REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB

Size: px
Start display at page:

Download "REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB"

Transcription

1 REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB Conducted: 29 th March 5 th April 2007 Prepared By: Pankaj Kohli ( ) Chandan Kumar ( ) Aamil Farooq ( )

2 Network Audit Table of Contents Page No. Executive Summary 3 Audit Objective 4 Audit Scope 4 Audit Approach 4 Observations 5 APPENDIX A C-STAR Network Architecture 6 APPENDIX B Details of Findings and Recommendations 10 2

3 1. Executive Summary This document is a report based on the audit of the network security of the local area network of Center of Security Theory and Algorithmic Research (C-STAR) at IIIT, Hyderabad. As a part of the audit questionnaire, different aspects of security of network and hosts ranging from cryptographic security measures in place as well as defense mechanisms against common threats were evaluated. This report explains the important findings in each area, and recommends specific enhancements where appropriate. Because the research center s local area network is not accessible from Internet, we concentrated much of our efforts on the internal threat. We developed a set of specific information security related objectives for this audit. They include: Ensure that hosts are not vulnerable to network based security attacks. Determine the use of unnecessary services by hosts. Determine the use of insecure protocols in the network. Check the strength of passwords being used. During the audit, we identified several findings that impact the security of hosts and network. These findings occurred in the areas of insecure protocols in use, host security and weak passwords in use. Our recommendations will minimize the risk that security problems will occur in future. Overall Score: Moderate Network Security System Security Authentication Security of data in transit Security of host/perimeter Identification/Authorization Weak Moderate Moderate 3

4 2. Audit Objective The objective of this audit was to conduct a threat and risk assessment related to data, network, and operations of the systems, accompanied by recommendations aimed at mitigating discovered risks. This audit included the following activities: Thorough review of the network, application and operating system architectures. Penetration testing of hosts, with subsequent identification of susceptibility to known hacker techniques. Vulnerability assessment of hosts. Review of strength of passwords being used. Identification of significant security practices. Prioritized summary of discovered vulnerabilities. Prioritized recommendations for risk reduction, as appropriate. Review and comparison of the security practices and implementation in the context of security industry best practices where possible. Assistance in mitigating any security risks involved. 3. Audit Scope The audit was conducted in accordance with the BS7799/ISO-7799 Information Security Standard. The scope of this audit was limited to the network security, host security, and authentication measures in use in Center of Security Theory and Algorithmic Research (C-STAR). The audit was conducted during the period of March 29 to April 5, The audit of the Intranet hosts included a review of the operating system and running services. This review was performed to determine if any vulnerability existed that could allow an intruder unauthorized access, and included penetration testing. The controls we reviewed included password standards and the use of encryption to transmit data over the local area network. 4. Audit Approach Below we provide the approach for performing the security audit. Our evaluation focused on three different aspects: Network Security Audit: The Network audit was used to determine security weaknesses on a network segment of the research center. The network audit mixes the host audit and network segment audit. The entire network segment was checked 4

5 for hosts that were operating. Each individual host and workstation found was then probed to determine the services operating. Each individual host and workstation found operating a service of any type was then checked against a list of known vulnerable services corresponding to the services found on that specific host. Audit logs were generated reflecting the information obtained, i.e. the entire network segment mapped, identified host and workstations operating, identified services operating on all host and workstations, known vulnerabilities of services operating on hosts identified and the level of threat to each individual host. Host Security Audit: The Host audit was used to determine the security weakness of an individual host. The host was checked for access and what services were operating. Once a complete list of services operating had been obtained, the services were checked for known vulnerabilities against a database of vulnerabilities. Once the host services have been checked, logs were generated, documenting the name of the host audited, the time / date of the audit, services found operating on the host, all known vulnerabilities of each individual service, as well as the level of risk and threat of each vulnerability. Authentication: Here, the purpose was to check the authentication mechanisms being used, specifically the passwords, and their strength. Eavesdropping was carried out to collect data being sent across the network. The data was then parsed and filtered to extract passwords and other credentials. 5. Observations During the audit, we identified several findings that impact the security of the hosts as well as privacy of the users in the research center. These findings occurred in the following areas: Insecure protocols in use Host security Weak passwords in use We recommend that the problems we identified be corrected to strengthen the security of the research center s local area network. Our recommendations will correct present problems and minimize the risk that security problems will occur in future. Appendix B, Details of Findings and Recommendations, lists the observations and recommendations. Because of the sensitivity of the observations, we have classified Appendix B as privileged and confidential. 5

6 APPENDIX A Network Architecture of CSTAR The first step to audit was to gather information about the network architecture of the research center, and about the hosts. For this purpose, an initial footprinting was carried out so as to gain information about the topology of the network. The following figure shows the topology of the network. The next step to audit was to conduct an initial review of the hosts in the research center, to gain information about hosts, their operating systems, and the services that were running. For this purpose, we carried out operating system and application fingerprinting of the hosts in the research center. The following table shows the operating systems and services running on machines in the research center. 6

