DLP Detection with Netflow
|
|
|
- Logan Short
- 10 years ago
- Views:
Transcription
1 DLP Detection with Netflow Christopher Poetzel Network Security Engineer Argonne National Laboratory FloCon 2011 Jan 11, 2012
2 Who Am I? Christopher Joseph Poetzel University of Wisconsin-Madison BS Computer Science Argonne National Laboratory summer student through college 10 years full time Network/Security Engineer Firewall/VPN/Network Administrator IDS/Netflow Scripting Proxy/URL Filtering Brextyn Ayers Poetzel Nov 5 th, 2010
3 Argonne National Laboratory IT Environment Challenges Diverse population: 2500 employees 10,000+ visitors annually Off-site computer users Foreign national employees, users, and collaborators Diverse funding: Not every computer is a DOE computer. IT is funded in many ways. Every program is working in an increasingly distributed computing model. Our goal: a consistent and comprehensively secure environment that supports the diversity of IT and requirements. Balance Science, Security, and Architecture. Argonne is managed by the UChicago Argonne LLC for the Department of Energy. 3
4 Emphasis on the Synergies of Multi-Program Science, Engineering & Applications Computational Science Accelerator Research Fundamental Physics Infrastructure Analysis Materials Characterization Catalysis Science Transportation Science User Facilities Nuclear Fuel Cycle Structural Biology.. and much more. 4
5 High Level Split of Argonne Divisions Scientific Operations Advanced Photon Source Biology High Entergy Physics Environmental Sciences Super Computers HR, Finances Plant and Facility Management Medical IT Computer Support, Core Networking Cyber Security Mission is to do Science More open and collaborative with world Less controlled by Central IT Full outbound restrictions Mission is Support Science Less open and little collaboration More Controlled by Central IT Access to Sensitive Information PII Records, Payroll, Medical Benefits, Travel System Limited Http, HTTPS (some ftp)
6 Data Loss Prevention (DLP) Data Loss Prevention (DLP) is a computer security term referring to systems that identify, monitor, and protect data in use, data in motion, and data at rest through deep content inspection, contextual security analysis of transactions, and with a centralized management framework. Protect Data in use: endpoint actions Protect Data in motion: network actions Protect Data at rest: data storage The systems are designed to detect and prevent the unauthorized use and transmission of confidential information. The Data to protect is dependant on organization PII (Social Security Numbers, Birth Dates, Addresses) Credit Card Numbers Source Code Internal Only Documents Many Many Vendors in this Game McAfee, BlueCoat, RSA, Symantec, Trend.. BECAUSE
7 DLP Happens.. All the time.. Even to Me WikiLeaks: Nov 2010 Government Documents leaked for all to see Arrests Made, USA Government Embarrassed, National Security Threatened Gawker Media Hacked: Dec 12, million user names and passwords exposed after user database compromised 500MB Torrent file of all accounts/passwords Gawker Advises users to change passwords or delete account Heartland Payment Systems (Credit Card Processing): May 15 th, ,000,000 Credit Card Numbers Stolen Settlement with VISA: $60,000, Jan 2010 Settlement with AMEX: $3,538, Dec 17, 2009 University of Wisconsin-Madison: Nov 26, ,000 names and identification card numbers including Social Security numbers stolen from server (1 was me)
8 DLP happens, so now what Early 2009, Argonne Cyber Security Program Office says DLP as a capability we would like to have. How can this be done given the following: No money for vendor solution No complete desktop network control of all hosts Small amount of time to commit to project Automated System minimal human interaction We do not have 24X7 analysts or operations center We do not want be chasing down alerts all the time We are not web traffic cops. We are not trying to stop people from getting to Facebook/Yahoo/etc Want to be alerted on large unauthorized offsite uploads that might be DLP Want to catch those abuse cases of people web surfing all day/night long What is the our best bang for out buck?
