Generalized Single Packet Authorization for Cloud Computing Environments
|
|
|
- Britney Gray
- 10 years ago
- Views:
Transcription
1 Generalized Single Packet Authorization for Cloud Computing Environments Michael Rash ShmooCon February, 2013 Copyright (C) Michael Rash
2 Agenda Brief Port Knocking / Single Packet Authorization Primer Lengthy demo SPA integrated into Amazon's Cloud General integration points for Cloud providers fwknop-2.5 release HMAC-SHA256 support Where is SPA headed? Copyright (C) Michael Rash
3 PK/SPA Assertion There is a security benefit in service concealment behind a default-drop packet filter + plus a lightweight passive authentication layer (Not a defense for client-side vulnerabilities) Copyright (C) Michael Rash
4 No Shortage of Server Vulns Cisco rsh vuln (HD Moore: Hacking Like It's 1985 ): ( UPnP vulnerabilities (affecting millions of devices): SHODAN enumeration of Internet connected SCADA devices: ( Barracuda Networks SSH backdoors (Stefan Viehböck): Copyright (C) Michael Rash
5 Typical PK/SPA Work Flow User wants SSH access behind PK/SPA firewall User executes PK/SPA client Firewall is reconfigured to allow SSH connections from the specified IP PK/SPA packet(s) passively monitored PK/SPA packet(s) never acknowledged in any way SSHD cannot be scanned for Think beyond SSHD Copyright (C) Michael Rash
6 General Goal of fwknop Solve PK limitations while simultaneously retaining its benefits Copyright (C) Michael Rash
7 The fwknop Design Firewall default drop stance for protected services Passive collection of authentication information (libpcap*) Support for Symmetric and Asymmetric ciphers Encrypted and non-replayable SPA packets Do not want anything that trusts an IP in the network layer header Server portable to embedded systems Do not want a heavyweight interpreted language (this is a trade off) Server portable to different firewall architectures and router ACL languages Make sophisticated use of NAT Client portable to everything from Cygwin to the iphone Do not want to require raw socket manipulation of packet headers or admin privileges Minimize library dependencies Copyright (C) Michael Rash
8 Things Aren't Always as They Seem User gains access to NetB from NetA with SPA Attacker: Which system to attack? SPA server can be anywhere on the routing path of an SPA packet not just the SPA destination IP SPA packet source IP can be spoofed too Neither the SPA source nor destination IP matters Copyright (C) Michael Rash
9 Tutorial Single Packet Authorization: A Comprehensive Guide to Strong Service Hardening with fwknop Copyright (C) Michael Rash
10 SPA in the Amazon Cloud Copyright (C) Michael Rash
11 Amazon AWS User Agreement Other Security and Backup. You are responsible for properly configuring and using the Service Offerings and taking your own steps to maintain appropriate security, protection and backup of Your Content, which may include the use of encryption technology to protect Your Content from unauthorized access and routine archiving Your Content... Copyright (C) Michael Rash
12 Amazon VPC Networks Copyright (C) Michael Rash
13 The Perfect SPA Use Case Microsoft RDP vulnerability last year (CVE ) Full remote code execution potential, although Metasploit only has a DoS module For a time, Cloud provider Windows images were vulnerable Problem: fwknop does not support a Windows firewall Copyright (C) Michael Rash
14 Amazon VPC + SPA Setup Copyright (C) Michael Rash
15 fwknopd Configuration We're going to create an SPA jump host gateway # cat /etc/fwknop/fwknopd.conf PCAP_FILTER udp port 40001; ENABLE_IPT_FORWARDING Y; ENABLE_IPT_LOCAL_NAT Y; ENABLE_IPT_SNAT Y; SNAT_TRANSLATE_IP ; # cat /etc/fwknop/access.conf SOURCE: ANY; KEY: test1234; FORCE_NAT: ; REQUIRE_SOURCE: Y; SOURCE: ANY; KEY: 1234test; REQUIRE_SOURCE: Y; Copyright (C) Michael Rash
16 Demo (video) Copyright (C) Michael Rash