7 IP Address Operating System Services Linux Kernel 2.6.x, Windows XP SP2 NetBIOS Name service (137/udp), Microsoft Datagram Service (445/tcp), Microsoft Terminal Services (3389/tcp) Windows XP SP2 Microsoft Terminal Services (3389/tcp) Windows XP SP2 Microsoft Windows RPC (135/tcp), NetBIOS Name service (137/udp), Microsoft Datagram Service (445/tcp), Microsoft Terminal Services (3389/tcp) Linux Kernel 2.6.x OpenSSH 4.0 (protocol 2.0) (22/tcp), MySQL (3306/tcp) Windows XP SP2 Microsoft Windows RPC (135/tcp), NetBIOS Name service (137/udp), Microsoft Datagram Service (445/tcp), Microsoft Terminal Services (3389/tcp) Linux Kernel 2.6.x vsftpd (21/tcp), OpenSSH 3.9p1 (protocol 1.99), Linux telnetd (23/tcp), Kerberised RSH (544/tcp), MySQL (3306/tcp) Linux Kernel 2.4.x OpenSSH 3.5p1 (protocol 1.99) (22/tcp) Linux Kernel 2.4.x OpenSSH 4.3 (protocol 2.0) (22/tcp) Windows XP SP2 NetBIOS Name service (137/udp), Microsoft Datagram Service (445/tcp), Microsoft Terminal Services (3389/tcp) Linux Kernel 2.4.x, Windows XP SP Linux Kernel 2.6.x, Windows XP SP2 Microsoft Terminal Services (3389/tcp) NetBIOS Name service (137/udp), Microsoft Datagram Service (445/tcp), Microsoft Terminal Services (3389/tcp) Linux Kernel 2.6.x vsftpd (21/tcp), OpenSSH 4.2.p1 Debian7-ubuntu3 (protocol 7

8 2.0) (22/tcp), Samba smb 3.x (139,445/tcp) Linux Kernel 2.6.x OpenSSH 4.0 (protocol 2.0) (22/tcp), Sendmail (25/tcp) Windows XP SP2 NetBIOS Name service (137/udp), Microsoft Datagram Service (445/tcp), Microsoft Terminal Services (3389/tcp) Windows XP SP2 NetBIOS Name service (137/udp), Microsoft Datagram Service (445/tcp), Microsoft Terminal Services (3389/tcp) Windows XP SP2 NetBIOS Name service (137/udp), Microsoft Datagram Service (445/tcp), Microsoft Terminal Services (3389/tcp) NetBIOS Name Service (137/udp) Windows XP SP2 NetBIOS Name service (137/udp), Microsoft Datagram Service (445/tcp) Windows XP SP Windows XP SP2 NetBIOS Name service (137/udp), Microsoft Datagram Service (445/tcp) HP JetDirect ROM x.x.x EEPROM x.x.x HP JetDirect ftpd (21/tcp), HP JetDirect printer telnetd (23/tcp), HTTP (80/tcp), SNMP (161/udp), HTTPS (443/tcp), JetDirect (9100/tcp) During the audit, we discovered that Microsoft File Sharing services were among the most heavily used service in the network. Among other heavily used services in the network were Microsoft Terminal Services (Remote Desktop Services) and Secure Shell (SSH). The figure below shows the most present services discovered in the network during the audit. 8

9 We also discovered several services which were deployed but not being used. The most widely deployed service among such services was sunrpc running on several hosts running some flavor of Linux operating system. We also discovered insecure services such as FTP, Telnet and SMTP, which accept credentials in plaintext form. 9

10 Appendix - B Details of Findings and Recommendations 1. Network Security Network Security mechanisms are used to protect data in transit. This is the most insidious problem facing connected machines today because the standard Internet protocols, most visibly TCP/IP, were not designed with an emphasis on efficiency and reliability and not security. Data sent across a network - whether a private network or a public one such as the Internet - is vulnerable to "packet sniffing". In other words, data that moves to and from connected machines can be eavesdropped without such activity being detected, and further, it is also susceptible to unauthorized tampering and misrepresentation ("spoofing") unless network security is in place. Most commonly, network security is achieved by the use of cryptographic protocols at one or more layers of the network stack, depending on the requirements of the application that handles sensitive data. Not only does data passing through the system need to be secured, management and control data to/from the system also needs to be secured to prevent unauthorized remote management and to enforce access control Audit Results The current state of Network Security in the local area network of Center of Security Theory and Algorithmic Research was deemed Weak based on the following findings: Several hosts on the network use insecure protocols such as POP and IMAP. o POP and IMAP sessions can easily be modified by any intermediate router between the client and server, which is a threat for privacy and security. o POP and IMAP use plaintext passwords for authentication, which can be eavesdropped and used for potential future exploits. Several users on the network use web interface to check their mail on Students and Research servers which use SquirrelMail. 10

11 o Sessions of SquirrelMail can easily be modified by any intermediate routers between the client and server, which is a threat for privacy and security. o SquirrelMail accepts passwords in plaintext, which can be eavesdropped and used for future exploits. Few users use HTTP Basic Authentication to access certain websites, which is a very weak form of encoding (Base64), and is susceptible to eavesdropping. During the auditing period of seven days, we were able to capture 116 passwords, that were being transmitted using insecure protocols such as POP, IMAP, HTTP (Web-based ), and HTTP Basic Authentication. Following are the details of captured passwords: Protocol Passwords Captured POP 8 IMAP 77 HTTP 29 HTTP Basic Auth. 2 Total Passwords 116 Unique Passwords 13 Captured Plaintext Passwords HTTP 25% HTTP Basic Authentication 2% POP 7% IMAP 66% 1.2. Recommendations The current state of network security can be hardened using the following practices: Using Kerberos enabled servers. 11

