Secure application programming in the presence of side channel attacks. Marc Witteman & Harko Robroch Riscure 04/09/08 Session Code: RR-203
|
|
|
- Buddy Sparks
- 8 years ago
- Views:
Transcription
1 Secure application programming in the presence of side channel attacks Marc Witteman & Harko Robroch Riscure 04/09/08 Session Code: RR-203
2 Attacks in the field Survey 2007*, Hong Kong: Asia-Pacific Pay-TV piracy losses top US$1.5 billion for 2007 Unlooper: $100 Fault injection attack * Source: Cable & Satellite Broadcasting Association Asia & Standard Bank 2
3 Side channel attack on a standard 3-DES implementation (gnu-crypto) x45 0x08 0xEF 0x23 Time-power analysis Note: Generated with our Side Channel Test Platform Inspector 3
4 Outline Introduction What are side channel attacks? How to assess the risk? Secure programming patterns Conclusion 4
5 Objectives of this presentation Familiarize you with side channel threats Provide guidance for side channel protection at application level 5
6 Problem definition Are you making a Set-top box? Cell phone? Printer? Gaming console? And focusing on logical security? You leave the device vulnerable to side channel attacks 6
7 Change your protection strategy Common paradigm Do not trust input Preserve confidentiality and integrity in output Local: at input / output But we also need to Beware of leakage Protect run-time integrity Pervasive: throughout code Code 7
8 Outline Introduction What are side channel attacks? Side channel analysis Fault injection How to assess the risk? Secure programming patterns Conclusion 8
9 Side channel attacks Leakage - Side channel analysis 1. Timing 2. Power consumption 3. Electro-magnetic emission Fault - Side channel injection of faults 1. Power glitches 2. Optical pulses 9
10 Impact on your device Leakage 1. Key retrieval 2. Password / PIN retrieval Fault injection 1. Change a program decision E.g. unauthorized firmware update 2. Key retrieval E.g. trigger computational fault 10
11 Side channel analysis PC Probe $100 - $20K Oscilloscope $1K - $20k Amplifier (optional) $1K 10K Analysis and control software Fault injection PC Signal Generator $1K - $20K Glitch device $100 - $50K Analysis and control software Side channel attack equipment 11
12 Outline Introduction What are side channel attacks? How to assess the risk? Secure programming patterns Conclusion 12
13 Applicability to your device If side channel threats apply, depends on Physical access? Access time window? Interfacing and control? Exploitation equipment $? First mitigate easier threats! 13
14 How to identify weaknesses in your code Leakage Where you process a secret Processing access, use, verify Note: also data that depends on a secret Fault Security critical decision point Example: access control, branches (if, switch) Where you manipulate sensitive data Example: state, key-dependent data 14
15 Outline Introduction What are side channel attacks? How to assess the risk? Secure programming patterns Conclusion 15
16 Approach Countermeasures at each level of the device Application Operating Hardware System Hardware C r y p t o Here, we focus on the application 16
17 Patterns Philosophy: find repeatable solutions for common problems that are optimal rather than perfect Design Patterns Book from 1994 Recurring patterns in software design 17
18 Side channel protection patterns We define 15 related patterns KEY.INTEGRITY CRYPTO KEY.ACCESS DEFAULTFAIL BRANCH FLOW LEAKAGE CRYPTO.USER FAULT CONST.CODING ACCESS CLEARING BRANCH VERIFY DETECT DOUBLECHECK RESPOND 18
19 Side channel protection patterns KEY.INTEGRITY KEY.ACCESS BRANCH Use of a key value can cause data leakage Only use pointers to keys LEAKAGE CRYPTO.USER ACCESS CLEARING VERIFY 19
20 Side channel protection patterns KEY.INTEGRITY KEY.ACCESS LEAKAGE ACCESS BRANCH CRYPTO.USER CLEARING Checking Parity checking key integrity can leak is also the tricky key 1) Use Make pointers time-constant to keys + randomize checking order Or don t check the parity VERIFY 20
21 A standard implementation (Gnu Crypto) public static boolean checkparity ( byte[]key, int offset) { for (int i = 0; i < DES_KEY_LEN; i++) { // for all key bytes byte keybyte = key[i + offset]; int count = 0; while (keybyte!= 0) { // loop till no 1 bits left if ((keybyte & 0x01)!= 0) { count++; // increment for every 1 bit } keybyte >>>= 1; // shift right } if ((count & 1) == 0) { // not odd return false; // parity not adjusted } } return true; // all bytes were odd } 21
22 Power profile of parity check (Gnu Crypto)
23 Make time-constant (OpenSSL)???????? Why would you now have to randomize the order? 23
24 Side channel protection patterns KEY.INTEGRITY KEY.ACCESS LEAKAGE ACCESS VERIFY BRANCH CRYPTO.USER CLEARING if and switch statements leak information Avoid confidential branches Confidential decisions must be time-constant and in identical instruction sequence 24
25 Side channel protection patterns KEY.INTEGRITY KEY.ACCESS LEAKAGE ACCESS VERIFY BRANCH CRYPTO.USER CLEARING Checking Implementing key crypto integrity is is very also tricky 1) Usepointers - don t implement to keys - crypto in an application The O/S and hardware take care of this 25
