Latest advance in Suricata I D P S
|
|
|
- Chloe Chandler
- 10 years ago
- Views:
Transcription
1 Latest advance in Suricata I D P S Éric Leblond OISF July 9th 2012 Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
2 1 Introduction Introduction Goals of the project Ecosystem 2 Functionnalities List of functionnalities Signatures 3 Advanced functionalities of Suricata libhtp Flow variables 4 Suricata 1.3 Extraction et inspection of files TLS Handshake parser 5 The future The roadmap More information Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
3 Suricata? (C) Jean-Marie Hullot, CC BY 3.0 Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
4 Suricata? (C) Jean-Marie Hullot, CC BY 3.0 Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
5 Introduction Éric Leblond Initial and lead developer of NuFW Netfilter Contributor (mainly ulogd2 and userpace interaction) Suricata core developer (IPS, multicore optimisation,... ) Independant Open Source et security consultant... Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
6 About OISF Open Information Security Foundation Non-profit foundation organized to build a next generation IDS/IPS engine Funded by US Governement (DHS, Navy) Development of an Open Source IDS/IPS: Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
7 About OISF Open Information Security Foundation Non-profit foundation organized to build a next generation IDS/IPS engine Funded by US Governement (DHS, Navy) Development of an Open Source IDS/IPS: Developers financement Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
8 About OISF Open Information Security Foundation Non-profit foundation organized to build a next generation IDS/IPS engine Funded by US Governement (DHS, Navy) Development of an Open Source IDS/IPS: Developers financement Financial support of related projects (barnyard2) Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
9 About OISF Open Information Security Foundation Non-profit foundation organized to build a next generation IDS/IPS engine Funded by US Governement (DHS, Navy) Development of an Open Source IDS/IPS: Developers financement Financial support of related projects (barnyard2) Board who defines big orientation Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
10 About OISF Open Information Security Foundation Non-profit foundation organized to build a next generation IDS/IPS engine Funded by US Governement (DHS, Navy) Development of an Open Source IDS/IPS: Developers financement Financial support of related projects (barnyard2) Board who defines big orientation Roadmap is defined in public reunion Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
11 About OISF Consortium members HOST program: Homeland Open Security Technology Platinium level: BAE systems Gold level: Npulse, Endace, Emerging Threats Bronze level: SRC, Everis, Bivio networks, Nitro Security, Mara systems,... Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
12 About OISF Consortium members HOST program: Homeland Open Security Technology Platinium level: BAE systems Gold level: Npulse, Endace, Emerging Threats Bronze level: SRC, Everis, Bivio networks, Nitro Security, Mara systems,... Technology partner: Napatech, Nvidia Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
13 About OISF Consortium members HOST program: Homeland Open Security Technology Platinium level: BAE systems Gold level: Npulse, Endace, Emerging Threats Bronze level: SRC, Everis, Bivio networks, Nitro Security, Mara systems,... Technology partner: Napatech, Nvidia Developers Leader : Victor Julien Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
14 About OISF Consortium members HOST program: Homeland Open Security Technology Platinium level: BAE systems Gold level: Npulse, Endace, Emerging Threats Bronze level: SRC, Everis, Bivio networks, Nitro Security, Mara systems,... Technology partner: Napatech, Nvidia Developers Leader : Victor Julien Developers: Anoop Saldanha, Gurvinder Singh, Pablo Rincon, William Metcalf, Eric Leblond,... Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
15 About OISF Consortium members HOST program: Homeland Open Security Technology Platinium level: BAE systems Gold level: Npulse, Endace, Emerging Threats Bronze level: SRC, Everis, Bivio networks, Nitro Security, Mara systems,... Technology partner: Napatech, Nvidia Developers Leader : Victor Julien Developers: Anoop Saldanha, Gurvinder Singh, Pablo Rincon, William Metcalf, Eric Leblond,... Board Matt Jonkmann Richard Bejtlich, Dr. Jose Nazario, Joel Ebrahimi, Marc Norton, Stuart Wilson... Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
16 Goals Bring new technologies to IDS Performance Multi-threads Hardware acceleration suricata-10gbps Open source Support of Linux / *BSD / Mac OSX / Windows Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
17 Similar projects Bro Different technology (capture oriented) Statistical study Snort Equivalent Compatible Frontal concurrence Sourcefire has felt endangered and has been aggressive enterprise_apps/ Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
18 Suricata vs Snort Suricata Drived by a foundation Multi-threaded Native IPS Advanced functions (flowint, libhtp) PF_RING support, CUDA support Modern and modular code Young but dynamic Snort Developed by Sourcefire Multi-process IPS support SO ruleset (advanced logic + perf but closed) No hardware acceleration Old code 10 years of experience Independant study: Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
19 Suricata with snort ruleset Not optimised Don t use any advanced feature Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
20 Suricata with dedicated ruleset Use Suricata optimised matchs Use Suricata advanced keywords Can get one from Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