12 Using IMAP/SSL and POP/SSL instead of IMAP and POP to retrieve mail. Using SSH to read . Configure web-mail to use SSL. 2. System Security System Security mechanisms are used to protect the system itself or the perimeter of a network from external intrusions. Uncontrolled external connections to a system could result in a variety of attacks including packet floods, invalid data that uses up valuable bandwidth or processing power on the device, or Denial of Service (DoS) attacks where illegitimate users could prevent valid users from using the device's services or from managing the device. Basic system security usually takes the form of a simple "packet-filtering" firewall that enables the system to only allow or deny packets to/from specific peers based on a variety of criteria such as source/destination IP addresses, protocol type, ingress/egress network interface and other packet data fields. More evolved "stateful inspection" firewalls look beyond a single packet for their decision making and instead maintain packet stream state enabling protection against floods or corrupt data emanating from valid network nodes. Sophisticated intrusion protection and detection systems bolster this capability with fast pattern matching, bandwidth control to allow management even in the face of attacks and automatic protection measures against Denial of Service attacks Audit Results The current state of System Security in the local area network of Center of Security Theory and Algorithmic Research was deemed Moderate based on the following findings: Nine (9) hosts were discovered running Microsoft Terminal Services (Remote Desktop Services), which is vulnerable to Man-in-the-middle attack. One (1) host was discovered running SNMP service with default community string, which can be used by an attacker to gain more information about the host or to change the configuration remotely. 12

13 One (1) host was discovered running HTTP server having vulnerability which can be used to read arbitrary files on the web server. Four (4) hosts were discovered running services that use plaintext passwords for authentication. Two (2) hosts were discovered running SSH protocol 1.0, which is vulnerable to Man-in-the-middle attack. Several hosts were discovered running unnecessary services. We classified the vulnerabilities as follows: High Risk: Vulnerabilities that can be easily exploited, and could lead to compromise, and/or pose a high risk to the stability of the campus network. Moderate Risk: Vulnerabilities whose exploitation could result in compromise of the confidentiality, integrity, or availability of users' data, or the integrity or availability of processing/network devices. Low Risk: Vulnerabilities that are very difficult to exploit or, if exploited, impact would be minimal. Below is the summary of vulnerabilities found during the audit. Vulnerabilities Count Low Risk 21 Moderate Risk 12 High Risk 2 Vulnerabilities 6% 34% 60% Low Risk Moderate Risk High Risk During the audit, we were able to discover one (1) host with two (2) high risk vulnerabilities, and eleven hosts with one or more moderate risk vulnerabilities. Below is the summary of vulnerabilities discovered on each host during the audit. 13

14 Specifically, we discovered that HP LaserJet Printer ( ) installed in the research center was vulnerable to two high risk vulnerabilities. Also, several hosts were discovered running services that were not being used. Below is the summary of unnecessary services discovered during the audit. 14

15 2.2. Recommendations We recommend the following practices to improve the state of system security of hosts: Minimize use of Microsoft Terminal Services. Patching or upgrading vulnerable services. Using SSH protocol 2.0 instead of protocol 1.0. Using SSH and SFTP/SCP instead of Telnet/RSH and FTP/RCP. Shutting down services which are not being used. 3. Authentication Authentication is any process by which you verify that someone is who they claim they are. This usually involves a username and a password, but can include any other method of demonstrating identity, such as a smart card, retina scan, voice recognition, or fingerprints. Authorization is finding out if the person, once identified, is permitted to have the resource. Since they are the least expensive to implement, most systems rely on passwords to authenticate users. As well, passwords are often used in addition to physical or cryptographic proofs of identity to further strengthen security Audit Results The current state of System Security in the local area network of Center of Security Theory and Algorithmic Research was deemed Moderate based on the following findings: 31% of the passwords in use were found to be weak, in the sense that either they were short or were easily guessable. Services were discovered that accept credentials in plaintext form, and are therefore susceptible to eavesdropping. Below is the summary of strength of passwords in use in the network: Password Strength Count Weak 4 Moderate 5 Strong 4 15

16 Password Strength Strong 31% Weak 31% Moderate 38% 3.2. Recommendations We recommend the following practices to harden the strength of passwords being used: Use of special characters and numeral along with alphabets to construct passwords. Use of passwords which are eight characters or longer. Not using easily guessable information such as first or last name, date of birth, etc. in passwords. Using services that accept credentials in secure form. 16

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks

More information

A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.

A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection. A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based

More information

1 hours, 30 minutes, 38 seconds Heavy scan. All scanned network resources. Copyright 2001, FTP access obtained

1 hours, 30 minutes, 38 seconds Heavy scan. All scanned network resources. Copyright 2001, FTP access obtained home Network Vulnerabilities Detail Report Grouped by Vulnerability Report Generated by: Symantec NetRecon 3.5 Licensed to: X Serial Number: 0182037567 Machine Scanned from: ZEUS (192.168.1.100) Scan Date:

More information

My FreeScan Vulnerabilities Report

My FreeScan Vulnerabilities Report Page 1 of 6 My FreeScan Vulnerabilities Report Print Help For 66.40.6.179 on Feb 07, 008 Thank you for trying FreeScan. Below you'll find the complete results of your scan, including whether or not the

More information

Medical Device Security Health Group Digital Output

Medical Device Security Health Group Digital Output Medical Device Security Health Group Digital Output Security Assessment Report for the Kodak Color Medical Imager 1000 (CMI-1000) Software Version 1.1 Part Number 1G0434 Revision 2.0 June 21, 2005 CMI-1000

More information

CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security

CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security CTS2134 Introduction to Networking Module 8.4 8.7 Network Security Switch Security: VLANs A virtual LAN (VLAN) is a logical grouping of computers based on a switch port. VLAN membership is configured by

More information

Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak CR V4.1

Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak CR V4.1 Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak CR V4.1 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents Table of Contents

More information

IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT

IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT Roopa K. Panduranga Rao MV Dept of CS and Engg., Dept of IS and Engg., J.N.N College of Engineering, J.N.N College of Engineering,

More information

Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak DryView 8150 Imager Release 1.0.

Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak DryView 8150 Imager Release 1.0. Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak DryView 8150 Imager Release 1.0 Page 1 of 9 Table of Contents Table of Contents... 2 Executive Summary...

More information

Networking for Caribbean Development

Networking for Caribbean Development Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n

More information

Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak Capture Link Server V1.00

Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak Capture Link Server V1.00 Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak Capture Link Server V1.00 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents

More information

8. Firewall Design & Implementation

8. Firewall Design & Implementation DMZ Networks The most common firewall environment implementation is known as a DMZ, or DeMilitarized Zone network. A DMZ network is created out of a network connecting two firewalls; i.e., when two or

More information

CS 665: Computer System Security. Network Security. Usage environment. Sources of vulnerabilities. Information Assurance Module

CS 665: Computer System Security. Network Security. Usage environment. Sources of vulnerabilities. Information Assurance Module CS 665: Computer System Security Network Security Bojan Cukic Lane Department of Computer Science and Electrical Engineering West Virginia University 1 Usage environment Anonymity Automation, minimal human

More information

Black Box Penetration Testing For GPEN.KM V1.0 Month dd "#$!%&'(#)*)&'+!,!-./0!.-12!1.03!0045!.567!5895!.467!:;83!-/;0!383;!

Black Box Penetration Testing For GPEN.KM V1.0 Month dd #$!%&'(#)*)&'+!,!-./0!.-12!1.03!0045!.567!5895!.467!:;83!-/;0!383;! Sample Penetration Testing Report Black Box Penetration Testing For GPEN.KM V1.0 Month dd "#$%&'#)*)&'+,-./0.-121.030045.5675895.467:;83-/;0383; th, yyyy A&0#0+4*M:+:#&*#0%+C:,#0+4N:

More information

Penetration Testing Report Client: Business Solutions June 15 th 2015

Penetration Testing Report Client: Business Solutions June 15 th 2015 Penetration Testing Report Client: Business Solutions June 15 th 2015 Acumen Innovations 80 S.W 8 th St Suite 2000 Miami, FL 33130 United States of America Tel: 1-888-995-7803 Email: info@acumen-innovations.com

More information

Basics of Internet Security

Basics of Internet Security Basics of Internet Security Premraj Jeyaprakash About Technowave, Inc. Technowave is a strategic and technical consulting group focused on bringing processes and technology into line with organizational

More information

Linux Network Security

Linux Network Security Linux Network Security Course ID SEC220 Course Description This extremely popular class focuses on network security, and makes an excellent companion class to the GL550: Host Security course. Protocols

More information

Windows Remote Access

Windows Remote Access Windows Remote Access A newsletter for IT Professionals Education Sector Updates Issue 1 I. Background of Remote Desktop for Windows Remote Desktop Protocol (RDP) is a proprietary protocol developed by

More information

ITEC441- IS Security. Chapter 15 Performing a Penetration Test

ITEC441- IS Security. Chapter 15 Performing a Penetration Test 1 ITEC441- IS Security Chapter 15 Performing a Penetration Test The PenTest A penetration test (pentest) simulates methods that intruders use to gain unauthorized access to an organization s network and

More information

Understanding and evaluating risk to information assets in your software projects

Understanding and evaluating risk to information assets in your software projects Understanding and evaluating risk to information assets in your software projects ugh.. what a mouthful Dana Epp Windows Security MVP Who am I? Microsoft Windows Security MVP Information Security Professional

More information

Security. TestOut Modules 12.6 12.10

Security. TestOut Modules 12.6 12.10 Security TestOut Modules 12.6 12.10 Authentication Authentication is the process of submitting and checking credentials to validate or prove user identity. 1. Username 2. Credentials Password Smart card

More information

Active Defense and Prevention

Active Defense and Prevention Active Defense and Prevention Coleman Kane Coleman.Kane@ge.com October 15, 2014 Cyber Defense Overview Active Defense 1 / 11 Active Defense and Prevention are the strategies employed to prevent, obstruct,

More information

Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak DR V2.0

Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak DR V2.0 Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak DR V2.0 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents Table of Contents

More information

Cyber Essentials. Test Specification

Cyber Essentials. Test Specification Cyber Essentials Test Specification Contents Scope of the Audit...2 Assumptions...3 Success Criteria...3 External systems...4 Required tests...4 Test Details...4 Internal systems...7 Tester pre-requisites...8

More information

SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users.

SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be grouped

More information

CMPT 471 Networking II

CMPT 471 Networking II CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access

More information

Rapid Vulnerability Assessment Report

Rapid Vulnerability Assessment Report White Paper Rapid Vulnerability Assessment Report Table of Contents Executive Summary... Page 1 Characteristics of the Associated Business Corporation Network... Page 2 Recommendations for Improving Security...

