Security in EIS. The Future. This lecture. Jonny Pettersson 29/4 2010
|
|
- Sandra Burke
- 8 years ago
- Views:
Transcription
1 Security in EIS Jonny Pettersson 29/ /4-10 Design av samverkande system - Jonny Pettersson 1 The Future The world is never going to be perfect, either on- or offline; so let s not set impossibly high standards for online. - Esther Dyson 29/4-10 Design av samverkande system - Jonny Pettersson 2 This lecture System Security services Security ypolicies Assumption, trust, assurance, risk Authentication Design principles 29/4-10 Design av samverkande system - Jonny Pettersson 3 1
2 Security in EIS What is a system? A product or component The above + OS, communications, etc The above + one or more applications Any or all of the above + IT staff Any or all of the above + internal users and management Any or all of the above + customers and other external users Any or all of the above + the surrounding environment including the media, competitors, regulators, and politicians 29/4-10 Design av samverkande system - Jonny Pettersson 4 EIS 29/4-10 Design av samverkande system - Jonny Pettersson 5 Principle of Easiest Penetration Principle of Easiest Penetration: An intruder must be expected to use any available means of penetration. This is not necessarily the most obvious means, nor is it necessarily the one against which the most solid defence has been installed. Pfleeger, /4-10 Design av samverkande system - Jonny Pettersson 6 2
3 The Basic Components Confidentiality The concealment of information or resources Also applies to the existence of data Resource hiding Assumptions and trust underlie confidentiality mechanisms Def. Let X be a set of entities and let I be some information. Then I has the property of confidentiality with respect to X if no member of X can obtain information about I. 29/4-10 Design av samverkande system - Jonny Pettersson 7 The Basic Components (2) Integrity The trustworthiness of data or resources Two classes: prevention mechanisms detection mechanisms Relies on assumptions about the source of the data the trust in that source Def. Let X be a set of entities and let I be some information or a resource. Then I has the property of integrity with respect to X if all members of X trust I. 29/4-10 Design av samverkande system - Jonny Pettersson 8 The Basic Components (3) Availability The ability to use the information or resource desired Reliability Def. Let X be a set of entities and let I be a resource. Then I has the property of availability with respect to X if all members of X can access I. 29/4-10 Design av samverkande system - Jonny Pettersson 9 3
4 Policy and Mechanism An example: Umeå University forbids copying some other student A student t sees that t another student t have not read protected its files and copies them. Is anyone (or both) violating the security? 29/4-10 Design av samverkande system - Jonny Pettersson 10 Policy and Mechanism (2) Def. A security policy is a statement of what is, and what is not, allowed. A security policy defines secure for a system or a set of system. Purpose, goal, responsibilities, a foundation for the choice of security mechanisms, Def. A security mechanism is an entity or procedure that enforces some part of the security policy. Mechanisms can be nontechnical 29/4-10 Design av samverkande system - Jonny Pettersson 11 The Role of Trust An example: A system administrator receives a security patch Assumes that the patch came from the vendor and was not tampered in transit Assumes that the vendor tested the patch thoroughly Assumes that the vendor s test environment corresponds to her environment Assumes that the patch is installed correctly Any security policy, mechanism, or procedure is based on assumptions 29/4-10 Design av samverkande system - Jonny Pettersson 12 4
5 Assumptions and Trust How does we determine if the policy correctly describes the required level and type of security for the system? Security rests on assumptions Policy and assumptions The policy divides the system in secure and nonsecure states The security mechanisms prevent the system from entering a nonsecure state 29/4-10 Design av samverkande system - Jonny Pettersson 13 Assumptions and Trust (2) Trusting that mechanisms work requires several assumptions 1. Each mechanism is designed to implement one or more parts of the security policy 2. The union of the mechanisms implements all aspects of the security policy 3. The mechanisms are implemented correctly 4. The mechanisms are installed and administered correctly 29/4-10 Design av samverkande system - Jonny Pettersson 14 Assurance An attempt to provide a basis for bolstering how much one can trust a system Requires specific steps to ensure that the system will function properly Detailed specifications of the desired behavior An analysis of the design of the components Arguments or proofs that all implementations produce the desired behavior Def. A system is said to satisfy a specification if the specification correctly states how the system will function. 29/4-10 Design av samverkande system - Jonny Pettersson 15 5
