Software Defined Perimeter
|
|
|
- Marilyn Welch
- 10 years ago
- Views:
Transcription
1 So#ware Defined Perimeter Software Defined Perimeter A new approach to access control Junaid Islam, Co Chair
2 Before we start, two ideas we believe strongly Complexity is the primary reason security systems fail (Junaid said this) The ideal security solu?on should just work (what Bob wants) 2 Internet 2 Technology Exchange 2015
3 600+ U.S. Vic<ms of Chinese Cyber Espionage 3
4 Fundamental Problem: AOacks Server exploita?on Creden?al the# Connec?on hijacking Connec?on- oriented protocol DNS Client connects to server before authen?ca?on Vulnerability is unauthen?cated connec?vity & visibility IP addr of finance server? Alice Alice Hello , I d like some data Who are you? Alice, p@ssw0rd You re authorized
5 Connec<vity & Visibility: Not a New Problem Wall off the enterprise Hide the applica?ons Tightly manage the computers Enterprise Alice Internet Bob This worked in the Business model of the 1990 s 5
6 Business 2.0: The Perimeter Crumbled Phishing, BYOD, SaaS, IaaS, Contractors, subject maoer experts, outsourced so#ware and IT, channel partner, ERP professional Remove visibility Remove connec?vity Cloud & BYOD friendly Enterprise IaaS SaaS cec9a2187c914df2b3078e320f Alice Bob The world needs a new security model!!! 6
7 How SDP Started: Big companies with BIG problems Connec?ng 200,000 users to data center- cloud apps Monitoring and upda?ng vehicle so#ware Enabling "customer controlled" services 7 Internet 2 Technology Exchange 2015
8 Current Connec<vity Model Connect to Application Provide Credentials Multifactor Token Denial of Service TheA Server Hijacking APT/Lateral Movement 8 Internet 2 Technology Exchange 2015
9 Solu<on Requirements Insider Threat Mobile Devices Cloud Migration No secrets Highly scalable Any infrastructure 9 Internet 2 Technology Exchange 2015
10 SoYware Defined Perimeter Mul?factor Token Provide Creden?als Connect to Applica?on 10 Internet 2 Technology Exchange 2015
11 SDP Architecture 0. One?me on- boarding Client root of trust Digital ar?facts & thin client 1. Device Authen?ca?on & Authoriza?on SPA: an? DDoS, defeats SSL aoacks mtls & fingerprint: an? creden?al the# Issuing CA Gateway Client Crypto IP s SDP Controller SAML IdP 2. User Authen?ca?on & Authoriza?on Enterprise iden?ty: separa?on of trust SAML IdP integrated with LDAP groups 3. Dynamically Provisioned Connec?ons Applica?ons isolated and protected Usability: portal page of applica?ons 3. Dynamic Connec<on SDP Gateways Hos<ng & IaaS SDP 3. Dynamic Connec<on DMZ & Data Center 11 Internet 2 Technology Exchange 2015
12 Key SDP Features 64 bit id is not secret (can be listed) SPA can carry payload for Auto/IoT applica?ons AOacks can be detected in the first packet 12 Internet 2 Technology Exchange 2015
13 Defea<ng A^acks on the Extended Enterprise Server Isola<on SPA, Dynamic FW Transparent MFA mtls, Fingerprint Encryp<on, Pinned Certs, No DNS Server exploita?on: constant aoacks Misconfigura?ons Vulnerabili?es Injec?ons Denial of Service Creden?al the#: ⅔ of Verizon DBIR Phishing Keyloggers Brute force Connec?on hijacking: stealthiest Man- in- the- Middle Cer?ficate forgery DNS poisoning User name Password Internet 2 Technology Exchange 2015
14 SDP Provides Real Time Threat Detec<on 14 Internet 2 Technology Exchange 2015
15 15 SDP Cryptography Profile ECDHE- RSA- AES256- GCM- SHA384 TLS suite ECDHE: Ellip?c Curve Diffie Hellman Ephemeral Ellip?c curve pre- master keys Generate the four symmetric keys of the TLS Ephemeral keys per session Perfect Forward Secrecy But not client or server authen?ca?on RSA: Public/private key pair with an X.509 cer?ficate Client and server authen?ca?on Vidder s implementa?on: Cer?ficates pinned to a trusted root cer?ficate Not the hundreds of (possibly compromised) roots browsers trust Employs OCSP stapling (RFC 6066) Forwards the OCSP response with TLS Server hello Reduces the load on