More information

Introduction of Intrusion Detection Systems

Introduction of Intrusion Detection Systems Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:

More information

Cisco Advanced Services for Network Security

Cisco Advanced Services for Network Security Data Sheet Cisco Advanced Services for Network Security IP Communications networking the convergence of data, voice, and video onto a single network offers opportunities for reducing communication costs

More information

Topics in Network Security

Topics in Network Security Topics in Network Security Jem Berkes MASc. ECE, University of Waterloo B.Sc. ECE, University of Manitoba www.berkes.ca February, 2009 Ver. 2 In this presentation Wi-Fi security (802.11) Protecting insecure

More information

SonicWALL PCI 1.1 Implementation Guide

SonicWALL PCI 1.1 Implementation Guide Compliance SonicWALL PCI 1.1 Implementation Guide A PCI Implementation Guide for SonicWALL SonicOS Standard In conjunction with ControlCase, LLC (PCI Council Approved Auditor) SonicWall SonicOS Standard

More information

March 2012 www.tufin.com

March 2012 www.tufin.com SecureTrack Supporting Compliance with PCI DSS 2.0 March 2012 www.tufin.com Table of Contents Introduction... 3 The Importance of Network Security Operations... 3 Supporting PCI DSS with Automated Solutions...

More information

Considerations In Developing Firewall Selection Criteria. Adeptech Systems, Inc.

Considerations In Developing Firewall Selection Criteria. Adeptech Systems, Inc. Considerations In Developing Firewall Selection Criteria Adeptech Systems, Inc. Table of Contents Introduction... 1 Firewall s Function...1 Firewall Selection Considerations... 1 Firewall Types... 2 Packet

More information

INTERNET SECURITY: THE ROLE OF FIREWALL SYSTEM

INTERNET SECURITY: THE ROLE OF FIREWALL SYSTEM INTERNET SECURITY: THE ROLE OF FIREWALL SYSTEM Okumoku-Evroro Oniovosa Lecturer, Department of Computer Science Delta State University, Abraka, Nigeria Email: victorkleo@live.com ABSTRACT Internet security

More information

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with

More information

HP ProLiant Essentials Vulnerability and Patch Management Pack Server Security Recommendations

HP ProLiant Essentials Vulnerability and Patch Management Pack Server Security Recommendations HP ProLiant Essentials Vulnerability and Patch Management Pack Server Security Recommendations Security Considerations for VPM and HP SIM Servers Introduction... 3 External patch acquisition... 4 Comparing

More information

INTERNET SECURITY: FIREWALLS AND BEYOND. Mehernosh H. Amroli 4-25-2002

INTERNET SECURITY: FIREWALLS AND BEYOND. Mehernosh H. Amroli 4-25-2002 INTERNET SECURITY: FIREWALLS AND BEYOND Mehernosh H. Amroli 4-25-2002 Preview History of Internet Firewall Technology Internet Layer Security Transport Layer Security Application Layer Security Before

More information

For more information email sales@patchadvisor.com or call 703.749.7723

For more information email sales@patchadvisor.com or call 703.749.7723 Vulnerability Assessment Methodology Today s networks are typically comprised of a variety of components from many vendors. This adds to the difficulties faced by the system administration staff, as they

More information

S E C U R I T Y A S S E S S M E N T : B o m g a r A p p l i a n c e s

S E C U R I T Y A S S E S S M E N T : B o m g a r A p p l i a n c e s S E C U R I T Y A S S E S S M E N T : B o m g a r A p p l i a n c e s During the period between November 2012 and March 2013, Symantec Consulting Services partnered with Bomgar to assess the security

More information

Network Security Fundamentals

Network Security Fundamentals APNIC elearning: Network Security Fundamentals 27 November 2013 04:30 pm Brisbane Time (GMT+10) Introduction Presenter Sheryl Hermoso Training Officer sheryl@apnic.net Specialties: Network Security IPv6

More information

S E C U R I T Y A S S E S S M E N T : B o m g a r B o x T M. Bomgar. Product Penetration Test. September 2010

S E C U R I T Y A S S E S S M E N T : B o m g a r B o x T M. Bomgar. Product Penetration Test. September 2010 S E C U R I T Y A S S E S S M E N T : B o m g a r B o x T M Bomgar Product Penetration Test September 2010 Table of Contents Introduction... 1 Executive Summary... 1 Bomgar Application Environment Overview...

More information

Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion

Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann

More information

Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak Medical Image Manager (MIM) Version 6.1.

Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak Medical Image Manager (MIM) Version 6.1. Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak Medical Image Manager (MIM) Version 6.1.1 Part Number 1G0119 Version 1.0 Eastman Kodak Company, Health Group

More information

APNIC elearning: Network Security Fundamentals. 20 March 2013 10:30 pm Brisbane Time (GMT+10)

APNIC elearning: Network Security Fundamentals. 20 March 2013 10:30 pm Brisbane Time (GMT+10) APNIC elearning: Network Security Fundamentals 20 March 2013 10:30 pm Brisbane Time (GMT+10) Introduction Presenter/s Nurul Islam Roman Senior Training Specialist nurul@apnic.net Specialties: Routing &

More information

The Nexpose Expert System

The Nexpose Expert System Technical Paper The Nexpose Expert System Using an Expert System for Deeper Vulnerability Scanning Executive Summary This paper explains how Rapid7 Nexpose uses an expert system to achieve better results

More information

Cisco Smart Care Service Security

Cisco Smart Care Service Security White Paper Cisco Smart Care Service Security Cisco Smart Care Service is a managed service comprised of components that include a Cisco network appliance, a Windows-based Cisco software client, and partner

More information

IBM. Vulnerability scanning and best practices

IBM. Vulnerability scanning and best practices IBM Vulnerability scanning and best practices ii Vulnerability scanning and best practices Contents Vulnerability scanning strategy and best practices.............. 1 Scan types............... 2 Scan duration

More information

CS5008: Internet Computing

CS5008: Internet Computing CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is

More information

Network Security: Introduction

Network Security: Introduction Network Security: Introduction 1. Network security models 2. Vulnerabilities, threats and attacks 3. Basic types of attacks 4. Managing network security 1. Network security models Security Security has

More information

White Paper A SECURITY GUIDE TO PROTECTING IP PHONE SYSTEMS AGAINST ATTACK. A balancing act

White Paper A SECURITY GUIDE TO PROTECTING IP PHONE SYSTEMS AGAINST ATTACK. A balancing act A SECURITY GUIDE TO PROTECTING IP PHONE SYSTEMS AGAINST ATTACK With organizations rushing to adopt Voice over IP (VoIP) technology to cut costs and integrate applications designed to serve customers better,

More information

Data Collection and Analysis: Get End-to-End Security with Cisco Connected Analytics for Network Deployment

Data Collection and Analysis: Get End-to-End Security with Cisco Connected Analytics for Network Deployment White Paper Data Collection and Analysis: Get End-to-End Security with Cisco Connected Analytics for Network Deployment Cisco Connected Analytics for Network Deployment (CAND) is Cisco hosted, subscription-based

More information

IDS 4.0 Roadshow. Module 1- IDS Technology Overview. 2003, Cisco Systems, Inc. All rights reserved. IDS Roadshow

IDS 4.0 Roadshow. Module 1- IDS Technology Overview. 2003, Cisco Systems, Inc. All rights reserved. IDS Roadshow IDS 4.0 Roadshow Module 1- IDS Technology Overview Agenda Network Security Network Security Policy Management Protocols The Security Wheel IDS Terminology IDS Technology HIDS and NIDS IDS Communication

More information

Appalachian Regional Commission Evaluation Report. Table of Contents. Results of Evaluation... 1. Areas for Improvement... 2

Appalachian Regional Commission Evaluation Report. Table of Contents. Results of Evaluation... 1. Areas for Improvement... 2 Report No. 13-35 September 27, 2013 Appalachian Regional Commission Table of Contents Results of Evaluation... 1 Areas for Improvement... 2 Area for Improvement 1: The agency should implement ongoing scanning

More information

Security Considerations White Paper for Cisco Smart Storage 1

Security Considerations White Paper for Cisco Smart Storage 1 Security Considerations White Paper for Cisco Smart Storage An open network is like a bank s vault with windows Bill Thomson Network-Attached Storage (NAS) is a relatively simple and inexpensive way to

More information

Global Partner Management Notice

Global Partner Management Notice Global Partner Management Notice Subject: Critical Vulnerabilities Identified to Alert Payment System Participants of Data Compromise Trends Dated: May 4, 2009 Announcement: To support compliance with

More information

Exam Questions SY0-401

Exam Questions SY0-401 Exam Questions SY0-401 CompTIA Security+ Certification http://www.2passeasy.com/dumps/sy0-401/ 1. A company has implemented PPTP as a VPN solution. Which of the following ports would need to be opened

More information

Network Defense Tools

Network Defense Tools Network Defense Tools Prepared by Vanjara Ravikant Thakkarbhai Engineering College, Godhra-Tuwa +91-94291-77234 www.cebirds.in, www.facebook.com/cebirds ravikantvanjara@gmail.com What is Firewall? A firewall

More information

1 Data information is sent onto the network cable using which of the following? A Communication protocol B Data packet

1 Data information is sent onto the network cable using which of the following? A Communication protocol B Data packet Review questions 1 Data information is sent onto the network cable using which of the following? A Communication protocol B Data packet C Media access method D Packages 2 To which TCP/IP architecture layer

More information

Firewalls (IPTABLES)

Firewalls (IPTABLES) Firewalls (IPTABLES) Objectives Understand the technical essentials of firewalls. Realize the limitations and capabilities of firewalls. To be familiar with iptables firewall. Introduction: In the context

More information

Expediting Incident Response with Foundstone ERS. Foundstone Inc. August, 2003

Expediting Incident Response with Foundstone ERS. Foundstone Inc. August, 2003 Expediting Incident Response with Foundstone ERS Foundstone Inc. August, 2003 Enterprise Risk Solutions Platform Supports Successful Response and Remediation Introduction The Foundstone Enterprise Risk

More information

Code of Connection (CoCo) for Devices Connected to the University s Network

Code of Connection (CoCo) for Devices Connected to the University s Network Code of Connection (CoCo) for Devices Connected to the University s Author Information Security Officer (Technical) Version V1.1 Date 23 April 2015 Introduction This Code of Connection (CoCo) establishes

More information

TABLE OF CONTENT. Page 2 of 9 INTERNET FIREWALL POLICY

TABLE OF CONTENT. Page 2 of 9 INTERNET FIREWALL POLICY IT FIREWALL POLICY TABLE OF CONTENT 1. INTRODUCTION... 3 2. TERMS AND DEFINITION... 3 3. PURPOSE... 5 4. SCOPE... 5 5. POLICY STATEMENT... 5 6. REQUIREMENTS... 5 7. OPERATIONS... 6 8. CONFIGURATION...