26 Side channel protection patterns KEY.INTEGRITY KEY.ACCESS LEAKAGE BRANCH CRYPTO.USER Checking Accessing key an array integrity is prone is also to tricky differential analysis 1) Use pointers dynamic to offset keysto traverse array ACCESS CLEARING VERIFY 26
27 Side channel protection patterns KEY.INTEGRITY KEY.ACCESS LEAKAGE ACCESS VERIFY BRANCH CRYPTO.USER CLEARING Verification of e.g. password leaks data on the stored value Compare entire data value and use LEAKAGE.ACCESS Better: compare encrypted / hashed value strcmp and memcmp are sequential 27
28 Side channel protection patterns KEY.INTEGRITY KEY.ACCESS LEAKAGE BRANCH CRYPTO.USER Checking Clearing an key array integrity leaks is also tricky information 1) Use Overwrite pointers with to random keys data, and then clear it ACCESS CLEARING VERIFY 28
29 Side channel protection patterns Differential fault analysis reveals secret key CRYPTO Verify ciphered data before transmitting it Don t transmit if inconsistent FAULT DEFAULTFAIL FLOW CONST.CODING BRANCH DETECT DOUBLECHECK RESPOND 29
30 Side channel protection patterns Assuming a parameter has a value eases fault injection CRYPTO Also verify the last possible value when verifying conditions By default, a comparison should lead to a failure FAULT DEFAULTFAIL FLOW CONST.CODING BRANCH DETECT DOUBLECHECK RESPOND 30
31 Side channel protection patterns Program flow can be manipulated code hi-jacking CRYPTO Use a shadow stack and program counter Verify these after branches FAULT DEFAULTFAIL FLOW CONST.CODING BRANCH DETECT DOUBLECHECK RESPOND 31
32 Side channel protection patterns Simple data values are easy to manipulate CRYPTO Use non-trivial values Preferably with maximal hamming distance FAULT DEFAULTFAIL FLOW CONST.CODING STATE_INIT = 0 0x3C DETECT RESPOND BRANCH DOUBLECHECK 32
33 Side channel protection patterns A Boolean is easy to corrupt Use non-trivial values for sensitive decisions CRYPTO FAULT DEFAULTFAIL FLOW CONST.CODING BRANCH DETECT DOUBLECHECK RESPOND 33
34 Side channel protection patterns Detect if you get hit Keep checksums and verify each time data is used Use integrity-controlled objects CRYPTO FAULT DEFAULTFAIL FLOW CONST.CODING BRANCH DETECT DOUBLECHECK RESPOND 34
35 Side channel protection patterns A wrong decision can be enforced CRYPTO Verify data used in a decision twice 2 nd check should be complementary to 1 st FAULT DEFAULTFAIL FLOW CONST.CODING BRANCH DETECT DOUBLECHECK RESPOND 35
36 Side channel protection patterns Immunity is hard; respond after you detect it CRYPTO Log incidents Disable functionality Wipe secrets FAULT DEFAULTFAIL FLOW CONST.CODING BRANCH DETECT DOUBLECHECK RESPOND 36
37 Outline Introduction What are side channel attacks? How to assess the risk? Secure programming patterns Conclusion Discussion Developer checklist Further research Concluding 37
38 Discussion Relationship with hardware & O/S protection? Underlying level OK Excellent, apply all patterns Underlying level not OK Prioritize what patterns to apply Application Operating Hardware System Hardware Cr yp to 38
39 Discussion (cont.) Implementing sufficient protection is a challenge A compiler may undo countermeasures Weakness identification requires experience Protecting sensitive decisions is tedious Incident response may conflict with reliability requirements Trade off between secure programming and maintainability 39
40 Device developer checklist Does the device need protection? Understand the resistance of the hardware & O/S Identify potential weaknesses in design Apply the patterns Understand your compiler Code it Test the resistance of the device 40
41 Further research Generic code solutions for patterns Secure comparison of arrays Integrity-controlled objects Shadow stack and program counter Traps Computer-aided inspection & protection Find weaknesses in code Explore flow alternatives and privilege handling Conversion to machine language (compiler) 41
42 Concluding Be aware that most existing software has little side channel resistance On our experience, these patterns improve the side channel resistance of devices Read more on this in our paper ( 42
43 References & resources 1. Design patterns: elements of reusable object-oriented software, ISBN Advances in smart card security, 3. Differential power analysis, 4. Power analysis attacks: revealing the secrets of smart cards, ISBN OpenSSL, 6. GNU Crypto, 7. Smart Card Alliance, 8. Secure application programming in the presence of side channel attacks, 43
44 Thank you. More questions? Marc Witteman Chief Technology Officer Harko Robroch Managing Director Riscure B.V. Rotterdamseweg 183c 2629 HD Delft The Netherlands Phone: +31 (0) Visit Riscure at booth
Side Channel Analysis and Embedded Systems Impact and Countermeasures
Side Channel Analysis and Embedded Systems Impact and Countermeasures Job de Haas Agenda Advances in Embedded Systems Security From USB stick to game console Current attacks Cryptographic devices Side
Side Channels: Hardware or Software threat?