the OCSP responder Mi?gates a DoS of the OCSP responder AES256- GCM: Advanced Encryp?on Standard (NIST FIPS 197) Symmetric key encryp?on 256 bit cipher block size Galois/Counter Mode Block cipher that simultaneously computes encryp?on and integrity PC s and servers implement GCM in hardware Negligible performance impact due to encryp?on of the data SHA384: Secure Hash Algorithms (and member of SHA- 2) Generates a 384 bit hash Verifies integrity of the clear text Client/Server handshake Single Packet Authoriza?on (SPA) History: Invented >10 years ago Commonly used for super user ssh access to servers Mi?gates aoacks by unauthorized users Algorithm Based on RFC 4226, "HOTP HMAC- based One- Time Password Used for hardware/so#ware one?me password tokens 128- bit random number seed 128- bit non- secret counter So#ware Defined Perimeter: SPA occurs before TLS (SSL) connec?on Mi?gates aoacks on TLS by unauthorized users See AOacks on SSL/TLS SPA = UID, OTP, CTR, GMAC UID = Universal ID of SDP Client OTP = HMAC[seed CTR] GMAC = E client private key [HMAC[UID OTP CTR]] Each client has an id, seed, and counter Counter is incremented, appended to seed, and hashed UID, OTP, CTR, & and the counter are sent as clear text. The counter is increment to mi?gate playback aoacks. The packet is also signed to provide integrity checking.
16 A^acks on SSL/TLS Name Date A^ack Unauthorized Authorized Users SSLstrip Feb 2009 hop to hops SPA No hop DigiNotar Sept 2011 MitM forged certs SPA Pinned certs BEAST Apr 2012 Java Applet oracle SPA Client- based CRIME Sept 2012 MitM SPDY compressing oracle SPA No compression Lucky 13 Feb 2013 MitM CBC padding oracle SPA GCM TIME Mar 2013 Browser JavaScript?ming oracle SPA Client- based RC4 biases Mar 2013 MitM RC4 oracle SPA No cypher nego?a?on BREACH Aug 2013 Website redirect, compression SPA No redirect or compression goto fail Feb 2014 MitM counterfeit key via coding error SPA Pinned dedicated cert Triple Handshake Mar 2014 Server MitM on client cert SPA Pinned dedicated cert Heartbleed Apr 2014 OpenSSL bug SPA Not single- ended SSL BERserk Sept 2014 MitM PKCS#1.5 padding SPA Not Mozilla NSS Poodle Oct 2014 MitM SSLv3 oracle SPA No cypher nego?a?on Poodle++ Dec 2014 MitM JavaScript?ming oracle SPA Client- based FREAK Mar 2015 MitM nego?a?on 512 bit key SPA No key nego?a?on Bar- mitzvah Mar 2015 View RC4 SPA No RC4 logjam May 2015 MitM downgrade to 512 bit key SPA No suite nego?a?on 16
17 Current SDP Workgroup Ac<vi<es Suppor?ng DHS contract for Terabit scale DDoS solu?on Coordina?ng development efforts of commercial partners Beginning efforts of Version 2 looking for volunteers!!! 17 Internet 2 Technology Exchange 2015
18 Typical Denial of Service (DoS) A^acks Applica?on layer SQL statements that DoS the database Many false posi?ves punish legi?mate users PrecisionAccess defeats this with no false posi?ves User name/password Compromise or DoS each user Cannot be stopped with tradi?onal tools PrecisionAccess defeats this with no users compromised SSL nego?a?on Single laptop can DoS a server Very expensive to stop with tradi?onal tools PrecisionAccess defeats this with very liole effort Bandwidth consump?on > 100 s Gbps Cannot be stopped by do it yourself tools SDP scale out at AWS mi?gates Tbps DIY: WAF & Load Balancer DoS Protec?on Service PA 18
19 Na<onal Cyber Security Framework Device Attacks Internet Attacks Server Attacks File & Memory Protection Software Defined Perimeter Behavior Profiling Server FW+VPN Data Theft RAM Scraping Credential Theft Connection Hijacking Denial of Service Insider Threats Server Exploits 19 SDP Workshop Tuesday Sept
20 Global Beverage Company Business Objec<ve: Minimize opera?onal costs and maximize flexibility Vidder SDP Solu<on: ü Secures partner employee access to the required apps ü Protects against DDOS and server vulnerability aoacks ü Brings visibility into which individuals are accessing which applica?ons, from where, and when ü Mi?gates creden?al the# and eases password management with transparent MFA ü Delivers a single solu?on for both web- based and fat applica?ons SDP Controller AWS SDP Gateway ERP Apps (SAP) Browser Supply Chain Partners Data Center SDP Workshop Tuesday Sept