More information

Solution of Exercise Sheet 5

Solution of Exercise Sheet 5 Foundations of Cybersecurity (Winter 15/16) Prof. Dr. Michael Backes CISPA / Saarland University saarland university computer science Protocols = {????} Client Server IP Address =???? IP Address =????

More information

What is Really Needed to Secure the Internet of Things?

What is Really Needed to Secure the Internet of Things? What is Really Needed to Secure the Internet of Things? By Alan Grau, Icon Labs alan.grau@iconlabs.com The Internet of Things (IoT) has become a ubiquitous term to describe the tens of billions of devices

More information

A radical approach to secure LAN network using novel hardening techniques

A radical approach to secure LAN network using novel hardening techniques A radical approach to secure LAN network using novel hardening techniques Sakshi Sharma 1, Gurleen Singh 2 and Prabhdeep Singh 3 1,2,3 Computer Science Department, Punjab Technical University, Kapurthala,

More information

Second-generation (GenII) honeypots

Second-generation (GenII) honeypots Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. b.zdrnja@auckland.ac.nz Abstract Honeypots are security resources which trap malicious activities, so they

More information

Comparison of Firewall, Intrusion Prevention and Antivirus Technologies

Comparison of Firewall, Intrusion Prevention and Antivirus Technologies White Paper Comparison of Firewall, Intrusion Prevention and Antivirus Technologies How each protects the network Juan Pablo Pereira Technical Marketing Manager Juniper Networks, Inc. 1194 North Mathilda

More information

Firewalls. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49. Firewall Design Principles

Firewalls. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49. Firewall Design Principles Firewalls Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49 1 Firewall Design Principles Firewall Characteristics Types of Firewalls Firewall Configurations

More information

Guide to Vulnerability Management for Small Companies

Guide to Vulnerability Management for Small Companies University of Illinois at Urbana-Champaign BADM 557 Enterprise IT Governance Guide to Vulnerability Management for Small Companies Andrew Tan Table of Contents Table of Contents... 1 Abstract... 2 1. Introduction...

More information

Print Audit Facilities Manager Technical Overview

Print Audit Facilities Manager Technical Overview Print Audit Facilities Manager Technical Overview Print Audit Facilities Manager is a powerful, easy to use tool designed to remotely collect meter reads, automate supplies fulfilment and report service

More information

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewall

More information

TECHNICAL NOTE 01/02 PROTECTING YOUR COMPUTER NETWORK

TECHNICAL NOTE 01/02 PROTECTING YOUR COMPUTER NETWORK TECHNICAL NOTE 01/02 PROTECTING YOUR COMPUTER NETWORK 2002 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor organisation to the Centre

More information

4. Getting started: Performing an audit

4. Getting started: Performing an audit 4. Getting started: Performing an audit Introduction Security scans enable systems administrators to identify and assess possible risks within a network. Through GFI LANguard N.S.S. this is performed automatically,

More information

Before deploying SiteAudit it is recommended to review the information below. This will ensure efficient installation and operation of SiteAudit.

Before deploying SiteAudit it is recommended to review the information below. This will ensure efficient installation and operation of SiteAudit. SiteAudit Knowledge Base Deployment Check List June 2012 In This Article: Platform Requirements Windows Settings Discovery Configuration Before deploying SiteAudit it is recommended to review the information

More information

INNOV-04 The SANS Top 20 Internet Security Vulnerabilities

INNOV-04 The SANS Top 20 Internet Security Vulnerabilities INNOV-04 The SANS Top 20 Internet Security Vulnerabilities (and what it means to OpenEdge Applications) Michael Solomon, CISSP PMP CISM Solomon Consulting Inc. www.solomonconsulting.com (Thanks to John

More information

Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness

Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness CISP BULLETIN Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness November 21, 2006 To support compliance with the Cardholder Information Security Program (CISP), Visa USA

More information

Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1

Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A

More information

Web App Security Audit Services

Web App Security Audit Services locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System

More information

General Network Security

General Network Security 4 CHAPTER FOUR General Network Security Objectives This chapter covers the following Cisco-specific objectives for the Identify security threats to a network and describe general methods to mitigate those

More information

Configure a Microsoft Windows Workstation Internal IP Stateful Firewall

Configure a Microsoft Windows Workstation Internal IP Stateful Firewall 70 Lab #5 Lab #5 Assessment Spreadsheet A Review the default settings for Windows Firewall on your student workstation and indicate your settings below: GENERAL Recommended (Firewall On/Off) Don t Allow

More information

a) Encryption is enabled on the access point. b) The conference room network is on a separate virtual local area network (VLAN)

a) Encryption is enabled on the access point. b) The conference room network is on a separate virtual local area network (VLAN) MIS5206 Week 12 Your Name Date 1. Which significant risk is introduced by running the file transfer protocol (FTP) service on a server in a demilitarized zone (DMZ)? a) User from within could send a file

More information

REDSEAL NETWORKS SOLUTION BRIEF. Proactive Network Intelligence Solutions For PCI DSS Compliance