Side Channels: Hardware or Software threat? Job de Haas Riscure Who am I Job de Haas Principal Security Analyst at Riscure Testing security on: Set-top-boxes, mobile phones, smart cards, payment terminals,
SENSE Security overview 2014
SENSE Security overview 2014 Abstract... 3 Overview... 4 Installation... 6 Device Control... 7 Enrolment Process... 8 Authentication... 9 Network Protection... 12 Local Storage... 13 Conclusion... 15 2
CryptoFirewall Technology Introduction
CryptoFirewall Technology Introduction Cryptography Research, Inc. www.cryptography.com 575 Market St., 21 st Floor, San Francisco, CA 94105 1998-2007 Cryptography Research, Inc. Protected under issued
Horst Görtz Institute for IT-Security
Horst Görtz Institute for IT-Security On the Vulnerability of FPGA Bitstream Encryption against Power Analysis Attacks Extracting Keys from Xilinx Virtex-II FPGAs Amir Moradi, Alessandro Barenghi, Timo
Hardware Trojans Detection Methods Julien FRANCQ
DEFENDING WORLD SECURITY Hardware Trojans Detection Methods Julien FRANCQ 2013, December the 12th Outline c 2013 CASSIDIAN CYBERSECURITY - All rights reserved TRUDEVICE 2013, December the 12th Page 2 /
Introduction Page 4. Inspector SCA Page 6. Inspector FI Page 10. Service & Product support Page 13. Inspector Hardware Matrix Page 14
inspector Introduction Page 4 Inspector SCA Page 6 Inspector FI Page 10 Service & Product support Page 13 Inspector Hardware Matrix Page 14 Riscure Riscure is an independent security test laboratory specialising
Sleuth: Automated Verification of Software Power Analysis Countermeasures
Sleuth: Automated Verification of Software Power Analysis Countermeasures Ali Galip Bayrak*, Francesco Regazzoni, David Novo*, and Paolo Ienne* * Ecole Polytechnique Fédérale de Lausanne (EPFL) TU Delft
Java Card. Smartcards. Demos. . p.1/30
. p.1/30 Java Card Smartcards Java Card Demos Smart Cards. p.2/30 . p.3/30 Smartcards Credit-card size piece of plastic with embedded chip, for storing & processing data Standard applications bank cards
Advances in Smartcard Security
Advances in Smartcard Security Marc Witteman Introduction Over the last decade smartcards have entered our global community. Although initially they were only used as simple phone cards they now support
Adversary Modelling 1
Adversary Modelling 1 Evaluating the Feasibility of a Symbolic Adversary Model on Smart Transport Ticketing Systems Authors Arthur Sheung Chi Chan, MSc (Royal Holloway, 2014) Keith Mayes, ISG, Royal Holloway
How To Manage Security On A Networked Computer System
Unified Security Reduce the Cost of Compliance Introduction In an effort to achieve a consistent and reliable security program, many organizations have adopted the standard as a key compliance strategy
πωχ Notes on Domino Black Hat Las Vegas 2003 Aldora Louw PricewaterhouseCoopers
Notes on Domino Black Hat Las Vegas 2003 Aldora Louw PricewaterhouseCoopers Lotus Domino is inherently secure...a Misconception!!! Security is Not Automatic!!!! Slide #2 Security Requires Planning Design
CMSC 421, Operating Systems. Fall 2008. Security. URL: http://www.csee.umbc.edu/~kalpakis/courses/421. Dr. Kalpakis
CMSC 421, Operating Systems. Fall 2008 Security Dr. Kalpakis URL: http://www.csee.umbc.edu/~kalpakis/courses/421 Outline The Security Problem Authentication Program Threats System Threats Securing Systems
Practical Online Filesystem Checking and Repair
Practical Online Filesystem Checking and Repair Daniel Phillips Samsung Research America (Silicon Valley) d.phillips@partner.samsung.com 1 2013 SAMSUNG Electronics Co. Why we want online checking: Fsck
Security testing of hardware product
Alain MERLE CESTI LETI CEA Grenoble Alain.merle@cea.fr Security testing of hardware product DCIS/SASTI/CESTI 1 Abstract «What are you doing in ITSEFs?» Testing, Security testing, Attacks, Evaluations,
PUF Physical Unclonable Functions
Physical Unclonable Functions Protecting next-generation Smart Card ICs with SRAM-based s The use of Smart Card ICs has become more widespread, having expanded from historical banking and telecommunication
Cyber Attacks: An Emerging Threat to Satellites
Cyber Attacks: An Emerging Threat to Satellites This presentation does not contain any ITAR restricted material. Paul Wood Southwest Research Institute paul.wood@swri.org Agenda Cyber Security Threat Environment