21 Chip Design Company Business Objec<ve: Accelerate chip design process by leveraging public clouds Vidder SDP Solu<on: ü Secures design engineers access to cloud- based environment at customer sites ü Single tenant SDP federates to each IAM ü Customer VPC enclaves not reachable from Internet ü Flexible SDP deployment enables dynamic customer use SDP Controller AWS VPC Enclave C VPC Enclave B Browser App App SDP Gateway Company B Company A VPC Enclave A Company C 21 SDP Workshop Tuesday Sept
22 Global Automo<ve Company Business Objec<ve: Enable in field vehicle upgrades to retain customers and "sell" new features Vidder SDP Solu<on: ü Vehicle status delivered in a single SPA packet ü Provides a common access plaorm for apps regardless of where they are deployed: in internal data center or (mul?ple) cloud sites ü Op?mizes packet path to op?mize user experience SDPController AWS SDPGateway SDP Gateway SDP Workshop Tuesday Sept
23 Closing comments SDP is really simple SDP supports a wide range of applica?ons SDP is a collabora?ve effort so join the team! 23 Internet 2 Technology Exchange 2015
24 Contact Informa<on Junaid Islam CTO Vidder 24
CSA SDP Working Group
CSA SDP Working Group An Open Source Code Project for a Software Defined Perimeter to Defend Cloud Applications from DDoS CSA Conference - Berlin November 2015 DHS Problem Addressing the Changing Perimeter
Is Your SSL Website and Mobile App Really Secure?
Is Your SSL Website and Mobile App Really Secure? Agenda What is SSL / TLS SSL Vulnerabilities PC/Server Mobile Advice to the Public Hong Kong Computer Emergency Response Team Coordination Centre 香 港 電
SSL BEST PRACTICES OVERVIEW
SSL BEST PRACTICES OVERVIEW THESE PROBLEMS ARE PERVASIVE 77.9% 5.2% 19.2% 42.3% 77.9% of sites are HTTP 5.2% have an incomplete chain 19.2% support weak/insecure cipher suites 42.3% support SSL 3.0 83.1%
Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)
Security Protocols Security Protocols Necessary to communicate securely across untrusted network Provide integrity, confidentiality, authenticity of communications Based on previously discussed cryptographic
Security Protocols/Standards
Security Protocols/Standards Security Protocols/Standards Security Protocols/Standards How do we actually communicate securely across a hostile network? Provide integrity, confidentiality, authenticity
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) In this video you will learn the quite a bit about Public Key Infrastructure and how it is used to authenticate clients and servers. The purpose of Public Key Infrastructure
The Seven Habits of State-of-the-Art Mobile App Security
#mstrworld The Seven Habits of State-of-the-Art Mobile App Security Mobile Security 8 July 2014 Anand Dwivedi, Product Manager, MicroStrategy strworld Agenda - Seven Habits of State of the Art Mobile App
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
Secure Socket Layer (SSL) and Transport Layer Security (TLS)
Secure Socket Layer (SSL) and Transport Layer Security (TLS) Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available
Secure Sockets Layer (SSL ) / Transport Layer Security (TLS) Network Security Products S31213
Secure Sockets Layer (SSL ) / Transport Layer Security (TLS) Network Security Products S31213 UNCLASSIFIED Example http ://www. greatstuf f. com Wants credit card number ^ Look at lock on browser Use https
Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1
Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutions
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies Dave Corbett Technical Product Manager Implementing Forward Secrecy 1 Agenda Part 1: Introduction Why is Forward Secrecy important?
