Software and Web Security 2 Session Management
|
|
|
- Rodney Franklin
- 9 years ago
- Views:
Transcription
1 Software and Web Security 2 Session Management sws2 1
2 Recall from last week Server and client, ie. web application and browser, communicate by HTTP requests and responses HTTP response can be with GET & POST GET: parameters in URL POST: parameters in HTTP body sws2 2
3 Lack of state in HTTP HTTP is a stateless protocol it does not remember if there were previous requests bad for web applications (eg. logged in?) For most web applications we need the notion of a session: a sequence of HTTP requests & responses that belong together Why can t we use IP address for this? multiple clients can share the same IP address eg different users on lilo.science.ru.nl idem for servers eg osiris & blackboard hosted at same RU machine clients can change IP address or even servers might sws2 3
4 session management Two levels at which sessions can be created 1. by the web application itself 2. at the transport layer, using HTTPS What is the best solution? Use both! web application Application Layer HTTP HTTPS... DNS Transport Layer TCP UDP Network Layer IP... sws2 4
5 sessions by the web application (Section of book) sws2 5
6 sessions managed by the web application Web application creates & manages sessions Session data is stored at server and associated with a unique session ID After session has been created, client is informed of session ID and client attaches session ID to subsequent requests Hence server knows about previous requests Web application frameworks usually provide built-in support for session management but a web application developers can implement their own NB it is better to use existing solutions than inventing your own Still, don t underestimate the complexity of using these correctly. sws2 6
7 sessions & authentication The notion of session close tied with authentication Eg after logging in with a username & password, you will often have certain access rights for the rest of the session While the session last, any information that can be used by an attacker to spoof the session (eg a session ID) is just as valuable as the username/password. sws2 7
8 Example: session ID in URL Web page returned by the server contains links with session ID as extra parameter <html> Example web page with session IDs in the URL. The user can now click <a href= >here</a> or <a href= passing on its session id back to the server wherever we go next. </html> sws2 8
9 Example: session ID in hidden parameter <htm> The form below uses a hidden field <form method= POST" action= <input type="text" name= Your address"> <input type="hidden" name= sid" value= s1234"> <input type="submit" value= Click here to submit"> </form> Hidden means hidden by default by browser, not hidden from a proxy like WebScarab. Browser plugins will show hidden fields and let them be edited. A hidden form field could also be used to track user preferences, eg <input type="hidden" name="language" value= Dutch"> The same goes for an extra parameter in the URL. sws2 9
10 Cookies Piece of information that is set by the server & stored by the browser when HTPP response includes Set-Cookie field in header belongs to some domain, eg includes expiry date, domain name, optional path, optional flags eg secure and HTTPOnly flags Cookie is sent automatically sent back by the browser, for any request to that domain in the Cookie field of HTTP request effectively, provides state information about the current session Cookie can include any type of information sensitive information, such as password, credit card nrs,.. less sensitive information, such as language preferences Almost all websites use cookies. sws2 10
11 Different ways to provide session ID Three ways to exchange session IDs 1. encoding it in the URL 2. Hidden form field 3. Cookies Which is most secure against an attacker eavesdropping on the network traffic? None is! sws2 11
12 Different ways to provide session ID Pros & cons 1. encoding it in the URL Downsides: stored in logs (eg browser history) can be cached & bookmarked visible in the browser location bar 2. Hidden form field Marginally better: won t appear in URLs, and cannot be bookmarked, and less likely to be logged 3. Cookies Best choice: automatically handled by browser; easier & more flexible. But will not work if client does not accept cookies. sws2 12
13 Different types of cookies non-persistent cookies only stored while current browser session lasts good for sessions persistent cookies preserved between browser sessions useful for maintaining user preferences across sessions lousy for privacy... secure cookies only sent over encrypted HTTPS connections Encrypting cookies sent over insecure, ie HTTP, connection is pointless. Why? Attackers can simply replay a stolen encrypted cookie HTTPonly cookies Inaccessible to scripts; will be discussed when we do client side scripting sws2 13