9 Our Solution A Netflow based solution to look for anomalous amounts of offsite data within the last hour. Focus on areas of greatest risk Alert us to things out of normal Configurable Ability to exclude ips Ability for different thresholds for different networks Automated Alerting
10 Focus on areas of greatest risk Operations Divisions provide the greatest area of risk Contains the meat of sensitive data Jobs are not about collaboration, about support Offsite traffic is limited to Http, Https and thus easier to model and understand Operations HR, Finances Plant and Facility Management Medical IT Computer Support, Core Networking Cyber Security Mission is Support Science Less open and little collaboration More Controlled by Central IT Access to Sensitive Information PII Records, Payroll, Medical Benefits, Travel System Limited Http, HTTPS (some ftp)
11 Alert us to things out of normal Using netflow we base lined the normal hourly amount of offsite web traffic for 1 month. Fairly simple netflow script On Average, Per subnet, offsite Web traffic threshold Weekdays 6am-6pm, 25 MB 6pm 6am, 5 MB Weekends, 5MB Configurable Exclude known offsite uploaders by IP Address Stored in a mysql database table MB Thresholds are on a per subnet basis Also in a mysql database table
12 Automated Alerting ALERT for Excessive OFFSITE WEB Traffic FWInterface: sample_yellow network FWNetwork: XXX.0 FWIntDescr: Sample Yellow network Dest: Offsite NON-ANL on TCP 80,443 TimeStart: Monday, AM TimeEnd: Monday, PM Offsite MB For Subnet: Threshold for 1 Host During Period: 25 MB/hour for single host Further Information for Alarm Period # Report Information # # Fields: Total # Symbols: Disabled # Sorting: Descending Field 2 # Name: Source IP # Args: flow-stat -f9 -S2
13 # IPaddr flows octets packets # User:Doe, Jane DNS:csi3388XX Top 25 Dest Hosts # recn: ip-destination-address*,flows,octets,packets,duration post.craigslist.org,89, ,21459, Key Line in Alert a deploy.akamaitechnologies.com,44,416136,745, ,85,383093,1324, ** others removed ** # stop, hit record limit Apparently this user was uploading something large to craigslist during work hours. Work related??
14 Script Logic / Flow-Tools Guts Create ACL to watch for traffic from network Y (include exemptions) Determine Offsite Traffic in last hour for network Y ( X.Y) Run Netflow on Border Router to get Offsite Mb amount for subnet for past hour flow-cat $flowargs flow-filter -f /tmp/$tempfile -S check1 -P 80,443 flow-stat -f9 -S2 Check amount against thresholds Thresholds run against database limits Send Alert if threshold tripped 356 line perl script, backend database table for thresholds, exclusions, and subnets to watch Fairly Efficient / Quick Watching 49 networks for DLP detection Average runtime is 5minutes Took less than a week to come together
15 What the solutions does First insight into DLP for those networks where it matters HR, Financial People, Lab Directors, etc Identifies people uploading large amounts of data to offsite services Facebook Online attachments Snapfish/Walgreens/ETC YouTube Videos Or something large heading offsite that shouldn t be Identifies afterhours personal doing lots of web surfing in the wee hours of the morning Exemptions and different thresholds do not bury us with false positives Helps us know our network better
16 What this solution is not Does not actually stop DLP, just helps detect it Focused only on the network detection side of DLP Gives no information on data offloaded Not available within netflow Can obtain with use of local PCAP device No Polices like a vendor solution No inspection of traffic leaving (social security numbers, credit card, resumes, etc) Will not catch DLP when Network MB volume is low Local Argonne network is not being monitored
17 Future Solution has done its job for past 2 years as an early detection system It is far from perfect but has helped to Find some legitimate offsite uploads that needed to be more controlled Find those egregious web surfers If we were to progress this script/solution to the next level Watch offsite levels by IP address, not by network Include some automatic data gathering from our PCAP software to give insight into data pushed offsite Automatic trending of thresholds We are investigating commercial DLP Solutions Any recommendations please let me know
18 Takeaways DLP is a problem and it does happen Our quick and simple DLP solution is a great example of how netflow statistics can be used to in various productive ways At Argonne, our staffing situation limits us from any real-time operator style netflow interface Only real-time netflow interactions is once an alarm/alert has been triggered If a commercial or home-brew tool can not send out automated alarms in some manner, we will not use it We have been using netflow for cyber security and network related endeavors for 9+ years. It is an invaluable tool for out cyber security and network personal.