17 Demo: Key Points Do not have any direct integration with AWS border controls All SPA principles apply Default-drop firewall policy cannot scan for a target Passive packet acquisition SPA packets are never acknowledged Replay detection Temporary firewall reconfiguration for service access Access to any service on any VPC system all through a single routable Elastic IP SPA hardened jump host Sophisticated usage of NAT Accessed hosts don't even need a route to the Internet (DNAT + SNAT usage) Ghost services Scanners only see Apache (or whatever), but SPA allows access to SSHD or any other service iptables SPA NAT rules intercept connections out from under local userspace services fwknop has supported ghost services since the old perl days Copyright (C) Michael Rash
18 Can We Generalize This to Other Cloud Computing Environments? Copyright (C) Michael Rash
19 Some Observations About Amazon Could fully control and configure internal OS images (install software, manipulate firewall rules, etc.) No (apparent) specialized filtering in AWS border ACL Not restricted to accessing VPC hosts with specialized applications controlled by Amazon any application that is compatible with ACL configuration will work The above translates to greater ease of use and deployment for Amazon customers independent of SPA or anything else e.g. it is a good architecture that other Cloud providers will emulate Copyright (C) Michael Rash
20 SPA Integration with Arbitrary Cloud IaaS Providers Useful Cloud infrastructures provide remote access via SSH/RDP/VPN protocol to customizable OS images Universal HTTP/HTTPS for Cloud usage is not generally compatible with SPA Cloud providers usually implement a network ACL capability May or may not be customizable by the user SPA client must communicate in a compatible fashion We don't necessarily need NAT capabilities in the SPA implementation (support less complex cloud environments) IaaS (Infrastructure as a Service) providers are generally SPA-compatible Copyright (C) Michael Rash
21 Cloud Providers Wikipedia currently lists 129 different Cloud providers: Copyright (C) Michael Rash
22 Private Clouds Bare metal owned by a private entity Cloud layer provided by open source or proprietary computing stack SPA is likely compatible in two ways: Integration with raw OS underneath the virtualization layer Integration with guest OS instances (e.g. similar to AWS deployment) Copyright (C) Michael Rash
23 Hybrid Clouds SPA is likely compatible bi-directionally if public portion is compatible Copyright (C) Michael Rash
24 Evaluating Cloud IaaS + SPA Compatibility Copyright (C) Michael Rash
25 Moving Up the Cloud Stack We've shown SPA integrates well with IaaS, but what about PaaS (Platform as a Service) and SaaS (Software as a Service) models? Copyright (C) Michael Rash
26 Moving Up the Cloud Stack (cont'd) SPA PaaS integration to the extent that the base infrastructure is under user control Amazon Elastic Beanstalk SaaS not generally SPA compatible Users do not have infrastructure control Would require massive integration effort, and drastically changes usage model Copyright (C) Michael Rash
27 Amazon Elastic Beanstalk ed.walkthrough.html Copyright (C) Michael Rash
28 Specialized Cloud Providers Cloud storage providers (DropBox, Mozy, etc.) Not generally SPA-compatible (SaaS model) Such providers construct purpose-built cloud infrastructure that is accessed through a dedicated client-side application (web browser or custom app) Clouds optimized for computing performance (e.g. Penguin Computing) SPA compatibility likely for IaaS portion SPA not generally a good fit for HPC jobs Copyright (C) Michael Rash
29 Further Research... To what extent are packet filters used within Cloud computing stacks? (Independent of OS packet filters.) This may hint at direct SPA integration with Cloud software Are there natural SPA integration points for distributed computing jobs? If so, is there a security benefit? (Cloud-specific threat modeling.) Are there integration points for admin layers below distributed content distribution services (e.g. Amazon Cloud Front)? Do any major IaaS Cloud providers leverage packet filters in ways that are incompatible with SPA? (Probably not.) Copyright (C) Michael Rash