6 Operational Issues Risk analysis The level of protection is a function of the probability of an attack occurring and the effects of the attack should it succeed Risk is a function of environment The risks change with time Many risks are quite remote but still exist 29/4-10 Design av samverkande system - Jonny Pettersson 16 Autenticering Användaridentifiering Kunskap - Något man känner till Tillhörighet - Något man har Säkrare Egenskap - Något man är För säkrare Kombinera 2 eller 3 Man kan även använda Var man är 29/4-10 Design av samverkande system - Jonny Pettersson 17 Något man känner till Betyder för det mesta passwords Ofta grund för säkerheten Många passwords blir det Psykologiska problem Social Engineering Operationella frågor 29/4-10 Design av samverkande system - Jonny Pettersson 18 6
7 Password-attacker Titta över axeln Avlyssning Falskt log-on program Loggar Stöld av password-databasen On-line gissning Off-line gissning 29/4-10 Design av samverkande system - Jonny Pettersson 19 Password guessing Humans are incapable of securely storing highquality cryptographic keys, and they have unacceptable speed and accuracy when performing cryptographic operations. They are also large, expensive to maintain, difficult to manage, and they pollute the environment. It is astonishing that these devices continue to be manufactured and deployed, but they are sufficiently pervasive that we must design our protocols around their limitations Network Security: Private Communication in a Public World 29/4-10 Design av samverkande system - Jonny Pettersson 20 Något man har Passiva enheter Fysisk nyckel Magnetkort Smart cards PIN aktiverat minne Specialläsare Krypto på kort Hemligheten behöver aldrig lämna kortet 29/4-10 Design av samverkande system - Jonny Pettersson 21 7
8 Något man är Biometriska enheter Signaturverifierare Ansiktsscanner Fingeravtrycksläsare Ögonscanner Röstigenkännare 29/4-10 Design av samverkande system - Jonny Pettersson 22 Biometri Problem Noice, collusion, false repudiation, statistik, individuella skillnader, religon, Begränsningar Dyra Användarna gillar dem inte Ej användbart för nätverksautenticering Funkar bäst som komplement (bemannade) Avskräckande användning är bra 29/4-10 Design av samverkande system - Jonny Pettersson 23 Säkerhetsprotokoll Det som håller ihop Security Engineering Antaganden görs kan inte skydda mot allt Utvärdera protokoll Är hotmodellen realistisk? Hanterar protokollet hoten? Har omgivningen förändrats? Små missar i protokollet kan ge allvarliga konsekvenser 29/4-10 Design av samverkande system - Jonny Pettersson 24 8
9 Schneier om PKI och SSL Secrets and Lies, s239 As it is used, with the average user not bothering to verify the certificates and no revocation mechanism, SSL is just simply a (very slow) Diffie-Hellman key-exchange method. Digital certificates provide no actual security for electronic commerce; it s a complete sham. 29/4-10 Design av samverkande system - Jonny Pettersson 25 Design principles Specific design principles underlie the design and implementation of security mechanisms Build on simplicity Makes it easier to understand Less can go wrong Reduces the potential for inconsistencies and restriction Minimizes the interaction of system component Minimizes the power of an entity 29/4-10 Design av samverkande system - Jonny Pettersson 26 Principle of Least Privilege Def. The principle of least privilege states that a subject should be given only those privileges it needs in order to complete its task. The function of the subject should control the assignment of rights Rights should be removed when not needed any more Mail server and file access 29/4-10 Design av samverkande system - Jonny Pettersson 27 9