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Threat Modeling. Frank Piessens (Frank.Piessens@cs.kuleuven.be ) KATHOLIEKE UNIVERSITEIT LEUVEN
Threat Modeling Frank Piessens (Frank.Piessens@cs.kuleuven.be ) Secappdev 2007 1 Overview Introduction Key Concepts Threats, Vulnerabilities, Countermeasures Example Microsoft s Threat Modeling Process
CSE331: Introduction to Networks and Security. Lecture 32 Fall 2004
CSE331: Introduction to Networks and Security Lecture 32 Fall 2004 Hackers / Intruders External attacks Typical hacker Exploits carried out remotely Does not have an account on the remote machine Insider
ICTN 4040. Enterprise Database Security Issues and Solutions
Huff 1 ICTN 4040 Section 001 Enterprise Information Security Enterprise Database Security Issues and Solutions Roger Brenton Huff East Carolina University Huff 2 Abstract This paper will review some of
Security Controls for the Autodesk 360 Managed Services
Autodesk Trust Center Security Controls for the Autodesk 360 Managed Services Autodesk strives to apply the operational best practices of leading cloud-computing providers around the world. Sound practices
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 6
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 6 Announcements Reminder: Send in project groups TODAY If you don't have a group, let us know. If you haven't started on the project
Application Intrusion Detection
Application Intrusion Detection Drew Miller Black Hat Consulting Application Intrusion Detection Introduction Mitigating Exposures Monitoring Exposures Response Times Proactive Risk Analysis Summary Introduction
Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography
Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography What Is Steganography? Steganography Process of hiding the existence of the data within another file Example:
CHASE Survey on 6 Most Important Topics in Hardware Security
University of Connecticut CHASE Survey on 6 Most Important Topics in Hardware Security Prepared By Prof. M. Tehranipoor Charles H. Knapp Associate Professor in Engineering Innovation Topics! Counterfeit
Penetration Testing Windows Vista TM BitLocker TM
Penetration Testing BitLocker TM Drive Encryption Douglas MacIver Penetration Engineer System Integrity Group, Corporation Hack In The Box 2006/09/21 2006 Corporation. All rights reserved. Trustworthy
Introduction to Information Security
Introduction to Information Security Chapter 1 Information Security Basics Winter 2015/2016 Stefan Mangard, www.iaik.tugraz.at What is Information Security? 2 Security vs. Safety The German word Sicherheit
Data Security Incident Response Plan. [Insert Organization Name]
![Data Security Incident Response Plan. [Insert Organization Name]](/thumbs/34/17160420.jpg "Data Security Incident Response Plan. [Insert Organization Name]")
Data Security Incident Response Plan Dated: [Month] & [Year] [Insert Organization Name] 1 Introduction Purpose This data security incident response plan provides the framework to respond to a security
Malicious Code on Java Card Smartcards: Attacks and Countermeasures
Malicious Code on Java Card Smartcards: Attacks and Countermeasures Wojciech Mostowski and Erik Poll Digital Security Radboud University Nijmegen To be presented at CARDIS'2008 Erik Poll Radboud University
Computer Systems Structure Main Memory Organization
Computer Systems Structure Main Memory Organization Peripherals Computer Central Processing Unit Main Memory Computer Systems Interconnection Communication lines Input Output Ward 1 Ward 2 Storage/Memory
CrashPlan Security SECURITY CONTEXT TECHNOLOGY
TECHNICAL SPECIFICATIONS CrashPlan Security CrashPlan is a continuous, multi-destination solution engineered to back up mission-critical data whenever and wherever it is created. Because mobile laptops
User s Guide. Security Operations. 2013. 5 Ver. 1.02
User s Guide Security Operations 013. 5 Ver. 1.0 Contents 1 Security 1.1 Introduction... 1- Compliance with the ISO15408 Standard... 1- Operating Precautions... 1- INSTALLATION CHECKLIST... 1-3 1. Security
90% of data breaches are caused by software vulnerabilities.