19 All done Thanks for the ear Questions Cpoetzel at anl.gov
SOUTHERN POLYTECHNIC STATE UNIVERSITY. Snort and Wireshark. IT-6873 Lab Manual Exercises. Lucas Varner and Trevor Lewis Fall 2013
SOUTHERN POLYTECHNIC STATE UNIVERSITY Snort and Wireshark IT-6873 Lab Manual Exercises Lucas Varner and Trevor Lewis Fall 2013 This document contains instruction manuals for using the tools Wireshark and
Who is Watching You? Video Conferencing Security
Who is Watching You? Video Conferencing Security Navid Jam Member of Technical Staff March 1, 2007 SAND# 2007-1115C Computer and Network Security Security Systems and Technology Video Conference and Collaborative
SFWR ENG 4C03 Class Project Firewall Design Principals Arash Kamyab 9940313 March 04, 2004
SFWR ENG 4C03 Class Project Firewall Design Principals Arash Kamyab 9940313 March 04, 2004 Introduction: A computer firewall protects computer networks from unwanted intrusions which could compromise confidentiality
WHITE PAPER. Managed File Transfer: When Data Loss Prevention Is Not Enough Moving Beyond Stopping Leaks and Protecting Email
WHITE PAPER Managed File Transfer: When Data Loss Prevention Is Not Enough Moving Beyond Stopping Leaks and Protecting Email EXECUTIVE SUMMARY Data Loss Prevention (DLP) monitoring products have greatly
Overview - Using ADAMS With a Firewall
Page 1 of 6 Overview - Using ADAMS With a Firewall Internet security is becoming increasingly important as public and private entities connect their internal networks to the Internet. One of the most popular
Overview - Using ADAMS With a Firewall
Page 1 of 9 Overview - Using ADAMS With a Firewall Internet security is becoming increasingly important as public and private entities connect their internal networks to the Internet. One of the most popular
Automatic Network Protection Scenarios Using NetFlow
Automatic Network Protection Scenarios Using NetFlow Vojt ch Krmí ek, Jan Vykopal {krmicek vykopal}@ics.muni.cz FloCon 2012 January 9-12, Austin, Texas Part I Flow-based Network Protection Krmicek et al.
RSA Data Loss Prevention (DLP) Understand business risk and mitigate it effectively
RSA Data Loss Prevention (DLP) Understand business risk and mitigate it effectively Arrow ECS DLP workshop, Beograd September 2011 Marko Pust [email protected] 1 Agenda DLP in general What to expect from
A Buyer's Guide to Data Loss Protection Solutions
A Buyer's Guide to Data Loss Protection Solutions 2010 Websense, Inc. All rights reserved. Websense is a registered trademark of Websense, Inc. in the United States and certain international markets. Websense
Websense Web Security Gateway: Integrating the Content Gateway component with Third Party Data Loss Prevention Applications
Websense Web Security Gateway: Integrating the Content Gateway component with Third Party Data Loss Prevention Applications November, 2010 2010 Websense, Inc. All rights reserved. Websense is a registered
Solutions and IT services for Oil-Gas & Energy markets
Solutions and IT services for The context Companies operating in the Oil-Gas & Energy sectors are facing radical changes that have a significant impact on their business processes. In this context, compliance
An Overview of the Bro Intrusion Detection System
An Overview of the Bro Intrusion Detection System Brian L. Tierney, Vern Paxson, James Rothfuss Lawrence Berkeley National Laboratory Typical Approach: Firewall with default deny policy A blocking router
Norton Personal Firewall for Macintosh
Norton Personal Firewall for Macintosh Evaluation Guide Firewall Protection for Client Computers Corporate firewalls, while providing an excellent level of security, are not always enough protection for
A Websense Research Brief Prevent Data Loss and Comply with Payment Card Industry Data Security Standards
A Websense Research Brief Prevent Loss and Comply with Payment Card Industry Security Standards Prevent Loss and Comply with Payment Card Industry Security Standards Standards for Credit Card Security
TRITON AP-ENDPOINT STOP ADVANCED THREATS AND SECURE SENSITIVE DATA FOR ROAMING USERS
TRITON AP-ENDPOINT STOP ADVANCED THREATS AND SECURE SENSITIVE DATA FOR ROAMING USERS TRITON AP-ENDPOINT STOP ADVANCED THREATS AND SECURE SENSITIVE DATA FOR ROAMING USERS From a damaged reputation to regulatory
FIREWALLS & CBAC. [email protected]
FIREWALLS & CBAC [email protected] Implementing a Firewall Personal software firewall a software that is installed on a single PC to protect only that PC All-in-one firewall can be a single device that
Step-by-Step Configuration
Step-by-Step Configuration Kerio Technologies Kerio Technologies. All Rights Reserved. Printing Date: August 15, 2007 This guide provides detailed description on configuration of the local network which
10 Cool Things Your Firewall Should Do. A firewall that blocks threats is only the beginning