10 Principle of Fail-Safe Defaults Def. The principle of fail-safe defaults states that, unless a subject is given explicit access to an object, it should be denied access to that object. The default access should be none In case of failure, changes should be undone Mail server and the spool directory 29/4-10 Design av samverkande system - Jonny Pettersson 28 Principle of Economy of Mechanism Def. The principle of economy of mechanism states that security mechanisms should be as simple as possible. Simple design and implementation fewer errors Interfaces to other modules are suspect Implicit assumptions about input or output parameters or the current system state Replace the finger server 29/4-10 Design av samverkande system - Jonny Pettersson 29 Principle of Complete Mediation Def. The principle of complete mediation requires that all accesses to objects be checked to ensure that they are allowed. Restricts t the caching of information When a subject attempts to read a object First attempt: Allowed? Second attempt: a new check should be done Unix and file descriptors 29/4-10 Design av samverkande system - Jonny Pettersson 30 10
11 Principle of Open Design Def. The principle of open design states that the security of a mechanism should not depend on the secrecy of its design or implementation. No security through h obscurity ( Dumpster-diving ) Especially true of cryptographic software and systems DVD and the Content Scrambling System 29/4-10 Design av samverkande system - Jonny Pettersson 31 Principle of Separation of Privilege Def. The principle of separation of privilege states that a system should not grant permission based on a single condition. More than one condition should be met Provides a fine-grained control over a resource Provides additional assurance that the access is authorized Banking 29/4-10 Design av samverkande system - Jonny Pettersson 32 Principle of Least Common Mechanism Def. The principle of least common mechanism states that mechanisms used to access resources should not be shared. Limits it sharing Sharing resources can provide a information channel One universal smart card or many smart cards 29/4-10 Design av samverkande system - Jonny Pettersson 33 11
12 Principle of Psychological Acceptability Def. The principle of psychological acceptability states that security mechanisms should not make the resource more difficult to access than if the security mechanisms were not present. Configuring and executing a program should be as easy and as intuitive as possible Output should be clear, direct, and useful The security burden must be both minimal and reasonable Password and error messages 29/4-10 Design av samverkande system - Jonny Pettersson 34 This lecture System Including peoples Security services Confidentiality, integrity, availability Security policies i Security mechanisms implements policies Assumption, trust, assurance, risk It is all about risk and trust Authentication First authenticate, then see what they are allowed to do Design principles Things to think about 29/4-10 Design av samverkande system - Jonny Pettersson 35 12
CS 4803 Computer and Network Security
Access to general objects CS 4803 Computer and Network Security Memory protection is only one example Need a way to protect more general objects Before we begin, some design principles Alexandra (Sasha)
More informationChapter 13. Design Principles. 13.1 Overview
ch_13.fm Page 341 Thursday, October 31, 2002 10:47 AM Chapter 13 Design Principles FALSTAFF: If I had a thousand sons, the first human principle I would teach them should be, to forswear thin potations
More informationSecurity Goals Services
1 2 Lecture #8 2008 Freedom from danger, risk, etc.; safety. Something that secures or makes safe; protection; defense. Precautions taken to guard against crime, attack, sabotage, espionage, etc. An assurance;
More informationHost Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
More informationPlain English Guide To Common Criteria Requirements In The. Field Device Protection Profile Version 0.75
Plain English Guide To Common Criteria Requirements In The Field Device Protection Profile Version 0.75 Prepared For: Process Control Security Requirements Forum (PCSRF) Prepared By: Digital Bond, Inc.
More informationSecuring Administrator Access to Internal Windows Servers
Securing Administrator Access to Internal Windows Servers Contents 1. Introduction... 3 2. PKI implementation... 3 Require two-factor authentication for computers... 3 Require two-factor authentication
More informationAlternative: Strong password Protocols
Using Passwords send pwd, compare against h(pwd) send h(pwd), compare against h(pwd) send h(pwd), compare against h(h(pwd)) use h(pwd) as secret in challenge/response, server stores h(pwd). Why not h(h(pwd))?
