtch.com Eric Van Hensbergen, ericvh@gmail.com ABSTRACT Traditionally, Plan 9 [5] runs mainly on local networks, where
Contents III: Contents II: Contents: Rule Set Based Access Control (RSBAC) 4.2 Model Specifics 5.2 AUTH
Rule Set Based Access Control (RSBAC) Linux Kernel Security Extension Tutorial Amon Ott Contents: 1 Motivation: Why We Need Better Security in the Linux Kernel 2 Overview of RSBAC 3 How
Lab 2 : Basic File Server. Introduction
Lab 2 : Basic File Server Introduction In this lab, you will start your file system implementation by getting the following FUSE operations to work: CREATE/MKNOD, LOOKUP, and READDIR SETATTR, WRITE and
Case Studies. Joint software development Mail 1 / 38. Case Studies Joint Software Development. Mailers
Joint software development Mail 1 / 38 Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems
Authentication Types. Password-based Authentication. Off-Line Password Guessing
Authentication Types Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4:
2.4: Authentication Authentication types Authentication schemes: RSA, Lamport s Hash Mutual Authentication Session Keys Trusted Intermediaries
Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Sync Security and Privacy Brief
Introduction Security and privacy are two of the leading issues for users when transferring important files. Keeping data on-premises makes business and IT leaders feel more secure, but comes with technical
SSL Tunnels. Introduction
SSL Tunnels Introduction As you probably know, SSL protects data communications by encrypting all data exchanged between a client and a server using cryptographic algorithms. This makes it very difficult,
Case Study: Access control 1 / 39
Case Study: Access control 1 / 39 Joint software development Mail 2 / 39 Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group
Midterm 2 exam solutions. Please do not read or discuss these solutions in the exam room while others are still taking the exam.
CS 161 Computer Security Spring 2010 Paxson/Wagner MT2 Solns Midterm 2 exam solutions Please do not read or discuss these solutions in the exam room while others are still taking the exam. CS 161, Spring
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
CS 161 Computer Security Spring 2010 Paxson/Wagner MT2
CS 161 Computer Security Spring 2010 Paxson/Wagner MT2 PRINT your name:, (last) SIGN your name: (first) PRINT your class account login: cs161- Your T s name: Your section time: Name of the person sitting
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 39 System Security Welcome
Usable Crypto: Introducing minilock. Nadim Kobeissi HOPE X, NYC, 2014
Usable Crypto: Introducing minilock Nadim Kobeissi HOPE X, NYC, 2014 2012 Browsers are an environment that is hostile to cryptography Malleability of the JavaScript runtime. The lack of low-level (system-level)
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
Example of Standard API
16 Example of Standard API System Call Implementation Typically, a number associated with each system call System call interface maintains a table indexed according to these numbers The system call interface
Internet Mail Client Control Library SSL Supplement
Codestone Ltd Internet Mail Client Control Library SSL Supplement Codestone Ltd 2004 Page 1 / 22 Welcome to the Internet Mail Client Control Library SSL Supplement we hope you will find the library to
TEL2821/IS2150: INTRODUCTION TO SECURITY Lab: Operating Systems and Access Control
TEL2821/IS2150: INTRODUCTION TO SECURITY Lab: Operating Systems and Access Control Version 3.4, Last Edited 9/10/2011 Students Name: Date of Experiment: Read the following guidelines before working in
Using etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
1. Open the Account Settings window by clicking on Account Settings from the Entourage menu.
Using TLS Encryption with Microsoft Entourage This guide assumes that you have previously configured Entourage to work with your Beloit College email account. If you have not, you can create an account
System Security Fundamentals
System Security Fundamentals Alessandro Barenghi Dipartimento di Elettronica, Informazione e Bioingegneria Politecnico di Milano alessandro.barenghi - at - polimi.it April 28, 2015 Lesson contents Overview
CRYPTOGRAPHY AS A SERVICE
CRYPTOGRAPHY AS A SERVICE Peter Robinson RSA, The Security Division of EMC Session ID: ADS R01 Session Classification: Advanced Introduction Deploying cryptographic keys to end points such as smart phones,