10 Cool Things Your Firewall Should Do A firewall that blocks threats is only the beginning Table of Contents The Firewall Grows Up 1 The Application Firewall 2 1st Cool Thing: Managing Streaming Video
NetFlow Tracker Overview. Mike McGrath x ccie CTO [email protected]
NetFlow Tracker Overview Mike McGrath x ccie CTO [email protected] 2006 Copyright Crannog Software www.crannog-software.com 1 Copyright Crannog Software www.crannog-software.com 2 LEVELS OF NETWORK
Architecture Overview
Architecture Overview Design Fundamentals The networks discussed in this paper have some common design fundamentals, including segmentation into modules, which enables network traffic to be isolated and
Scalable NetFlow Analysis with Hadoop Yeonhee Lee and Youngseok Lee
Scalable NetFlow Analysis with Hadoop Yeonhee Lee and Youngseok Lee {yhlee06, lee}@cnu.ac.kr http://networks.cnu.ac.kr/~yhlee Chungnam National University, Korea January 8, 2013 FloCon 2013 Contents Introduction
Meeting the Challenge of Big Data Log Management: Sumo Logic s Real-Time Forensics and Push Analytics
Meeting the Challenge of Big Data Log Management: Sumo Logic s Real-Time Forensics and Push Analytics A Sumo Logic White Paper Executive Summary The huge volume of log data generated by today s enterprises
Web Protection for Your Business, Customers and Data
WHITE PAPER: WEB PROTECTION FOR YOUR BUSINESS, CUSTOMERS............ AND.... DATA........................ Web Protection for Your Business, Customers and Data Who should read this paper For security decision
Architecture. The DMZ is a portion of a network that separates a purely internal network from an external network.
Architecture The policy discussed suggests that the network be partitioned into several parts with guards between the various parts to prevent information from leaking from one part to another. One part
The Benefits of SSL Content Inspection ABSTRACT
The Benefits of SSL Content Inspection ABSTRACT SSL encryption is the de-facto encryption technology for delivering secure Web browsing and the benefits it provides is driving the levels of SSL traffic
Finding Network Security Breaches Using LiveAction Software to detect and analyze security issues in your network
LiveAction Application Note Finding Network Security Breaches Using LiveAction Software to detect and analyze security issues in your network September 2012 http://www.liveaction.com Table of Contents
Transformation of honeypot raw data into structured data
Transformation of honeypot raw data into structured data 1 Majed SANAN, Mahmoud RAMMAL 2,Wassim RAMMAL 3 1 Lebanese University, Faculty of Sciences. 2 Lebanese University, Director of center of Research
Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified
Standard: Data Security Standard (DSS) Requirement: 6.6 Date: February 2008 Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified Release date: 2008-04-15 General PCI
High Speed Data Transfer from the APS. Kenneth Sidorowicz September 27, 2006
High Speed Data Transfer from the APS Kenneth Sidorowicz September 27, 2006 Deep Inspection Firewalls Secure Computing G2 Model 4150 firewalls were installed during the September 2004 accelerator shutdown
Cyber - Security and Investigations. Ingrid Beierly August 18, 2008
Cyber - Security and Investigations Ingrid Beierly August 18, 2008 Agenda Visa Cyber - Security and Investigations Today s Targets Recent Attack Patterns Hacking Statistics (removed) Top Merchant Vulnerabilities
PAVING THE PATH TO THE ELIMINATION OF THE TRADITIONAL DMZ
PAVING THE PATH TO THE ELIMINATION A RSACCESS WHITE PAPER 1 The Traditional Role of DMZ 2 The Challenges of today s DMZ deployments 2.1 Ensuring the Security of Application and Data Located in the DMZ
Five Tips to Ensure Data Loss Prevention Success
Five Tips to Ensure Data Loss Prevention Success A DLP Experts White Paper January, 2013 Author s Note The content of this white paper was developed independently of any vendor sponsors and is the sole
Network Security Policy
Network Security Policy I. PURPOSE Attacks and security incidents constitute a risk to the University's academic mission. The loss or corruption of data or unauthorized disclosure of information on campus
Introduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
AlienVault. Unified Security Management (USM) 5.x Policy Management Fundamentals
AlienVault Unified Security Management (USM) 5.x Policy Management Fundamentals USM 5.x Policy Management Fundamentals Copyright 2015 AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,
Multi-Homing Security Gateway
Multi-Homing Security Gateway MH-5000 Quick Installation Guide 1 Before You Begin It s best to use a computer with an Ethernet adapter for configuring the MH-5000. The default IP address for the MH-5000
System Management. What are my options for deploying System Management on remote computers?