More informationPrinciples of Computer Security. Dr George Danezis (g.danezis@ucl.ac.uk)
Principles of Computer Security Dr George Danezis (g.danezis@ucl.ac.uk) Why SecAppDev? Learning security on the job is necessary. However, Foundations: Principles. (Today) Access control. Advances: Privacy-friendly
More informationIntroduction to Computer Security
Introduction to Computer Security (ECE 458) Vijay Ganesh Spring 2014 Online Resources, Books, Notes,... Books Introduction to Computer Security by Matt Bishop Computer Security: Art and Science by Matt
More informationInformation Security Basic Concepts
Information Security Basic Concepts 1 What is security in general Security is about protecting assets from damage or harm Focuses on all types of assets Example: your body, possessions, the environment,
More informationDigital certificates and SSL
Digital certificates and SSL 20 out of 33 rated this helpful Applies to: Exchange Server 2013 Topic Last Modified: 2013-08-26 Secure Sockets Layer (SSL) is a method for securing communications between
More informationCSE331: Introduction to Networks and Security. Lecture 1 Fall 2004
CSE331: Introduction to Networks and Security Lecture 1 Fall 2004 Course Information Steve Zdancewic lecturer Web: http://www.cis.upenn.edu/~stevez E-mail: stevez@cis.upenn.edu Office hours: Mon. 3:00
More informationVICTORIA UNIVERSITY OF WELLINGTON Te Whare Wānanga o te Ūpoko o te Ika a Māui
VICTORIA UNIVERSITY OF WELLINGTON Te Whare Wānanga o te Ūpoko o te Ika a Māui School of Engineering and Computer Science Te Kura Mātai Pūkaha, Pūrorohiko PO Box 600 Wellington New Zealand Tel: +64 4 463
More informationa) Encryption is enabled on the access point. b) The conference room network is on a separate virtual local area network (VLAN)
MIS5206 Week 12 Your Name Date 1. Which significant risk is introduced by running the file transfer protocol (FTP) service on a server in a demilitarized zone (DMZ)? a) User from within could send a file
More informationCMSC 421, Operating Systems. Fall 2008. Security. URL: http://www.csee.umbc.edu/~kalpakis/courses/421. Dr. Kalpakis
CMSC 421, Operating Systems. Fall 2008 Security Dr. Kalpakis URL: http://www.csee.umbc.edu/~kalpakis/courses/421 Outline The Security Problem Authentication Program Threats System Threats Securing Systems
More information6. AUDIT CHECKLIST FOR NETWORK ADMINISTRATION AND SECURITY AUDITING
6. AUDIT CHECKLIST FOR NETWORK ADMINISTRATION AND SECURITY AUDITING The following is a general checklist for the audit of Network Administration and Security. Sl.no Checklist Process 1. Is there an Information
More informationOverview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
More informationSecure Transfers. Contents. SSL-Based Services: HTTPS and FTPS 2. Generating A Certificate 2. Creating A Self-Signed Certificate 3
Contents SSL-Based Services: HTTPS and FTPS 2 Generating A Certificate 2 Creating A Self-Signed Certificate 3 Obtaining A Signed Certificate 4 Enabling Secure Services 5 A Note About Ports 5 Connecting
More informationSmart Card- An Alternative to Password Authentication By Ahmad Ismadi Yazid B. Sukaimi
Smart Card- An Alternative to Password Authentication By Ahmad Ismadi Yazid B. Sukaimi Purpose This paper is intended to describe the benefits of smart card implementation and it combination with Public
More informationCS 356 Lecture 28 Internet Authentication. Spring 2013
CS 356 Lecture 28 Internet Authentication Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
More informationEnabling Active Directory Authentication with ESX Server 1
1 Enabling Active Directory Authentication with ESX Server 1 This document provides information about how to configure ESX Server to use Active Directory for authentication. ESX Server system includes
More informationInformation Systems Security
Information Systems Security Lecture 4: Security Engineering Prof. Dr. Christoph Karg Aalen University of Applied Sciences Department of Computer Science 11.10.2015 Learning Objective Learning Objective
More informationTOPIC HIERARCHY. Distributed Environment. Security. Kerberos
KERBEROS TOPIC HIERARCHY Distributed Environment Security Privacy Authentication Authorization Non Repudiation Kerberos ORIGIN MIT developed Kerberos to protect network services. Developed under the Project
More informationRemote Access Security
Glen Doss Towson University Center for Applied Information Technology Remote Access Security I. Introduction Providing remote access to a network over the Internet has added an entirely new dimension to
More informationCryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 40 Firewalls and Intrusion
More informationSecurity Guide. BlackBerry Enterprise Service 12. for ios, Android, and Windows Phone. Version 12.0
Security Guide BlackBerry Enterprise Service 12 for ios, Android, and Windows Phone Version 12.0 Published: 2015-02-06 SWD-20150206130210406 Contents About this guide... 6 What is BES12?... 7 Key features