90% of data breaches are caused by software vulnerabilities. Get the skills you need to build secure software applications Secure Software Development (SSD) www.ce.ucf.edu/ssd Offered in partnership with
CHAPTER 7: The CPU and Memory
CHAPTER 7: The CPU and Memory The Architecture of Computer Hardware, Systems Software & Networking: An Information Technology Approach 4th Edition, Irv Englander John Wiley and Sons 2010 PowerPoint slides
CIS 551 / TCOM 401 Computer and Network Security. Spring 2006 Lecture 7
CIS 551 / TCOM 401 Computer and Network Security Spring 2006 Lecture 7 Announcements Reminder: First Midterm is one week from today. (2/9/2006) In class, closed notes Example exam from last year will be
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy 21 June 2010 Table of Contents Introduction Module Specification Ports and Interfaces Approved Algorithms Test Environment Roles
INTRUSION PROTECTION AGAINST SQL INJECTION ATTACKS USING REVERSE PROXY
INTRUSION PROTECTION AGAINST SQL INJECTION ATTACKS USING REVERSE PROXY Asst.Prof. S.N.Wandre Computer Engg. Dept. SIT,Lonavala University of Pune, snw.sit@sinhgad.edu Gitanjali Dabhade Monika Ghodake Gayatri
Software License Management using the Polymorphic Encryption Algorithm White Paper
pmc-ciphers.com Software License Management using the Polymorphic Encryption Algorithm White Paper Published: May 2007, first published in January 2003 PMC Software License Management 1 Software License
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Secure Hardware PV018 Masaryk University Faculty of Informatics
Secure Hardware PV018 Masaryk University Faculty of Informatics Jan Krhovják Vašek Matyáš Roadmap Introduction The need of secure HW Basic terminology Architecture Cryptographic coprocessors/accelerators
The Trivial Cisco IP Phones Compromise
Security analysis of the implications of deploying Cisco Systems SIP-based IP Phones model 7960 Ofir Arkin Founder The Sys-Security Group ofir@sys-security.com http://www.sys-security.com September 2002
Test vehicle tool to assess candidate ITSEF s competency
Test vehicle tool to assess candidate ITSEF s competency September 28, 2011 Takayuki TOBITA IT Security Center (ISEC) Information-technology Promotion Agency, JAPAN (IPA) 1 Common Criteria Scheme in Japan
Mobile Security Framework; Advances in Mobile Governance in Korea. TaeKyung Kim tkkim@stu.ac.kr
Mobile Security Framework; Advances in Mobile Governance in Korea TaeKyung Kim tkkim@stu.ac.kr I. e-banking in Korea 1. e-banking? BIS (Bank for International Settlements) - e-finance(electronic banking)
Pervasive Computing und. Informationssicherheit
Pervasive Computing und 11. Symposium on Privacy and Security Rüschlikon, 13. September 2006 Prof. Christof Paar European Competence Center for IT Security www.crypto.rub.de Contents 1. Pervasive Computing
Chapter 15 Operating System Security
Operating Systems: Internals and Design Principles Chapter 15 Operating System Security Eighth Edition By William Stallings System Access Threats System access threats fall into two general categories:
More effective protection for your access control system with end-to-end security
More effective protection for your access control system with end-to-end security By Jeroen Harmsen The first article on end-to-end security appeared as long ago as 1981. The principle originated in ICT
The Misuse of RC4 in Microsoft Word and Excel
The Misuse of RC4 in Microsoft Word and Excel Hongjun Wu Institute for Infocomm Research, Singapore hongjun@i2r.a-star.edu.sg Abstract. In this report, we point out a serious security flaw in Microsoft
CIS 551 / TCOM 401 Computer and Network Security
CIS 551 / TCOM 401 Computer and Network Security Spring 2008 Lecture 8 2/12/08 CIS/TCOM 551 1 Announcements Project 1 has been graded. Project 2: will be posted this week Due March 7th Network intrusion
CMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
Monitoring Conditional Access Systems
Monitoring Conditional Access Systems Introduction A Conditional Access system is a key component for most digital TV operations. They secure the operators investments by encrypting the signals and ensures
MovieLabs Specification for Enhanced Content Protection Version 1.0