30 fwknop Development Copyright (C) Michael Rash
31 fwknop-2.5 (coming soon) HMAC-SHA256 HMAC(K,m) = H((K opad) H((K ipad) m)) SPA encrypted message = m HMAC K!= encryption key fwknop uses the encrypt-then-authenticate paradigm SSH uses encrypt-and-mac SSL uses MAC-then-encrypt Has made the Vaudenay and more recent Lucky 13 padding oracle attacks possible IPSEC uses encrypt-then-mac INT-CTXT and IND-CCA2 secure Copyright (C) Michael Rash
32 fwknop Vulnerabilities CVE Improper IP validation (requires a valid encryption key to exploit) CVE Client side last processing overflow (local exploit) Fixed since (Latest release is 2.0.4) CREDIT: Fernando Arnaboldi, IOActive. Additional thanks to Erik Gomez for helping to make this auditing effort possible. Copyright (C) Michael Rash
33 What are we doing about this? Test suite driven valgrind validation Every new commit is tested against a valgrind baseline Lightweight C code helps a lot here SPA packet fuzzer Compile time security options Usage of static analyzers (e.g. splint, Clang static analyzer, etc.) SPA protocol review Copyright (C) Michael Rash
34 SPA Packet Fuzzer Builds encrypted SPA packets with malicious payloads Series of patches against libfko to remove various constraints and validation steps Automatically tested via the test/test fwknop.pl test suite Over 2,000 fuzzing packets currently used in different modes Copyright (C) Michael Rash
35 Test Suite: #./test fwknop.pl [build security] [client] Position Independent Executable (PIE)...pass (3) [build security] [client] stack protected binary...pass (4) [build security] [client] fortify source functions...pass (5) [build security] [client] read only relocations...pass (6) [build security] [client] immediate binding...pass (7) [build security] [server] Position Independent Executable (PIE)...pass (8) [build security] [server] stack protected binary...pass (9) [build security] [server] fortify source functions...pass (10) [build security] [server] read only relocations...pass (11) [build security] [server] immediate binding...pass (12) This is enabled via: gcc fstack protector all fstack protector fpie pie D_FORTIFY_SOURCE=2 Wl, z,relro Wl, z,now Copyright (C) Michael Rash
36 iphone + Android fwknop Clients Copyright (C) Michael Rash
37 The Future of fwknop Mandatory Access Control support via SELinux and/or AppArmor Further cloud computing extensions and integration points Privilege separation Support for libcap-ng UDP listener mode Tunneling mode extensions (DNS, HTTP, SMTP, Tor) Copyright (C) Michael Rash
38 Linux Firewalls 2nd Edition To be released in Copyright (C) Michael Rash
39 Thank You... The Amazon Security team Damien Stuart developed the original C port Fernando Arnaboldi and Erik Gomez (IOActive) Franck Joncourt (Debian) Sebastien Jeanquier authoritative PK/SPA thesis Sean Greven (FreeBSD port) Vlad Glagolev (OpenBSD port) Copyright (C) Michael Rash
40 Slides: Copyright (C) Michael Rash
Chapter 11 Cloud Application Development
Chapter 11 Cloud Application Development Contents Motivation. Connecting clients to instances through firewalls. Chapter 10 2 Motivation Some of the questions of interest to application developers: How
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk
Don't Get Owned at DEF CON
Don't Get Owned at DEF CON Single Packet Authorization and SSH Tunneling DEF CON 22 Jay Beale InGuardians Single Packet Authorization Single packet authorization is an advancement on the port knocking
Recommended IP Telephony Architecture
Report Number: I332-009R-2006 Recommended IP Telephony Architecture Systems and Network Attack Center (SNAC) Updated: 1 May 2006 Version 1.0 [email protected] This Page Intentionally Left Blank ii Warnings
Network Security and Firewall 1
Department/program: Networking Course Code: CPT 224 Contact Hours: 96 Subject/Course WEB Access & Network Security: Theoretical: 2 Hours/week Year Two Semester: Two Prerequisite: NET304 Practical: 4 Hours/week
Linux Network Security