14 domains, subdomain, and top level domains The domain in a cookie can be a subdomain of a website, eg the subdomain cs.ru.nl of ru.nl Complex set of rules govern access across (sub)domains subdomains can access cookie for domain, but not vice versa subdomains can set cookie for direct superdomain, but not vv Rationale: subdomains need not trust their superdomain For top level domains, eg.nl, there are additional rules, to prevent ru.nl from setting a cookie for.nl But does all this work as intended for countries that use 3 level domain names? Eg somecompany.co.uk, where co.uk is not a top level domain sws2 14
15 Some session attacks Aim of attacker: steal the session ID this can be session cookie, or other form of session ID if the victim is logged in, this is just as good as stealing his username and password Interception intercept request or response and extract the cookie (eg on unprotected wifi) Prediction try to guess a session ID Brute Force try many guesses for the session ID, until you get lucky,,, Fixation make the victim use a certain session ID sws2 15
16 Session ID prediction example Suppose you can check your grades in blackboard on page blackboard.ru.nl/grades.php?s=s where s is your student number. Then you could try other student IDs or better still the university employee number of the teacher. sws2 16
17 Session fixation example If sessionids are passed in URL or hidden form field, then an attacker 1. start a session and obtain a session ID; 2. craft a link (or a webpage) for the victim, and try to get the victim to click that link (or visit that page and click links on it), with that session ID included; 3. the victim now goes to the website using a known session ID; 4. if the victim logs on, and the session ID is not changed, the attacker can abuse the user s rights! Alternatively, the attacker could craft a webpage, to do this eg a webpage that looks just like the login screen of the genuine website. Session attacks on cookies require client side scripting; we discuss these later. sws2 17
18 Making session attacks harder use an encrypted HTTPS connection for all requests & responses that include the session ID, not just the login Use long enough, random session IDs associate session to an IP address and disallow the same session ID to be used from a different IP address downside: if legitimate user changes IP address during session his session breaks change session ID after any change in privilege level eg after logging in expire sessions eg by setting expiration on cookies require the clients to re-authenticate, esp. before important actions sws2 18
19 What about other information besides a session ID? sws2 19
20 Things that can go wrong Classic security flaw in shopping web site store application: price is recorded in a hidden form field, as shown by the web proxy output above. The client can change this... sws2 20
21 MAC To prevent tampering or spoofing of sessions IDs, cookies, or other data, sent back by the browser, the server can use MAC (Message Authentication Code) MAC is like a digital signature, but using (faster) symmetric crypto rather than (slower) public key crypto. To MAC data, the server - computes hash of the session ID (or cookie, hidden parameters, or any other info passed to the client); - encrypts this hash with a symmetric key only server knows, {hash(m)} Key - appends MAC to the session ID (or in cookie, or as hidden param). When info with MAC is returned by client, the server can now check its integrity. Any data sent to the client that the client should return unaltered to the server, should be MAC-ed : the server should not trust the client! Alternatively, the server could just send session ID and keep all other important info locally sws2 21
22 sessions using HTTPS (Section in book) sws2 22
23 HTTPS (and SSL,TLS, SSL/TLS, TLS/SSL,..) HTTPS runs HTTP over TLS/SSL. TLS (Transport Layer Security) is new version of SSL (Secure Sockets Layer): TLS version 1.0 is SSL version 3.1 in practical usage, SSL and TLS are often synonyms, eg certificates used for TLS are typically called SSL certificates TLS/SSL highly configurable, and security guarantees depend on configuration: typically, integrity and confidentiality of the session attacker on the network can still see that two IP addresses communicate, but not what often also server authentication ie client authenticates the server rarely also client authentication ie server authenticates the client sws2 23
24 HTTPS 1. Server sends certificate to client, which includes server s public key PK is digitally signed by Certificate Authority (CA), or self-signed browsers come pre-configures with a list of trusted CAs 2. Client checks that certificate has not been revoked by requesting Certificate Revocation List (CRL) from CA 3. client authenticates the server by sending random challenge nonce encrypted with PK, and checking some response that includes nonce 4. client and server agree a symmetric session key based on nonce and some random number chosen by server 5. Subsequent HTTP traffic encrypted and MACed with session key encryption for confidentiality, MACing for integrity periodically the session key is refreshed sws2 24
25 securing session vs individual request/responses Subtle but important difference between integrity of individual HTTP requests and responses integrity of the session of HTTP requests and responses Integrity of the session means that the sequence (incl. the order) of messages is intact. Having only integrity of individual messages would allow replay attacks and other Man-in-the-Middle attacks where attacker removes, repeats, or reorders some HTTP traffic. sws2 25
26 regular vs Extended Validation certificates There are no specific requirements on how a CA should check its clients before it issues its certificates For Extended Validation (EV) certificates there are. and some auditor checks that CA sticks to these Most browsers show padlock for regular certificates, and a green URL in the location bar for EV certificates NB the fact that some certificates or some CAs - are more secure than others, raises interesting questions: how secure is all this anyway? who and what are we trusting? sws2 26
27 What are we trusting? sws2 27
28 What are we trusting? eg some_ca.com some_website.com sws2 28
29 sws2 29
30 sws2 30
31 sws2 31
32 URL obfuscation or malicious URLs 1. Old bug in Internet Explorer: part of the URL following an Esc or null character was not shown in location bar. How can attacker abuse this? 2. In any browser, an attacker can try to confuse the user, eg. which translates into Domain names containing Unicode characters eg Cyrillic p instead of Latin p in paypal.com Modern browsers use Punycode, an ASCII encoded version of Unicode, which shows this as sws2 32
33 Browser can try to warn user The bottom message warns that the URL contains a redundant login:password at the start of the URL as in example 2 on previous slide sws2 33
34 sws1 34
35 Things that go wrong sws2 35
36 Things that go wrong: implementing SSL/TLS (1) Feb 2014: goto bug in SSL/TLS in Apple ios and OSX CVE certificates not correctly checked Feb 2014: bug in GnuTLS CVE certificates not correctly checked April 2014: heartbleed bug in OpenSSL CVE buffer overflow allows remote attacker to retrieve data from server Feb 2015: FREAK attack on Oracle JSSE CVE force fallback to low-strength crypto found by Joeri de Ruiter here at the RU, and by researchers at INRIA sws2 36
37 sws2 37
38 sws2 38
39 sws2 39
40 more software = more bugs Ironically, as Heartbleed shows, any additional security measure that you introduce eg using SSL/TLS requires additional software that may come with additional software vulnerabilities... sws2 40
41 Things that go wrong... (2) March 2012: ING banking app does not check SSL certificate December 2012: ABN-AMRO app did not check SSL certificate Easier to use a generic web browser, which does - or should do - HTTPS checks correctly, rather than implementing SSL/TLS support yourself. sws2 41
42 Other things that go wrong... (3) Certificate Authority DigiNotar was hacked in Fake certificates for google.com were issued. DigiNotar provided all the certificates for the NL government... Fortunately, the certificate in the chip in your passport or ID card was not issued by DigiNotar. sws2 42
43 What are we trusting? What are we trusting when we use HTTPS? that web server protects its private key that browser checks the certificate correctly, including the CRL that user checks for non-ascii characters in URL, or browser warns about these that user check the certificates, that CA is not compromised that there is no malware in our browser or on our machine that is faking the display... The Trusted Computing Base (TCB) includes the web server, the browser, the underlying operating systems, the CA,... Not to mention the user, the sys admin of the server, the sys admin of the CA, the auditors that audit the CA,... sws2 43
44 Securing the last 30 centimeter... We can secure connections between computers 1000s of miles apart, eg using TLS/SSL, but the remaining 30 cm between user and laptop remain a problem sws2 44
45 Using encryption on the Internet is the equivalent of arranging an armored car to deliver credit card information from someone living in a cardboard box to someone living on a park bench. Gene Spafford The Trusted Computing Base (TCB) is huge, with all software and hardware at the client, server, and certificate authority. sws2 45
46 To do Do WebGoat 1a,2a,3a,4a & hackme lvl0 hand in the lvl0 Read and NB we skipped for now check out some certificates in your web browser for some sites that use HTTPS check out some cookies in your web browser eg using a cookie plugin sws2 46
What is Web Security? Motivation
[email protected] http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Topics in Network Security
Topics in Network Security Jem Berkes MASc. ECE, University of Waterloo B.Sc. ECE, University of Manitoba www.berkes.ca February, 2009 Ver. 2 In this presentation Wi-Fi security (802.11) Protecting insecure
The Benefits of SSL Content Inspection ABSTRACT
The Benefits of SSL Content Inspection ABSTRACT SSL encryption is the de-facto encryption technology for delivering secure Web browsing and the benefits it provides is driving the levels of SSL traffic
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
SSL and Browsers: The Pillars of Broken Security
SSL and Browsers: The Pillars of Broken Security Ivan Ristic Wolfgang Kandek Qualys, Inc. Session ID: TECH-403 Session Classification: Intermediate SSL, TLS, And PKI SSL (or TLS, if you prefer) is the
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current
Web Application Report
Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 8.5.0.1 11/14/2012 8:52:13 AM 11/14/2012
Transport Layer Security Protocols
SSL/TLS 1 Transport Layer Security Protocols Secure Socket Layer (SSL) Originally designed to by Netscape to secure HTTP Version 2 is being replaced by version 3 Subsequently became Internet Standard known
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Lecture 11 Web Application Security (part 1)
Lecture 11 Web Application Security (part 1) Computer and Network Security 4th of January 2016 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 11, Web Application Security (part 1)
Vulnerabilità dei protocolli SSL/TLS
Università degli Studi di Milano Facoltà di Scienze Matematiche, Fisiche e Naturali Dipartimento di Informatica e Comunicazione Vulnerabilità dei protocolli SSL/TLS Andrea Visconti Overview Introduction
Security Protocols/Standards
Security Protocols/Standards Security Protocols/Standards Security Protocols/Standards How do we actually communicate securely across a hostile network? Provide integrity, confidentiality, authenticity
HTTP. Internet Engineering. Fall 2015. Bahador Bakhshi CE & IT Department, Amirkabir University of Technology
HTTP Internet Engineering Fall 2015 Bahador Bakhshi CE & IT Department, Amirkabir University of Technology Questions Q1) How do web server and client browser talk to each other? Q1.1) What is the common
http://alice.teaparty.wonderland.com:23054/dormouse/bio.htm
Client/Server paradigm As we know, the World Wide Web is accessed thru the use of a Web Browser, more technically known as a Web Client. 1 A Web Client makes requests of a Web Server 2, which is software
Using Foundstone CookieDigger to Analyze Web Session Management
Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.
Web Payment Security. A discussion of methods providing secure communication on the Internet. Zhao Huang Shahid Kahn
Web Payment Security A discussion of methods providing secure communication on the Internet Group Members: Peter Heighton Zhao Huang Shahid Kahn 1. Introduction Within this report the methods taken to
Contents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008
Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Contents Authentication and Identity Assurance The Identity Assurance continuum Plain Password Authentication
Instructions on TLS/SSL Certificates on Yealink Phones
Instructions on TLS/SSL Certificates on Yealink Phones 1. Summary... 1 2. Encryption, decryption and the keys... 1 3. SSL connection flow... 1 4. The instructions to a certificate... 2 4.1 Phone acts as
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University October 2015 1 List of Figures Contents 1 Introduction 1 2 History 2 3 Public Key Infrastructure (PKI) 3 3.1 Certificate
Thick Client Application Security
Thick Client Application Security Arindam Mandal ([email protected]) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two
Session Management in Web Applications
Session Management in Web Applications Author: EUROSEC GmbH Chiffriertechnik & Sicherheit Tel: 06173 / 60850, www.eurosec.com EUROSEC GmbH Chiffriertechnik & Sicherheit, 2005 What is Web-based Session
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
A perspective to incident response or another set of recommendations for malware authors
A perspective to incident response or another set of recommendations for malware authors Alexandre Dulaunoy - TLP:WHITE [email protected] June 7, 2013 CIRCL, national CERT of Luxembourg CIRCL
Session Hijacking Exploiting TCP, UDP and HTTP Sessions
Session Hijacking Exploiting TCP, UDP and HTTP Sessions Shray Kapoor [email protected] Preface With the emerging fields in e-commerce, financial and identity information are at a higher risk of being
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks. Whitepaper
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks Whitepaper The security industry has extensively focused on protecting against malicious injection attacks like
Web Application Security Considerations
Web Application Security Considerations Eric Peele, Kevin Gainey International Field Directors & Technology Conference 2006 May 21 24, 2006 RTI International is a trade name of Research Triangle Institute
Web Security. Mahalingam Ramkumar
Web Security Mahalingam Ramkumar Issues Phishing Spreading misinformation Cookies! Authentication Domain name DNS Security Transport layer security Dynamic HTML Java applets, ActiveX, JavaScript Exploiting
Web Security. Crypto (SSL) Client security Server security 2 / 40. Web Security. SSL Recent Changes in TLS. Protecting the Client.
1 / 40 Crypto () Client security Server security 2 / 40 Trusting The Server s Client SET The Failure of SET Aside: The SET Root Certificate The Client s Server Who Issues Web Certificates? Mountain America
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
Workday Mobile Security FAQ
Workday Mobile Security FAQ Workday Mobile Security FAQ Contents The Workday Approach 2 Authentication 3 Session 3 Mobile Device Management (MDM) 3 Workday Applications 4 Web 4 Transport Security 5 Privacy
Secure Sockets Layer (SSL) / Transport Layer Security (TLS)
Secure Sockets Layer (SSL) / Transport Layer Security (TLS) Brad Karp UCL Computer Science CS GZ03 / M030 19 th November 2014 What Problems Do SSL/TLS Solve? Two parties, client and server, not previously
Specific recommendations
Background OpenSSL is an open source project which provides a Secure Socket Layer (SSL) V2/V3 and Transport Layer Security (TLS) V1 implementation along with a general purpose cryptographic library. It
Salesforce1 Mobile Security Guide
Salesforce1 Mobile Security Guide Version 1, 1 @salesforcedocs Last updated: December 8, 2015 Copyright 2000 2015 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of salesforce.com,
Breaking the Myths of Extended Validation SSL Certificates
BlackHat Briefings, 2009 Breaking the Myths of Extended Validation SSL Certificates Alexander Sotirov phmsecurity.com Mike Zusman intrepidusgroup.com Introduction Chosen-prefix MD5 collisions allowed us
SSL/TLS: The Ugly Truth
SSL/TLS: The Ugly Truth Examining the flaws in SSL/TLS protocols, and the use of certificate authorities. Adrian Hayter CNS Hut 3 Team [email protected] Contents Introduction to SSL/TLS Cryptography
Certificates and network security
Certificates and network security Tuomas Aura CSE-C3400 Information security Aalto University, autumn 2014 Outline X.509 certificates and PKI Network security basics: threats and goals Secure socket layer
Sync Security and Privacy Brief
Introduction Security and privacy are two of the leading issues for users when transferring important files. Keeping data on-premises makes business and IT leaders feel more secure, but comes with technical
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) [email protected] Open Web Application Security Project http://www.owasp.org
Cyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
SSL BEST PRACTICES OVERVIEW
SSL BEST PRACTICES OVERVIEW THESE PROBLEMS ARE PERVASIVE 77.9% 5.2% 19.2% 42.3% 77.9% of sites are HTTP 5.2% have an incomplete chain 19.2% support weak/insecure cipher suites 42.3% support SSL 3.0 83.1%
Fairsail REST API: Guide for Developers
Fairsail REST API: Guide for Developers Version 1.02 FS-API-REST-PG-201509--R001.02 Fairsail 2015. All rights reserved. This document contains information proprietary to Fairsail and may not be reproduced,
OWASP Application Security Building and Breaking Applications
OWASP Application Security Building and Breaking Applications Rochester OWASP Chapter - Durkee Consulting, Inc. [email protected] Who's? Principal Security Consultant Durkee Consulting Inc. Founder of Rochester
Using EMC Unisphere in a Web Browsing Environment: Browser and Security Settings to Improve the Experience
Using EMC Unisphere in a Web Browsing Environment: Browser and Security Settings to Improve the Experience Applied Technology Abstract The Web-based approach to system management taken by EMC Unisphere
Securing the SSL/TLS channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs
OWASP AppSec APAC 2012 The OWASP Foundation http://www.owasp.org Securing the SSL/TLS channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs
Network Security Essentials Chapter 5
Network Security Essentials Chapter 5 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 5 Transport-Level Security Use your mentality Wake up to reality From the song, "I've Got
Dashlane Security Whitepaper
Dashlane Security Whitepaper November 2014 Protection of User Data in Dashlane Protection of User Data in Dashlane relies on 3 separate secrets: The User Master Password Never stored locally nor remotely.
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
Michael Coates [email protected] michael-coates.blogspot.com
Michael Coates [email protected] michael-coates.blogspot.com Who am I? Web Security Engineer @ Mozilla Contributor OWASP 2010 Top 10 Author OWASP TLS Cheat Sheet Creator & Leader OWASP AppSensor Security
RoomWizard Synchronization Software Manual Installation Instructions
2 RoomWizard Synchronization Software Manual Installation Instructions Table of Contents Exchange Server Configuration... 4 RoomWizard Synchronization Software Installation and Configuration... 5 System
SNARE Agent for Windows v 4.2.3 - Release Notes
SNARE Agent for Windows v 4.2.3 - Release Notes Snare is a program that facilitates the central collection and processing of the Windows Event Log information. All three primary event logs (Application,
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers The Website can be developed under Windows or Linux Platform. Windows Development should be use: ASP, ASP.NET 1.1/ 2.0, and
SSL EXPLAINED SSL EXPLAINED
1 Table of Contents Introduction... 3 What is SSL?... 4 How does SSL work?... 7 Google & SSL... 11 SSL/TLS... 13 Web Filtering SSL... 14 About Lightspeed Systems... 26 2 Introduction SSL is a challenge
Lab Exercise SSL/TLS. Objective. Step 1: Open a Trace. Step 2: Inspect the Trace
Lab Exercise SSL/TLS Objective To observe SSL/TLS (Secure Sockets Layer / Transport Layer Security) in action. SSL/TLS is used to secure TCP connections, and it is widely used as part of the secure web:
Sichere Software- Entwicklung für Java Entwickler
Sichere Software- Entwicklung für Java Entwickler Dominik Schadow Senior Consultant Trivadis GmbH 05/09/2012 BASEL BERN LAUSANNE ZÜRICH DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. HAMBURG MÜNCHEN STUTTGART
Overview of CSS SSL. SSL Cryptography Overview CHAPTER
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet, ensuring secure transactions such as the transmission of credit card numbers
Den Gode Webservice - Security Analysis
Den Gode Webservice - Security Analysis Cryptomathic A/S September, 2006 Executive Summary This report analyses the security mechanisms provided in Den Gode Web Service (DGWS). DGWS provides a framework
Network Security Web Security and SSL/TLS. Angelos Keromytis Columbia University
Network Security Web Security and SSL/TLS Angelos Keromytis Columbia University Web security issues Authentication (basic, digest) Cookies Access control via network address Multiple layers SHTTP SSL (TLS)
E-Commerce Security. The Client-Side Vulnerabilities. Securing the Data Transaction LECTURE 7 (SECURITY)
E-Commerce Security An e-commerce security system has four fronts: LECTURE 7 (SECURITY) Web Client Security Data Transport Security Web Server Security Operating System Security A safe e-commerce system
Vulnerability Remediation Plugin Guide
Vulnerability Remediation Plugin Guide Plugin V 1.0 Doc Rev. 0.139 April 17, 2014 Table of Contents INTRODUCTION... 3 Background... 3 Purpose... 3 PRE-REQUISITES... 4 Supported versions of Venafi Trust
BlackBerry Enterprise Service 10. Universal Device Service Version: 10.2. Administration Guide
BlackBerry Enterprise Service 10 Universal Service Version: 10.2 Administration Guide Published: 2015-02-24 SWD-20150223125016631 Contents 1 Introduction...9 About this guide...10 What is BlackBerry
Web App Security Audit Services
locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System
Transport Level Security
Transport Level Security Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Auditing a Web Application. Brad Ruppert. SANS Technology Institute GWAS Presentation 1
Auditing a Web Application Brad Ruppert SANS Technology Institute GWAS Presentation 1 Objectives Define why application vulnerabilities exist Address Auditing Approach Discuss Information Interfaces Walk
Apache Partial HTTP Request Denial of Service Vulnerability - Zero Day. SSL Certificate - Subject Common Name Does Not Match Server FQDN
Vulnerability Scan 06 October 2014 at 16:21 URL : http://www.test.co.uk Summary: 34 vulnerabilities found 0 10 24 72 Cookie Does Not Contain The "HTTPOnly" Attribute Cookie Does Not Contain The "secure"
Websense Content Gateway HTTPS Configuration
Websense Content Gateway HTTPS Configuration web security data security email security Support Webinars 2010 Websense, Inc. All rights reserved. Webinar Presenter Title: Sr. Tech Support Specialist Cisco
The Hidden Dangers of Public WiFi
WHITEPAPER: OCTOBER 2014 The Hidden Dangers of Public WiFi 2 EXECUTIVE SUMMARY 4 MARKET DYNAMICS 4 The Promise of Public WiFi 5 The Problem with Public WiFi 6 MARKET BEHAVIOR 6 Most People Do Not Protect
Web Application Entity Session Management using the eid Card Frank Cornelis 03/03/2010. Fedict 2010. All rights reserved
Web Application Entity Session Management using the eid Card Frank Cornelis 03/03/2010 Fedict 2010. All rights reserved What is Entity Authentication? Entity authentication is the process whereby one party
Transition Networks White Paper. Network Security. Why Authentication Matters YOUR NETWORK. OUR CONNECTION.
Transition Networks White Paper Why Authentication Matters YOUR NETWORK. OUR CONNECTION. : Why Authentication Matters For most organizations physical security is a given. Whether it is video surveillance,
Extended SSL Certificates
Introduction Widespread usage of internet has led to the growth of awareness amongst users, who now associate green address bar with security. Though people are able to recognize the green bar, there is
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
An Insight into Cookie Security
An Insight into Cookie Security Today most websites and web based applications use cookies. Cookies are primarily used by the web server to track an authenticated user or other user specific details. This
Network Security - ISA 656 Email Security
Network Security - ISA 656 Angelos Stavrou November 13, 2007 The Usual Questions The Usual Questions Assets What are we trying to protect? Against whom? 2 / 33 Assets The Usual Questions Assets Confidentiality
Securing Microsoft Exchange 2010 with Symantec SSL Certificates
BUSINESS GUIDE: SECURING MICROSOFT EXCHANGE 2010 WITH SYMANTEC SSL CERTIFICATES Symantec Business Guide Securing Microsoft Exchange 2010 with Symantec SSL Certificates Best Practices for Securing Your
Configuration Guide BES12. Version 12.2
Configuration Guide BES12 Version 12.2 Published: 2015-07-07 SWD-20150630131852557 Contents About this guide... 8 Getting started... 9 Administrator permissions you need to configure BES12... 9 Obtaining
Last update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is to
Security & Privacy on the WWW. Topic Outline. Information Security. Briefing for CS4173
Security & Privacy on the WWW Briefing for CS4173 Topic Outline 1. Information Security Relationship to safety Definition of important terms Where breaches can occur Web techniques Components of security
CS 640 Introduction to Computer Networks. Network security (continued) Key Distribution a first step. Lecture24
Introduction to Computer Networks Lecture24 Network security (continued) Key distribution Secure Shell Overview Authentication Practical issues Firewalls Denial of Service Attacks Definition Examples Key
CrashPlan Security SECURITY CONTEXT TECHNOLOGY
TECHNICAL SPECIFICATIONS CrashPlan Security CrashPlan is a continuous, multi-destination solution engineered to back up mission-critical data whenever and wherever it is created. Because mobile laptops
Internet Security [1] VU 184.216. Engin Kirda [email protected]
![Internet Security [1] VU 184.216. Engin Kirda engin@infosys.tuwien.ac.at](/thumbs/33/15826620.jpg "Internet Security [1] VU 184.216. Engin Kirda engin@infosys.tuwien.ac.at")
Internet Security [1] VU 184.216 Engin Kirda [email protected] Christopher Kruegel [email protected] Administration Challenge 2 deadline is tomorrow 177 correct solutions Challenge 4 will
SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users.
system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be grouped
Secure Web Development Teaching Modules 1. Threat Assessment
Secure Web Development Teaching Modules 1 Threat Assessment Contents 1 Concepts... 1 1.1 Software Assurance Maturity Model... 1 1.2 Security practices for construction... 3 1.3 Web application security
Single Sign-On for the Internet: A Security Story. Eugene Tsyrklevich [email protected] Vlad Tsyrklevich [email protected]
Single Sign-On for the Internet: A Security Story Eugene Tsyrklevich [email protected] Vlad Tsyrklevich [email protected] BlackHat USA, Las Vegas 2007 Introduction With the explosion of Web 2.0 technology,
Decryption. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks
Decryption Palo Alto Networks PAN-OS Administrator s Guide Version 6.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us
Web and Email Security 1 / 40
Web and 1 / 40 Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why
Security Goals Services
1 2 Lecture #8 2008 Freedom from danger, risk, etc.; safety. Something that secures or makes safe; protection; defense. Precautions taken to guard against crime, attack, sabotage, espionage, etc. An assurance;
Gateway Apps - Security Summary SECURITY SUMMARY
Gateway Apps - Security Summary SECURITY SUMMARY 27/02/2015 Document Status Title Harmony Security summary Author(s) Yabing Li Version V1.0 Status draft Change Record Date Author Version Change reference
Security Issues in Web Programming. Robert M. Dondero, Ph.D. Princeton University
Security Issues in Web Programming Robert M. Dondero, Ph.D. Princeton University 1 Objectives You will learn about: Authentication and authorization Secure storage of usernames and passwords Secure data
This chapter describes how to use the Junos Pulse Secure Access Service in a SAML single sign-on deployment. It includes the following sections:
CHAPTER 1 SAML Single Sign-On This chapter describes how to use the Junos Pulse Secure Access Service in a SAML single sign-on deployment. It includes the following sections: Junos Pulse Secure Access
Implementation of Web Application Firewall
Implementation of Web Application Firewall OuTian 1 Introduction Abstract Web 層 應 用 程 式 之 攻 擊 日 趨 嚴 重, 而 國 內 多 數 企 業 仍 不 知 該 如 何 以 資 安 設 備 阻 擋, 仍 在 採 購 傳 統 的 Firewall/IPS,
HTTPS Inspection with Cisco CWS
White Paper HTTPS Inspection with Cisco CWS What is HTTPS? Hyper Text Transfer Protocol Secure (HTTPS) is a secure version of the Hyper Text Transfer Protocol (HTTP). It is a combination of HTTP and a
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER XSS-BASED ABUSE OF BROWSER PASSWORD MANAGERS Ben Stock, Martin Johns, Sebastian Lekies Browser choices Full disclosure: Ben was an intern with Microsoft
Breaking the Security Myths of Extended Validation SSL Certificates
Breaking the Security Myths of Extended Validation SSL Certificates Alexander Sotirov phreedom.org Mike Zusman intrepidusgroup.com Introduction SSL certificate authorities have been thoroughly broken in
Computer Networks. Secure Systems
Computer Networks Secure Systems Summary Common Secure Protocols SSH HTTPS (SSL/TSL) IPSec Wireless Security WPA2 PSK vs EAP Firewalls Discussion Secure Shell (SSH) A protocol to allow secure login to
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data