21 1 Introduction Introduction Goals of the project Ecosystem 2 Functionnalities List of functionnalities Signatures 3 Advanced functionalities of Suricata libhtp Flow variables 4 Suricata 1.3 Extraction et inspection of files TLS Handshake parser 5 The future The roadmap More information Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
22 Fonctionnalities Ipv6 native support Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
23 Fonctionnalities Ipv6 native support Multi-threaded Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
24 Fonctionnalities Ipv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
25 Fonctionnalities Ipv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
26 Fonctionnalities Ipv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Optimized support of IP only tests Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
27 Fonctionnalities Ipv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Optimized support of IP only tests IPS is native (inline mode) Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
28 Fonctionnalities Ipv6 native support Multi-threaded Native hardware acceleration (PF_RING, Napatech, Endace, Myricom) Numerous options for performance optimisation Optimized support of IP only tests IPS is native (inline mode) Protocol detection Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
29 Global architecture Chained treatment modules Each running mode can have its own architecture Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
30 Global architecture Chained treatment modules Each running mode can have its own architecture Architecture of mode "pcap auto v1": Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
31 Global architecture Chained treatment modules Each running mode can have its own architecture Architecture of mode "pcap auto v1": Fine setting of CPU preferences Attach a thread to a CPU Attach a threads family to a CPU set Allow IRQs based optimisation Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
32 Entry modules IDS PCAP live, multi interface offline support AF_PACKET PF_RING: mutltithread Capture card support: Napatech, Myricom, Endace Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
33 Entry modules IDS IPS PCAP live, multi interface offline support AF_PACKET PF_RING: mutltithread Capture card support: Napatech, Myricom, Endace NFQueue: Linux: multi-queue, advanced support Windows ipfw : FreeBSD NetBSD Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
34 Output modules Fastlog Unified log (Barnyard 1 & 2) HTTP log (log in apache-style format) Prelude (IDMEF) Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
35 Suricata Ecosystem Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
36 Signatures Support almost all snort ruleset features Exclusive features used by VRT ou Emerging Threats rulesets alert tcp any any -> /24 21 (content: "USER root"; msg: "FTP root login";) Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
37 Signatures Support almost all snort ruleset features Exclusive features used by VRT ou Emerging Threats rulesets alert tcp any any -> /24 21 (content: "USER root"; msg: "FTP root login";) Action: alert / drop / pass Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
38 Signatures Support almost all snort ruleset features Exclusive features used by VRT ou Emerging Threats rulesets alert tcp any any -> /24 21 (content: "USER root"; msg: "FTP root login";) IP parameters Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
39 Signatures Support almost all snort ruleset features Exclusive features used by VRT ou Emerging Threats rulesets alert tcp any any -> /24 21 (content: "USER root"; msg: "FTP root login";) Motif Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
40 Signatures Support almost all snort ruleset features Exclusive features used by VRT ou Emerging Threats rulesets alert tcp any any -> /24 21 (content: "USER root"; msg: "FTP root login";) Other parameters Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
41 1 Introduction Introduction Goals of the project Ecosystem 2 Functionnalities List of functionnalities Signatures 3 Advanced functionalities of Suricata libhtp Flow variables 4 Suricata 1.3 Extraction et inspection of files TLS Handshake parser 5 The future The roadmap More information Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
42 libhtp Security oriented HTTP parser Written by Ivan Ristić (ModSecurity, IronBee) Flow tracking Support of keywords http_body http_raw_uri http_header http_cookie... Able to decode gzip compressed flows Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
43 Using HTTP features in signature Signature example: Chat facebook alert http $HOME_NET any > $EXTERNAL_NET $HTTP_PORTS \ ( msg: "ET CHAT Facebook Chat ( send message ) " ; \ flow : established, to_server ; content : "POST" ; http_method ; \ content : " / ajax / chat / send. php " ; h t t p _ u r i ; content : " facebook. com" ; http_header ; \ classtype : p o l i c y v i o l a t i o n ; reference : u r l, doc. emergingthreats. net / ; \ reference : url,www. emergingthreats. net / cgi bin / cvsweb. cgi / sigs / POLICY / POLICY_Facebook_Chat ; \ sid : ; rev : 4 ; \ ) This signature tests: The HTTP method: POST The page: /ajax/chat/send.php The domain: facebook.com Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
44 Flow variables Objectives Detection of in-multiple-step attack Verify condition on a flow Modify alert treatment State machine inside each flow Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
45 Flow variables Objectives Detection of in-multiple-step attack Verify condition on a flow Modify alert treatment State machine inside each flow Flowbits boolean condition Set a flag Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
46 Flow variables Objectives Detection of in-multiple-step attack Verify condition on a flow Modify alert treatment State machine inside each flow Flowbits boolean condition Set a flag Flowint Define counter Arithmetic operation Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
47 1 Introduction Introduction Goals of the project Ecosystem 2 Functionnalities List of functionnalities Signatures 3 Advanced functionalities of Suricata libhtp Flow variables 4 Suricata 1.3 Extraction et inspection of files TLS Handshake parser 5 The future The roadmap More information Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
48 Suricata 1.3 New hardware support: Myricom, Endace, Napatech TLS/SSL handshake parser Better performances On the fly MD5 calculation and matching for files in HTTP streams Scripts for looking up files/file md5s at Virus Total and others (contributed by Martin Holste) http_user_agent keyword for matching on the HTTP User-Agent header Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
49 More scability Flow engine: removal of a contention point and better hash function. Thresholding and Tag engines: fine locking instead of global one. Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
50 In the engine Less memory New ac-bs algorithm From 35G with ac-full to less than 4G for ac-bs Handling 1Gb/s with 7000 rules Rule engine improvement Reload ruleset without breaking the flow analysis Rule analyser Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
51 Extraction et inspection of files Get files from HTTP downloads and uploads Detect information about the file using libmagic Type of file Other details... A dedicated extension of signature language Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
52 Dedicated keywords filemagic : description of content alert http any any > any any (msg: " windows exec " ; \ f i l e m a g i c : " executable f o r MS Windows " ; sid : 1 ; rev : 1 ; ) filestore : store file for inspection alert http any any > any any (msg: " windows exec " ; filemagic : " executable f o r MS Windows " ; \ f i l e s t o r e ; sid : 1 ; rev : 1 ; ) fileext : file extension alert http any any > any any (msg: " jpg claimed, but not jpg f i l e " ; \ f i l e e x t : " jpg " ; \ f i l e m a g i c :! "JPEG image data " ; sid : 1 ; rev : 1 ; ) filename : file name alert http any any > any any (msg: " sensitive f i l e leak " ; filename : " secret " ; sid : 1 ; rev : 1 ; ) Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
53 Examples Files sending on a server only accepting PDF a l e r t http $EXTERNAL_NET > $WEBSERVER any (msg: " suspicious upload " ; \ flow : established, to_server ; content : "POST" http_method ; \ content : " / upload. php " ; h t t p _ u r i ; \ filemagic :! "PDF document " ; \ f i l e s t o r e ; sid : 1 ; rev : 1 ; ) Private keys in the wild alert http $HOME_NET any > $EXTERNAL_NET any (msg: " outgoing private key " ; \ f i l e m a g i c : "RSA p r i v a t e key " ; sid : 1 ; rev : 1 ; ) Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
54 Disk storage Every file is stored on disk with a metadata file Disk usage limit can be set Scripts for looking up files / file md5 s at Virus Total and others Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
55 Actual limit of files extraction Limited to the HTTP protocol Storage limit are suboptimal MS Office files are not decoded Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
56 TLS Handshake parser TLS is an application in Suricata way Automatic detection of protocol Independent of port Made by pattern matching Dedicated keywords Usable in the signatures Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
57 Other supported applications HTTP : keywords: http_uri, http_body, http_user_agent,... SMTP FTP keyword: ftpbounce SSH keywords: ssh.softwareversion, ssh.protoversion DCERPC SMB Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
58 A TLS handshake parser No traffic decryption Method Analyse of TLS handshake Parsing of TLS messages A security-oriented parser Coded from scratch Provide a hackable code-base for the feature No external dependency Contributed by Pierre Chifflier (ANSSI) With security in mind: Resistance to attacks (audit, fuzzing) Anomaly detection Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
59 A handshake parser The syntax alert tcp $HOME_NET any > $EXTERNAL_NET 443 becomes alert t l s $HOME_NET any > $EXTERNAL_NET any Interest: No dependency to IP params Pattern matching is limited to identified protocol Less false positive More performance Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
60 TLS keywords TLS.version: Match protocol version number TLS.subject: Match certificate subject TLS.issuerdn: Match the name of the CA which has signed the key More to come Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
61 TLS keywords TLS.version: Match protocol version number TLS.subject: Match certificate subject TLS.issuerdn: Match the name of the CA which has signed the key More to come TLS.fingerprint: Match the fingerprint of the certificate Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
62 Example: verify security policy (1/2) Environnement: A company with servers With an official PKI Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
63 Example: verify security policy (1/2) Environnement: A company with servers With an official PKI The goal: Verify that the PKI is used Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
64 Example: verify security policy (1/2) Environnement: A company with servers With an official PKI The goal: Verify that the PKI is used Without working too much Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
65 Example: verify security policy (2/2) Let s check that the certificates used when a client negotiate a connection to one of our servers are the good one Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
66 Example: verify security policy (2/2) Let s check that the certificates used when a client negotiate a connection to one of our servers are the good one The signature: alert t l s any any > $SERVERS any ( t l s. issuerdn :! "C=NL, O=Staat der Nederlanden, \ CN=Staat der Nederlanden Root CA" ; ) Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
67 Example: detect certificate anomaly Google.com is signed by Google Internet Authority Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
68 Example: detect certificate anomaly Google.com is signed by Google Internet Authority Not by an other CA Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
69 Example: detect certificate anomaly Google.com is signed by Google Internet Authority Not by an other CA (Diginotar by example) Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
70 Example: detect certificate anomaly Google.com is signed by Google Internet Authority Not by an other CA (Diginotar by example) If it is the case, this is bad! Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
71 Example: detect certificate anomaly Google.com is signed by Google Internet Authority Not by an other CA (Diginotar by example) If it is the case, this is bad! Let s block that! Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
72 Example: detect certificate anomaly Google.com is signed by Google Internet Authority Not by an other CA (Diginotar by example) If it is the case, this is bad! Let s block that! Signature: drop t l s $CLIENT any > any any ( \ t l s. subject="c=us, ST=California, L=Mountain View, O=Google Inc, CN=. google.com" ; \ t l s. issuerdn =! "C=US, O=Google Inc, CN=Google Internet Authority " ; ) Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
73 Example: detect certificate anomaly Google.com is signed by Google Internet Authority Not by an other CA (Diginotar by example) If it is the case, this is bad! Let s block that! Signature: drop t l s $CLIENT any > any any ( \ t l s. subject="c=us, ST=California, L=Mountain View, O=Google Inc, CN=. google.com" ; \ t l s. issuerdn =! "C=US, O=Google Inc, CN=Google Internet Authority " ; ) What! KPN has been hacked too! Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
74 Example: detect certificate anomaly Google.com is signed by Google Internet Authority Not by an other CA (Diginotar by example) If it is the case, this is bad! Let s block that! Signature: drop t l s $CLIENT any > any any ( \ t l s. subject="c=us, ST=California, L=Mountain View, O=Google Inc, CN=. google.com" ; \ t l s. issuerdn =! "C=US, O=Google Inc, CN=Google Internet Authority " ; ) What! KPN has been hacked too! Let s get rid of the Dutch! drop t l s $CLIENT any > any any ( t l s. issuerdn="c=nl" ) ; Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
75 Actual limit Keywords apply only to first certificate of the chain. Impossible to do check on chained certificates Supported by the parser but not by the keywords. Some keyword are missing and will be added used cryptographic algorithm Key size Diffie-Hellman parameters Statistical study and certificate storage Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
76 1 Introduction Introduction Goals of the project Ecosystem 2 Functionnalities List of functionnalities Signatures 3 Advanced functionalities of Suricata libhtp Flow variables 4 Suricata 1.3 Extraction et inspection of files TLS Handshake parser 5 The future The roadmap More information Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
77 Roadmap IP and DNS reputation SCADA Preprocessor (thanks to Digital Bond) Keyword geoip Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
78 How to test it fast and easy? Already available in Debian, Ubuntu, Gentoo, Freebsd Live distribution: SIEM live (Suricata + Prelude + Openvas) : https: // Smooth-Sec (Suricata + Snorby) : Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
79 Questions Do you have questions? Big thanks: Pierre Chifflier : The whole OISF team and especially Victor Julien Related read: OISF website: Planet suricata: Suricata devel site: Join me: Mail: [email protected] Twitter: Regiteric Blog: Éric Leblond (OISF) Latest advance in Suricata IP D S July 9th / 44
Suricata 2.0, Netfilter and the PRC
Suricata 2.0, Netfilter and the PRC Éric Leblond Stamus Networks April 26, 2014 Éric Leblond (Stamus Networks) Suricata 2.0, Netfilter and the PRC April 26, 2014 1 / 52 Eric Leblond a.k.a Regit French
D&D of malware with exotic C&C
D&D of malware with exotic C&C D&D = Description & Detection C&C = Command & Control Automotive Consumer Energy & Chemicals Paul Rascagneres - @r00tbsd Eric Leblond - @Regiteric Life Sciences & Healthcare
Network Security Monitoring
Network Security Monitoring Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
COUNTERSNIPE WWW.COUNTERSNIPE.COM
COUNTERSNIPE WWW.COUNTERSNIPE.COM COUNTERSNIPE SYSTEMS LLC RELEASE 7.0 CounterSnipe s version 7.0 is their next major release and includes a completely new IDS/IPS leveraging high performance scalability
Intrusion Detection Architecture Utilizing Graphics Processors
Acta Informatica Pragensia 1(1), 2012, 50 59, DOI: 10.18267/j.aip.5 Section: Online: aip.vse.cz Peer-reviewed papers Intrusion Detection Architecture Utilizing Graphics Processors Liberios Vokorokos 1,
EZ Snort Rules Find the Truffles, Leave the Dirt. David J. Bianco Vorant Network Security, Inc. [email protected]. 2006, Vorant Network Security, Inc.
EZ Snort Rules Find the Truffles, Leave the Dirt David J. Bianco Vorant Network Security, Inc. [email protected] 2006, Vorant Network Security, Inc. Table of Contents Intro to Snort Configuration Anatomy
The Power of SNORT SNORT Update
The Power of SNORT SNORT Update Jean-Paul Kerouanton 11 th May 2010 2 Leveraging the Snort Brand The Power SNORT = The Power of Open Source The SNORT- Universe AMAZON - +100 items GOOGLE +3.700.000 hits
Analysis of Network Packets. C DAC Bangalore Electronics City
Analysis of Network Packets C DAC Bangalore Electronics City Agenda TCP/IP Protocol Security concerns related to Protocols Packet Analysis Signature based Analysis Anomaly based Analysis Traffic Analysis
Vuurmuur - iptables manager
Vuurmuur - iptables manager Victor Julien July 7, 2014 Victor Julien Vuurmuur - iptables manager July 7, 2014 1 / 23 About me Vuurmuur founder and lead developer of Vuurmuur Open Source Suricata IDS/IPS
Intrusion Detection & SNORT. Fakrul Alam [email protected]
Intrusion Detection & SNORT Fakrul Alam [email protected] Sometimes, Defenses Fail Our defenses aren t perfect Patches weren t applied promptly enough Antivirus signatures not up to date 0- days get through
IDS Categories. Sensor Types Host-based (HIDS) sensors collect data from hosts for
Intrusion Detection Intrusion Detection Security Intrusion: a security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts
Snort Installation - Ubuntu FEUP. SSI - ProDEI-2010. Paulo Neto and Rui Chilro. December 7, 2010
December 7, 2010 Work Proposal The purpose of this work is: Explain a basic IDS Architecture and Topology Explain a more advanced IDS solution Install SNORT on the FEUP Ubuntu distribution and test some
Configuring Snort as a Firewall on Windows 7 Environment
Configuring Snort as a Firewall on Windo Environment Moath Hashim Alsafasfeh a, Abdel Ilah Noor Alshbatat b a National university of Malaysia UKM, Selengor, Malaysia. b Tafila Technical University, Electrical
Passive Logging. Intrusion Detection System (IDS): Software that automates this process
Passive Logging Intrusion Detection: Monitor events, analyze for signs of incidents Look for violations or imminent violations of security policies accepted use policies standard security practices Intrusion
Suricata IDS. What is it and how to enable it
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
12/8/2015. Review. Final Exam. Network Basics. Network Basics. Network Basics. Network Basics. 12/10/2015 Thursday 5:30~6:30pm Science S-3-028
Review Final Exam 12/10/2015 Thursday 5:30~6:30pm Science S-3-028 IT443 Network Security Administration Instructor: Bo Sheng True/false Multiple choices Descriptive questions 1 2 Network Layers Application
Configuring Snort as a Firewall on Windows 7 Environment
Journal of Ubiquitous Systems & Pervasive Networks Volume 3, No. 2 (2011) pp. 3- Configuring Snort as a Firewall on Windo Environment Moath Hashim Alsafasfeh a, Abdel Ilah Noor Alshbatat b a National University
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
Network Security Management
Network Security Management TWNIC 2003 Objective Have an overview concept on network security management. Learn how to use NIDS and firewall technologies to secure our networks. 1 Outline Network Security
Network Traffic Analysis
2013 Network Traffic Analysis Gerben Kleijn and Terence Nicholls 6/21/2013 Contents Introduction... 3 Lab 1 - Installing the Operating System (OS)... 3 Lab 2 Working with TCPDump... 4 Lab 3 - Installing
From Network Security To Content Filtering
Computer Fraud & Security, May 2007 page 1/10 From Network Security To Content Filtering Network security has evolved dramatically in the last few years not only for what concerns the tools at our disposals
W3Perl A free logfile analyzer
W3Perl A free logfile analyzer Features Works on Unix / Windows / Mac View last entries based on Perl scripts Web / FTP / Squid / Email servers Session tracking Others log format can be added easily Detailed
BEGINNER S GUIDE to. Open Source Intrusion Detection Tools. www.alienvault.com
BEGINNER S GUIDE to Open Source Intrusion Detection Tools www.alienvault.com IDS Basics If you aren t already running network IDS, you should be. There are two types of Network IDS: Signature Detection
CHAPETR 3. DISTRIBUTED DEPLOYMENT OF DDoS DEFENSE SYSTEM
59 CHAPETR 3 DISTRIBUTED DEPLOYMENT OF DDoS DEFENSE SYSTEM 3.1. INTRODUCTION The last decade has seen many prominent DDoS attack on high profile webservers. In order to provide an effective defense against
CSE331: Introduction to Networks and Security. Lecture 12 Fall 2006
CSE331: Introduction to Networks and Security Lecture 12 Fall 2006 Announcements Midterm I will be held Friday, Oct. 6th. True/False Multiple Choice Calculation Short answer Short essay Project 2 is on
Dynamic Rule Based Traffic Analysis in NIDS
International Journal of Information & Computation Technology. ISSN 0974-2239 Volume 4, Number 14 (2014), pp. 1429-1436 International Research Publications House http://www. irphouse.com Dynamic Rule Based
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP Aakanksha Vijay M.tech, Department of Computer Science Suresh Gyan Vihar University Jaipur, India Mrs Savita Shiwani Head Of
Network Payload Analysis for Advanced Persistent Threats Charles Smutz, Lockheed Martin CIRT
Network Payload Analysis for Advanced Persistent Threats Charles Smutz, Lockheed Martin CIRT 0000 7/6/2010 1 About Speaker Name Background Current Job Employer Education Charles Smutz Sysadmin, Networking,
Open Source in Government: Delivering Network Security, Flexibility and Interoperability
W H I T E P A P E R Open Source in Government: Delivering Network Security, Flexibility and Interoperability Uncompromising performance. Unmatched flexibility. Introduction Amid a growing emphasis on transparency
A COMPARATIVE ANALYSIS OF OPEN- SOURCE INTRUSION DETECTION SYSTEMS
TALLINN UNIVERSITY OF TECHNOLOGY Faculty of Information Technology Department of Computer Science Chair of Network Software A COMPARATIVE ANALYSIS OF OPEN- SOURCE INTRUSION DETECTION SYSTEMS Master s Thesis
Network Security, ISA 656, Angelos Stavrou. Snort Lab
Snort Lab Purpose: In this lab, we will explore a common free Intrusion Detection System called Snort. Snort was written initially for Linux/Unix, but most functionality is now available in Windows. In
Threat Advisory: Trivial File Transfer Protocol (TFTP) Reflection DDoS
Classification: TLP-GREEN RISK LEVEL: MEDIUM Threat Advisory: Trivial File Transfer Protocol (TFTP) Reflection DDoS Release Date: 6.1.16 1.0 / OVERVIEW / Akamai SIRT is investigating a new DDoS reflection
From traditional to alternative approach to storage and analysis of flow data. Petr Velan, Martin Zadnik
From traditional to alternative approach to storage and analysis of flow data Petr Velan, Martin Zadnik Introduction Network flow monitoring Visibility of network traffic Flow analysis and storage enables
TLS and SRTP for Skype Connect. Technical Datasheet
TLS and SRTP for Skype Connect Technical Datasheet Copyright Skype Limited 2011 Introducing TLS and SRTP Protocols help protect enterprise communications Skype Connect now provides Transport Layer Security
CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security
CTS2134 Introduction to Networking Module 8.4 8.7 Network Security Switch Security: VLANs A virtual LAN (VLAN) is a logical grouping of computers based on a switch port. VLAN membership is configured by
Lab exercise: Working with Wireshark and Snort for Intrusion Detection
CS 491S: Computer and Network Security Fall 2008 Lab exercise: Working with Wireshark and Snort for Intrusion Detection Abstract: This lab is intended to give you experience with two key tools used by
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or
Network Defense Tools
Network Defense Tools Prepared by Vanjara Ravikant Thakkarbhai Engineering College, Godhra-Tuwa +91-94291-77234 www.cebirds.in, www.facebook.com/cebirds [email protected] What is Firewall? A firewall
Network Security. Chapter 9. Attack prevention, detection and response. Attack Prevention. Part I: Attack Prevention
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Part I: Attack Prevention Network Security Chapter 9 Attack prevention, detection and response Part Part I:
AlienVault. Unified Security Management (USM) 5.x Policy Management Fundamentals
AlienVault Unified Security Management (USM) 5.x Policy Management Fundamentals USM 5.x Policy Management Fundamentals Copyright 2015 AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,
Online Network Intrusion Detection System Using Temporal Logic and Stream Data Processing
Online Network Intrusion Detection System Using Temporal Logic and Stream Data Processing Thesis submitted in accordance with the requirements of the University of Liverpool for the degree of Doctor in
Network Security Monitoring
Network Security Coleman Kane [email protected] September 24, 2014 Cyber Defense Overview Network Security 1 / 23 Passive Passive 2 Alert Alert Passive monitoring analyzes traffic with the intention
Advancement in Virtualization Based Intrusion Detection System in Cloud Environment
Advancement in Virtualization Based Intrusion Detection System in Cloud Environment Jaimin K. Khatri IT Systems and Network Security GTU PG School, Ahmedabad, Gujarat, India Mr. Girish Khilari Senior Consultant,
Traffic Analyzer Based on Data Flow Patterns
AUTOMATYKA 2011 Tom 15 Zeszyt 3 Artur Sierszeñ*, ukasz Sturgulewski* Traffic Analyzer Based on Data Flow Patterns 1. Introduction Nowadays, there are many systems of Network Intrusion Detection System
Intrusion Detection Systems (IDS)
Intrusion Detection Systems (IDS) What are They and How do They Work? By Wayne T Work Security Gauntlet Consulting 56 Applewood Lane Naugatuck, CT 06770 203.217.5004 Page 1 6/12/2003 1. Introduction Intrusion
IDS and Penetration Testing Lab III Snort Lab
IDS and Penetration Testing Lab III Snort Lab Purpose: In this lab, we will explore a common free Intrusion Detection System called Snort. Snort was written initially for Linux/Unix, but most functionality
Web Application Firewall
Web Application Firewall Getting Started Guide August 3, 2015 Copyright 2014-2015 by Qualys, Inc. All Rights Reserved. Qualys and the Qualys logo are registered trademarks of Qualys, Inc. All other trademarks
The Bro Network Intrusion Detection System
The Bro Network Intrusion Detection System Robin Sommer International Computer Science Institute, & Lawrence Berkeley National Laboratory [email protected] http://www.icir.org System Philosophy Bro
Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort
License Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons
How To Protect Your Network From Attack From Outside From Inside And Outside
IT 4823 Information Security Administration Firewalls and Intrusion Prevention October 7 Notice: This session is being recorded. Lecture slides prepared by Dr Lawrie Brown for Computer Security: Principles
USE HONEYPOTS TO KNOW YOUR ENEMIES
USE HONEYPOTS TO KNOW YOUR ENEMIES SHERIF MOUSA (EG-CERT) 9 MAY 2012 WHAT ARE WE GOING TO TALK ABOUT? What exactly happens on the end of your Internet connection. Open Source tools to set up your own Honeypot
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
3.2: Transport Layer: SSL/TLS Secure Socket Layer (SSL) Transport Layer Security (TLS) Protocol
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Network Layer: IPSec Transport Layer: SSL/TLS Chapter 4: Security on the Application Layer Chapter 5: Security
Network Security. Lecture 3
Network Security Lecture 3 Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Security protocols application transport network datalink physical Contents IPSec overview
Fighting Advanced Persistent Threats (APT) with Open Source Tools
Fighting Advanced Persistent Threats (APT) with Open Source Tools What is APT? The US Air Force invented the term in 2006 APT refers to advanced techniques used to gain access to an intelligence objective
Web Security Considerations
CEN 448 Security and Internet Protocols Chapter 17 Web Security Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University [email protected]
Repsheet. A Behavior Based Approach to Web Application Security. Aaron Bedra Application Security Lead Braintree Payments. tirsdag den 1.
Repsheet A Behavior Based Approach to Web Application Security Aaron Bedra Application Security Lead Braintree Payments Right now, your web applications are being attacked And it will happen again, and
SSL/TLS. What Layer? History. SSL vs. IPsec. SSL Architecture. SSL Architecture. IT443 Network Security Administration Instructor: Bo Sheng
What Layer? /TLS IT443 Network Security Administration Instructor: Bo Sheng Application TCP IPSec IP LAN layer Application TCP IP LAN layer 1 2 History v2 proposed and deployed in Netscape 1.1 (1995) PCT
Infrastructure for active and passive measurements at 10Gbps and beyond
Infrastructure for active and passive measurements at 10Gbps and beyond Best Practice Document Produced by UNINETT led working group on network monitoring (UFS 142) Author: Arne Øslebø August 2014 1 TERENA
How To Set Up An Ip Firewall On Linux With Iptables (For Ubuntu) And Iptable (For Windows)
Security principles Firewalls and NAT These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/) Host vs Network
CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013
CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
SSL BEST PRACTICES OVERVIEW
SSL BEST PRACTICES OVERVIEW THESE PROBLEMS ARE PERVASIVE 77.9% 5.2% 19.2% 42.3% 77.9% of sites are HTTP 5.2% have an incomplete chain 19.2% support weak/insecure cipher suites 42.3% support SSL 3.0 83.1%
provides several new features and enhancements, and resolves several issues reported by WatchGuard customers.
WatchGuard XCS v10.0 Update 1 Release Notes WatchGuard XCS Build 140312 Revision Date 11 November, 2014 Introduction WatchGuard is pleased to announce the release of WatchGuard XCS v10.0 Update 1. This
Quantitative Analysis of Intrusion Detection Systems: Snort and Suricata
Quantitative Analysis of Intrusion Detection Systems: Snort and Suricata Joshua S. White a, Thomas T. Fitzsimmons b, Jeanna N. Matthews c a Wallace H. Coulter School of Engineering b,c Department of Computer
Data Collection and Analysis: Get End-to-End Security with Cisco Connected Analytics for Network Deployment
White Paper Data Collection and Analysis: Get End-to-End Security with Cisco Connected Analytics for Network Deployment Cisco Connected Analytics for Network Deployment (CAND) is Cisco hosted, subscription-based
JOOMLA REFLECTION DDOS-FOR-HIRE
1 TLP: GREEN GSI ID: 1085 JOOMLA REFLECTION DDOS-FOR-HIRE RISK FACTOR - HIGH 1.1 / OVERVIEW / Following a series of vulnerability disclosures throughout 2014, the popular content management framework Joomla
CS 356 Lecture 27 Internet Security Protocols. Spring 2013
CS 356 Lecture 27 Internet Security Protocols Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Fighting Advanced Persistent Threats (APT) with Open Source Tools
Fighting Advanced Persistent Threats (APT) with Open Source Tools What is APT? The US Air Force invented the term in 2006 APT refers to advanced techniques used to gain access to an intelligence objective
Configuring SSL Termination
CHAPTER 4 This chapter describes the steps required to configure a CSS as a virtual SSL server for SSL termination. It contains the following major sections: Overview of SSL Termination Creating an SSL
Real-Time Communication Security: SSL/TLS. Guevara Noubir [email protected] CSU610
Real-Time Communication Security: SSL/TLS Guevara Noubir [email protected] CSU610 1 Some Issues with Real-time Communication Session key establishment Perfect Forward Secrecy Diffie-Hellman based PFS
Snapt Balancer Manual
Snapt Balancer Manual Version 1.2 pg. 1 Contents Chapter 1: Introduction... 3 Chapter 2: General Usage... 4 Configuration Default Settings... 4 Configuration Performance Tuning... 6 Configuration Snapt
Network Security Monitoring
CEENET/GEANT Security Workshop Sofia, 2014 Network Security Monitoring An Introduction to the world of Intrusion Detection Systems Irvin Homem [email protected] Stockholm University Who am I? Of Indian and
Acano solution. Security Considerations. August 2015 76-1026-01-E
Acano solution Security Considerations August 2015 76-1026-01-E Contents Contents 1 Introduction... 3 2 Acano Secure Development Lifecycle... 3 3 Acano Security Points... 4 Acano solution: Security Consideration
Cleaning Encrypted Traffic
Optenet Documentation Cleaning Encrypted Traffic Troubleshooting Guide iii Version History Doc Version Product Date Summary of Changes V6 OST-6.4.300 01/02/2015 English editing Optenet Documentation
Kaseya Server Instal ation User Guide June 6, 2008
Kaseya Server Installation User Guide June 6, 2008 About Kaseya Kaseya is a global provider of IT automation software for IT Solution Providers and Public and Private Sector IT organizations. Kaseya's
Track 2 Workshop PacNOG 7 American Samoa. Firewalling and NAT
Track 2 Workshop PacNOG 7 American Samoa Firewalling and NAT Core Concepts Host security vs Network security What is a firewall? What does it do? Where does one use it? At what level does it function?
ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy
ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy OVERVIEW The global communication and the continuous growth of services provided through the Internet or local infrastructure require to
HAProxy 1.5 and beyond
HAProxy 1.5 and beyond FRnOG 22-2014/04/04 Willy Tarreau HAProxy / ALOHA R&D http://www.haproxy.com/ Quick history - major dates Project started in 2000 as a hack to rewrite HTTP headers
IDS / IPS. James E. Thiel S.W.A.T.
IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods
Security Engineering Part III Network Security. Security Protocols (I): SSL/TLS
Security Engineering Part III Network Security Security Protocols (I): SSL/TLS Juan E. Tapiador [email protected] Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer Science,
A Study of What Really Breaks SSL HITB Amsterdam 2011
A Study of What Really Breaks SSL HITB Amsterdam 2011 v1.0 Ivan Ristic Michael Small 20 May 2011 Agenda 1. State of SSL 2. Quick intro to SSL Labs 3. SSL Configuration Surveys 4. Survey of Actual SSL Usage
Transport Level Security
Transport Level Security Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
nmap, nessus, and snort Vulnerability Analysis & Intrusion Detection
nmap, nessus, and snort Vulnerability Analysis & Intrusion Detection agenda Vulnerability Analysis Concepts Vulnerability Scanning Tools nmap nikto nessus Intrusion Detection Concepts Intrusion Detection
Effective IDS/IPS Network Security in a Dynamic World with Next-Generation Intrusion Detection & Prevention
Effective IDS/IPS Network Security in a Dynamic World with Next-Generation Intrusion Detection & Prevention Your Security Challenges Defending the Dynamic Network! Dynamic threats 䕬 䕬 䕬 䕬 Many threats
IntruPro TM IPS. Inline Intrusion Prevention. White Paper
IntruPro TM IPS Inline Intrusion Prevention White Paper White Paper Inline Intrusion Prevention Introduction Enterprises are increasingly looking at tools that detect network security breaches and alert
Bro at 10 Gps: Current Testing and Plans
U.S. Department of Energy Bro at 10 Gps: Current Testing and Plans Office of Science Brian L. Tierney Lawrence Berkeley National Laboratory Bro s Use at LBL Operational 24 7 since 1996 Monitors traffic
42goISP Documentation
42goISP Documentation 42goISP Documentation I Table of Contents General...1 1 What is 42goISP?...1 2 Terms and structure of the manual...1 3 Installation/Upgrade/Deinstallation...1 3.1 Installation...1
Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1
Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutions
ERserver. iseries. Secure Sockets Layer (SSL)
ERserver iseries Secure Sockets Layer (SSL) ERserver iseries Secure Sockets Layer (SSL) Copyright International Business Machines Corporation 2000, 2002. All rights reserved. US Government Users Restricted
Implementing Cisco IOS Network Security
Implementing Cisco IOS Network Security IINS v3.0; 5 Days, Instructor-led Course Description Implementing Cisco Network Security (IINS) v3.0 is a 5-day instructor-led course focusing on security principles
Network Based Intrusion Detection Using Honey pot Deception
Network Based Intrusion Detection Using Honey pot Deception Dr.K.V.Kulhalli, S.R.Khot Department of Electronics and Communication Engineering D.Y.Patil College of Engg.& technology, Kolhapur,Maharashtra,India.
Connecting with Computer Science, 2e. Chapter 5 The Internet
Connecting with Computer Science, 2e Chapter 5 The Internet Objectives In this chapter you will: Learn what the Internet really is Become familiar with the architecture of the Internet Become familiar
ModSecurity The Open Source Web Application Firewall
OWASP AppSec NYC 2008 ModSecurity The Open Source Web Application Firewall Ivan Ristić Vice President, Security Research Breach Security 1/46 Introduction Ivan Ristić Web application security and web application
Secure Sockets Layer (SSL ) / Transport Layer Security (TLS) Network Security Products S31213
Secure Sockets Layer (SSL ) / Transport Layer Security (TLS) Network Security Products S31213 UNCLASSIFIED Example http ://www. greatstuf f. com Wants credit card number ^ Look at lock on browser Use https
Network Security Essentials Chapter 5
Network Security Essentials Chapter 5 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 5 Transport-Level Security Use your mentality Wake up to reality From the song, "I've Got
IONA Security Platform
IONA Security Platform February 22, 2002 Igor Balabine, PhD IONA Security Architect Copyright IONA Technologies 2001 End 2 Anywhere Agenda IONA Security Platform (isp) architecture Integrating with Enterprise
FIREWALL AND NAT Lecture 7a
FIREWALL AND NAT Lecture 7a COMPSCI 726 Network Defence and Countermeasures Muhammad Rizwan Asghar August 3, 2015 Source of most of slides: University of Twente FIREWALL An integrated collection of security