Linux Network Security Course ID SEC220 Course Description This extremely popular class focuses on network security, and makes an excellent companion class to the GL550: Host Security course. Protocols
Network Penetration Testing and Ethical Hacking Scanning/Penetration Testing. SANS Security 560.2. Sans Mentor: Daryl Fallin
Network Penetration Testing and Ethical Hacking Scanning/Penetration Testing SANS Security 560.2 Sans Mentor: Daryl Fallin http://www.sans.org/info/55868 Copyright 2010, All Rights Reserved Version 4Q10
athenahealth Interface Connectivity SSH Implementation Guide
athenahealth Interface Connectivity SSH Implementation Guide 1. OVERVIEW... 2 2. INTERFACE LOGICAL SCHEMATIC... 3 3. INTERFACE PHYSICAL SCHEMATIC... 4 4. SECURE SHELL... 5 5. NETWORK CONFIGURATION... 6
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100
Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100 Course Description: Introduction to Cybersecurity is designed to provide students the basic concepts and terminology
How to Grow and Transform your Security Program into the Cloud
How to Grow and Transform your Security Program into the Cloud Wolfgang Kandek Qualys, Inc. Session ID: SPO-207 Session Classification: Intermediate Agenda Introduction Fundamentals of Vulnerability Management
Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity
Basic Security Requirements and Techniques Confidentiality The property that stored or transmitted information cannot be read or altered by an unauthorized party Integrity The property that any alteration
Firewalls and VPNs. Principles of Information Security, 5th Edition 1
Firewalls and VPNs Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you should be able to: Understand firewall technology and the various approaches
Definition of firewall
Internet Firewalls Definitions: firewall, policy, router, gateway, proxy NAT: Network Address Translation Source NAT, Destination NAT, Port forwarding NAT firewall compromise via UPnP/IGD Packet filtering
Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN
Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts
Network Defense Tools
Network Defense Tools Prepared by Vanjara Ravikant Thakkarbhai Engineering College, Godhra-Tuwa +91-94291-77234 www.cebirds.in, www.facebook.com/cebirds [email protected] What is Firewall? A firewall
Executive Summary and Purpose
ver,1.0 Hardening and Securing Opengear Devices Copyright Opengear Inc. 2013. All Rights Reserved. Information in this document is subject to change without notice and does not represent a commitment on
Network Configuration Settings
Network Configuration Settings Many small businesses already have an existing firewall device for their local network when they purchase Microsoft Windows Small Business Server 2003. Often, these devices
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP
solution brief PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP AWS AND PCI DSS COMPLIANCE To ensure an end-to-end secure computing environment, Amazon Web Services (AWS) employs a shared security responsibility
A SURVEY OF CLOUD COMPUTING: NETWORK BASED ISSUES PERFORMANCE AND ANALYSIS
A SURVEY OF CLOUD COMPUTING: NETWORK BASED ISSUES PERFORMANCE AND ANALYSIS *Dr Umesh Sehgal, #Shalini Guleria *Associate Professor,ARNI School of Computer Science,Arni University,[email protected]
An Introduction to Cloud Computing Concepts
Software Engineering Competence Center TUTORIAL An Introduction to Cloud Computing Concepts Practical Steps for Using Amazon EC2 IaaS Technology Ahmed Mohamed Gamaleldin Senior R&D Engineer-SECC [email protected]
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
Vulnerability Assessment and Penetration Testing
Vulnerability Assessment and Penetration Testing Module 1: Vulnerability Assessment & Penetration Testing: Introduction 1.1 Brief Introduction of Linux 1.2 About Vulnerability Assessment and Penetration
Corporate VPN Using Mikrotik Cloud Feature. By SOUMIL GUPTA BHAYA Mikortik Certified Trainer