Getting Started, page 1 Managing Assets, page 2 Distributing Software, page 3 Distributing Patches, page 4 Backing Up Assets, page 5 Using Virus Protection, page 6 Security, page 7 Getting Started What
How To Protect A Web Application From Attack From A Trusted Environment
Standard: Version: Date: Requirement: Author: PCI Data Security Standard (PCI DSS) 1.2 October 2008 6.6 PCI Security Standards Council Information Supplement: Application Reviews and Web Application Firewalls
Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 6 Network Security Objectives List the different types of network security devices and explain how they can be used Define network
An overview of traffic analysis using NetFlow
The LOBSTER project An overview of traffic analysis using NetFlow Arne Øslebø UNINETT [email protected] 1 Outline What is Netflow? Available tools Collecting Processing Detailed analysis security
How To Block A Ddos Attack On A Network With A Firewall
A Prolexic White Paper Firewalls: Limitations When Applied to DDoS Protection Introduction Firewalls are often used to restrict certain protocols during normal network situations and when Distributed Denial
LOG INTELLIGENCE FOR SECURITY AND COMPLIANCE
PRODUCT BRIEF uugiven today s environment of sophisticated security threats, big data security intelligence solutions and regulatory compliance demands, the need for a log intelligence solution has become
Information Security Services
Information Security Services Information Security In 2013, Symantec reported a 62% increase in data breaches over 2012. These data breaches had tremendous impacts on many companies, resulting in intellectual
THE 2014 THREAT DETECTION CHECKLIST. Six ways to tell a criminal from a customer.
THE 2014 THREAT DETECTION CHECKLIST Six ways to tell a criminal from a customer. Telling criminals from customers online isn t getting any easier. Attackers target the entire online user lifecycle from
plixer Scrutinizer Competitor Worksheet Visualization of Network Health Unauthorized application deployments Detect DNS communication tunnels
Scrutinizer Competitor Worksheet Scrutinizer Malware Incident Response Scrutinizer is a massively scalable, distributed flow collection system that provides a single interface for all traffic related to
Analysis of Network Beaconing Activity for Incident Response
Analysis of Network Beaconing Activity for Incident Response FloCon2008 Peter Balland, P. O. Box 808, Livermore, CA 94551 This work performed under the auspices of the U.S. Department of Energy by under
Company Co. Inc. LLC. LAN Domain Network Security Best Practices. An integrated approach to securing Company Co. Inc.
Company Co. Inc. LLC Multiple Minds, Singular Results LAN Domain Network Security Best Practices An integrated approach to securing Company Co. Inc. LLC s network Written and Approved By: Geoff Lacy, Tim
Firewalls, Tunnels, and Network Intrusion Detection. Firewalls
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
How To Control Your Network With A Firewall On A Network With An Internet Security Policy On A Pc Or Ipad (For A Web Browser)
1110 Cool Things Your Firewall Should Do Extend beyond blocking network threats to protect, manage and control application traffic Table of Contents The Firewall Grows Up 1 What does SonicWALL Application
White Paper. Securing and Integrating File Transfers Over the Internet
White Paper Securing and Integrating File Transfers Over the Internet While the integrity of data during transfer has always been a concern the desire to use the Internet has highlighted the need to secure
Step-by-Step Configuration
Step-by-Step Configuration Kerio Technologies C 2001-2003 Kerio Technologies. All Rights Reserved. Printing Date: December 17, 2003 This guide provides detailed description on configuration of the local
ACCEPTING PAYMENT CARD ASSESSMENT Pre-Selection Questionnaire
ACCEPTING PAYMENT CARD ASSESSMENT Pre-Selection Questionnaire Overview This pre-implementation questionnaire is designed to provide the Boston College Internal Audit Department with a general understanding
Managing PHI in the Cloud Best Practices
Managing PHI in the Cloud Best Practices Executive Whitepaper Recent advances in both Cloud services and Data Loss Prevention (DLP) technology have substantially improved the ability of healthcare organizations
Lumeta IPsonar. Active Network Discovery, Mapping and Leak Detection for Large Distributed, Highly Complex & Sensitive Enterprise Networks
IPsonar provides visibility into every IP asset, host, node, and connection on the network, performing an active probe and mapping everything that's on the network, resulting in a comprehensive view of
Guideline on Firewall
CMSGu2014-02 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Firewall National Computer Board Mauritius Version 1.0 June
IBM Managed Security Services (Cloud Computing) hosted e-mail and Web security - express managed Web security
IBM Managed Security Services (Cloud Computing) hosted e-mail and Web security - express managed Web security INTC-8608-01 CE 12-2010 Page 1 of 8 Table of Contents 1. Scope of Services...3 2. Definitions...3
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls
HTGR- Netflow. or, how to know what your network really did without going broke
HTGR- Netflow or, how to know what your network really did without going broke Michael W. Lucas [email protected] GKN Driveline North America, Inc. Copyright 2007 Michael W. Lucas slide 1 What
APPLICATION PERFORMANCE MONITORING
APPLICATION PERFORMANCE MONITORING PRACTICAL WAYS TO MONITOR THE END USER EXPERIENCE WHITE PAPER Performance of key applications is a critical item to monitor in many IT environments where users depend
Remote Access Platform. Architecture and Security Overview
Remote Access Platform Architecture and Security Overview NOTICE This document contains information about one or more ABB products and may include a description of or a reference to one or more standards
Privilege Gone Wild: The State of Privileged Account Management in 2015
Privilege Gone Wild: The State of Privileged Account Management in 2015 March 2015 1 Table of Contents... 4 Survey Results... 5 1. Risk is Recognized, and Control is Viewed as a Cross-Functional Need...
Getting Started Guide
Getting Started Guide Before you set up your account, you may want to spend a few minutes thinking about what you want to get out of Flextivity. Of course, Flextivity helps you successfully manage basic
Data Privacy: The High Cost of Unprotected Sensitive Data 6 Step Data Privacy Protection Plan
WHITE PAPER Data Privacy: The High Cost of Unprotected Sensitive Data 6 Step Data Privacy Protection Plan Introduction to Data Privacy Today, organizations face a heightened threat landscape with data
Famly ApS: Overview of Security Processes
Famly ApS: Overview of Security Processes October 2015 Please consult http://famly.co for the latest version of this paper Page 1 of 10 Table of Contents 1. INTRODUCTION TO SECURITY AT FAMLY... 3 2. PHYSICAL
SHARE THIS WHITEPAPER. Top Selection Criteria for an Anti-DDoS Solution Whitepaper
SHARE THIS WHITEPAPER Top Selection Criteria for an Anti-DDoS Solution Whitepaper Table of Contents Top Selection Criteria for an Anti-DDoS Solution...3 DDoS Attack Coverage...3 Mitigation Technology...4
1. Firewall Configuration
1. Firewall Configuration A firewall is a method of implementing common as well as user defined security policies in an effort to keep intruders out. Firewalls work by analyzing and filtering out IP packets
Breach Found. Did It Hurt?
ANALYST BRIEF Breach Found. Did It Hurt? INCIDENT RESPONSE PART 2: A PROCESS FOR ASSESSING LOSS Authors Christopher Morales, Jason Pappalexis Overview Malware infections impact every organization. Many
Move over, TMG! Replacing TMG with Sophos UTM
Move over, TMG! Replacing TMG with Sophos UTM Christoph Litzbach, Pre-Sales Engineer NSG 39 Key Features of TMG HTTP Antivirus/spyware URL Filtering HTTPS forward inspection Web Caching Role based access
Bring Your Own Device (BYOD) and 1:1 Initiatives: What Questions Do You Need to Answer Before Jumping In?
Bring Your Own Device (BYOD) and 1:1 Initiatives: What Questions Do You Need to Answer Before Jumping In? Bruce Alexander Product Specialist- Wireless and Mobility Bret Straffon Product Specialist-Security
Lifecycle Solutions & Services. Managed Industrial Cyber Security Services
Lifecycle Solutions & Services Managed Industrial Cyber Security Services Around the world, industrial firms and critical infrastructure operators partner with Honeywell to address the unique requirements
INCREASE NETWORK VISIBILITY AND REDUCE SECURITY THREATS WITH IMC FLOW ANALYSIS TOOLS
WHITE PAPER INCREASE NETWORK VISIBILITY AND REDUCE SECURITY THREATS WITH IMC FLOW ANALYSIS TOOLS Network administrators and security teams can gain valuable insight into network health in real-time by
Basic & Advanced Administration for Citrix NetScaler 9.2
Basic & Advanced Administration for Citrix NetScaler 9.2 Day One Introducing and deploying Citrix NetScaler Key - Brief Introduction to the NetScaler system Planning a NetScaler deployment Deployment scenarios
System Security Plan University of Texas Health Science Center School of Public Health
System Security Plan University of Texas Health Science Center School of Public Health Note: This is simply a template for a NIH System Security Plan. You will need to complete, or add content, to many
Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)
s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware
A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
Beyond PCI Checklists:
Beyond PCI Checklists: Securing Cardholder Data with Tripwire s enhanced File Integrity Monitoring white paper Configuration Control for Virtual and Physical Infrastructures Contents 4 The PCI DSS Configuration
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump www.enisa.europa.eu Agenda Intro to netflow Metrics Toolbox (Nfsen + Nfdump) Demo www.enisa.europa.eu 2 What is Netflow Netflow = Netflow
How to Choose the Right Industrial Firewall: The Top 7 Considerations. Li Peng Product Manager
How to Choose the Right Industrial Firewall: The Top 7 Considerations Li Peng Product Manager The right industrial firewall can strengthen the safety and reliability of control systems Central to industrial
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
mbits Network Operations Centrec
mbits Network Operations Centrec The mbits Network Operations Centre (NOC) is co-located and fully operationally integrated with the mbits Service Desk. The NOC is staffed by fulltime mbits employees,
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT The frequency and sophistication of Distributed Denial of Service attacks (DDoS) on the Internet are rapidly increasing. Most of the earliest
Gold Support for NetFlow Tracker
Visual Network Systems Gold Support helps you fully leverage your NetFlow Tracker investment and keep it current with regular software upgrades and comprehensive technical assistance. Gold Support for
Web Analytics Understand your web visitors without web logs or page tags and keep all your data inside your firewall.
Web Analytics Understand your web visitors without web logs or page tags and keep all your data inside your firewall. 5401 Butler Street, Suite 200 Pittsburgh, PA 15201 +1 (412) 408 3167 www.metronomelabs.com
Data Loss Prevention Best Practices to comply with PCI-DSS An Executive Guide
Data Loss Prevention Best Practices to comply with PCI-DSS An Executive Guide. Four steps for success Implementing a Data Loss Prevention solution to address PCI requirements may be broken into four key
Minimum Requirements for Cencon 4 with Microsoft R SQL 2008 R2 Express
Minimum Requirements for Cencon 4 with Microsoft R SQL 2008 R2 Express SQL 2008 R2 Express Restrictions 1 CPU 1 GB Ram Use Limit 10 GB Database Size High Availability Options None (No Database Mirroring,
Minimum Requirements for Cencon 4 with Microsoft R SQL 2008 R2 Standard
Minimum Requirements for Cencon 4 with Microsoft R SQL 2008 R2 Standard SQL 2008 R2 Standard Restrictions 4 CPU 64 GB Ram Use Limit 524 PB Database Size High Availability Options Limited Database Mirroring,
Securely Yours LLC IT Hot Topics. Sajay Rai, CPA, CISSP, CISM [email protected]
Securely Yours LLC IT Hot Topics Sajay Rai, CPA, CISSP, CISM [email protected] Contents Background Top Security Topics What auditors must know? What auditors must do? Next Steps [Image Info]
Safeguards and Security
Safeguards and Security Overview The Safeguards and Security (S&S) program mission is to support Departmental research at Office of Science (SC) laboratories by ensuring appropriate levels of protection
Alfresco Enterprise on AWS: Reference Architecture
Alfresco Enterprise on AWS: Reference Architecture October 2013 (Please consult http://aws.amazon.com/whitepapers/ for the latest version of this paper) Page 1 of 13 Abstract Amazon Web Services (AWS)
THE EXECUTIVE GUIDE TO DATA LOSS PREVENTION. Technology Overview, Business Justification, and Resource Requirements
THE EXECUTIVE GUIDE TO DATA LOSS PREVENTION Technology Overview, Business Justification, and Resource Requirements Introduction to Data Loss Prevention Intelligent Protection for Digital Assets Although