1. Open the preferences screen by opening the Mail menu and selecting Preferences...
Using TLS encryption with OS X Mail This guide assumes that you have already created an account in Mail. If you have not, you can use the new account wizard. The new account wizard is in the Accounts window
Desktop : Ubuntu 10.04 Desktop, Ubuntu 12.04 Desktop Server : RedHat EL 5, RedHat EL 6, Ubuntu 10.04 Server, Ubuntu 12.04 Server, CentOS 5, CentOS 6
201 Datavoice House, PO Box 267, Stellenbosch, 7599 16 Elektron Avenue, Technopark, Tel: +27 218886500 Stellenbosch, 7600 Fax: +27 218886502 Adept Internet (Pty) Ltd. Reg. no: 1984/01310/07 VAT No: 4620143786
Secure Remote Password (SRP) Authentication
Secure Remote Password (SRP) Authentication Tom Wu Stanford University tjw@cs.stanford.edu Authentication in General What you are Fingerprints, retinal scans, voiceprints What you have Token cards, smart
CS 416: Opera-ng Systems Design
Question 1 Explain the major difference between a file system that supports journaling (e.g., Linux ext4) versus a log-structured file system (e.g., YAFFS2). Operating Systems 2015 Exam 3 Review Paul Krzyzanowski
FL EDI SECURE FTP CONNECTIVITY TROUBLESHOOTING GUIDE. SSL/FTP (File Transfer Protocol over Secure Sockets Layer)
FL EDI SECURE FTP CONNECTIVITY TROUBLESHOOTING GUIDE This troubleshooting guide covers secure file transfers using the SFTP and SSL/FTP file transfer protocols for Claims, POC, and Medical EDI transmissions.
Using Network Attached Storage with Linux. by Andy Pepperdine
Using Network Attached Storage with Linux by Andy Pepperdine I acquired a WD My Cloud device to act as a demonstration, and decide whether to use it myself later. This paper is my experience of how to
How To Use Kerberos
KERBEROS 1 Kerberos Authentication Service Developed at MIT under Project Athena in mid 1980s Versions 1-3 were for internal use; versions 4 and 5 are being used externally Version 4 has a larger installed
Wireless Robust Security Networks: Keeping the Bad Guys Out with 802.11i (WPA2)
Wireless Robust Security Networks: Keeping the Bad Guys Out with 802.11i (WPA2) SUNY Technology Conference June 21, 2011 Bill Kramp FLCC Network Administrator Copyright 2011 William D. Kramp All Rights
Secured Communications using Linphone & Flexisip
Secured Communications using Linphone & Flexisip Solution description Office: Le Trident Bat D 34, avenue de l Europe 38100 Grenoble France Tel. : +33 (0)9 52 63 65 05 Headquarters: 12, allée des Genêts
Security Guide. BlackBerry Enterprise Service 12. for ios, Android, and Windows Phone. Version 12.0
Security Guide BlackBerry Enterprise Service 12 for ios, Android, and Windows Phone Version 12.0 Published: 2015-02-06 SWD-20150206130210406 Contents About this guide... 6 What is BES12?... 7 Key features
OPENID AUTHENTICATION SECURITY
OPENID AUTHENTICATION SECURITY Erik Lagercrantz and Patrik Sternudd Uppsala, May 17 2009 1 ABSTRACT This documents gives an introduction to OpenID, which is a system for centralised online authentication.
Thick Client Application Security
Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two
Secure Software Programming and Vulnerability Analysis
Secure Software Programming and Vulnerability Analysis Christopher Kruegel chris@auto.tuwien.ac.at http://www.auto.tuwien.ac.at/~chris Operations and Denial of Service Secure Software Programming 2 Overview
Oracle Solaris Security: Mitigate Risk by Isolating Users, Applications, and Data
Oracle Solaris Security: Mitigate Risk by Isolating Users, Applications, and Data Will Fiveash presenter, Darren Moffat author Staff Engineer Solaris Kerberos Development Safe Harbor Statement The following
Applying Cryptography as a Service to Mobile Applications
Applying Cryptography as a Service to Mobile Applications SESSION ID: CSV-F02 Peter Robinson Senior Engineering Manager RSA, The Security Division of EMC Introduction This presentation proposes a Cryptography
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)
Security Protocols Security Protocols Necessary to communicate securely across untrusted network Provide integrity, confidentiality, authenticity of communications Based on previously discussed cryptographic
The Security Behind Sticky Password
The Security Behind Sticky Password Technical White Paper version 3, September 16th, 2015 Executive Summary When it comes to password management tools, concerns over secure data storage of passwords and
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh10/
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh10/ Fall 2010 Sonja Buchegger buc@kth.se Lecture 13, Dec. 6, 2010 Auditing Security Audit an independent review and examination
CS 103 Lab Linux and Virtual Machines
1 Introduction In this lab you will login to your Linux VM and write your first C/C++ program, compile it, and then execute it. 2 What you will learn In this lab you will learn the basic commands and navigation
Network Security. Abusayeed Saifullah. CS 5600 Computer Networks. These slides are adapted from Kurose and Ross 8-1
Network Security Abusayeed Saifullah CS 5600 Computer Networks These slides are adapted from Kurose and Ross 8-1 Public Key Cryptography symmetric key crypto v requires sender, receiver know shared secret
Enabling Active Directory Authentication with ESX Server 1
1 Enabling Active Directory Authentication with ESX Server 1 This document provides information about how to configure ESX Server to use Active Directory for authentication. ESX Server system includes
$ftp = Net::FTP->new("some.host.name", Debug => 0) or die "Cannot connect to some.host.name: $@";
NAME Net::FTP - FTP Client class SYNOPSIS use Net::FTP; $ftp = Net::FTP->new("some.host.name", Debug => 0) or die "Cannot connect to some.host.name: $@"; $ftp->login("anonymous",'-anonymous@') or die "Cannot
Using Foundstone CookieDigger to Analyze Web Session Management
Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.