Corporate VPN Using Mikrotik Cloud Feature By SOUMIL GUPTA BHAYA Mikortik Certified Trainer What is a VPN? A virtual private network (VPN) is a method for the extension of a private network across a public
Guidelines for Website Security and Security Counter Measures for e-e Governance Project
and Security Counter Measures for e-e Governance Project Mr. Lalthlamuana PIO, DoICT Background (1/8) Nature of Cyber Space Proliferation of Information Technology Rapid Growth in Internet Increasing Online
How To Understand A Firewall
Module II. Internet Security Chapter 6 Firewall Web Security: Theory & Applications School of Software, Sun Yat-sen University Outline 6.1 Introduction to Firewall What Is a Firewall Types of Firewall
Securing the Microsoft Platform on Amazon Web Services
Securing the Microsoft Platform on Amazon Web Services Tom Stickle August 2012 (Please consult http://aws.amazon.com/whitepapers/ for the latest version of this paper) Page 1 of 22 Abstract Deploying Microsoft
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3
NETWORK SECURITY HACKS
SECOND EDITION NETWORK SECURITY HACKS 2008 AGI-Information Management Consultants May be used for personal purporses only or by libraries associated to dandelon.com network. Andrew Lockhart O'REILLY Beijing
CS 665: Computer System Security. Network Security. Usage environment. Sources of vulnerabilities. Information Assurance Module
CS 665: Computer System Security Network Security Bojan Cukic Lane Department of Computer Science and Electrical Engineering West Virginia University 1 Usage environment Anonymity Automation, minimal human
INFORMATION SECURITY TRAINING CATALOG (2015)
INFORMATICS AND INFORMATION SECURITY RESEARCH CENTER CYBER SECURITY INSTITUTE INFORMATION SECURITY TRAINING CATALOG (2015) Revision 3.0 2015 TÜBİTAK BİLGEM SGE Siber Güvenlik Enstitüsü P.K. 74, Gebze,
Implementing Cisco IOS Network Security
Implementing Cisco IOS Network Security IINS v3.0; 5 Days, Instructor-led Course Description Implementing Cisco Network Security (IINS) v3.0 is a 5-day instructor-led course focusing on security principles
z/os Firewall Technology Overview
z/os Firewall Technology Overview Mary Sweat E - Mail: [email protected] Washington System Center OS/390 Firewall/VPN 1 Firewall Technologies Tools Included with the OS/390 Security Server Configuration
NETASQ & PCI DSS. Is NETASQ compatible with PCI DSS? NG Firewall version 9
NETASQ & PCI DSS Is NETASQ compatible with PCI DSS? We have often been asked this question. Unfortunately, even the best firewall is but an element in the process of PCI DSS certification. This document
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
IINS Implementing Cisco Network Security 3.0 (IINS)
IINS Implementing Cisco Network Security 3.0 (IINS) COURSE OVERVIEW: Implementing Cisco Network Security (IINS) v3.0 is a 5-day instructor-led course focusing on security principles and technologies, using
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
Firewalls. Chien-Chung Shen [email protected]
Firewalls Chien-Chung Shen [email protected] The Need for Firewalls Internet connectivity is essential however it creates a threat vs. host-based security services (e.g., intrusion detection), not cost-effective
JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA
JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA To purchase Full version of Practice exam click below; http://www.certshome.com/jk0-022-practice-test.html FOR CompTIA JK0-022 Exam Candidates
Internet infrastructure. Prof. dr. ir. André Mariën
Internet infrastructure Prof. dr. ir. André Mariën (c) A. Mariën 31/01/2006 Topic Firewalls (c) A. Mariën 31/01/2006 Firewalls Only a short introduction See for instance: Building Internet Firewalls, second
Virtual Private Networks
Virtual Private Networks ECE 4886 Internetwork Security Dr. Henry Owen Definition Virtual Private Network VPN! Virtual separation in protocol provides a virtual network using no new hardware! Private communication
Zorp and KZorp: Integrating Packet Filtering and Userspace proxying