Software Defined Perimeter: Securing the Cloud to the Internet of Things
Software Defined Perimeter: Securing the Cloud to the Internet of Things SESSION ID: CDS-T08 Jim Reavis Chief Executive Officer Cloud Security Alliance @cloudsa About Cloud Security Alliance Global, not-for-profit
SSL/TLS: The Ugly Truth
SSL/TLS: The Ugly Truth Examining the flaws in SSL/TLS protocols, and the use of certificate authorities. Adrian Hayter CNS Hut 3 Team [email protected] Contents Introduction to SSL/TLS Cryptography
Analyzing the Security Schemes of Various Cloud Storage Services
Analyzing the Security Schemes of Various Cloud Storage Services ECE 646 Project Presentation Fall 2014 12/09/2014 Team Members Ankita Pandey Gagandeep Singh Bamrah Pros and Cons of Cloud Storage Services
Network Security Essentials Chapter 5
Network Security Essentials Chapter 5 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 5 Transport-Level Security Use your mentality Wake up to reality From the song, "I've Got
Web Security. Mahalingam Ramkumar
Web Security Mahalingam Ramkumar Issues Phishing Spreading misinformation Cookies! Authentication Domain name DNS Security Transport layer security Dynamic HTML Java applets, ActiveX, JavaScript Exploiting
A tutorial on how you can host mul$ple SSL Cer$ficates on a single IP address without losing any backward compa6bility
A tutorial on how you can host mul$ple SSL Cer$ficates on a single IP address without losing any backward compa6bility Paul van Brouwershaven Business Development Director EMEA, GlobalSign @vanbroup on
Authentication applications Kerberos X.509 Authentication services E mail security IP security Web security
UNIT 4 SECURITY PRACTICE Authentication applications Kerberos X.509 Authentication services E mail security IP security Web security Slides Courtesy of William Stallings, Cryptography & Network Security,
WEB SITE SECURITY. Jeff Aliber Verizon Digital Media Services
WEB SITE SECURITY Jeff Aliber Verizon Digital Media Services 1 SECURITY & THE CLOUD The Cloud (Web) o The Cloud is becoming the de-facto way for enterprises to leverage common infrastructure while innovating
SSL Report: ebfl.srpskabanka.rs (91.240.6.48)
Home Projects Qualys.com Contact You are here: Home > Projects > SSL Server Test > SSL Report: (91.240.6.48) Assessed on: Sun, 03 Jan 2016 15:46:07 UTC HIDDEN Clear cache Scan Another» Summary Overall
Bit Chat: A Peer-to-Peer Instant Messenger
Bit Chat: A Peer-to-Peer Instant Messenger Shreyas Zare [email protected] https://technitium.com December 20, 2015 Abstract. Bit Chat is a peer-to-peer instant messaging concept, allowing one-to-one
Vidder PrecisionAccess
Vidder PrecisionAccess Security Architecture February 2016 910 E HAMILTON AVENUE. SUITE 410 CAMPBELL, CA 95008 P: 408.418.0440 F: 408.706.5590 WWW.VIDDER.COM Table of Contents I. Overview... 3 II. Components...