MovieLabs Specification for Enhanced Content Protection Version 1.0 Introduction Digital content distribution technologies are evolving and advancing at a rapid pace. Content creators are using these technologies
AMI security considerations
AMI security considerations Jeff McCullough Introduction Many electric utilities are deploying or planning to deploy smart grid technologies. For smart grid deployments, advanced metering infrastructure
A Secure Software Implementation of Nonlinear Advanced Encryption Standard
IOSR Journal of VLSI and Signal Processing (IOSR-JVSP) ISSN: 2319 4200, ISBN No. : 2319 4197 Volume 1, Issue 5 (Jan. - Feb 2013), PP 44-48 A Secure Software Implementation of Nonlinear Advanced Encryption
- Table of Contents -
- Table of Contents - 1 INTRODUCTION... 1 1.1 TARGET READERS OF THIS DOCUMENT... 1 1.2 ORGANIZATION OF THIS DOCUMENT... 2 1.3 COMMON CRITERIA STANDARDS DOCUMENTS... 3 1.4 TERMS AND DEFINITIONS... 4 2 OVERVIEW
Information Security Basic Concepts
Information Security Basic Concepts 1 What is security in general Security is about protecting assets from damage or harm Focuses on all types of assets Example: your body, possessions, the environment,
Oracle Solaris Security: Mitigate Risk by Isolating Users, Applications, and Data
Oracle Solaris Security: Mitigate Risk by Isolating Users, Applications, and Data Will Fiveash presenter, Darren Moffat author Staff Engineer Solaris Kerberos Development Safe Harbor Statement The following
Chapter 12 Network Administration and Support
Chapter 12 Network Administration and Support Objectives Manage networked accounts Monitor network performance Protect your servers from data loss Guide to Networking Essentials, Fifth Edition 2 Managing
Security in ST : From Company to Products
Security in ST : From Company to Products July 2015 Thierry FENSCH Innovation, Collaboration and Efficiency Director Grenoble Site A global semiconductor leader 2014 revenues of $7.40B Who we are 2 Approximately
MXMedia CipherStream. Preliminary Assessment. Copyright 2012 Farncombe 1.0. Author: T +44 1256 844161 F +44 1256 844162 www.farncombe.
MXMedia CipherStream Preliminary Assessment 1.0 Author: T +44 1256 844161 F +44 1256 844162 www.farncombe.com Copyright 2012 Farncombe Belvedere Basing View Basingstoke RG21 4HG This document and the information
Java Card Applet Firewall Exploration and Exploitation
Java Card Applet Firewall Exploration and Exploitation Wojciech Mostowski and Erik Poll Digital Security Radboud University Nijmegen The Netherlands http://www.cs.ru.nl/~{woj,erikpoll}/ Introduction Study
Wireless security (WEP) 802.11b Overview
Wireless security (WEP) 9/01/10 EJ Jung 802.11b Overview! Standard for wireless networks Approved by IEEE in 1999! Two modes: infrastructure and ad hoc IBSS (ad hoc) mode Independent Basic Service Set
Acano solution. Security Considerations. August 2015 76-1026-01-E
Acano solution Security Considerations August 2015 76-1026-01-E Contents Contents 1 Introduction... 3 2 Acano Secure Development Lifecycle... 3 3 Acano Security Points... 4 Acano solution: Security Consideration
Broadcasting encryption or systematic #FAIL? Phil
WE 201 EK 2 42 Broadcasting encryption or systematic #FAIL? SUMMARY Intro : Broadcasting something... 1984 : Discret 11 1995 : Syster 1996 2002 : Seca 1 2002 2008 : Seca 2 Conclusion 2/49 Broadcasting
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 7 Access Control Fundamentals
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 7 Access Control Fundamentals Objectives Define access control and list the four access control models Describe logical access control
MICROPROCESSOR. Exclusive for IACE Students www.iace.co.in iacehyd.blogspot.in Ph: 9700077455/422 Page 1
MICROPROCESSOR A microprocessor incorporates the functions of a computer s central processing unit (CPU) on a single Integrated (IC), or at most a few integrated circuit. It is a multipurpose, programmable
Plain English Guide To Common Criteria Requirements In The. Field Device Protection Profile Version 0.75
Plain English Guide To Common Criteria Requirements In The Field Device Protection Profile Version 0.75 Prepared For: Process Control Security Requirements Forum (PCSRF) Prepared By: Digital Bond, Inc.
Patterns for Secure Boot and Secure Storage in Computer Systems
Patterns for Secure Boot and Secure Storage in Computer Systems Hans Löhr, Ahmad-Reza Sadeghi, Marcel Winandy Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany {hans.loehr,ahmad.sadeghi,marcel.winandy}@trust.rub.de
REGULATIONS FOR THE SECURITY OF INTERNET BANKING
REGULATIONS FOR THE SECURITY OF INTERNET BANKING PAYMENT SYSTEMS DEPARTMENT STATE BANK OF PAKISTAN Table of Contents PREFACE... 3 DEFINITIONS... 4 1. SCOPE OF THE REGULATIONS... 6 2. INTERNET BANKING SECURITY
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
ARIZONA CTE CAREER PREPARATION STANDARDS & MEASUREMENT CRITERIA SOFTWARE DEVELOPMENT, 15.1200.40
SOFTWARE DEVELOPMENT, 15.1200.40 STANDARD 1.0 APPLY PROBLEM-SOLVING AND CRITICAL THINKING SKILLS TO INFORMATION 1.1 Describe methods of establishing priorities 1.2 Prepare a plan of work and schedule information
EPASSPORT WITH BASIC ACCESS CONTROL AND ACTIVE AUTHENTICATION
COMMON CRITERIA PROTECTION PROFILE EPASSPORT WITH BASIC ACCESS CONTROL AND ACTIVE AUTHENTICATION Draft Version 1.0 TURKISH STANDARDS INSTITUTION TABLE OF CONTENTS Common Criteria Protection Profile...
VASCO Data Security International, Inc. DIGIPASS GO-7. FIPS 140-2 Non-Proprietary Cryptographic Module Security Policy
VASCO Data Security International, Inc. DIGIPASS GO-7 FIPS 140-2 Non-Proprietary Cryptographic Module Security Policy Security Level: 2 Version: 1.7 Date: August 12, 2015 Copyright VASCO Data Security
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Section 12 MUST BE COMPLETED BY: 4/22
Test Out Online Lesson 12 Schedule Section 12 MUST BE COMPLETED BY: 4/22 Section 12.1: Best Practices This section discusses the following security best practices: Implement the Principle of Least Privilege
Storing Encrypted Plain Text Files Using Google Android
Storing Encrypted Plain Text Files Using Google Android Abstract Jared Hatfield University of Louisville Google Android is an open source operating system that is available on a wide variety of smart phones
CS52600: Information Security
CS18000: Programming I CS52600: Information Security Vulnerability Analysis 15 November 2010 Prof. Chris Clifton Vulnerability Analysis Vulnerability: Lapse in enforcement enabling violation of security
Wireless LAN Security Mechanisms
Wireless LAN Security Mechanisms Jingan Xu, Andreas Mitschele-Thiel Technical University of Ilmenau, Integrated Hard- and Software Systems Group jingan.xu@tu-ilmenau.de, mitsch@tu-ilmenau.de Abstract.