More informationColumbia University Web Security Standards and Practices. Objective and Scope
Columbia University Web Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Security Standards and Practices document establishes a baseline of security related requirements
More informationPatterns for Secure Boot and Secure Storage in Computer Systems
Patterns for Secure Boot and Secure Storage in Computer Systems Hans Löhr, Ahmad-Reza Sadeghi, Marcel Winandy Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany {hans.loehr,ahmad.sadeghi,marcel.winandy}@trust.rub.de
More informationFairWarning Mapping to PCI DSS 3.0, Requirement 10
FairWarning Mapping to PCI DSS 3.0, Requirement 10 Requirement 10: Track and monitor all access to network resources and cardholder data Logging mechanisms and the ability to track user activities are
More informationAdministrative Improvements. Administrative Improvements. Scoping Guidance. Clarifications for Segmentation
The PCI DSS Lifecycle 1 The PCI DSS follows a three-year lifecycle PCI DSS 3.0 will be released in November 2013 Optional (but recommended) in 2014; Required in 2015 PCI SSC Community Meeting Update: PCI
More informationDesign Principles for Protection Mechanisms. Security Principles. Economy of Mechanism. Least Privilege. Complete Mediation. Economy of Mechanism (2)
Security Principles Design Principles for Protection Mechanisms Security is a system requirement just like performance, capability, cost, etc. Therefore, it may be necessary to trade off certain security
More informationStrong Encryption for Public Key Management through SSL
Strong Encryption for Public Key Management through SSL CH.SUSHMA, D.NAVANEETHA 1,2 Assistant Professor, Information Technology, Bhoj Reddy Engineering College For Women, Hyderabad, India Abstract: Public-key
More information31 Ways To Make Your Computer System More Secure
31 Ways To Make Your Computer System More Secure Copyright 2001 Denver Tax Software, Inc. 1. Move to more secure Microsoft Windows systems. Windows NT, 2000 and XP can be made more secure than Windows
More informationWeb Plus Security Features and Recommendations
Web Plus Security Features and Recommendations (Based on Web Plus Version 3.x) Centers for Disease Control and Prevention National Center for Chronic Disease Prevention and Health Promotion Division of
More informationGuidelines for Web applications protection with dedicated Web Application Firewall
Guidelines for Web applications protection with dedicated Web Application Firewall Prepared by: dr inŝ. Mariusz Stawowski, CISSP Bartosz Kryński, Imperva Certified Security Engineer INTRODUCTION Security
More informationUsing etoken for Securing E-mails Using Outlook and Outlook Express
Using etoken for Securing E-mails Using Outlook and Outlook Express Lesson 15 April 2004 etoken Certification Course Securing Email Using Certificates Unprotected emails can be easily read and/or altered
More informationPrivyLink Cryptographic Key Server *
WHITE PAPER PrivyLink Cryptographic Key * Tamper Resistant Protection of Key Information Assets for Preserving and Delivering End-to-End Trust and Values in e-businesses September 2003 E-commerce technology
More informationRSA SecurID Two-factor Authentication
RSA SecurID Two-factor Authentication Today, we live in an era where data is the lifeblood of a company. Now, security risks are more pressing as attackers have broadened their targets beyond financial
More informationWindows Security. CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger. www.cse.psu.edu/~tjaeger/cse497b-s07/
Windows Security CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/ Windows Security 0 to full speed No protection system in early versions
More informationCryptography and network security CNET4523
1. Name of Course 2. Course Code 3. Name(s) of academic staff 4. Rationale for the inclusion of the course/module in the programme Cryptography and network security CNET4523 Major The Great use of local
More informationIT HEALTHCHECK TOP TIPS WHITEPAPER
WHITEPAPER PREPARED BY MTI TECHNOLOGY LTD w: mti.com t: 01483 520200 f: 01483 520222 MTI Technology have been specifying and conducting IT Healthcheck s across numerous sectors including commercial, public
More informationMeeting the FDA s Requirements for Electronic Records and Electronic Signatures (21 CFR Part 11)
Meeting the FDA s Requirements for Electronic Records and Electronic Signatures (21 CFR Part 11) Executive Summary...3 Background...4 Internet Growth in the Pharmaceutical Industries...4 The Need for Security...4
More informationMobile Device Security and Encryption Standard and Guidelines
Mobile Device Security and Encryption Standard and Guidelines University Mobile Computing and Device best practices are currently defined as follows: 1) The use of any sensitive or private data on mobile
More informationUsing etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