Transport Level Security
Transport Level Security Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
SAP Single Sign-On 2.0 Overview Presentation
SAP Single Sign-On 2.0 Overview Presentation March 2016 Public Agenda SAP security portfolio Overview SAP Single Sign-On Single sign-on main scenarios Capabilities Summary 2016 SAP SE or an SAP affiliate
Managing IPv4 scarcity when using SSL Cer7ficates Mul7ple SSL Cer7ficates on a single IP address
GlobalSign. A GMO Internet Inc group company. Managing IPv4 scarcity when using SSL Cer7ficates Mul7ple SSL Cer7ficates on a single IP address Paul van Brouwershaven Business Development Director EMEA,
HTTPS: Transport-Layer Security (TLS), aka Secure Sockets Layer (SSL)
CSCD27 Computer and Network Security HTTPS: Transport-Layer Security (TLS), aka Secure Sockets Layer (SSL) 11 SSL CSCD27 Computer and Network Security 1 CSCD27F Computer and Network Security 1 TLS (Transport-Layer
Real-Time Communication Security: SSL/TLS. Guevara Noubir [email protected] CSU610
Real-Time Communication Security: SSL/TLS Guevara Noubir [email protected] CSU610 1 Some Issues with Real-time Communication Session key establishment Perfect Forward Secrecy Diffie-Hellman based PFS
SSL GOOD PRACTICE GUIDE
SSL GOOD PRACTICE GUIDE VERSION: 1.4 DATE: 23/09/2015 TASK NUMBER: SSL_Whitepaper PREPARED FOR Paul Docherty Director Portcullis Computer Security Ltd The Grange Barn Pike s End Pinner Middlesex HA5 2EX
Information Security
SE 4472 / ECE 9064 Information Security Week 11: Transport Layer Security (TLS): Putting it all together Fall 2015 Prof. Aleksander Essex Security at the Transport Layer Where we started in this course:
How To Understand And Understand The Ssl Protocol (Www.Slapl) And Its Security Features (Protocol)
WEB Security: Secure Socket Layer Cunsheng Ding HKUST, Hong Kong, CHINA C. Ding - COMP581 - L22 1 Outline of this Lecture Brief Information on SSL and TLS Secure Socket Layer (SSL) Transport Layer Security
TLS/SSL in distributed systems. Eugen Babinciuc
TLS/SSL in distributed systems Eugen Babinciuc Contents 1. Introduction to TLS/SSL 2. A quick review of cryptography 3. TLS/SSL in distributed systems 4. Conclusions Introduction to TLS/SSL TLS/SSL History
Secure Sockets Layer
SSL/TLS provides endpoint authentication and communications privacy over the Internet using cryptography. For web browsing, email, faxing, other data transmission. In typical use, only the server is authenticated
What is network security?
Network security Network Security Srinidhi Varadarajan Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice: application
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
Strong Authentication for Future Web Applications
Strong Authentication for Future Web Applications Chris Williams Leidos, Inc. July 18, 2014 For W3C Identity in the Browser Workshop Abstract Leidos (formerly SAIC), has been using strong authentication
Network Security. Gaurav Naik Gus Anderson. College of Engineering. Drexel University, Philadelphia, PA. Drexel University. College of Engineering
Network Security Gaurav Naik Gus Anderson, Philadelphia, PA Lectures on Network Security Feb 12 (Today!): Public Key Crypto, Hash Functions, Digital Signatures, and the Public Key Infrastructure Feb 14:
, ) I Transport Layer Security
Secure Sockets Layer (SSL, ) I Transport Layer Security _ + (TLS) Network Security Products S31213 UNCLASSIFIED Location of SSL -L Protocols TCP Ethernet IP SSL Header Encrypted SSL data= HTTP " Independent
SSL Server Rating Guide
SSL Server Rating Guide version 2009j (20 May 2015) Copyright 2009-2015 Qualys SSL Labs (www.ssllabs.com) Abstract The Secure Sockets Layer (SSL) protocol is a standard for encrypted network communication.
Communication Systems 16 th lecture. Chair of Communication Systems Department of Applied Sciences University of Freiburg 2009
16 th lecture Chair of Communication Systems Department of Applied Sciences University of Freiburg 2009 1 25 Organization Welcome to the New Year! Reminder: Structure of Communication Systems lectures
Web Security Considerations
CEN 448 Security and Internet Protocols Chapter 17 Web Security Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University [email protected]
SSL implementieren aber sicher!
SSL implementieren aber sicher! Karlsruher Entwicklertag 2014 21.05.2014 Dr. Yun Ding SSL in the news 2011 2012 2013 2014 BEAST CRIME Lucky 13 Compromised CAs RC4 biases BREACH DRBG Backdoor Apple goto
Security Technical. Overview. BlackBerry Enterprise Service 10. BlackBerry Device Service Solution Version: 10.2
BlackBerry Enterprise Service 10 BlackBerry Device Service Solution Version: 10.2 Security Technical Overview Published: 2014-09-10 SWD-20140908123239883 Contents 1 About BlackBerry Device Service solution
Implementation Vulnerabilities in SSL/TLS
Implementation Vulnerabilities in SSL/TLS Marián Novotný [email protected] ESET, spol. s r.o. Bratislava, Slovak Republic Abstract SSL/TLS protocol has become a standard way for establishing a secure communication
Chapter 7: Network security
Chapter 7: Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice: application layer: secure e-mail transport
TLS and SRTP for Skype Connect. Technical Datasheet
TLS and SRTP for Skype Connect Technical Datasheet Copyright Skype Limited 2011 Introducing TLS and SRTP Protocols help protect enterprise communications Skype Connect now provides Transport Layer Security
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
Network Security. Computer Security & Forensics. Security in Compu5ng, Chapter 7. l Network Defences. l Firewalls. l Demilitarised Zones
Network Security Security in Compu5ng, Chapter 7 Topics l Network AAacks l Reconnaissance l AAacks l Spoofing l Web Site Vulnerabili5es l Denial of Service l Network Defences l Firewalls l Demilitarised
Secure Socket Layer. Carlo U. Nicola, SGI FHNW With extracts from publications of : William Stallings.
Secure Socket Layer Carlo U. Nicola, SGI FHNW With extracts from publications of : William Stallings. Abstraction: Crypto building blocks NS HS13 2 Abstraction: The secure channel 1., run a key-exchange
Authenticity of Public Keys
SSL/TLS EJ Jung 10/18/10 Authenticity of Public Keys Bob s key? private key Bob public key Problem: How does know that the public key she received is really Bob s public key? Distribution of Public Keys!
Computer and Network Security. Outline
Computer and Network Security Lecture 10 Certificates and Revocation Outline Key Distribution Certification Authorities Certificate revocation 1 Key Distribution K A, K B E KA ( K AB, E KB (KAB) ) K A
True Key by Intel Security
True Key by Intel Security Security White Paper 1.0 True Key by Intel Security is the easier, safer way to unlock your digital world. This White paper provides a technical overview of the comprehensive
SSL Protect your users, start with yourself
SSL Protect your users, start with yourself Kulsysmn 14 december 2006 Philip Brusten Overview Introduction Cryptographic algorithms Secure Socket Layer Certificate signing service
Applying Cryptography as a Service to Mobile Applications
Applying Cryptography as a Service to Mobile Applications SESSION ID: CSV-F02 Peter Robinson Senior Engineering Manager RSA, The Security Division of EMC Introduction This presentation proposes a Cryptography
Dashlane Security Whitepaper
Dashlane Security Whitepaper November 2014 Protection of User Data in Dashlane Protection of User Data in Dashlane relies on 3 separate secrets: The User Master Password Never stored locally nor remotely.
VoIP Security How to prevent eavesdropping on VoIP conversa8ons. Dmitry Dessiatnikov
VoIP Security How to prevent eavesdropping on VoIP conversa8ons Dmitry Dessiatnikov DISCLAIMER All informa8on in this presenta8on is provided for informa8on purposes only and in no event shall Security
NetScaler. Web Service Availability and Security
NetScaler Web Service Availability and Security NetScaler Application Delivery Controller What is NetScaler? NetScaler is an enterprise grade application delivery controller, or ADC. So, what does that
Lightweight Security using Identity-Based Encryption Guido Appenzeller
Lightweight Security using Identity-Based Encryption Guido Appenzeller Chief Technology Officer Voltage Security Inc. Identity-Based Encryption (IBE) IBE is a new public key encryption algorithm A number
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
Communication Systems SSL
Communication Systems SSL Computer Science Organization I. Data and voice communication in IP networks II. Security issues in networking III. Digital telephony networks and voice over IP 2 Network Security
Einführung in SSL mit Wireshark
Einführung in SSL mit Wireshark Chemnitzer Linux-Tage 16. März 2014 Martin Kaiser What? SSL/TLS is the most widely used security protocol on the Internet there's lots of parameters, options, extensions
Security Guide. BES12 Cloud
Security Guide BES12 Cloud Published: 2015-08-20 SWD-20150812133927242 Contents Security features of BES12 Cloud...4 How BES12 Cloud protects data stored in BlackBerry data centers...4 How BES12 Cloud
Security vulnerabilities in the Internet and possible solutions
Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished in
EXAM questions for the course TTM4135 - Information Security May 2013. Part 1
EXAM questions for the course TTM4135 - Information Security May 2013 Part 1 This part consists of 5 questions all from one common topic. The number of maximal points for every correctly answered question
Secure Socket Layer/ Transport Layer Security (SSL/TLS)
Secure Socket Layer/ Transport Layer Security (SSL/TLS) David Sánchez Universitat Pompeu Fabra World Wide Web (www) Client/server services running over the Internet or TCP/IP Intranets nets widely used
An Overview of Communication Manager Transport and Storage Encryption Algorithms
An Overview of Communication Manager Transport and Storage Encryption Algorithms Abstract The following paper provides a description of the standard algorithms that are implemented within Avaya Communication
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk
Savitribai Phule Pune University
Savitribai Phule Pune University Centre for Information and Network Security Course: Introduction to Cyber Security / Information Security Module : Pre-requisites in Information and Network Security Chapter
OpenADR 2.0 Security. Jim Zuber, CTO QualityLogic, Inc.
OpenADR 2.0 Security Jim Zuber, CTO QualityLogic, Inc. Security Overview Client and server x.509v3 certificates TLS 1.2 with SHA256 ECC or RSA cipher suites TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_CBC_SHA256
Introduction. Purpose. Background. Details
Introduction Recent media reports confirm that Secure Socket Layer (SSL) 3.0 is obsolete and insecure. This report provides guidance on how to ensure your communications use the more secure Transport Layer
Network Security Part II: Standards
Network Security Part II: Standards Raj Jain Washington University Saint Louis, MO 63131 [email protected] These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 18-1 Overview
Part I. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai 2001. Siemens AG 2001, ICN M NT
Part I Contents Part I Introduction to Information Security Definition of Crypto Cryptographic Objectives Security Threats and Attacks The process Security Security Services Cryptography Cryptography (code
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Chapter 8 Security. IC322 Fall 2014. Computer Networking: A Top Down Approach. 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012
Chapter 8 Security IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright 1996-2012 J.F Kurose and K.W. Ross, All
SDP Hackathon #4 Analysis & Report
SDP Hackathon #4 Analysis & Report High Availability Public Cloud Research March 28, 2016 Research Participants The Software-Defined Perimeter (SDP) Research Workgroup of the Cloud Security Alliance (CSA)
DRAFT Standard Statement Encryption
DRAFT Standard Statement Encryption Title: Encryption Standard Document Number: SS-70-006 Effective Date: x/x/2010 Published by: Department of Information Systems 1. Purpose Sensitive information held
Outline. INF3510 Information Security. Lecture 10: Communications Security. Communication Security Analogy. Network Security Concepts
Outline INF3510 Information Security Lecture 10: Communications Security Network security concepts Communication security Perimeter security Protocol architecture and security services Example security
Privileged Administra0on Best Prac0ces :: September 1, 2015
Privileged Administra0on Best Prac0ces :: September 1, 2015 Discussion Contents Privileged Access and Administra1on Best Prac1ces 1) Overview of Capabili0es Defini0on of Need 2) Preparing your PxM Program
Lecture 10: Communications Security
INF3510 Information Security Lecture 10: Communications Security Audun Jøsang University of Oslo Spring 2015 Outline Network security concepts Communication security Perimeter security Protocol architecture
Chapter 10. Cloud Security Mechanisms
Chapter 10. Cloud Security Mechanisms 10.1 Encryption 10.2 Hashing 10.3 Digital Signature 10.4 Public Key Infrastructure (PKI) 10.5 Identity and Access Management (IAM) 10.6 Single Sign-On (SSO) 10.7 Cloud-Based
Secure Identity in Cloud Computing
Secure Identity in Cloud Computing Michelle Carter The Aerospace Corporation March 20, 2013 The Aerospace Corporation 2013 All trademarks, service marks, and trade names are the property of their respective
Cryptography and Network Security Sicurezza delle reti e dei sistemi informatici SSL/TSL
Cryptography and Network Security Sicurezza delle reti e dei sistemi informatici SSL/TSL Security architecture and protocol stack Applicat. (SHTTP) SSL/TLS TCP IPSEC IP Secure applications: PGP, SHTTP,
Whitepaper on AuthShield Two Factor Authentication with ERP Applications
Whitepaper on AuthShield Two Factor Authentication with ERP Applications By INNEFU Labs Pvt. Ltd Table of Contents 1. Overview... 3 2. Threats to account passwords... 4 2.1 Social Engineering or Password
Protocol Rollback and Network Security
CSE 484 / CSE M 584 (Spring 2012) Protocol Rollback and Network Security Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee,
ViSolve Open Source Solutions
ViSolve Open Source Solutions Best-In-Class Authentication and Authorization Solutions & Services ViSolve Inc. ViSolve Securing Digital Assets Contents Security Overview Security Concerns Security Needs
Apache Milagro (incubating) An Introduction ApacheCon North America
Apache Milagro (incubating) An Introduction ApacheCon North America Apache Milagro will establish a new independent security framework for the Internet A Distributed Cryptosystem Secure the Future of the
Practical Invalid Curve Attacks on TLS-ECDH
Practical Invalid Curve Attacks on TLS-ECDH Tibor Jager, Jörg Schwenk, Juraj Somorovsky Horst Görtz Institute for IT Security Ruhr University Bochum @jurajsomorovsky 1 1 About Me and Our Institute Security
Securing Internet Facing. Applications. Technical White Paper. configuration drift, in which IT members open up ports or make small, supposedly
Securing Internet Facing Applications Ten years ago protecting the corporate network meant deploying traditional firewalls and intrusion detection solutions at the perimeter of the trusted network in order
Proposed Documents for JOSE: JSON Web Signature (JWS) JSON Web Encryp6on (JWE) JSON Web Key (JWK)
Proposed Documents for JOSE: JSON Web Signature (JWS) JSON Web Encryp6on (JWE) JSON Web Key (JWK) Mike Jones Standards Architect Microso@ IETF 82 November 14, 2011 Mo6va6on Clear need for industry- standard
WHITEPAPER. SECUREAUTH 2-FACTOR AS A SERVICE 2FaaS
WHITEPAPER SECUREAUTH 2-FACTOR AS A SERVICE 2FaaS EXECUTIVE OVERVIEW 2-Factor as a Service (2FaaS) is a 100% cloud-hosted authentication solution that offers flexible security without compromising user
Network Security. Abusayeed Saifullah. CS 5600 Computer Networks. These slides are adapted from Kurose and Ross 8-1
Network Security Abusayeed Saifullah CS 5600 Computer Networks These slides are adapted from Kurose and Ross 8-1 Public Key Cryptography symmetric key crypto v requires sender, receiver know shared secret
CRYPTOGRAPHY AS A SERVICE
CRYPTOGRAPHY AS A SERVICE Peter Robinson RSA, The Security Division of EMC Session ID: ADS R01 Session Classification: Advanced Introduction Deploying cryptographic keys to end points such as smart phones,