15-412. Factotum Sep. 23, 2013
15-412 Factotum Sep. 23, 2013 Dave Eckhardt 1 Factotum Left Out (of P9/9P Lecture) The whole authentication thing There is an auth server much like a Kerberos KDC There is an authentication fle system
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
Security Technical. Overview. BlackBerry Enterprise Service 10. BlackBerry Device Service Solution Version: 10.2
BlackBerry Enterprise Service 10 BlackBerry Device Service Solution Version: 10.2 Security Technical Overview Published: 2014-09-10 SWD-20140908123239883 Contents 1 About BlackBerry Device Service solution
Savitribai Phule Pune University
Savitribai Phule Pune University Centre for Information and Network Security Course: Introduction to Cyber Security / Information Security Module : Pre-requisites in Information and Network Security Chapter
CHARTER BUSINESS custom hosting faqs 2010 INTERNET. Q. How do I access my email? Q. How do I change or reset a password for an email account?
Contents Page Q. How do I access my email? Q. How do I change or reset a password for an email account? Q. How do I forward or redirect my messages to a different email address? Q. How do I set up an auto-reply
E- Encryption in Unix
UNIVERSITY of WISCONSIN-MADISON Computer Sciences Department CS 537 A. Arpaci-Dusseau Intro to Operating Systems Spring 2000 Security Solutions and Encryption Questions answered in these notes: How does
How to configure your email client
How to configure your email client This guide will teach you how to set up your email client. In this guide we will cover both Outlook and Windows Live mail, which are two of the major email clients used
Fossil an archival file server
Fossil an archival file server Russ Cox rsc@mit.edu PDOS Group Meeting January 7, 2003 http://pdos/~rsc/talks History... Cached WORM file server (Quinlan and Thompson): active file system on magnetic disk
NeoMail Guide. Neotel (Pty) Ltd
NeoMail Guide Neotel (Pty) Ltd NeoMail Connect Guide... 1 1. POP and IMAP Client access... 3 2. Outlook Web Access... 4 3. Outlook (IMAP and POP)... 6 4. Outlook 2007... 16 5. Outlook Express... 24 1.
Security Protocols: SSH. Michael E. Locasto University of Calgary
Security Protocols: SSH Michael E. Locasto University of Calgary Agenda Philosophy: data protec?on on the network Discussion of SSH SSH history Authen?ca?on Mechanisms SSH2 design overview / architecture
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) In this video you will learn the quite a bit about Public Key Infrastructure and how it is used to authenticate clients and servers. The purpose of Public Key Infrastructure
Management, Logging and Troubleshooting
CHAPTER 15 This chapter describes the following: SNMP Configuration System Logging SNMP Configuration Cisco NAC Guest Server supports management applications monitoring the system over SNMP (Simple Network
Topics in Network Security
Topics in Network Security Jem Berkes MASc. ECE, University of Waterloo B.Sc. ECE, University of Manitoba www.berkes.ca February, 2009 Ver. 2 In this presentation Wi-Fi security (802.11) Protecting insecure
THE BCS PROFESSIONAL EXAMINATIONS BCS Level 6 Professional Graduate Diploma in IT. April 2009 EXAMINERS' REPORT. Network Information Systems
THE BCS PROFESSIONAL EXAMINATIONS BCS Level 6 Professional Graduate Diploma in IT April 2009 EXAMINERS' REPORT Network Information Systems General Comments Last year examiners report a good pass rate with
HotZone. Theory of Operations Configuration Management
HotZone Theory of Operations Configuration Management What is HotZone? Free low-interaction honeypot Source code available (not Open Source but freely downloadable) Designed to be kitted up as a standalone
CS 600.443 Final Exam
CS 600.443 Final Exam Name: This exam is closed book and closed notes. You are required to do this completely on your own without any help from anybody else. Feel free to write on the back of any page
CIS 551 / TCOM 401 Computer and Network Security. Spring 2005 Lecture 4
CIS 551 / TCOM 401 Computer and Network Security Spring 2005 Lecture 4 Access Control: The Big Picture Objects - resources being protected E.g. files, devices, etc. Subjects - active entities E.g. processes,
The System Monitor Handbook. Chris Schlaeger John Tapsell Chris Schlaeger Tobias Koenig
Chris Schlaeger John Tapsell Chris Schlaeger Tobias Koenig 2 Contents 1 Introduction 6 2 Using System Monitor 7 2.1 Getting started........................................ 7 2.2 Process Table.........................................
Introduction to Operating Systems
Introduction to Operating Systems It is important that you familiarize yourself with Windows and Linux in preparation for this course. The exercises in this book assume a basic knowledge of both of these
CSE331: Introduction to Networks and Security. Lecture 34 Fall 2006
CSE331: Introduction to Networks and Security Lecture 34 Fall 2006 Announcements Problem with Crypto.java Look for a new Crypto.java file later today Project 4 is due Dec. 8th at midnight. Homework 3 is
USB Portable Storage Device: Security Problem Definition Summary
USB Portable Storage Device: Security Problem Definition Summary Introduction The USB Portable Storage Device (hereafter referred to as the device or the TOE ) is a portable storage device that provides
Email Set Up Instructions
Email Set Up Instructions Email Support...1 Important Fist Steps for all Users...2 DO YOU KNOW YOUR USERNAME AND PASSWORD?...2 Install the Despaminator CompanyV Certificate...2 What is Your Mail Client?...2
Encrypt-FS: A Versatile Cryptographic File System for Linux
Encrypt-FS: A Versatile Cryptographic File System for Linux Abstract Recently, personal sensitive information faces the possibility of unauthorized access or loss of storage devices. Cryptographic technique
Best Practices for VMware ESX Server 2
Best Practices for VMware ESX Server 2 2 Summary VMware ESX Server can be deployed in many ways. In this document, we recommend specific deployment guidelines. Following these guidelines will maximize
CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules
CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules Dr. Frederic Stumpf, ESCRYPT GmbH Embedded Security, Stuttgart, Germany 1 Introduction Electronic Control Units (ECU) are embedded
Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide
![Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide](/thumbs/24/4351346.jpg "Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide")
Network Security [2] Public Key Encryption Also used in message authentication & key distribution Based on mathematical algorithms, not only on operations over bit patterns (as conventional) => much overhead
Send Email TLM. Table of contents
Table of contents 1 Overview... 3 1.1 Overview...3 1.1.1 Introduction...3 1.1.2 Definitions... 3 1.1.3 Concepts... 3 1.1.4 Features...4 1.1.5 Requirements... 4 2 Warranty... 5 2.1 Terms of Use... 5 3 Configuration...6
Chapter 9 Key Management 9.1 Distribution of Public Keys 9.1.1 Public Announcement of Public Keys 9.1.2 Publicly Available Directory
There are actually two distinct aspects to the use of public-key encryption in this regard: The distribution of public keys. The use of public-key encryption to distribute secret keys. 9.1 Distribution
Creating Home Directories for Windows and Macintosh Computers
ExtremeZ-IP Active Directory Integrated Home Directories Configuration! 1 Active Directory Integrated Home Directories Overview This document explains how to configure home directories in Active Directory
Building Your Firewall Rulebase Lance Spitzner Last Modified: January 26, 2000
Building Your Firewall Rulebase Lance Spitzner Last Modified: January 26, 2000 Building a solid rulebase is a critical, if not the most critical, step in implementing a successful and secure firewall.
The BackTrack Successor
SCENARIOS Kali Linux The BackTrack Successor On March 13, Kali, a complete rebuild of BackTrack Linux, has been released. It has been constructed on Debian and is FHS (Filesystem Hierarchy Standard) complaint.
Storing Encrypted Plain Text Files Using Google Android
Storing Encrypted Plain Text Files Using Google Android Abstract Jared Hatfield University of Louisville Google Android is an open source operating system that is available on a wide variety of smart phones
Practical Mac OS X Insecurity. Security Concepts, Problems and Exploits on your Mac
Practical Mac OS X Insecurity Security Concepts, Problems and Exploits on your Mac Who am I? Student of physics, mathematics and astronomy in Bonn Mac user since 1995 I love Macs Mac evangelist Intentions
CMSC 421, Operating Systems. Fall 2008. Security. URL: http://www.csee.umbc.edu/~kalpakis/courses/421. Dr. Kalpakis
CMSC 421, Operating Systems. Fall 2008 Security Dr. Kalpakis URL: http://www.csee.umbc.edu/~kalpakis/courses/421 Outline The Security Problem Authentication Program Threats System Threats Securing Systems
File System Encryption with Integrated User Management
File System Encryption with Integrated User Management Stefan Ludwig Corporate Technology Siemens AG, Munich fsfs@stefan-ludwig.de Prof. Dr. Winfried Kalfa Operating Systems Group Chemnitz University of
SENSE Security overview 2014
SENSE Security overview 2014 Abstract... 3 Overview... 4 Installation... 6 Device Control... 7 Enrolment Process... 8 Authentication... 9 Network Protection... 12 Local Storage... 13 Conclusion... 15 2
Security in Android apps
Security in Android apps Falco Peijnenburg (3749002) August 16, 2013 Abstract Apps can be released on the Google Play store through the Google Developer Console. The Google Play store only allows apps
Company Co. Inc. LLC. LAN Domain Network Security Best Practices. An integrated approach to securing Company Co. Inc.
Company Co. Inc. LLC Multiple Minds, Singular Results LAN Domain Network Security Best Practices An integrated approach to securing Company Co. Inc. LLC s network Written and Approved By: Geoff Lacy, Tim
Creating a User Profile for Outlook 2013
Creating a User Profile for Outlook 2013 This document tells you how to create a user profile for Outlook 2013 on your computer (also known as the Outlook client). This is necessary, for example, when
Implementing Union Filesystem as a 9P2000 File Server
Implementing Union Filesystem as a 9P2000 File Server Latchesar Ionkov Los Alamos National Laboratory lionkov@lanl.gov ABSTRACT This paper describes the design and implementation of a 9P2000 file server
Authentication. Computer Security. Authentication of People. High Quality Key. process of reliably verifying identity verification techniques
Computer Security process of reliably verifying identity verification techniques what you know (eg., passwords, crypto key) what you have (eg., keycards, embedded crypto) what you are (eg., biometric information)
LSN 10 Linux Overview
LSN 10 Linux Overview ECT362 Operating Systems Department of Engineering Technology LSN 10 Linux Overview Linux Contemporary open source implementation of UNIX available for free on the Internet Introduced
Recipe for Mobile Data Security: TPM, Bitlocker, Windows Vista and Active Directory
Recipe for Mobile Data Security: TPM, Bitlocker, Windows Vista and Active Directory Tom Olzak October 2007 If your business is like mine, laptops regularly disappear. Until recently, centrally managed
CAPITAL UNIVERSITY PASSWORD POLICY
1.0 Overview Passwords are an important aspect of computer security. They are the front line of protection for user accounts. A poorly chosen password may result in the compromise of Capital University's
Building Robust Security Solutions Using Layering And Independence
Building Robust Security Solutions Using Layering And Independence Fred Roeper Neal Ziring Information Assurance Directorate National Security Agency Session ID: STAR-401 Session Classification: Intermediate
A Study on Secure Electronic Medical DB System in Hospital Environment
A Study on Secure Electronic Medical DB System in Hospital Environment Yvette E. Gelogo 1 and Sungwon Park 2 * 1 Catholic University of Daegu, Daegu, Korea 2 Department of Nursing, Hannam University, 133
iscsi Security (Insecure SCSI) Presenter: Himanshu Dwivedi
iscsi Security (Insecure SCSI) Presenter: Himanshu Dwivedi Agenda Introduction iscsi Attacks Enumeration Authorization Authentication iscsi Defenses Information Security Partners (isec) isec Partners Independent
Technical Note. Configuring Outlook Web Access with Secure WebMail Proxy for eprism
Technical Note Configuring Outlook Web Access with Secure WebMail Proxy for eprism Information in this document is subject to change without notice. This document may be distributed freely only in whole,
Xerox Mobile Print Cloud
September 2012 702P00860 Xerox Mobile Print Cloud Information Assurance Disclosure 2012 Xerox Corporation. All rights reserved. Xerox and Xerox and Design are trademarks of Xerox Corporation in the United
Homeland Security Red Teaming
Homeland Security Red Teaming Directs intergovernmental coordination Specifies Red Teaming Viewing systems from the perspective of a potential adversary Target hardening Looking for weakness in existing
Security Maintenance Practices. IT 4823 Information Security Administration. Patches, Fixes, and Revisions. Hardening Operating Systems
IT 4823 Information Security Administration Securing Operating Systems June 18 Security Maintenance Practices Basic proactive security can prevent many problems Maintenance involves creating a strategy