Zorp and KZorp: Integrating Packet Filtering and Userspace proxying Balázs Scheidler Zorp Has been established in 2000, as the first BalaBit product Code was GPLd right from the start
Security Technology: Firewalls and VPNs
Security Technology: Firewalls and VPNs 1 Learning Objectives Understand firewall technology and the various approaches to firewall implementation Identify the various approaches to remote and dial-up
Príprava štúdia matematiky a informatiky na FMFI UK v anglickom jazyku
Univerzita Komenského v Bratislave Fakulta matematiky, fyziky a informatiky Príprava štúdia matematiky a informatiky na FMFI UK v anglickom jazyku ITMS: 26140230008 dopytovo orientovaný projekt Moderné
Oracle public Database and Java Cloud for Trials 19.03.2015
Oracle public Database and Java Cloud for Trials 19.03.2015 Arnold Keller, Senior Sales Consultant Core Technology Hannes Gütlin, Senior Sales Consultant Middleware Agenda 1 2 3 4 Oracle Cloud Introduction
74% 96 Action Items. Compliance
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant What infrastructure security really means? Infrastructure Security is Making sure that your system services are always running
IPv6 SECURITY. May 2011. The Government of the Hong Kong Special Administrative Region
IPv6 SECURITY May 2011 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without the express
Security vulnerabilities in the Internet and possible solutions
Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished in
Learn Ethical Hacking, Become a Pentester
Learn Ethical Hacking, Become a Pentester Course Syllabus & Certification Program DOCUMENT CLASSIFICATION: PUBLIC Copyrighted Material No part of this publication, in whole or in part, may be reproduced,
Networking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
Internet Security and Acceleration Server 2000 with Service Pack 1 Audit. An analysis by Foundstone, Inc.
Internet Security and Acceleration Server 2000 with Service Pack 1 Audit An analysis by Foundstone, Inc. Internet Security and Acceleration Server 2000 with Service Pack 1 Audit This paper presents an
Network Security Using Hybrid Port Knocking
8 Network Security Using Hybrid Port Knocking Dr. Hussein Al-Bahadili and Dr. Ali H. Hadi, Arab Academy for Financial Sciences, faculty of Information Technology, Amman Jordan Arab Academy for Financial
ZEN LOAD BALANCER EE v3.02 DATASHEET The Load Balancing made easy
ZEN LOAD BALANCER EE v3.02 DATASHEET The Load Balancing made easy OVERVIEW The global communication and the continuous growth of services provided through the Internet or local infrastructure require to
Track 2 Workshop PacNOG 7 American Samoa. Firewalling and NAT
Track 2 Workshop PacNOG 7 American Samoa Firewalling and NAT Core Concepts Host security vs Network security What is a firewall? What does it do? Where does one use it? At what level does it function?
ΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
IBM. Vulnerability scanning and best practices
IBM Vulnerability scanning and best practices ii Vulnerability scanning and best practices Contents Vulnerability scanning strategy and best practices.............. 1 Scan types............... 2 Scan duration
ANNEXURE-1 TO THE TENDER ENQUIRY NO.: DPS/AMPU/MIC/1896. Network Security Software Nessus- Technical Details
Sub: Supply, Installation, setup and testing of Tenable Network Security Nessus vulnerability scanner professional version 6 or latest for scanning the LAN, VLAN, VPN and IPs with 3 years License/Subscription
2016 TÜBİTAK BİLGEM Cyber Security Institute
2016 Revision 5.0 2016 TÜBİTAK BİLGEM Cyber Security Institute 1 ... 3 1. Information Security Awareness for End Users... 4 2. Information Security Awareness for Managers... 5 3. Social Engineering: Attack
ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy
ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy OVERVIEW The global communication and the continuous growth of services provided through the Internet or local infrastructure require to
Remote Desktop Gateway. Accessing a Campus Managed Device (Windows Only) from home.