Security (II) ISO 7498-2: Security Architecture of OSI Reference Model. Outline. Course Outline: Fundamental Topics. EE5723/EE4723 Spring 2012
Course Outline: Fundamental Topics System View of Network Security Network Security Model Security Threat Model & Security Services Model Overview of Network Security Security Basis: Cryptography Secret
Healthcare Security Vulnerabilities. Adam Goslin Chief Operations Officer High Bit Security
Healthcare Security Vulnerabilities Adam Goslin Chief Operations Officer High Bit Security Webinar Overview IT Security and Data Loss Breach Sources / Additional Information Recent Medical Breach / Loss
Exploiting Transparent User Identification Systems
Exploiting Transparent User Identification Systems Wayne Murphy Benjamin Burns Version 1.0a 1 CONTENTS 1.0 Introduction... 3 1.1 Project Objectives... 3 2.0 Brief Summary of Findings... 4 3.0 Background
Yaffs NAND Flash Failure Mitigation
Yaffs NAND Flash Failure Mitigation Charles Manning 2012-03-07 NAND flash is one of very few types of electronic device which are knowingly shipped with errors and are expected to generate further errors
ADVANCED IC REVERSE ENGINEERING TECHNIQUES: IN DEPTH ANALYSIS OF A MODERN SMART CARD. Olivier THOMAS Blackhat USA 2015
ADVANCED IC REVERSE ENGINEERING TECHNIQUES: IN DEPTH ANALYSIS OF A MODERN SMART CARD Olivier THOMAS Blackhat USA 2015 About Texplained Texplained [Technology Explained] refers
Software based Finite State Machine (FSM) with general purpose processors
Software based Finite State Machine (FSM) with general purpose processors White paper Joseph Yiu January 2013 Overview Finite state machines (FSM) are commonly used in electronic designs. FSM can be used
Rfid Authentication Protocol for security and privacy Maintenance in Cloud Based Employee Management System
Rfid Authentication Protocol for security and privacy Maintenance in Cloud Based Employee Management System ArchanaThange Post Graduate Student, DKGOI s COE, Swami Chincholi, Maharashtra, India archanathange7575@gmail.com,
SHORT MESSAGE SERVICE SECURITY
SHORT MESSAGE SERVICE SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
RF-Enabled Applications and Technology: Comparing and Contrasting RFID and RF-Enabled Smart Cards
RF-Enabled Applications and Technology: Comparing and Contrasting RFID and RF-Enabled Smart Cards January 2007 Developed by: Smart Card Alliance Identity Council RF-Enabled Applications and Technology:
picojava TM : A Hardware Implementation of the Java Virtual Machine
picojava TM : A Hardware Implementation of the Java Virtual Machine Marc Tremblay and Michael O Connor Sun Microelectronics Slide 1 The Java picojava Synergy Java s origins lie in improving the consumer
Dr. Alexander Walsch alexander.walsch@ge.com IN 2244 Part V WS 2013/14 Technische Universität München
Industrial Embedded Systems - Design for Harsh Environment - Dr. Alexander Walsch alexander.walsch@ge.com IN 2244 Part V WS 2013/14 Technische Universität München Architecture Patterns Recurring Hardware
UNCLASSIFIED Version 1.0 May 2012
Secure By Default: Platforms Computing platforms contain vulnerabilities that can be exploited for malicious purposes. Often exploitation does not require a high degree of expertise, as tools and advice
SECURITY PRACTICES FOR ADVANCED METERING INFRASTRUCTURE Elif Üstündağ Soykan, Seda Demirağ Ersöz 08.05.2014, ICSG 2014
SECURITY PRACTICES FOR ADVANCED METERING INFRASTRUCTURE Elif Üstündağ Soykan, Seda Demirağ Ersöz 08.05.2014, ICSG 2014 Table of Contents Introduction AMI Communication Architecture Security Threats Security
Information Technology Security Evaluation Criteria. ITSEC Joint Interpretation Library (ITSEC JIL)
S Information Technology Security Evaluation Criteria ITSEC Joint Interpretation Library (ITSEC JIL) Version 2.0 November 1998 This document is paginated from i to vi and from 1 to 65 ITSEC Joint Interpretation
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
Secure Web Development Teaching Modules 1. Security Testing. 1.1 Security Practices for Software Verification
Secure Web Development Teaching Modules 1 Security Testing Contents 1 Concepts... 1 1.1 Security Practices for Software Verification... 1 1.2 Software Security Testing... 2 2 Labs Objectives... 2 3 Lab
Information Security By Bhupendra Ratha, Lecturer School of Library & Information Science D.A.V.V., Indore E-mail:bhu261@gmail.com Outline of Information Security Introduction Impact of information Need
FIPS 140-2 Non-Proprietary Security Policy. IBM Internet Security Systems SiteProtector Cryptographic Module (Version 1.0)
FIPS 140-2 Non-Proprietary Security Policy IBM Internet Security Systems SiteProtector Document Version 2.3 August 5, 2010 Document Version 2.3 IBM Internet Security Systems Page 1 of 24 Prepared For:
Introduction. What is an Operating System?
Introduction What is an Operating System? 1 What is an Operating System? 2 Why is an Operating System Needed? 3 How Did They Develop? Historical Approach Affect of Architecture 4 Efficient Utilization
Confinement Problem. The confinement problem Isolating entities. Example Problem. Server balances bank accounts for clients Server security issues:
Confinement Problem The confinement problem Isolating entities Virtual machines Sandboxes Covert channels Mitigation 1 Example Problem Server balances bank accounts for clients Server security issues:
SSH Secure Shell. What is SSH?
Security, like correctness, is not an add-on feature. -- Andrew S. Tanenbaum SSH Secure Shell - - Binary Packet Protocol - key exchange - server authentication - - SSH Connection Protocol What is SSH?