More informationPart I. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai 2001. Siemens AG 2001, ICN M NT
Part I Contents Part I Introduction to Information Security Definition of Crypto Cryptographic Objectives Security Threats and Attacks The process Security Security Services Cryptography Cryptography (code
More informationSecurity and Operating Systems It s the Application
What is Security? Internal Roles Protecting Whom? Operating Systems 1 / 38 What is Security? Internal Roles Protecting Whom? What is operating system security? How do operating systems contribute to system
More informationGuideline on Auditing and Log Management
CMSGu2012-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Auditing and Log Management National Computer Board Mauritius
More informationESnet SSL CA service Certificate Policy And Certification Practice Statement Version 1.0
ESnet SSL CA service Certificate Policy And Certification Practice Statement Version 1.0 June 30, 2004 Table of Contents Table of Contents...2 1 Introduction...3 1.1 Overview...3 1.1.1 General Definitions...4
More informationREPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB
REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB Conducted: 29 th March 5 th April 2007 Prepared By: Pankaj Kohli (200607011) Chandan Kumar (200607003) Aamil Farooq (200505001) Network Audit Table of
More informationAn Introduction to Network Vulnerability Testing
CONTENTS Introduction 3 Penetration Testing Overview 4 Step 1: Defining the Scope 4 Step 2: Performing the Penetration Test 5 Step 3: Reporting and Delivering Results 6 VeriSign SecureTEST 7 Common Vulnerability
More informationBendigo and Adelaide Bank Ltd Security Incident Response Procedure
Bendigo and Adelaide Bank Ltd Security Incident Response Procedure Table of Contents 1 Introduction...1 2 Incident Definition...2 3 Incident Classification...2 4 How to Respond to a Security Incident...4
More informationWindows 7, Enterprise Desktop Support Technician
MS50331 Längd: 5 dagar Windows 7, Enterprise Desktop Support Technician Detta är den bredaste, mest djuplodande kursen för dig som arbetar som Supporttekniker och behöver vara champion på Windows när frågorna
More informationFull Compliance Contents
Full Compliance for and EU Annex 11 With the regulation support of Contents 1. Introduction 2 2. The regulations 2 3. FDA 3 Subpart B Electronic records 3 Subpart C Electronic Signatures 9 4. EU GMP Annex
More informationPrivyLink Internet Application Security Environment *
WHITE PAPER PrivyLink Internet Application Security Environment * The End-to-end Security Solution for Internet Applications September 2003 The potential business advantages of the Internet are immense.
More informationSavitribai Phule Pune University
Savitribai Phule Pune University Centre for Information and Network Security Course: Introduction to Cyber Security / Information Security Module : Pre-requisites in Information and Network Security Chapter
More informationFISMA / NIST 800-53 REVISION 3 COMPLIANCE
Mandated by the Federal Information Security Management Act (FISMA) of 2002, the National Institute of Standards and Technology (NIST) created special publication 800-53 to provide guidelines on security
More informationCheck Point FDE integration with Digipass Key devices
INTEGRATION GUIDE Check Point FDE integration with Digipass Key devices 1 VASCO Data Security Disclaimer Disclaimer of Warranties and Limitation of Liabilities All information contained in this document
More informationArcot Systems, Inc. Securing Digital Identities. FPKI-TWG Mobility Solutions Today s Speaker Tom Wu Principal Software Engineer
Arcot Systems, Inc. Securing Digital Identities FPKI-TWG Mobility Solutions Today s Speaker Tom Wu Principal Software Engineer Today s Agenda Background Who is Arcot Systems? What is an ArcotID? Why use
More information3. Firewall Evaluation Criteria
Firewall Management Prep. drd. Radu Constantinescu Academy of Economics Studies, Bucharest ABSTRACT Network connectivity can be both a blessing and a curse. On the one hand, network connectivity can enable
More informationThat Point of Sale is a PoS
SESSION ID: HTA-W02 That Point of Sale is a PoS Charles Henderson Vice President Managed Security Testing Trustwave @angus_tx David Byrne Senior Security Associate Bishop Fox Agenda POS Architecture Breach
More informationWindows Web Based VPN Connectivity Details & Instructions
VPN Client Overview UMDNJ s Web based VPN utilizes an SSL (Secure Socket Layer) Based Cisco Application that provides VPN functionality without having to install a full client for end users running Microsoft
More informationExternal Authentication with Checkpoint R75.40 Authenticating Users Using SecurAccess Server by SecurEnvoy
External Authentication with Checkpoint R75.40 Authenticating Users Using SecurAccess Server by SecurEnvoy Contact information SecurEnvoy www.securenvoy.com 0845 2600010 Merlin House Brunel Road Theale
More informationExploiting Transparent User Identification Systems
Exploiting Transparent User Identification Systems Wayne Murphy Benjamin Burns Version 1.0a 1 CONTENTS 1.0 Introduction... 3 1.1 Project Objectives... 3 2.0 Brief Summary of Findings... 4 3.0 Background
More informationEntrust Managed Services PKI. Getting started with digital certificates and Entrust Managed Services PKI. Document issue: 1.0
Entrust Managed Services PKI Getting started with digital certificates and Entrust Managed Services PKI Document issue: 1.0 Date of issue: May 2009 Copyright 2009 Entrust. All rights reserved. Entrust
More informationHow To Ensure Correctness Of Data In The Cloud
Ensuring Data Storage Security in Cloud Computing ABSTRACT Cloud computing has been envisioned as the next-generation architecture of IT enterprise. In contrast to traditional solutions, where the IT services
More informationAuthentication Types. Password-based Authentication. Off-Line Password Guessing
Authentication Types Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4:
More informationCHOOSING THE RIGHT PORTABLE SECURITY DEVICE. A guideline to help your organization chose the Best Secure USB device
CHOOSING THE RIGHT PORTABLE SECURITY DEVICE A guideline to help your organization chose the Best Secure USB device Introduction USB devices are widely used and convenient because of their small size, huge
More informationGlobalSign Enterprise Solutions
GlobalSign Enterprise Solutions Secure Email & Key Recovery Using GlobalSign s Auto Enrollment Gateway (AEG) 1 v.1.2 Table of Contents Table of Contents... 2 Introduction... 3 The Benefits of Secure Email...
More informationSecure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current
More informationHomeland Security Red Teaming
Homeland Security Red Teaming Directs intergovernmental coordination Specifies Red Teaming Viewing systems from the perspective of a potential adversary Target hardening Looking for weakness in existing
More informationcipher: the algorithm or function used for encryption and decryption
! "# $ %& %'()! *,+ & -.! % %- / 0-1 2+ 34 576!! 8 9! ": ;
More informationConsiderations In Developing Firewall Selection Criteria. Adeptech Systems, Inc.
Considerations In Developing Firewall Selection Criteria Adeptech Systems, Inc. Table of Contents Introduction... 1 Firewall s Function...1 Firewall Selection Considerations... 1 Firewall Types... 2 Packet
More informationCSP & PCI DSS Compliance on HP NonStop systems
CSP & PCI DSS Compliance on HP NonStop systems July 23, 2014 For more information about Computer Security Products Inc., contact us at: 200 Matheson Blvd. West Suite 200 Mississauga, Ontario, Canada L5R
More informationWhy you need secure email
Why you need secure email WHITE PAPER CONTENTS 1. Executive summary 2. How email works 3. Security threats to your email communications 4. Symmetric and asymmetric encryption 5. Securing your email with
More informationComputer and Network Security Policy
Coffeyville Community College Computer and Network Security Policy Created By: Jeremy Robertson Network Administrator Created on: 6/15/2012 Computer and Network Security Page 1 Introduction: The Coffeyville
More informationSMS PASSCODE CONFIGURATION FOR CISCO ASA / RADIUS AUTHENTICATION SMS PASSCODE 2011
SMS PASSCODE CONFIGURATION FOR CISCO ASA / RADIUS AUTHENTICATION SMS PASSCODE 2011 Introduction SMS PASSCODE is widely used by Cisco customers extending the Cisco ASA VPN concentrators with both IPsec
More informationWhat is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
More informationStrong Security in Multiple Server Environments
White Paper Strong Security in Multiple Server Environments VeriSign OnSite for Server IDs Contents 1. Introduction 1 2. Security Solutions: The Digital ID System 2 2.1. What Is a Digital ID? 2 2.2 How
More informationZyWALL OTP Co works with Active Directory Not Only Enhances Password Security but Also Simplifies Account Management
ZyWALL OTP Co works with Active Directory Not Only Enhances Password Security but Also Simplifies Account Management Problem: The employees of a global enterprise often need to telework. When a sales representative
More informationMitigating Risks and Monitoring Activity for Database Security
The Essentials Series: Role of Database Activity Monitoring in Database Security Mitigating Risks and Monitoring Activity for Database Security sponsored by by Dan Sullivan Mi tigating Risks and Monitoring
More informationSpecific recommendations
Background OpenSSL is an open source project which provides a Secure Socket Layer (SSL) V2/V3 and Transport Layer Security (TLS) V1 implementation along with a general purpose cryptographic library. It
More informationCopyright http://support.oracle.com/
Primavera Portfolio Management 9.0 Security Guide July 2012 Copyright Oracle Primavera Primavera Portfolio Management 9.0 Security Guide Copyright 1997, 2012, Oracle and/or its affiliates. All rights reserved.
More informationColumbia University Web Application Security Standards and Practices. Objective and Scope
Columbia University Web Application Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Application Security Standards and Practices document establishes a baseline
More informationWHITE PAPER. An Introduction to Network- Vulnerability Testing
An Introduction to Network- Vulnerability Testing C ONTENTS + Introduction 3 + Penetration-Testing Overview 3 Step 1: Defining the Scope 4 Step 2: Performing the Penetration Test 5 Step 3: Reporting and
More informationWindows 2000 Security Architecture. Peter Brundrett Program Manager Windows 2000 Security Microsoft Corporation
Windows 2000 Security Architecture Peter Brundrett Program Manager Windows 2000 Security Microsoft Corporation Topics Single Sign-on Kerberos v5 integration Active Directory security Delegation of authentication
More informationLecture VII : Public Key Infrastructure (PKI)
Lecture VII : Public Key Infrastructure (PKI) Internet Security: Principles & Practices John K. Zao, PhD (Harvard) SMIEEE Computer Science Department, National Chiao Tung University 2 Problems with Public
More informationMobile Billing System Security Target
Mobile Billing System Security Target Common Criteria: EAL1 Version 1.2 25 MAY 11 Document management Document identification Document ID Document title Product version IDV_EAL1_ASE IDOTTV Mobile Billing
More informationSecurity. TestOut Modules 12.6 12.10
Security TestOut Modules 12.6 12.10 Authentication Authentication is the process of submitting and checking credentials to validate or prove user identity. 1. Username 2. Credentials Password Smart card
More informationArkansas Department of Information Systems Arkansas Department of Finance and Administration
Arkansas Department of Information Systems Arkansas Department of Finance and Administration Title: Electronic Signature Standard Document Number: SS 70 011 Effective Date: Act 722 of 2007 requires state
More informationRSA Authentication Manager 7.1 Security Best Practices Guide. Version 2
RSA Authentication Manager 7.1 Security Best Practices Guide Version 2 Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com. Trademarks
More informationData Breaches and Web Servers: The Giant Sucking Sound
Data Breaches and Web Servers: The Giant Sucking Sound Guy Helmer CTO, Palisade Systems, Inc. Lecturer, Iowa State University @ghelmer Session ID: DAS-204 Session Classification: Intermediate The Giant
More information2.4: Authentication Authentication types Authentication schemes: RSA, Lamport s Hash Mutual Authentication Session Keys Trusted Intermediaries
Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application
More informationAustralasian Information Security Evaluation Program
Australasian Information Security Evaluation Program Certification Report Certificate Number: 2010/70 23 November 2010 Version 1.0 Commonwealth of Australia 2010. Reproduction is authorised provided that
More informationModule 7 Security CS655! 7-1!
Module 7 Security CS655! 7-1! Issues Separation of! Security policies! Precise definition of which entities in the system can take what actions! Security mechanism! Means of enforcing that policy! Distributed
More informationApache Milagro (incubating) An Introduction ApacheCon North America
Apache Milagro (incubating) An Introduction ApacheCon North America Apache Milagro will establish a new independent security framework for the Internet A Distributed Cryptosystem Secure the Future of the
More informationWhite paper. Implications of digital certificates on trusted e-business.
White paper Implications of digital certificates on trusted e-business. Abstract: To remain ahead of e-business competition, companies must first transform traditional business processes using security
More informationIT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
More informationCryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 9: Authentication protocols, digital signatures Ion Petre Department of IT, Åbo Akademi University 1 Overview of
More informationStandard: Event Monitoring
Standard: Event Monitoring Page 1 Executive Summary The Event Monitoring Standard defines the requirements for Information Security event monitoring within SJSU computing resources to ensure that information
More informationHow To Control Vcloud Air From A Microsoft Vcloud 1.1.1 (Vcloud)
SOC 1 Control Objectives/Activities Matrix goes to great lengths to ensure the security and availability of vcloud Air services. In this effort, we have undergone a variety of industry standard audits,
More information