Remote Desktop Gateway Accessing a Campus Managed Device (Windows Only) from home. Contents Introduction... 2 Quick Reference... 2 Gateway Setup - Windows Desktop... 3 Gateway Setup Windows App... 4 Gateway
How To Extend Security Policies To Public Clouds
What You Will Learn Public sector organizations without the budget to build a private cloud can consider public cloud services. The drawback until now has been tenants limited ability to implement their
Addressing Security for Hybrid Cloud
Addressing Security for Hybrid Cloud Sreekanth Iyer Executive IT Architect IBM Cloud (CTO Office) Email : [email protected] Twitter: @sreek Blog: http://ibm.co/sreek July 18, 2015 Cloud is rapidly
Security Considerations White Paper for Cisco Smart Storage 1
Security Considerations White Paper for Cisco Smart Storage An open network is like a bank s vault with windows Bill Thomson Network-Attached Storage (NAS) is a relatively simple and inexpensive way to
Security + Certification (ITSY 1076) Syllabus
Security + Certification (ITSY 1076) Syllabus Course: ITSY 1076 Security+ 40 hours Course Description: This course is targeted toward an Information Technology (IT) professional who has networking and
Firewalls. CEN 448 Security and Internet Protocols Chapter 20 Firewalls
CEN 448 Security and Internet Protocols Chapter 20 Firewalls Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University [email protected]
McAfee Firewall Enterprise System Administration Intel Security Education Services Administration Course
McAfee Firewall Enterprise System Administration Intel Security Education Services Administration Course The McAfee Firewall Enterprise System Administration course from McAfee University is a fast-paced,
Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding
Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding This chapter describes the configuration for the SSL VPN Tunnel Client and for Port Forwarding. When a remote user accesses the SSL VPN
Network Access Security. Lesson 10
Network Access Security Lesson 10 Objectives Exam Objective Matrix Technology Skill Covered Exam Objective Exam Objective Number Firewalls Given a scenario, install and configure routers and switches.
Nessus Agents. October 2015
Nessus Agents October 2015 Table of Contents Introduction... 3 What Are Nessus Agents?... 3 Scanning... 4 Results... 6 Conclusion... 6 About Tenable Network Security... 6 2 Introduction Today s changing
Licenses are not interchangeable between the ISRs and NGX Series ISRs.
Q&A Cisco IOS SSL VPN Q. What is Cisco IOS SSL VPN or SSL VPN? A. Secure Sockets Layer (SSL)-based VPN is an emerging technology that provides remote-access connectivity from almost any Internet-enabled
The Evolving Threat Landscape and New Best Practices for SSL
The Evolving Threat Landscape and New Best Practices for SSL sponsored by Dan Sullivan Chapter 2: Deploying SSL in the Enterprise... 16 Infrastructure in Need of SSL Protection... 16 Public Servers...
Securing Modern Substations With an Open Standard Network Security Solution. Kevin Leech Schweitzer Engineering Laboratories, Inc.
Securing Modern Substations With an Open Standard Network Security Solution Kevin Leech Schweitzer Engineering Laboratories, Inc. Copyright SEL 2009 What Makes a Cyberattack Unique? While the resources
Network Security. Computer Security & Forensics. Security in Compu5ng, Chapter 7. l Network Defences. l Firewalls. l Demilitarised Zones
Network Security Security in Compu5ng, Chapter 7 Topics l Network AAacks l Reconnaissance l AAacks l Spoofing l Web Site Vulnerabili5es l Denial of Service l Network Defences l Firewalls l Demilitarised
Firewalls. Ingress Filtering. Ingress Filtering. Network Security. Firewalls. Access lists Ingress filtering. Egress filtering NAT
Network Security s Access lists Ingress filtering s Egress filtering NAT 2 Drivers of Performance RequirementsTraffic Volume and Complexity of Static IP Packet Filter Corporate Network The Complexity of
Architecture. The DMZ is a portion of a network that separates a purely internal network from an external network.