REDSEAL NETWORKS SOLUTION BRIEF. Proactive Network Intelligence Solutions For PCI DSS Compliance REDSEAL NETWORKS SOLUTION BRIEF Proactive Network Intelligence Solutions For PCI DSS Compliance Overview PCI DSS has become a global requirement for all entities handling cardholder data. A company processing,

More information

SAST, DAST and Vulnerability Assessments, 1+1+1 = 4

SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 Gordon MacKay Digital Defense, Inc. Chris Wysopal Veracode Session ID: Session Classification: ASEC-W25 Intermediate AGENDA Risk Management Challenges

More information

Locking down a Hitachi ID Suite server

Locking down a Hitachi ID Suite server Locking down a Hitachi ID Suite server 2016 Hitachi ID Systems, Inc. All rights reserved. Organizations deploying Hitachi ID Identity and Access Management Suite need to understand how to secure its runtime

More information

Building A Secure Microsoft Exchange Continuity Appliance

Building A Secure Microsoft Exchange Continuity Appliance Building A Secure Microsoft Exchange Continuity Appliance Teneros, Inc. 215 Castro Street, 3rd Floor Mountain View, California 94041-1203 USA p 650.641.7400 f 650.641.7401 ON AVAILABLE ACCESSIBLE Building

More information

Firewalls. Chapter 3

Firewalls. Chapter 3 Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border

More information

Network Access Security. Lesson 10

Network Access Security. Lesson 10 Network Access Security Lesson 10 Objectives Exam Objective Matrix Technology Skill Covered Exam Objective Exam Objective Number Firewalls Given a scenario, install and configure routers and switches.

More information

Cornerstones of Security

Cornerstones of Security Internet Security Cornerstones of Security Authenticity the sender (either client or server) of a message is who he, she or it claims to be Privacy the contents of a message are secret and only known to

More information

SNI Vulnerability Assessment Report

SNI Vulnerability Assessment Report SI Vulnerability Assessment Report Generated sample report Automated Infrastructure Discovery and Analysis Scan period 2009-04-07 10:31-2009-04-07 11:27 umber of scanned hosts 12 umber of hosts requiring

More information

Maruleng Local Municipality

Maruleng Local Municipality Maruleng Local Municipality. 22 November 2011 1 Version Control Version Date Author(s) Details 1.1 23/03/2012 Masilo Modiba New Policy 2 Contents ICT Firewall Policy 1 Version Control.2 1. Introduction.....4

More information

Introduction to Network Discovery and Identity

Introduction to Network Discovery and Identity The following topics provide an introduction to network discovery and identity policies and data: Host, Application, and User Detection, page 1 Uses for Host, Application, and User Discovery and Identity

More information

Pension Benefit Guaranty Corporation. Office of Inspector General. Evaluation Report. Penetration Testing 2001 - An Update

Pension Benefit Guaranty Corporation. Office of Inspector General. Evaluation Report. Penetration Testing 2001 - An Update Pension Benefit Guaranty Corporation Office of Inspector General Evaluation Report Penetration Testing 2001 - An Update August 28, 2001 2001-18/23148-2 Penetration Testing 2001 An Update Evaluation Report

More information

Network Security Guidelines. e-governance

Network Security Guidelines. e-governance Network Security Guidelines for e-governance Draft DEPARTMENT OF ELECTRONICS AND INFORMATION TECHNOLOGY Ministry of Communication and Information Technology, Government of India. Document Control S/L Type

More information

Firewalls. CEN 448 Security and Internet Protocols Chapter 20 Firewalls

Firewalls. CEN 448 Security and Internet Protocols Chapter 20 Firewalls CEN 448 Security and Internet Protocols Chapter 20 Firewalls Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University mdahshan@ccis.ksu.edu.sa

More information

PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES

PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute

More information

MIGRATIONWIZ SECURITY OVERVIEW

MIGRATIONWIZ SECURITY OVERVIEW MIGRATIONWIZ SECURITY OVERVIEW Table of Contents Introduction... 2 Shared Security Approach... 2 Customer Best Practices... 2 Application Security... 4 Database Level Security... 4 Network Security...

More information

Secure Software Programming and Vulnerability Analysis

Secure Software Programming and Vulnerability Analysis Secure Software Programming and Vulnerability Analysis Christopher Kruegel chris@auto.tuwien.ac.at http://www.auto.tuwien.ac.at/~chris Operations and Denial of Service Secure Software Programming 2 Overview

More information

Course Description and Outline. IT Essential II: Network Operating Systems V2.0

Course Description and Outline. IT Essential II: Network Operating Systems V2.0 Course Description and Outline IT Essential II: Network Operating Systems V2.0 Course Outline 1. Operating System Fundamentals 1.1 Operating System Basics 1.1.1 Overview of PC operating systems 1.1.2 PCs

More information

Protecting Critical Infrastructure

Protecting Critical Infrastructure Protecting Critical Infrastructure SCADA Network Security Monitoring March 20, 2015 Table of Contents Introduction... 4 SCADA Systems... 4 In This Paper... 4 SCADA Security... 4 Assessing the Security

More information

20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7

20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7 20-CS-6053-00X Network Security Spring, 2014 An Introduction To Network Security Week 1 January 7 Attacks Criminal: fraud, scams, destruction; IP, ID, brand theft Privacy: surveillance, databases, traffic

More information