Architecture The policy discussed suggests that the network be partitioned into several parts with guards between the various parts to prevent information from leaking from one part to another. One part
Decryption. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks
Decryption Palo Alto Networks PAN-OS Administrator s Guide Version 6.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us
Novell Access Manager SSL Virtual Private Network
White Paper www.novell.com Novell Access Manager SSL Virtual Private Network Access Control Policy Enforcement Compliance Assurance 2 Contents Novell SSL VPN... 4 Product Overview... 4 Identity Server...
Cloud Security Through Threat Modeling. Robert M. Zigweid Director of Services for IOActive
Cloud Security Through Threat Modeling Robert M. Zigweid Director of Services for IOActive 1 Key Points Introduction Threat Model Primer Assessing Threats Mitigating Threats Sample Threat Model Exercise
FRONT RUNNER DIPLOMA PROGRAM INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months
FRONT RUNNER DIPLOMA PROGRAM INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months MODULE: INTRODUCTION TO INFORMATION SECURITY INFORMATION SECURITY ESSENTIAL TERMINOLOGIES SECURITY
IPv6 Security Best Practices. Eric Vyncke [email protected] Distinguished System Engineer
IPv6 Best Practices Eric Vyncke [email protected] Distinguished System Engineer security 2007 Cisco Systems, Inc. All rights reserved. Cisco CPub 1 Agenda Shared Issues by IPv4 and IPv6 Specific Issues
Make a folder named Lab3. We will be using Unix redirection commands to create several output files in that folder.
CMSC 355 Lab 3 : Penetration Testing Tools Due: September 31, 2010 In the previous lab, we used some basic system administration tools to figure out which programs where running on a system and which files
HughesNet Broadband VPN End-to-End Security Enabled by the HN7700S-R
HughesNet Broadband VPN End-to-End Security Enabled by the HN7700S-R HughesNet Managed Broadband Network Services include a high level of end-toend security utilizing a robust architecture designed by
Lab Objectives & Turn In
Firewall Lab This lab will apply several theories discussed throughout the networking series. The routing, installing/configuring DHCP, and setting up the services is already done. All that is left for
Secure Software Programming and Vulnerability Analysis
Secure Software Programming and Vulnerability Analysis Christopher Kruegel [email protected] http://www.auto.tuwien.ac.at/~chris Operations and Denial of Service Secure Software Programming 2 Overview
Description: Objective: Attending students will learn:
Course: Introduction to Cyber Security Duration: 5 Day Hands-On Lab & Lecture Course Price: $ 3,495.00 Description: In 2014 the world has continued to watch as breach after breach results in millions of
IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT
IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT Roopa K. Panduranga Rao MV Dept of CS and Engg., Dept of IS and Engg., J.N.N College of Engineering, J.N.N College of Engineering,
Nixu SNS Security White Paper May 2007 Version 1.2
1 Nixu SNS Security White Paper May 2007 Version 1.2 Nixu Software Limited Nixu Group 2 Contents 1 Security Design Principles... 3 1.1 Defense in Depth... 4 1.2 Principle of Least Privilege... 4 1.3 Principle
Module 8. Network Security. Version 2 CSE IIT, Kharagpur
Module 8 Network Security Lesson 3 Firewalls Specific Instructional Objectives On completion of this lesson, the students will be able to answer: What a firewall is? What are the design goals of Firewalls
Topics in Network Security
Topics in Network Security Jem Berkes MASc. ECE, University of Waterloo B.Sc. ECE, University of Manitoba www.berkes.ca February, 2009 Ver. 2 In this presentation Wi-Fi security (802.11) Protecting insecure
NETWORK SECURITY (W/LAB) Course Syllabus
6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 NETWORK SECURITY (W/LAB) Course Syllabus Course Number: NTWK-0008 OHLAP Credit: Yes OCAS Code: 8131 Course Length: 130 Hours Career Cluster: Information
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected