Advanced Network Security

Microsoft news and product information from microsoft.com and product team blogs

noreply@blogger.com (iSecurity) — Tue, 30 Dec 2008 10:06:00 +0000

Microsoft Research:

The Betweenness Centrality Game for Strategic Network Formations In computer networks and social networks, the betweenness centrality of a node measures the amount of information passing through the node when all pairs are conducting shortest-path exchanges. In this paper, we introduce a strategic network-formation game based on the betweenness centrality.

Data security in e-business using intrusion signature analysis.

noreply@blogger.com (iSecurity) — Sun, 16 Nov 2008 00:51:00 +0000

Data security in e-business using intrusion signature analysis.
ABSTRACT - Data security is becoming one of the most serious problem threaten e-business
activity. Most people still worry about their personal information, especially their financial data
can be exposed to those computer criminal. Signature analysis system is the system that can help
detecting known attacking signature by detecting IP packet travel into the system. If any of the
packet match the database of the known attacking signature, the system should then alert the
administrator by e-mail or short message service (SMS) directly into administrator’s mobile
phone, to help them tackle security problem as soon as it happen. The detail of suspected IP
packet also written to relational database system for later analyze. This study conduct by using
all free open source software on Linux system machine.
KEY WORDS - Signature analysis, Security, Hack, Crack, Intrusion Detection.
บทคัดย่อ – ความปลอดภัยของข้อมูลสิ่งซึ่งมีความสำ คัญและเป็นปัจจัยสำ คัญที่ส่งผล
กระทบโดยตรงต่อกิจกรรมธุรกิจทางอิเลคทรอนิคส์ ผู้คนส่วนใหญ่ยังคงมีความกังวล
เกี่ยวกับข้อมูลส่วนตัวของตนเอง โดยเฉพาะอย่างยิ่งข้อมูลทางด้านการเงินอาจรั่วไหล
ไปสูเ่ หล่าอาชญากรทางอิเลคทรอนิคส์ได้ ระบบการวิเคราะห์รูปลักษณะการบุกรุก เป็น
ระบบที่จะสามารถช่วยในการตรวจจับการบุกรุกทางเครือข่ายโดยเทคนิคการตรวจสอบ
ชุดข้อมูล IP ที่เดินทางผ่านเข้ามายังระบบ ซึ่งหากตรวจพบแล้วก็จะทำ การแจ้งเตือนไป
ยังผูบ้ ริหารระบบโดยทางจดหมายอิเลคทรอนิคส์หรือทางบริการข้อความสั้น (SMS) ไป
ยังเครื่องโทรศัพท์เคลื่อนที่ของผู้บริหารระบบให้สามารถเข้ามาแก้ไขปัญหาที่เกิดขึ้นได้
ทันท่วงที รายละเอียดของชุดข้อมูล IP ที่ต้องสงสัยนั้น ก็จะถูกบันทึกลงในฐานข้อมูล
เชิงสัมพันธ์ เพื่อให้สามารถทำ การวิเคราะห์รายละเอียดเพิ่มเติมในภายหลังได้ต่อไป ใน
งานวิจัยครั้งนี้ทำ การศึกษาโดยใช้ซอฟต์แวร์แบบเปิดเผยรหัสชนิดให้เปล่าบนระบบ
ปฏิบัติการลินุกซ์
คำ สำ คัญ – การบุกรุกทางเครือข่าย, การตรวจจับการบุกรุก, ชุดข้อมูล IP
1. Introduction
Nowadays computer network security becoming more and more important issues. As all of the
computer become connected through local or wide area network or even the Internet. Business
organization use the network as part of the business strategy to become the advantage over their
competitors. And the network itself can become threaten to their computer system. Their valuable IT
resources can be threaten by various type of security. This study will be conduct by using Linux
machine act as Intranet server , installing necessary software to work in the manner design by
researcher. The Signature Analysis System can be used efficiently with other security tools especially
the well known firewall system.
2. Scope of this study
Scope of this study will be on the TCP/IP protocol suite. As TCP/IP is becoming world’s
standard protocol used in both small and large network. TCP/IP is also base system for many
important services available on the Internet such as www, ftp, e-mail etc. The system developed in
this study will capture all IP datagram comparing to the known pattern of attacking. If the pattern is
matched, the alert subsystem will work by sending e-mail to the administrator and short message
service (SMS). The detail of the IP suspected datagram will also keep into the relational database
system, namely Postgresql for later query the detail of the attacking.
3. Objective of the study.
Objective of this study is to
• Study the problem of computer network security
• Study the system currently available security system from various research system and
commercial security system.
• Analysis and design security system that can alert the network administrator through the e-mail
and SMS.
• Presenting an appropriate practice to maintain security of the system which can be easily
followed and can be really used.
4. Computer Network Security.
Computer Network Security can be classified into 4 categories [1]
• Secrecy is the practice to keep the data secret and will only be accessible by authorized person.
• Authentication concerning process to prove that the person or process being communicate with is
the real person or process they told.
• Nonrepudiation is the protection against denial of any responsibility , concerning signature which
will prove that the person or client is the one that is desirable. Also this will prove to make sure
that the received message is not from the malicious intention.
• Integrity control is the control the correctiveness of message to be as it was supposed to be
such as sending registered mail or the encryption of data using password.
5. Person who can be dangerous.
Person threaten to computer network security can be classify into [2].
5.1 Hackers
The generic term applies to computer enthusiasts who take pleasure in gaining access to other
people’s computer or networks. Many hackers are content with simply breaking in and leaving their
“footprints”, which are joke applications or messages on computer desktops. Other hackers, often
referred to as “crackers” are more malicious, crashing entire computer system, stealing or damaging
confidential data, defacing Web pages, and ultimately disrupting business. Some amateur hackers
merely locate hacking tools online and deploy them without much understanding of how they work or
their effects.
5.2 Unaware Staff
As employees focus on their specific job duties, they often overlook standard network security
rules. For example, they might choose passwords that are very simple to remember so that they can
log on to their network easily. However, such passwords might be easy to guess or crack by hackers
using simple common sense or widely available password cracking software utility. Employees can
unconsciously cause other security breaches including the accidental contraction and spreading of
computer viruses. One of the most common ways to pick up a virusis from a floppy disk or by
downloading files from the Internet. Employees who transport data via floppy disks can unwittingly
infect their corporate networks with viruses they picked up from computers in copy centers or
libraries. They might not even know if viruses are resident on their PCs. Corporations also face the risk
of infection when employees download files, such as PowerPoint presentations, from the Internet.
Surprisingly, companies must also be wary of human error Employees, whether they are computer
novices or computer savvy, can make such mistakes as erroneously installing virus protection software
or accidentally overlooking warnings regarding security threats.
5.3 Disgruntled Staff
Far more unsettling than the prospect of employee error causing harm to a network is the
potential for an angry or vengeful staff member to inflict damage. Angry employees, often those who
have been reprimanded, fired, or laid off, might vindictively infect their corporate networks with
viruses or intentionally delete crucial files. This group is especially dangerous because it is usually far
more aware of the network, the value of the information within it, where high-priority information is
located, and the safeguards protecting it.
5.4 Snoops
Whether content or disgruntled, some employees might also be curious or mischievous.
Employees known as "snoops" partake in corporate espionage, gaining unauthorized access to
confidential data in order to provide competitors with otherwise inaccessible information. Others are
simply satisfying their personal curiosities by accessing private information, such as financial data, a
romantic e-mail correspondence between coworkers, or the salary of a colleague. Some of these
activities might be relatively harmless, but others, such as previewing private financial, patient, or
human resources data, are far more serious, can be damaging to reputations, and can cause financial
liability for a company.
6. Proposed Signature Analysis System Design.
The Signature Analysis System required by this study is the system that can monitor any
suspected intrusion attempted by capturing all IP packet running within the monitored system. if any
of the IP packet in the system have been founded containing the known signature, this should be
assumed to be an intrusion attempt has occured. The system will alert system administrator by e-mail
and/or short message service (SMS). The detail of the intrusion activities such as activity type, IP
address, date and time of occurrence will also keep into relational database system for later detail
investigation. Design of this system fall into 8 subsystem. (figure 1)
Intrusion
Detection
Subsystem
(Snort)
Linux’s System
logger
(syslogd)
Relational Database
System
(Postgresql)
Incident
Analysis Tools
(ACID)
www Services
(Apache + PHP)
Log file checking
subsystem.
(Logcheck)
SMS
Sending
Subsystem
(smsd)
E-mail Sending
Subsystem
(sendmail)
Any changed in alert file
Figure 1- Illustrate all major subsystem of the Network Intrusion Detection System
6.1 Intrusion Detection Subsystem.
Main part of the system which function is to capture all IP datagram running within the
monitored system (packet originated both from inside or outside the enterprise network should be
captured) and analyze content of the datagram. Comparing datagram with database of intrusion
signature, if found it will put all the detail of the datagram to database subsystem (Postgresql).
Moreover the brief detail of the intrusion activity will also send to system logger daemon
(syslogd).
This subsystem is implemented using lightweight network intrusion detection system called
Snort. Snort has been created by Martin Roesch which based on the libpcap packet capture
library, commonly used in may TCP/IP traffic sniffers and analyzers. It can perform protocol
analysis, content searching/matching, and can be used to detect a variety of attacks and probes,
such as buffer overflow, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts,
and much more.
Snort use database of known attacking pattern, also known as signature which came from
various source to create rules. Information about Intrusion signature came from web site that
specialize in security. User can create their own rule based on the known attacking signature.
6.2 Relational Database Subsystem.
The database subsystem will function as main storage area of the system where the
Intrusion Detection Subsystem send all detail captured to. The system administrator can use the
database as the main source where they can trace back to the activities that had happen to their
system and may used as source where they can trace back to the origin of the intruder.
6.3 Incident Analysis Tools
Data collected in the database may be large and hard to analyze. To make analysis of the
data not a tedious job a subsystem is needed. Analysis Console for Incident Databases (ACIS) was
chose. The subsystem is PHP-based analysis tool that can help analysis of the data much more
efficient.
6.4 WWW services subsystem.
This subsystem is function as a main interface for system administrator so that they can use
their web browser to query for further detailed. This subsystem work in accordance with prior
subsystem.
6.5 System Logger.
System logger is common process that exist in major operating system. In this study the
system logger of Linux (syslogd) was used as starting point of alerting subsystem by create log
file and write any alert data received from Intrusion Detection Subsystem to this file.
6.6 Logfile Cheking Subsystem.
This subsystem’s function is to checking for any changed in the alert log file, any changed
in the log file will activate another two subsystem to alert system administrator.
6.7 Mail Sending Subsystem.
Sending alert through e-mail is one major alerting mechanism in this study. Alerting through
e-mail can give moderate detail of the event. Sendmail is activated whenever the logfile
checking mechanism found any change in the alert log file.
6.8 SMS Sending Subsystem.
This subsystem responsible in communication with GSM digital mobile phone system using
AT command. The system also activate by log file checking mechanism. Major advantage of this
subsystem is that it can send alert message as soon as the intrusion occurred. However the major
drawback of this subsystem is the limited amount of data that can be send at a time.
7. System Implementation and Testing Result.
Signature Analysis System developed in this study has been tested on Linux based Internet
/Intranet Server of 50 clients. The server connect to Internet through two interfaces one is
Ethernet which link to Bangkok headoffice through Satellite communication. The other interface is
dial-up modem connected to Internet Service Provider as a backup channel. The system normally
served as proxy-cache server, DNS server, FTP server, Intranet Web Server. After installing all
required subsystem and making necessary configuration, It can detect many intrusion attempted
both by technical staff who want to test the system and by the real intrusion attempted by staff
from other department. Testing of the system has been done by using tools and some technique
of the well known intrusion attempts and try to break into the Linux Server. The system can send
alert to system administrator both by e-mail and SMS. However some limitation of the system is
7.1 The system developed in this study use all separated free open-source software set up to work
together so the configuration of the whole system is quite tedious and need the understanding all
that component’s configuration.
7.2 The alerting mechanism, if not properly configure can send lots of message to administration
and become a e-mail bomb or sms bomb itself.
7.3 System administrator should always keep the database of signature up-to-date so that it can
detected the most recent technique of intrusion.
8. Conclusion
Signature Analysis System is one major that tool that should be implemented by all
organization interest in e-business activities. As security is the most important issue that can cause
customers or trade partners to be uncertain of their electronics activities. The common used
security tools is firewall which act like security guard that checking any data coming in and out of the
system, if the data coming in or out pass the rules specified by firewall administrator it can go in and
out of the system regardless of what activity that data should effect the system. The Signature
Analysis System on the other hand, is like surveillance system that keep an eye on all activity within a
system regardless of the origin of the activity, if found any suspected activity it will log and alert the
system administrator or even stop related process. Working together of both tools can help improve
the system security.
References
[1] Prasong Praneetpolgrang, Management Information System, Thanathach Press, Bangkok, 2000,pp
447-448
[2] Graham,Robert. , FAQ : Network Intrusion Detection Systems , ,[Online] Available
http://www.robertgraham.com/ pubs/network-intrusion-detection.html [ September 2, 2001]
[3] Frederick, Karen. (2001, March 28 – last update) Network Monitoring for Intrusion Detection
[Online] Available http://www.securityfocus.com/focus/ids/ articles/networmon.html [ September
2, 2001]
[4] Frederick, Karen. (2000, October 13 - last update) Abnormal IP Packets [Online] Available
http://www.securityfocus.com/focus/ids/articles/abnormal1.html [September 2, 2001]
[5] Elson, David. (2000, March 27 - last update) Intrusion Detection, Theory and Practice [Online]
Available http://www.securityfocus.com/focus/ids/articles/ davidelson.html [ September 2, 2001]
[6]. Elson, David (2000, May 22 -last update) Intrusion Detection on Linux [Online] Available
http://www.securityfocus.com/focus/ids/articles/linux-ids.html [September 2, 2001]
[7] MacBride, Robert. (2000, April 6 -last update) Intrusion Detection : Filling in the Gaps [Online]
Available http://www.securityfocus.com/focus/ids/articles/ robmacbride.html [ September 2, 2001]
[8] Cisco Systems ( 2001 ) A Beginner’s guide to Network Security[Online] Available
http://www.cisco.com/warp/public/cc/so/neso/sqso/beggu_pl.pdf [ September 9, 2001]
[9]. Enterprise Management Associates . ( 2000, May ) An Introduction to Network Security ,[Online]
http://www.solsoft.com/library/ema_whitepapers.pdf [ September 9, 2001]
[10]. Jai Sundar Balasubramaniyan, et al. ( 1998, June 11 ) An Architecture for intrusion Detection
using Autonomous Agents. Center for Education and Research in Information Assurance and
Security, Purdue University. [Online] Available
http://www.cerias.purdue.edu/homes/aafid/docs/tr9805.pdf [ September 9, 2001]
[11] Lee, Wenke ,et al. A Data Mining Framework for building Intrusion Detection Model. Computer
Science Department, Columbia University. [Online] Available
http://www.snort.org/docs/ieee_sp99_lee.ps [ September 9, 2001]
[12] Brandenburg University of Technology at Cottbus. The Intrusion Detection System AID. [Online]
Available http://www-rnks.informatik.tu-cottbus.de/~sobirey/aid.e.html [September 9, 2001]

Symantec NAC upgraded

noreply@blogger.com (iSecurity) — Sun, 10 Aug 2008 01:56:00 +0000

Integrates on-demand client into Symantec Network Access Control

Enterprises can expect more consumer devices to enter their networks, says analyst Zeus Kerravala. The key is controlling how much access they get

BANGALORE, INDIA: Symantec has upgraded Symantec Network Access Control, providing enforcement for managed endpoints, guest users and unmanaged devices. Symantec is helping customers reduce overall cost and simplify network access control deployment by integrating the on-demand client into Symantec Network Access Control.

Symantec is releasing an upgrade to Symantec Network Access Control (NAC), which will allow IT administrators to exert control over unmanaged devices and set customized levels of access for guest users entering their corporate networks.

The upgrade is available at no additional cost to customers under warranty or maintenance. The software image will be available for download from Symantec’s Web site on Aug. 15.

In addition, consolidated network access control policy configuration and management for managed and guest users can all be done through the Symantec Endpoint Protection Manager. The Symantec Network Access Control upgrade is scheduled to be available in August 2008.

An integrated, dissolvable on-demand client for guest user access can now be delivered directly from the Symantec Network Access Control Enforcer appliance in Gateway or DHCP modes to simplify deployment.

This helps ensure that unmanaged endpoints attempting to connect to corporate networks have the appropriate protection and security software installed. The on-demand client performs predefined checks to ensure that antivirus, antispyware, firewall and service pack software is installed and up-to-date.

"This critical expansion of our network access control capabilities allows customers to centrally enforce endpoint compliance policies for both managed and unmanaged endpoints, through integration with Symantec Endpoint Protection, and guest users," said Brad Kingsbury, senior vice president, Endpoint Security and Management Group, Symantec Corp. "With Symantec Network Access Control, we have taken a flexible approach that goes beyond host-based enforcement and offers customers an array of options for enforcing network access control on the network."

Symantec Network Access Control also supports authentication and identity-based access control for guest users by offering a new Web login that can be enabled as part of the on-demand client download process. Users can be authenticated against logins centrally stored in ActiveDirectory, LDAP, RADIUS or logins stored locally on the Enforcer. When used with LAN Enforcement, RADIUS attributes can control which resources guest users can access on the network once they have authenticated.

Furthermore, enhanced MAC address authentication functionality enforces network access for unmanaged devices in 802.1x-enabled environments. In LAN Enforcement mode, the Enforcer can check the MAC address of a device connecting to an 802.1x-enabled switch port, validate it against a store of known/authorized MAC addresses, and allow or block the device depending on whether it finds a match.

“We’ve actually brought all of the power of Symantec’s NAC agent for managed systems and put up that for the unmanaged world,” said senior manager of product management Rich Langston, who runs the NAC product line.

The on-demand product is a brand new, ground-up rewrite for unmanaged devices that gives administrators the exact same capabilities they currently have with the managed agent for guests and contractors, he explained.

It works by having users access the network through a Web browser, which takes them to a portal that requires a login. After presenting valid credentials, users download the on-demand agent, which runs in resident memory and dissolves when the user exits the system.

The agent ensures unmanaged devices meet predefined criteria for endpoint compliance before connecting to the network. This includes appropriate levels of security and protection, including up-to-date antivirus, antispyware, firewall and service pack software.

If a device fails to meet the criteria, automated remediation capabilities can work to resolve the issue. “Some of the competing solutions will take the user to a Web page and say, ‘You’re not on the network because your antivirus isn’t up-to-date so click on this URL,’” said Langston. “We automate everything.”

Non-compliant devices can be blocked or quarantined from the network. “The idea is to keep the network safe by keeping impurely configured systems off the network,” he said.

Symantec Network Access Control securely controls access to corporate networks, enforces endpoint security policy and easily integrates with existing network infrastructures. Regardless of how endpoints connect to the network, Symantec Network Access Control discovers and evaluates endpoint compliance status, provisions the appropriate network access, provides automated remediation capabilities, and continually monitors endpoints for changes in compliance status. The result is a network environment where corporations realize significant reductions in security incidents, increased levels of compliance to corporate IT security policy and confidence that endpoint security mechanisms are properly enabled.

Page 1 of 2

Symantec NAC upgrade aims at manageability
By: Jennifer Kavur - Network World Canada (01 Aug 2008)

Enterprises can expect more consumer devices to enter their networks, says analyst Zeus Kerravala. The key is controlling how much access they get

Symantec is releasing an upgrade to Symantec Network Access Control (NAC), which will allow IT administrators to exert control over unmanaged devices and set customized levels of access for guest users entering their corporate networks.

The upgrade is available at no additional cost to customers under warranty or maintenance. The software image will be available for download from Symantec’s Web site on Aug. 15.

“We’ve actually brought all of the power of Symantec’s NAC agent for managed systems and put up that for the unmanaged world,” said senior manager of product management Rich Langston, who runs the NAC product line.

The on-demand product is a brand new, ground-up rewrite for unmanaged devices that gives administrators the exact same capabilities they currently have with the managed agent for guests and contractors, he explained.

It works by having users access the network through a Web browser, which takes them to a portal that requires a login. After presenting valid credentials, users download the on-demand agent, which runs in resident memory and dissolves when the user exits the system.

The agent ensures unmanaged devices meet predefined criteria for endpoint compliance before connecting to the network. This includes appropriate levels of security and protection, including up-to-date antivirus, antispyware, firewall and service pack software.

If a device fails to meet the criteria, automated remediation capabilities can work to resolve the issue. “Some of the competing solutions will take the user to a Web page and say, ‘You’re not on the network because your antivirus isn’t up-to-date so click on this URL,’” said Langston. “We automate everything.”

Non-compliant devices can be blocked or quarantined from the network. “The idea is to keep the network safe by keeping impurely configured systems off the network,” he said.

Another key feature of the upgrade is a new Web login for guest users. “We now have the capability of giving them different levels of access,” said Langston. “This is important because most enterprises are interested in giving as little access to the network as necessary. For example, they might want to offer Internet access as a courtesy to casual guests, vendors, or the board of directors…If anything changes, they will get kicked off the network,” said Langston.

“We really have one the most powerful agents for client-side NAC that is available, which means that we are fully on board with the client,” said Langston. This includes performing very deep inspections of endpoints to make sure they are compliant with “all the policies the administrator wants…whatever his policies may be.”

CISCO Network Admission Control

noreply@blogger.com (iSecurity) — Fri, 08 Aug 2008 11:35:00 +0000

The Cisco® NAC Guest Server adds a new Secure Guest service to existing Cisco Network Admission Control (NAC) services such as authentication, posture, and profiling. The new Cisco NAC Guest Server enables simple, efficient, and secure management of guest network access. Cisco NAC Guest Server works with either Cisco NAC Appliance or Cisco wireless LAN controllers to manage the entire lifecycle of guest access, including:
• Provisioning: Allows any internal sponsor to create guest accounts

• Notification: Provides access details to the guest by print, e-mail, or text message

• Management: Makes it easy to modify and suspend accounts

• Reporting: Provides full reporting on guest accounts and guest activity

Cisco NAC Guest Server helps IT staff deal with administrative challenges commonly associated with supporting corporate visitors. The Secure Guest service enhances IT's ability to protect its own organization's assets, employees, and information from guests and their devices while providing secure and flexible network access to meet visitors' business needs. Cisco NAC Guest Server with its Secure Guest service delivers the following business benefits:
• Decreases deployment and management costs. Cisco NAC Guest Server allows trusted employees to create guest accounts quickly and securely. This removes the burden from IT and helpdesk personnel.

• Improves productivity. Streamlined account provisioning and notification processes help increase both guest usage and the productivity benefits for internal users and their guests.

• Improves customer and partner satisfaction. Providing guest access for visitors enables greater collaboration. Customers and partners alike appreciate this capability.

To learn more about Cisco NAC Guest Server and its Secure Guest service, visit the following resources:
• Product bulletin (including ordering information): http://www.cisco.com/en/US/products/ps6128/prod_bulletin0900aecd806f3235.html
• Data sheet: http://www.cisco.com/en/US/products/ps6128/products_data_sheet0900aecd806e98c9.html
• Q&A: http://www.cisco.com/en/US/products/ps6128/products_qanda_item0900aecd806f525a.shtml

Volume I: NAC Framework Architecture and Design (Networking Technology) (Paperback)
Volume II: NAC Deployment and Troubleshooting (Networking Technology) (Paperback)

Product Description

Cisco Network Admission Control

Volume I: NAC Framework Architecture and Design

A guide to endpoint compliance enforcement

Today, a variety of security challenges affect all businesses regardless of size and location. Companies face ongoing challenges with the fight against malware such as worms, viruses, and spyware. Today’s mobile workforce attach numerous devices to the corporate network that are harder to control from a security policy perspective. These host devices are often lacking antivirus updates and operating system patches, thus exposing the entire network to infection. As a result, worms and viruses continue to disrupt business, causing downtime and continual patching. Noncompliant servers and desktops are far too common and are difficult to detect and contain. Locating and isolating infected computers is time consuming and resource intensive.

Network Admission Control (NAC) uses the network infrastructure to enforce security policy compliance on all devices seeking to access network computing resources, thereby limiting damage from emerging security threats. NAC allows network access only to compliant and trusted endpoint devices (PCs, servers, and PDAs, for example) and can restrict the access of and even remediate noncompliant devices.

Cisco Network Admission Control, Volume I, describes the NAC architecture and provides an in-depth technical description for each of the solution components. This book also provides design guidelines for enforcing network admission policies and describes how to handle NAC agentless hosts. As a technical primer, this book introduces you to the NAC Framework solution components and addresses the architecture behind NAC and the protocols that it follows so you can gain a complete understanding of its operation. Sample worksheets help you gather and organize requirements for designing a NAC solution.

Denise Helfrich is a technical program sales engineer that develops and supports global online labs for the World Wide Sales Force Development at Cisco®.

Lou Ronnau, CCIE® No. 1536, is a technical leader in the Applied Intelligence group of the Customer Assurance Security Practice at Cisco.

Jason Frazier is a technical leader in the Technology Systems Engineering group for Cisco.

Paul Forbes is a technical marketing engineer in the Office of the CTO, within the Security Technology Group at Cisco.

Understand how the various NAC components work together to defend your network
Learn how NAC operates and identifies the types of information the NAC solution uses to make its admission decisions
Examine how Cisco Trust Agent and NAC-enabled applications interoperate
Evaluate the process by which a policy server determines and enforces a policy
Understand how NAC works when implemented using NAC-L2-802.1X, NAC-L3-IP, and NAC-L2-IP
Prepare, plan, design, implement, operate, and optimize a network admission control solution

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

Category: Cisco Press–Security

Covers: Network Admission Control

1587052415120506

About the Author

Denise Helfrich

is currently a technical program sales engineer developing and supporting global

online labs for the Worldwide Sales Force Delivery. For the previous six years, she was a technical marketing

engineer in the Access Router group, focusing on security for Cisco Systems. She is the author of

many Cisco training courses, including Network Admission Control. She has been active in the voice/

networking industry for over 20 years.

Lou Ronnau,

CCIE No. 1536, is currently a technical leader in the Applied Intelligence group of the

Customer Assurance Security Practice at Cisco Systems. He is the author of many Cisco solution guides

along with

Implementing Network Admission Control: Phase One Configuration and Deployment.

He

has been active in the networking industry for over 20 years, the last 12 years with Cisco Systems.

Jason Frazier

is a technical leader in the Technology Systems Engineering group for Cisco Systems.

He is a systems architect and one of the founders of Cisco’s Identity-Based Networking Services

(IBNS) strategy. Jason has authored many Cisco solution guides and often participates in industry

forums such as Cisco Networkers. He has been involved with network design and security for seven

years.

Paul Forbes

is a technical marketing engineer in the Office of the CTO, within the Security Technology

Group. His primary focus is on the NAC Partner Program, optimizing the integration between vendor

applications and Cisco networking infrastructure. He is also active in other security architecture initiatives

within the Office of the CTO. He has been active in the networking industry for ten years, as both a

customer and working for Cisco.

Product Description

Cisco Network Admission Control

Volume II: NAC Framework Deployment and Troubleshooting

The self-defending network in action

Jazib Frahim, CCIE® No. 5459

Omar Santos

David White, Jr., CCIE No. 12,021

When most information security professionals think about threats to their networks, they think about the threat of attackers from the outside. However, in recent years the number of computer security incidents occurring from trusted users within a company has equaled those occurring from external threats. The difference is, external threats are fairly well understood and almost all companies utilize tools and technology to protect against those threats. In contrast, the threats from internal trusted employees or partners are often overlooked and much more difficult to protect against.

Network Admission Control (NAC) is designed to prohibit or restrict access to the secured internal network from devices with a diminished security posture until they are patched or updated to meet the minimum corporate security requirements. A fundamental component of the Cisco® Self-Defending Network Initiative, NAC enables you to enforce host patch policies and to regulate network access permissions for noncompliant, vulnerable systems.

Cisco Network Admission Control, Volume II, helps you understand how to deploy the NAC Framework solution and ultimately build a self-defending network. The book focuses on the key components that make up the NAC Framework, showing how you can successfully deploy and troubleshoot each component and the overall solution. Emphasis is placed on real-world deployment scenarios, and the book walks you step by step through individual component configurations. Along the way, the authors call out best practices and tell you which mistakes to avoid. Component-level and solution-level troubleshooting techniques are also presented. Three full-deployment scenarios walk you through application of NAC in a small business, medium-sized organization, and large enterprise.

“To successfully deploy and troubleshoot the Cisco NAC solution requires thoughtful builds and design of NAC in branch, campus, and enterprise topologies. It requires a practical and methodical view towards building layered security and management with troubleshooting, auditing, and monitoring capabilities.”

—Jayshree V. Ullal, Senior Vice President, Datacenter, Switching and Security Technology Group, Cisco Systems®

Jazib Frahim, CCIE® No. 5459, is a senior network security engineer in the Worldwide Security Services Practice of the Cisco Advanced Services for Network Security team. He is responsible for guiding customers in the design and implementation of their networks with a focus on network security.

Omar Santos is a senior network security engineer in the Worldwide Security Services Practice of the Cisco Advanced Services for Network Security team. He has more than 12 years of experience in secure data communications.

David White, Jr., CCIE No. 12,021, has more than 10 years of networking experience with a focus on network security. He is currently an escalation engineer in the Cisco TAC, where he has been for more than six years.

Effectively deploy the Cisco Trust Agent
Configure Layer 2 IP and Layer 2 802.1x NAC on network access devices
Examine packet flow in a Cisco IOS NAD when NAC is enabled, and configure Layer 3 NAC on the NAD
Monitor remote access VPN tunnels
Configure and troubleshoot NAC on the Cisco ASA and PIX security appliances
Install and configure Cisco Secure Access Control Server (ACS) for NAC
Install the Cisco Security Agent Manage-ment Center and create agent kits
Add antivirus policy servers to ACS for external antivirus posture validation
Understand and apply audit servers to your NAC solution
Use remediation servers to automatically patch end hosts to bring them in compliance with your network policies
Monitor the NAC solution using the Cisco Security Monitoring, Analysis, and Response System (MARS)

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

Category: Cisco Press—Security

Covers: Network Admission Control

$60.00 USA / $75.00 CAN

About the Author

Jazib Frahim, CCIE No. 5459, has been with Cisco Systems for more than seven years. With a Bachelor’s degree in computer engineering from Illinois Institute of Technology, he started out as a TAC engineer with the LAN Switching team. He then moved to the TAC Security team, where he acted as a technical leader for the security products. He led a team of 20 engineers as a team leader in resolving complicated security and VPN technologies. Jazib is currently working as a Senior Network Security Engineer in the Worldwide Security Services Practice of Cisco’s Advanced Services for Network Security. He is responsible for guiding customers in the design and implementation of their networks, with a focus in network security. He holds two CCIEs, one in Routing and Switching and the other in Security. He also authored the Cisco Press book Cisco ASA: All-in-one Firewall, IPS, and VPN Adaptive Security Appliance(ISBN: 1-58705-209-1). Additionally, Jazib has written numerous Cisco online technical documents and has been an active member on Cisco’s online forum, NetPro. He has presented at Networkers on multiple occasions and has taught many onsite and online courses to Cisco customers, partners, and employees.

Jazib is currently pursuing a Master of Business Administration (MBA) degree from North Carolina State University.

Omar Santos is a Senior Network Security Consulting Engineer in the Worldwide Security Services Practice of Cisco’s Advanced Services for Network Security. He has more than 12 years of experience in secure data communications. Omar has designed, implemented, and supported numerous secure networks for Fortune 500 companies and the U.S. government, including the United States Marine Corps (USMC) and Department of Defense (DoD). He is also the author of the Cisco Press book Cisco ASA: All-in-one Firewall, IPS, and VPN Adaptive Security Appliance(ISBN: 1-58705-209-1) and many Cisco online technical documents and configuration guidelines. Prior to his current role, he was a technical leader of Cisco’s Technical Assistance Center (TAC), where he taught, led, and mentored many engineers within the organization. He is an active member of the InfraGard organization, a cooperative undertaking between the Federal Bureau of Investigation and an association of businesses, academic institutions, state and local law-enforcement agencies, and other participants that are dedicated to increasing the security of the critical infrastructures of the United States of America. Omar has also delivered numerous technical presentations to Cisco customers, partners, and other organizations.

David White, Jr., CCIE No. 12021, has more than ten years of networking experience with a focus on network security. He is currently an Escalation Engineer in the Cisco TAC, where he has been for more than six years. In his role at Cisco, he is involved in new product design and implementation and is an active participant in Cisco documentation, both online and in print. David holds a CCIE in Security and is also NSA IAM certified. Before joining Cisco, David worked for the U.S. government, where he helped secure its worldwide communications network. He was born and raised in St. Petersburg, Florida, and received his Bachelor’s degree in computer engineering from the Georgia Institute of Technology.

Enforce Security Policy Compliance
Enforce your organization's security policies on all devices seeking network access. Cisco Network Admission Control (NAC) allows only compliant and trusted endpoint devices, such as PCs, servers, and PDAs, onto the network, restricting the access of noncompliant devices, and thereby limiting the potential damage from emerging security threats and risks. Cisco NAC gives organizations a powerful, roles-based method of preventing unauthorized access and improving network resiliency.

Business Benefits
Security policy compliance: Ensures that endpoints conform to security policy; protects infrastructure and employee productivity; secures managed and unmanaged assets; supports internal environments and guest access; tailors policies to your risk level
Protects existing investments: Is compatible with third-party management applications; flexible deployment options minimize need for infrastructure upgrades
Mitigates risks from viruses, worms, and unauthorized access: Controls and reduces large-scale infrastructure disruptions; reduces OpEx and helps enable higher IT efficiency; integrates with other Cisco Self-Defending Network components to deliver comprehensive security protection
NAC Deployment Scenarios
Cisco NAC can be deployed in all infrastructure scenarios, including corporate LAN, WAN, wireless, and remote access (VPN). Cisco NAC deployments include the following options:

Cisco NAC Appliance is the recommended deployment solution for most customers. It is an appliance-based product that provides

Rapid deployment
Self-contained endpoint security posture assessment
Policy management
Integration with identity, remediation, and other services

Cisco NAC Appliance In-Band Option
This is the ideal option for wireless, remote access, and branch office applications, and works in heterogeneous network environments.

Cisco NAC Appliance Out-of-Band Option
This option is ideal for larger campus LAN deployments in which enforcement is controlled at the switch. Cisco NAC Out-of-Band can be combined with the Cisco NAC In-Band deployment option.

Cisco NAC Framework, through the Cisco Network Admission Control Partner Program, provides the option of integrating an intelligent network infrastructure with solutions from more than 75 manufacturers of leading antivirus and other security and management software.

NAC Deployment Services (PDF)
Cisco Security NAC Services provide rigorous requirements analysis, planning, design, and implementation consulting—essential to deploying an effective NAC solution.

Brochure
All contents are Copyright © 1992–2007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Cisco Expands Its NAC Leadership with the Cisco NAC Network Module and Cisco NAC Profiler
The new Cisco NAC Network Module for Cisco 2800 and 3800 Series Integrated Services Routers is the industry’s first full Network Admission Control (NAC) module. The Cisco NAC Network Module provides exceptional security for branch and remote offices, adds more NAC deployment options, and assists customers by simplifying deployment, troubleshooting, and management.
Cisco is also introducing the Cisco NAC Profiler, which adds new capabilities for endpoint device handling (including “dumb” devices such as IP phones, printers or scanners). The Cisco NAC Profiler provides visibility, intelligence, and automation to simplify initial NAC deployments and to reduce the ongoing NAC maintenance cost.
Read the complete Cisco NAC Network Module and Cisco NAC Profiler announcement.
For more technical information, read the Cisco NAC Network Module data sheet and the Cisco NAC Profiler data sheet.

Printed in USA C02-434732-00 9/07 All contents are Copyright © 1992–2007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.

McAfee Network Access Control

noreply@blogger.com (iSecurity) — Fri, 08 Aug 2008 11:11:00 +0000

McAfee System Protection
Protect your network from noncompliant or infected systems
Noncompliant, infected, or misconfigured systems pose security risks and incur costs due to system downtime and restoration. Even one infected host already on the network can cause disruptions to network bandwidth or can infect other compliant systems. Boost NAC with McAfee IntruShield® IPS to protect high-risk areas on the network by identifying, quarantining, and remediating infected devices.

About the Author
Jamey Heary, CCIE No. 7680, is currently a security consulting systems engineer at Cisco Systems, Inc., and works with its largest customers in the Northwest United States. Jamey joined Cisco in 2000. He currently leads its Western Security Asset team and is a field advisor for the U.S. Security Virtual team. Prior to working at Cisco, he worked for the Immigration and Naturalization Service as a network consultant and project leader. Before that he was the lead network and security engineer for a financial firm whose network carries approximately 12 percent of the global equities trading volume worldwide. His areas of expertise include network and host security design and implementation, security regulatory compliance, and routing and switching. His other certifications include CISSP, CCSP, and Microsoft MCSE. He is also a Certified HIPAA Security Professional. He has been working in the IT field for 13 years and in IT security for 9 years. He has a BS from St. Lawrence University.

About the Contributing Authors

Jerry Lin, CCIE No. 6469, is a consulting systems engineer for Cisco and is based in southern California. He specializes in security best practices. Jerry has worked with a variety of Cisco enterprise customers in areas such as software development, local government agencies, K—12 and universities, high tech manufacturing, retail, and health care, as well as managed web-hosting service provider customers. He holds his CCIE in routing and switching as well as in CCDP and CISSP. Jerry has been working in the IT industry for the past 12 years. During the late 1990s, he worked as a technical instructor. Jerry earned both a bachelor’s degree and a master’s degree in mechanical engineering from the University of California, Irvine.

Chad Sullivan, CCIE No. 6493 (Security, Routing and Switching, SNA/IP), CISSP, CHSP, is a senior security engineer and owner of Priveon, Inc., which provides leading security solutions to customers globally. Prior to starting Priveon, Chad worked as a security consulting systems engineer at Cisco. Chad is recognized within the industry as one of the leading implementers of the Cisco Security Agent product and is the author of both Cisco Press books dedicated to the Cisco Security Agent.

Alok Agrawal is the technical marketing manager for the Cisco NAC Appliance (Clean Access) product. He leads the technical marketing team developing technical concepts and solutions and driving future product architecture and features. He works with the Cisco sales and partner community to scale the adoption of the NAC Appliance product line globally. Prior to joining the Cisco Security Technology Group, he worked in the switching team of the Cisco Technical Assistance Center. He has a strong background in routing and switching and host security design and implementation. Alok holds a master’s degree in electrical engineering from the University of Southern California and a bachelor’s degree in electronics engineering from the University of Mumbai.

Mobile Workers and Guest Users May
Breed Security Threats and Pose Risk to Regulatory Compliance Juggling compliance audits with timely remediation of non-compliant, infected, and misconfigured systems can leave you vulnerable. Do you want to deploy a network access control (NAC) solution but feel frustrated with products that are unmanageable, very complex to deploy, and too expensive? Give yourself some breathing room with McAfee® Total Protection for Endpoint—Advanced, which includes McAfee Network Access Control solution. McAfee Network Access Control keeps you updated with new threat information while enforcing compliance, ensuring healthy networks, and addressing concerns about the cost, manageability, and complexity of most other NAC solutions.

NAC Benefits:
1. Minimize risk of outbreaks while allowing for policy flexibility
2. Protect your network from zero-day threats and infected guest devices; monitor the network continuously for threat assessment and attack behavior originating from all types of devices Minimize exposure from noncompliant, infected, or misconfigured systems
3. Allow only authorized devices to have network access: enforce compliance by scanning devices to test their overall security posture as they attempt to log onto a network Reduce downtime and risk
4. Guard against infections and vulnerabilities from mobile devices; identify and quarantine misconfigured systems and company laptops that fall out of compliance; enforce network access decision at the system level; remediate noncompliant devices automatically Make intelligent decisions based on real knowledge
5. Gain visibility of system and network threats with efficient security collaboration; breakthrough McAfee ePolicy Orchestrator® (ePO™) integration provides real-time visibility of actionable system host details, as well as the most relevant host IPS, anti-virus, and spyware events Leverage your existing network infrastructure
6. Deploy to all ePO managed systems in your network infrastructure without hardware replacements; get continuous, broad protection that keeps up with the latest threats with McAfee Total Protection for Enterprise—Advanced with NAC included; manage it all from a single, centralized console.

McAfee Makes NAC Accessible
You are not alone among enterprises that are reluctant to deploy an NAC solution. Prior options are unmanageable, too complex to deploy, and expensive—especially when you include product, deployment, and ongoing maintenance costs. McAfee addresses all of these concerns and more with:
McAfee addresses all of these concerns and more with a global partner ecosystem of distributors, value-added distributors (VADs), value-added resellers (VARs), and systems integrators, all offering product order fulfillment, professional services for deployment, and solution training for NAC administrators.

Yahoo Partners With McAfee To Make Search More Secure
Following Google (NSDQ: GOOG)'s lead, Yahoo (NSDQ: YHOO) is moving to make its search engine safer.
Yahoo and McAfee on Tuesday announced a partnership to integrate McAfee's SiteAdvisor technology with Yahoo Search. SiteAdvisor tracks Web site security issues, identifying sites associated with adware, malware, spyware, phishing, and spam.

More Security Insights White Papers CISSP Exam Tips Security vs. Flexibility: Must IT Management Choose? WebcastsWeb 2.0: Business Opportunity or Security Threat? Managing Risk and Bringing Rigor to Information Security ReportsWeb 2.0 Gets Down To Business Rolling Review: Microsoft NAP The new SearchScan feature in Yahoo Search is a manifestation of the partnership. It provides red warning messages about the risks posed by Web sites that appear in Yahoo Search results lists.
Google began flagging risky search results in February 2007.

"Searching on the Web can present a minefield of spyware, malware, and other malicious sites that can cause serious harm to your PC and cost you valuable time and money," said Vish Makhijani, senior VP and general manager of Yahoo Search, in a blog post. "We are taking steps to make you feel safe when searching the Web -- warning you about dangerous sites before you click on them."

According to Makhijani, "No other search engine today offers you this level of warning before visiting sites. Period."

Citing a March 2008 survey conducted by marketing research services provider Decipher, Yahoo and McAfee claim that 65% of Americans online are more worried about clicking unsecured search listings than the threat of neighborhood crime, getting one's wallet stolen, or e-mail scams. Unfortunately, Decipher hasn't posted this survey online, making it harder to divine why so many people supposedly prefer being pistol-whipped and robbed to a malware infection.

Tim Dowling, VP of McAfee's Web security group, said that SearchScan tests for browser exploits, so it will detect sites where malware is delivered through online ads.

According to a Google security report published in February, 2% of malicious Web sites were delivering malware via advertising. Because ads tend to be placed on popular sites, searchers encounter them more often than their general prevalence suggests. "On average, 12% of the overall search results that returned landing pages were associated with malicious content due to unsafe ads," the report said.

Flagging such sites, however, is not without problems. Web sites penalized by McAfee's scarlet letter may see a drop in visitors despite the possibility that the fault may lie with the security of the site's ad syndication network rather than with the hosting site itself. Still, fear of such stigma may make site owners demand better security at ad networks, which would improve Internet safety for everyone.

It's something of a surprise to find Yahoo striking a deal with McAfee given that McAfee in May 2007 fingered Yahoo as the search engine with the greatest percentage of risky search results (5.4%). But perhaps having partnered with McAfee, Yahoo will fare better in McAfee's forthcoming 2008 State of Search Engine Safety survey.

Asked whether Yahoo's new relationship with McAfee represents a conflict of interest that might affect the search engine's ranking in McAfee's upcoming survey, Dowling replied, "It's hard to say whether there's a real conflict of interest. It's a pretty quantitative study." He added that due to Yahoo's commitment to cleaner search results, "I would expect Yahoo to be the safest search engine, or one of them."

Dowling said McAfee was running a bit behind in compiling the data for its 2008 search safety survey but did provide a preview: Sponsored search results are twice as likely to link to malicious sites as organic search results, he said. "The bad guys try to look good and Internet advertising is a way they can buy their way into a higher search result position," he said.

Dowling also said that search engines collectively serve 8 billion risky sites per month worldwide.

Testimonials 1
I want to start out by saying that this book completely exceeded my expectations for the first NAC Appliance book. I wish this was published 3 years ago. The author clearly articulates the business benefits of NAC, including how NAC provides return on investment (ROI), which gives any reader the know-how to wisely purchase Cisco NAC Appliance. He also shows his technical expertise by diving extremely deep into the inner workings of Cisco NAC Appliance, which gives engineers, consultants, and operations the information they need to successfully deploy or maintain the product.

This book shows great details into the process flows of In-Band & Out-of-Band users, Clean Access Agent (CAA) users and network scanning users. The information on the different deployment options and how to use them in diverse environments is great to start your NAC Design. This book makes the confusing topics seem easy and manageable.

Some of the highlights that caught my eye and I thought everyone would like were:

- Chapter on Host Security Policy - An amazing deal of information on how to design/create a Host Security Policy as it relates to NAC Appliance is invaluable to deployments

- Exploration of High Availability and Load Balancing - Information on how to load balance Clean Access Servers using the CSM, CSS, ACE and PBR cannot be found anywhere else. This includes saving money on Failover Bundles by using N+1 Failover

- Layer 3 OOB Deployment options - Walk through of the benefits of the different methods of deploying L3 OOB, e.g. PBR, ACLS, VPNs, etc.

- Deployment Best Practices - An entire chapter on how to plan, schedule, and keep all parties happy for your NAC Appliance deployment

- Monitoring & Troubleshooting information - detailed list of all logs located on the CAM and CAS, as well as the information on how to troubleshoot and monitor online users

All in all this is a great book and I would recommend it for all people interested in Buying, Deploying, Operating, or Troubleshooting Cisco NAC Appliance. This is definitely a great reference manual to have at your desk!

Testimonials 2
The Cisco Self Securing Network platform is currently structured around several cornerstone technologies of which the Cisco Clean Access technology is a leading component. The Cisco Clean Access technology is one of several industry wide Network Admission Control (NAC) technologies which rely on a combination of client-server components. The Cisco Clean Access suite includes a client component which could be host-installed applet or a browser based applet that can read basic configuration data from a host machine and communicate compliance to enterprise defined rules/policies which are pre-defined on a clean access server appliance and other coorperating systems. The book, Cisco NAC Appliance is a good guide for administrators deploying this complex set of solutions brought from Perfigo Inc. after Perfigo's acquisition by Cisco 2006.

The book's organization and tone is aimed at security architects, security managers and security administrators. While a security architect will better understand the various deployment options and thus the place of the Cisco NAC framework in an enterprise, security managers will get a comprehensive enough view of the Cisco NAC framework to make the judgment call on actual deployment of the infrastructure and of course make decisions on cost/facility and better grapple with the potential cost benefit requests from enterprise's executive and the security administrator will have a quick guide handbook to help wade through the myriads of documentations from Cisco on its evolving SAFE architecture in general and the NAC framework in particular.

The organization of this book is excellent for the intended audience; six parts covering the basics of host security landscape, design of Cisco NAC appliance, developing a host security policy, the Cisco NAC configuration, some deployment best practices, and of course NAC appliance maintenance and troubleshooting. The six parts are laid out in fifteen accessible chapters spanning more than 500 pages with generous amount of configuration examples and screenshots.

With Cisco now having more than 45% market share in the endpoint access control market, books like these can only increase in importance as a guide to organizations grappling with the decision on what and where to deploy these technologies.

And for this volume, the taste of the pudding remains in the eating. So if you don't have a copy yet, go grab one (so long as you are interested in some endpoint security solutions now or at some point in the future). As for rating, I'll give it my best rating so far, four star out of five.

RADMIN - Remote Control Software

noreply@blogger.com (iSecurity) — Fri, 18 Jul 2008 03:37:00 +0000

RADMIN - Remote Control Software is Fast and Reliable Remote Control Software for Secure Remote Access to PC from Anywhere. Available on Windows Vista 32-bit and 64-bit Compatible (including Service Pack 1)

Radmin (Remote Administrator) is the world famous, award winning secure remote control software and remote access software which enables you to work on a remote computer in real time as if you were using its own keyboard and mouse.

Radmin (Remote Administrator) is fast and secure remote control and remote access software that enables you to work on a remote computer as if you were sitting right in front of it and access it from multiple places. Radmin includes full support for Windows Vista (32-bit and 64-bit), file transfer, multi-user text and voice chats, Windows security, Kerberos authentication, 256-bit AES encryption for all data streams, telnet access, multiple monitors support and unique DirectScreenTransfer™ technology. Radmin utilizes the ever-present TCP/IP protocol - the most widespread protocol used in LANs, WANs and the Internet. This means you can access your remote computer from anywhere in the world. Radmin is deployed on thousands of corporate PCs worldwide. Among our clients are companies where Radmin is the standard application for network management.

You view the remote computer's screen on your own monitor either in a window or full screen. All your mouse movements and keyboard signals are transferred directly to the remote computer. You work on the remote computer just as if it were right there in front of you. You can remotely access the same computer from multiple places and use advanced file transferring, text and voice chats, remote shutdown, Telnet and other useful features.

Radmin 3 consists of two modules:
The Viewer module (Radmin Viewer)
Radmin Viewer needs to be installed on the local computer (for example your home PC or notebook) which you want to use to access your remote computer.

The Server module (Radmin Server)
Radmin Server needs to be installed on the remote computer (for example your office PC) which you want to access from your own one.

Installing Radmin Server 3
The Server module needs to be installed on the remote computer (for example your office PC) that you want to access from your own one (for example your home PC or notebook).
Step 1: Run rserv32.exe to install Radmin Server.
Step 2: Follow the on-screen instructions. The installer will copy all required files into the default system directory.
Step 3: Please, remember to activate your newly installed copies of Radmin Server 3.

Installing Radmin Viewer 3
The Client module (also called the Viewer) needs to be installed on the local computer (for example your home PC or notebook) which you want to use to access your remote PC.

Step 1: Run rview32.exe to install Radmin Viewer.
Step 2: Follow the on-screen instructions and select an installation directory when asked. The installer will copy all required files into the specified directory.

FAQ

1. I can't connect to Radmin server. What can I do?

Check your connection to the remote host via TCP/IP: Type in the command prompt: ping remote_host_name
Ex: ping 10.0.0.1
Ex: ping myserver.mycompany.com
Make sure that radmin server is running on the remote computer. Verify that you are connecting to the correct port on which the radmin server is waiting for the incoming connection. Check the firewall settings on the remote computer. You can also examine Radmin’s logfile.txt to discover what's causing the problem.

2. I'm behind a router and don't have public IP address. What can I do?

Several situations are possible:

Your computers are in an internal network behind a NAT based router. Only the router has a public IP address. You can access your internal network computers via the Internet. To do this you need to configure 'Forwarding' on the router/firewall. Configure the router to forward connections from a port on the router to a specific IP address and port (Radmin server's default port is 4899) of the target computer in your internal network. You need to assign a port on the router for every computer you need to access. The router will then forward the connection to your computer in the internal network.
Your PCs have real IP addresses but the firewall has its port 4899 closed. In this case you have to open 4899 or use another open port.
Radmin Server does not start on the server. Examine the log file on the server for the reason.

Free Vulnerability Scan

noreply@blogger.com (iSecurity) — Tue, 15 Jul 2008 22:05:00 +0000

NetClarity offers FREE SCAN tool to findout if you have any
vulnerabilities ( Malware, Viruses, Worms, Trojans, Keyloggers and all
those nasty exploits are not the problem ) they can exploit, harden
your system and take a more proactive approach to securing your
personal computer.

http://www.netclarity.net/freescan.html

On completing the SCAN, please contact us for the full report unlock key.

NACwall are Network Access Control (NAC) appliances which scan
corporate networks for devices that may contain exposures or
vulnerabilities exploited by hackers that firewalls can't defend
against. NACwalls also alert customers and block against malicious and
un-trusted network access at all points on the network, whether wired
or wireless.

NACwall are proactive appliances that take just minutes to install.
Continuously scanning for vulnerability' s across every device on a
network, NACwalls can stop threats within milliseconds.

NACwall detect & respond to threats from network connected computers,
returning mobile users, wireless devices, new devices and even detect
´imitation´ users (spoofed machines). NACwalls respond in milliseconds
to un-trusted and potentially hazardous computer assets stunning off
their network access in less time than it took to read this sentence.

Network Access Control (NAC) is an approach to computer network security that attempts to unify endpoint security technology (such as antivirus, host intrusion prevention, and vulnerability assessment), user or system authentication and network security enforcement.

Network Access Control is a computer networking concept and set of protocols used to define how to secure the network nodes prior to the nodes accessing the network. NAC might integrate the automatic remediation process (fixing non-compliant nodes before allowing access) into the network systems, allowing the network infrastructure such as routers, switches and firewalls to work together with back office servers and end user computing equipment to ensure the information system is operating securely before interoperability is allowed.

Network Access Control (NAC) aims to do exactly what the name implies: control access to a network with policies, including pre-admission endpoint security policy checks and post-admission controls over where users and devices can go on a network and what they can do.

"NAC's roots trace back to the trusted computing movement. In this context an open-architecture was created as an alternative to proprietary NAC initiatives. TNC-WG aims at enabling network operators to provide endpoint integrity at every network connection, thus enabling interoperability among multi-vendor network endpoints.[3]"

Initially 802.1x was also thought of as NAC. Some still considers 802.1x as the most simple form of NAC, but most people think of NAC as something more.

Goals of Network Access Control
Because NAC represents an emerging category of security products, its definition is both evolving and controversial. The overarching goals of the concept can be distilled to:

Mitigation of zero-day attacks
The key value proposition of NAC solutions is the ability to prevent end-stations that lack antivirus, patches, or host intrusion prevention software from accessing the network and placing other computers at risk of cross-contamination of network worms.

Policy enforcement
NAC solutions allow network operators to define policies, such as the types of computers or roles of users allowed to access areas of the network, and enforce them in switches, routers, and network middleboxes.

Identity and access management
Where conventional IP networks enforce access policies in terms of IP addresses, NAC environments attempt to do so based on authenticated user identities, at least for user end-stations such as laptops and desktop computers.

Pre-admission and post-admission
There are two prevailing design philosophies in NAC, based on whether policies are enforced before or after end-stations gain access to the network. In the former case, called pre-admission NAC, end-stations are inspected prior to being allowed on the network. A typical use case of pre-admission NAC would be to prevent clients with out-of-date antivirus signatures from talking to sensitive servers. Alternatively, post-admission NAC makes enforcement decisions based on user actions, after those users have been provided with access to the network.

Agent versus agentless
The fundamental idea behind NAC is to allow the network to make access control decisions based on intelligence about end-systems, so the manner in which the network is informed about end-systems is a key design decision. A key difference among NAC systems is whether they require agent software to report end-system characteristics, or whether they use scanning and network inventory techniques to discern those characteristics remotely.

Out-of-band versus inline
In some out-of-band systems, agents are distributed on end-stations and report information to a central console, which in turn can control switches to enforce policy. In contrast the inline solutions can be single-box solutions which act as internal firewalls for access-layer networks and enforce the policy. Out-of-band solutions have the advantage of reusing existing infrastructure; inline products can be easier to deploy on new networks, and may provide more advanced network enforcement capabilities, because they are directly in control of individual packets on the wire. However, there are products that are agentless, and have both the inherent advantages of easier, less risky out-of-band deployment, but use techniques to provide inline effectiveness for non-compliant devices, where enforcement is required

Remediation, quarantine and captive portals
Network operators deploy NAC products with the expectation that some legitimate clients will be denied access to the network (if users never had out-of-date patch levels, NAC would be unnecessary). Because of this, NAC solutions require a mechanism to remediate the end-user problems that deny them access.

Two common strategies for remediation are quarantine networks and captive portals:

Quarantine
A quarantine network is a restricted IP network that provides users with routed access only to certain hosts and applications. Quarantine is often implemented in terms of VLAN assignment; when an NAC product determines that an end-user is out-of-date, their switch port is assigned to a VLAN that is routed only to patch and update servers, not to the rest of the network. Other solutions use Address Management techniques (such as Address Resolution Protocol (ARP) or Neighbor Discovery Protocol (NDP)) for quarantine, avoiding the overhead of managing quarantine VLANs.

Captive portals
A captive portal intercepts HTTP access to web pages, redirecting users to a web application that provides instructions and tools for updating their computer. Until their computer passes automated inspection, no network usage besides the captive portal is allowed. This is similar to the way paid wireless access works at public access points.

Benefits:
Minimize risk of outbreaks while allowing for policy flexibility
Protect your network from zero-day threats and infected guest devices; monitor the network continuously for threat assessment and attack behavior originating from all types of devices Minimize exposure from noncompliant, infected, or misconfigured systems

Allow only authorized devices to have network access: enforce compliance by scanning devices to test their overall security posture as they attempt to log onto a network Reduce downtime and risk

Guard against infections and vulnerabilities from mobile devices; identify and quarantine misconfigured systems and company laptops that fall out of compliance; enforce network access decision at the system level; remediate noncompliant devices automatically Make intelligent decisions based on real knowledge

Gain visibility of system and network threats with efficient security collaboration; breakthrough McAfee ePolicy Orchestrator® (ePO™) integration provides real-time visibility of actionable system host details, as well as the most relevant host IPS, anti-virus, and spyware events Leverage your existing network infrastructure

Deploy to all ePO managed systems in your network infrastructure without hardware replacements; get continuous, broad protection that keeps up with the latest threats with McAfee Total Protection for Enterprise—Advanced with NAC included; manage it all from a single, centralized console.

Features:

Dynamic NAC with IntruShield
Protect the internal organization from the threat of remote access, high-risk branch offices, or guest wireless networks by identifying, quarantining, and then remediating any infected device Flexible and powerful remediation options
Minimize helpdesk calls and make faster fixes on managed systems with automated remediation; for unmanaged systems, go to a user-directed remediation portal for quick results Broad enforcement options

Select from a variety of enforcement strategies, thanks to integration with ePO and a flexible architecture; protect against critical systems that cannot run agents with integrated McAfee Network Security Platform; add support for Microsoft NAP Framework Centralized management and control

Manage and control access to your network, along with your other system security protection, through a single console with ePO; get a bird's eye view or all the details about hosts and define policies; retrieve centralized reports of failed compliance checks and remediation action Protection from non-Microsoft® Windows devices

Monitor and assess threats and attacks from any device, including Macintosh and Unix systems and devices with embedded operating systems, like VoIP phones, printers, faxes, and copiers

Stealing the Network: How to Own the Box

noreply@blogger.com (iSecurity) — Fri, 11 Jul 2008 00:35:00 +0000

"Steal This Network" is not another of the countless hacker books out there, but an edgy, provocative, attack-oriented series of chapters written in a firsthand, conversational style. World-renowned network security personalities present a series of 25-to-30-page chapters written from the point of view of an attacker who is gaining access to a particular system.

Synopsis
"If you want to hack into someone else's network, the week between Christmas and New Year's Day is the best time. I love that time of year" (from Chapter 1, "Hide and Sneak"). Written by a team of network security professionals, this volume contains a series of fictional short stories demonstrating the techniques commonly used by criminal hackers. The appendix provides an overview of the "Laws of Security" and discusses ways to mitigate many of the attacks detailed in the book. Annotation © 2004 Book News, Inc., Portland, OR

Annotation
"Steal This Network" is not another of the countless hacker books out there, but an edgy, provocative, attack-oriented series of chapters written in a firsthand, conversational style. World-renowned network security personalities present a series of 25-to-30-page chapters written from the point of view of an attacker who is gaining access to a particular system.

Stealing the Network: How to Own the Box is a book about breaking into computer systems by various means, ranging from obtaining physical access to network intrusion. There are lots of books on computer security and on breaking into computer systems. What is unusual about this book is that it is composed of fictional stories based around various "exploits" to gain access to computer systems. The book has nine authors: Ryan Russel, Tim Mullen, FX, Dan Kaminsky, Joe Grand, Ken Pfeil, Ido Dubrawsky, Mark Burnett and Paul Craig. Each wrote a chapter, except for Ryan Russel who edited the book and wrote two chapters. All of the authors are involved in computer security or computer intrusion (or perhaps both at differing points in their lives).

The fictional nature of the book makes it readable, although Stealing the Network is not exactly Neuromancer. Most of the chapters revolve around a different fictional character using various methods for gaining unauthorized access to computer systems. These include "social engineering" - obtaining information or physical access by gaining the confidence of people at a company. Some are attacks are sophisticated. One vignette involves a beautiful woman hacker who specializes in hacking into printers.

One of the objectives of the authors of Stealing the Network is to get you to think about computer security in new ways. Before reading Stealing the Network I had never thought of printers as possible targets for intrusion attack. Printers have evolved into full network devices that run some form of operating system, which supports the network stack software. Although printers are increasingly powerful computers, they started out as dumb devices (raise your hand if you remember the old "chain" printers) so there is a tendency keep thinking of them as the dumb devices. This means that the network security on a printer may be non-existent. Since the printer can communicate with the rest of the network, it can serve as a platform for attack (as a network proxy if nothing else).

Although the characters in Stealing the Network are fictional, the techniques and software tools are real. The attack described in each chapter also includes a description of the software tools used (in some cases including the web site that publishes the software). The details of the attack are also broken down. Unless you have a real passion for the fine details of computer security and intrusion, these accounts can become tedious in places.

The appendix of Stealing the Network is titled Laws of Computer Security which attempts to summarize some of the issues raised in the stories. Stealing the Network is a valuable reference for those who want to understand current security exploits. The usefulness of the book as a reference is harmed by the fact that it does not include an index.

We wouldn't have to spend so much time, money, and effort on network security if we didn't have such bad software security. Think about the most recent security vulnerability about which you've read. Maybe it's a killer packet that allows an attacker to crash some server by sending it a particular packet. Maybe it's one of the gazillions of buffer overflows that allow an attacker to take control of a computer by sending it a particular malformed message. Maybe it's an encryption vulnerability that allows an attacker to read an encrypted message or to fool an authentication system. These are all software issues.

Bruce Schneier, from the forward to Building Secure Software: How to Avoid Security Problems the Right Way by John Viega and Gary McGraw, Addison-Wesley, 2002

Computer security is viewed by many people as "cool". Case, the cyberspace cowboy in Neuromancer hacking into computer systems. The mirror of Case is the computer security guru who protects the system with their vast store of knowledge. Some computer security "gurus" have even gained their fifteen minutes of media fame (can you say Satan). The truth is that network computer systems are vulnerable because of human limitations. While computer security is important, it may come as a shock to those who attend conferences like Black Hat to learn that computer security is not as cool as they think it is.

The design and implementation of secure computer networks, or at least networks that will not fall to most of the attacks described in Stealing the Network are not waiting for new results from computer science research or software engineering. As Bruce Schneier points out above, the problems that are encountered in computer security are frequently the result of well understood issues. For example, many of the computer network attacks that are described in Stealing the Network are buffer overflow attacks. Methods for avoiding buffer overflow problems have been known for something like 30 years.

There are two major historical factors that have lead to the poor state of computer security that prompts me to read books like Stealing the Network. These are:

Susceptibility to buffer overflow attack (as noted above)

The C/C++ programming languages have been used to implement every major operating system in use today (e.g., Windoz, UNIX and Linux). This includes the operating systems that run on network routers, like Cisco's IOS. Most, if not all, of the buffer overflow attacks result from the lack of compiled range checks in C/C++.

A range check allows buffer (array) overflows to be caught at runtime. For example, a potential buffer overflow problem exists in the code below (which calls the POSIX function gets).

#define SIZE 80
char buf[SIZE];

while (! gets( buf )) {
....
}

In this code a stream of text, terminated by a newline character, is read from the POSIX standard input (which might be connected to a TCP/IP socket). If the stream of text is longer than 80 characters, it will overwrite data which is stored following buf. A text stream of just the right size may overwrite the return address for a function (possibly the function that called the current function), allowing the attacker to insert and execute their own code.

Compilers for languages like Pascal and Java insert code that checks that an array (buffer) access is within the bounds of the memory allocated for the array. If there is an access beyond the end of the array, a runtime error will result. The software will fail, but the intruder will not gain access to the system.

The equality between arrays and pointers in C makes it very difficult, if not impossible to compile range checked into C. The designers of C (Kernighan and Ritchie) might have designed the language differently if they had realized that it would become the lingua franca of software. C was designed so that it could be efficiently translated into the Digital Equipment Corporation PDP instruction set. This allowed C to be used as an efficient vehicle to implement operating system software (e.g., the early versions of UNIX). The extra code generated by the compiler to support range checks was anathema to the concentration on efficiency in C.

Since every operating system in wide spread use has been implemented in C (or C++), the historical decisions in the C programming language resulted in many of the computer network vulnerabilities that exist today.

Microsoft Software

The most commonly attacked and penetrated computer systems run various versions of Microsoft's Windows operating system. The original root of the security problems in Windows based operating systems comes from the fact that Microsoft's model for computation is a computer system, running Microsoft Windows, on every desktop, joined by a network that supports simple operations like printing. Unlike UNIX, which evolved on systems joined by the Internet, the Internet was not part of Microsoft's world view until it exploded into popular culture. In Microsoft's view, computers running Windows would only communicate with other computers running Windows within a corporate network. The Web did not exist in this world view and computer networks where not heavily connected to the outside world. As a result, network security was not an issue Microsoft considered much.

Microsoft implemented features like OLE (Object Linking and Embedding) which allows a Microsoft Word document to include a spread sheet constructed with Microsoft Excel. By clicking on the spread sheet you can bring up Excel and make changes in the spread sheet. By allowing code execution to be started from a document, which could be sent via e-mail, Microsoft laid the foundation for security holes which are probably still not fixed.

All this is old history with Microsoft and a larger question exists: Why did Microsoft not take action to re-architect their software when it became obvious that the foundation for their design view was wrong? The fact that viruses have exploited vulnerabilities in Microsoft e-mail for years is simply inexcusable.

As Stealing the Network points out, there is no way to build a computer system that cannot be successfully attacked by some means. If nothing else, high levels of security make computer systems difficult to use. UNIX was designed in reaction to the secure, but difficult to use, MULTICS operating system. Systems that are difficult use to may be compromised as their users open holes to make their jobs easier.

While recognizing the limitations of computer security, it is still obvious that computer security could be greatly improved if people simply applied the knowledge that engineers and computer scientists have had for many years. Many of the vulnerabilities exploited by the characters in Stealing the Network would not exist if this happened. Firewalls and network intrusion detection systems exist to protect against problems that could have been avoided.

A Note on Terminology
The computer security/hacker community, like any community, has developed their own set of jargon. Some of this is generally familiar in the software world. The one term that I found unfamiliar was the term "0-day exploit". I did not find an explaination for this term in this book, but I later found that it means an exploit with 0-days of warning before the attack.

For example, it frequently happens that a vulnerability is announced for Microsoft operating systems. An attack does not appear for some number of days, so there is some chance to install software to protect the system.

In a 0-day exploit a previously unknown exploit becomes known only as a result of a successful attack. Those who manage the computer system have 0-days of warning. The security research community hopes to keep ahead of those who attack computer systems. But as the potential profits from system attacks increase 0-day attacks become inevitable.

Credit to Ian Kaplan

Stealing the Network: How to Own the Box is a couple years old, and is the first in a series of books that provide information on computer and network security by combining fictional narratives with genuine techniques. It is not written as a "how-to" guide, which makes it an easier read for a non-geek, though there is enough real technical information contained in the short stories to give a sysadmin or security enthusiast something to go on.

The book is divided into ten chapters (and an appendix that non-geeks may take a pass on), each one of which gives a short story dealing with some aspect of security. While there are clear roles associated with the protagonist in each story -- some white hat, some black -- overall the book does a nice job of presenting the information in a useful way without imposing morals on the reader. The stories give a wide variety of scenarios, which include:
- a general "break into a network" hack
- worm analysis
- hardware hacking
- printer security
- hacking without hacking (relying on the general laziness of users)
- wireless security
- social engineering
- forensics and post-incident analysis

The narratives are all more or less easy to follow (though a couple are somewhat long and dull), and help to illustrate good security by showing just how powerful poor security can be in the hands of an attacker. By riding shotgun on several different scenarios, you can spot the weak points and see where exactly vulnerabilities can be exploited. It shows that many networks, even those with SOME security in place, can often still be compromised relatively simply. Although it has been repeated to the point of being cliche, it is true that a chain is only as strong as its weakest link -- and many times, the weakest link is plain human laziness or ignorance.

This book is a quick read; I finished it in a little over a week. However, the effect it has had on me will be much longer-lasting. Although it is a bit dated by modern standards, there is enough real information to serve as a reminder that, while it is easy to talk about security on a web forum, true security is found only when you roll up your sleeves and get your hands dirty. It is not always enough to assume you are secure simply because you know a thing or two about firewalls and Windows Update. Security is a process, and it ends up being a process that is never truly finished.

I would like to close by sharing a quote from the book that, for some reason, has stuck with me:

What's funny is that I've never needed to resort to some fancy theoretical exploit that security researchers talk about, because the script kiddy stuff usually works just fine. I've seen administrators go to great lengths to prevent man-in-the-middle attacks. But I've never actually used such an attack myself, I don't know anyone else who has used one, and I don't know anyone who was ever a victim of one.

I highly recommend this book to anyone with a real interest in the guts of security. The dead tree edition retails for around US$50, though you can probably find a cheaper one used, or if you don't mind reading electronic copy (or if you have a printer that can handle it), you can download the eBook.

From the Publisher
"Stealing the Network: How to Own the Box" is NOT intended to be a "install, configure, update, troubleshoot, and defend book." It is also NOT another one of the countless Hacker books out there. So, what IS it? It is an edgy, provocative, attack-oriented series of chapters written in a first hand, conversational style. World-renowned network security personalities present a series of 25 to 30 page chapters written from the point of an attacker who is gaining access to a particular system. This book portrays the "street fighting" tactics used to attack networks and systems.

Not just another "hacker" book, it plays on "edgy" market success of Steal this Computer Book with first hand, eyewitness accounts
A highly provocative expose of advanced security exploits
Written by some of the most high profile "White Hats", "Black Hats" and "Gray Hats"
Gives readers a "first ever" look inside some of the most notorious network intrusions

Table of Contents
Chapter 1: Hide and Sneak--Ido Dubrawsky

Chapter 2: BabelNet--Dan Kaminsky

Chapter 3: The Worm Turns--Ryan Russell and Tim Mullen

Chapter 4: Just Another Day at the Office--Joe Grand

Chapter 5: h3X's Adventures in Networkland--FX

Chapter 6: The Thief No One Saw--Paul Craig

Chapter 7: Flying the Friendly Skies--Joe Grand

Chapter 8: dis-card--Mark Burnett

Chapter 9: Social (In)Security--Ken Pfeil

Chapter 10: The Art of Tracking--Mark Burnett

Appendix: The Laws of Security

Read an Excerpt
From Chapter 5, The Thief No One Saw
This is my story. My name is Dex. I'm a 22-year-old systems administrator. I live in an upper-class apartment in New York's CBD. My apartment is lined with computers, coffee cups, and cables. I work eight hours a day for a small online e-commerce site, mostly managing servers and security.

In my free time, I run my own contract development company, writing mostly C/C++. I also moonlight as a "Rent a Thief" for a black market media "distribution" company based out of Taiwan. On demand, I hack into companies and steal whatever is required. Usually, it's a new, highly anticipated game or a large, expensive CAD (computer-aided design) software package. Once, I was even asked to steal software used to design a nuclear power plant. I don't ask questions. This thievery doesn't stop at software, though. There is big money in commercial plans, financial data, and customer contact lists, as well.

I do this because I enjoy the rush and the feeling of outsmarting someone else. I never tell anyone else about a hack, and to date, only a few companies I've hit even suspected that they had been hacked. I am not a part of the typical hacker community, and I always work alone....

Slashdot.org
Stealing the Network is a refreshing change from more traditional computer books. The authors have created fictional stories based on non-fictional concepts that could really happen to our computer systems today. The realistic fiction approach makes the book much lighter to read and actually entertaining. I also believe this approach makes the true methods behind the fictional stores much more memorable then memorizing thousand page textbooks.

Wired
Stealing The Network: How to Own the Box, a compendium of tales written by well-known hackers, is a perfect summer read. The stories are fictional. The technology and techniques described are very real … At 328 pages, Stealing the Network is a summer blockbuster without the nonsense that packs the pages of most warm-weather reads. It's entertaining, but it won't leave your brain gagging on an overdose of fluff.

Amazon.com
Stealing the Network is a book of science fiction. It's a series of short stories about characters who gain unauthorized access to equipment and information, or deny use of those resources to the people who are meant to have access to them. The characters, though sometimes well described, are not the stars of these stories. That honor belongs to the tools that the black-hat hackers use in their attacks, and also to the defensive measures arrayed against them by the hapless sysadmins who, in this volume, always lose. Consider this book, with its plentiful detail, the answer to every pretty but functionally half-baked user interface ever shown in a feature film.
One can read this book for entertainment, though its writing falls well short of cyberpunk classics like Burning Chrome and Snow Crash. Its value is in its explicit references to current technologies--Cisco routers, OpenSSH, Windows 2000--and specific techniques for hacking them (the heroes and heroines of this book are always generous with command-history dumps). The specific detail may open your eyes to weaknesses in your own systems (or give you some ideas for, ahem, looking around on the network). Alternately, you can just enjoy the extra realism that the detail adds to these stories of packetized adventure. --David Wall

Product Description
"Stealing the Network: How to Own the Box" is NOT intended to be a "install, configure, update, troubleshoot, and defend book." It is also NOT another one of the countless Hacker books out there. So, what IS it? It is an edgy, provocative, attack-oriented series of chapters written in a first hand, conversational style. World-renowned network security personalities present a series of 25 to 30 page chapters written from the point of an attacker who is gaining access to a particular system. This book portrays the "street fighting" tactics used to attack networks and systems.

Not just another "hacker" book, it plays on "edgy" market success of Steal this Computer Book with first hand, eyewitness accounts
A highly provocative expose of advanced security exploits
Written by some of the most high profile "White Hats", "Black Hats" and "Gray Hats"
Gives readers a "first ever" look inside some of the most notorious network intrusions

Download Description
"Stealing the Network: How to Own the Box" is NOT intended to be a "install, configure, update, troubleshoot, and defend book." It is also NOT going to be another one of the countless Hacker books out there now by our competition. So, what IS it going to be? "Stealing the Network: How to Own the Box" is going to be an edgy, provocative, attack-oriented series of chapters written in a first hand, conversational style. World-renowned network security personalities will present a series of 25 to 30 page chapters written from the point of an attacker who is gaining access to a particular system. This book will portray the "street fighting" tactics used to attack networks and systems. --This text refers to the Digital edition.

Book Info
(Syngress Publishing) Combines fictional stories with real technology. Provides a glimpse into the creative minds of some of today's best hackers. Softcover.

From the Publisher
In the real world, hackers go after the "low-hanging fruit." They take the least risk and go for the greatest reward. They often act alone or in small groups. They don’t have government funding or belong to world criminal organizations. What they do have is spare time and a lot of curiosity, and believe me, hacking takes a lot of time. Some of the best hackers spend months working on one exploit. At the end of all that work, the exploit may turn out to not be reliable or to not to function at all! Breaking into a site is the same way. Hackers may spend weeks performing reconnaissance on a site, only to find out there is no practical way in, so it’s back to the drawing board.

In movies, Hollywood tends to gloss over this fact about the time involved in hacking. Who wants to watch while a hacker does research and test bugs for weeks? It’s not a visual activity like watching bank robbers in action, and it’s not something the public has experience with and can relate to. In the movie "Hackers," the director tried to get around this by using a visual montage and some time- lapse effects. In "Swordfish," hacking is portrayed by drinking wine to become inspired to visually build a virus in one night. One of the oldest hacking movies, War Games, is the closest to reality on the big screen. In that movie, the main character spends considerable time doing research on his target, tries a variety of approaches to breaking in, and in the end, is noticed and pursued.

But what if …? What would happen if the attackers were highly motivated and highly skilled? What if they had the guts and skills to perform sophisticated attacks? After a few drinks, these authors of the book you are holding in your hands are/were quick to speculate on what would be possible. Now, they have taken the time and effort to create ten stories exploring just what it would take to own the network.

About the Author
Dan Kaminsky, also known as Effugas, is a Senior Security Consultant for Avaya's Enterprise Security Practice, where he works on large-scale security infrastructure. Dan's experience includes two years at Cisco Systems, designing security infrastructure for cross-organization network monitoring systems, and he is best known for his work on the ultra-fast port scanner, scanrand, part of the "Paketto Keiretsu," a collection of tools that use new and unusual strategies for manipulating TCP/IP networks.

FX of Phenoelit has spent the better part of the last few years becoming familiar with the security issues faced by the foundation of the Internet, including protocol based attacks and exploitation of Cisco routers. He has presented the results of his work at several conferences, including DefCon, Black Hat Briefings, and the Chaos Communication Congress.

Mark Burnett is an independent security consultant, freelance writer, and a specialist in securing Windows-based IIS Web servers. Mark is a contributor to Dr. Tom Shinder's ISA Server and Beyond: Real World Security Solutions for Microsoft Enterprise Networks (Syngress Publishing, ISBN: 1-931836-66-3).

Joe Grand is the President and CEO of Grand Idea Studio, Inc., a product design and development firm that brings unique inventions to market through intellectual property licensing. As an electrical engineer, many of his creations including consumer devices, medical products, video games and toys, are sold worldwide. A recognized name in computer security and former member of the legendary hacker think-tank, The L0pht, Joe’s pioneering research on product design and analysis, mobile devices, and digital forensics is published in various industry journals.

Ido Dubrawsky (CCNA, CCDA, SCSA) is a Network Security Architect working in the SAFE architecture group of Cisco Systems, Inc. His responsibilities include research into network security design and implementation.

Paul Craig is a network administrator for a major broadcasting company in New Zealand. He has experience securing a great variety of networks and operating systems. Paul has also done extensive research and development in digital rights management (DRM) and copy protection systems.

Ken Pfeil is a Senior Security Consultant with Avaya's Enterprise Security Consulting Practice, based in New York. Ken's IT and security experience spans over 18 years with companies such as Microsoft, Dell, Identix and Merrill Lynch in strategic positions ranging from Systems Technical Architect to Chief Security Officer. While at Microsoft, Ken co-authored Microsoft's Best Practices for Enterprise Security white paper series, was a technical contributor to the MCSE Exam, Designing Security for Windows 2000 and official curriculum for the same.

Timothy Mullen is CIO and Chief Software Architect for AnchorIS, a developer of secure enterprise-based accounting solutions. Mullen is also a columnist for Security Focus' Microsoft Focus section, and a regular contributor of InFocus technical articles. Also known as Thor, he is the founder of the "Hammer of God" security coop group.

Ryan Russell has worked in the IT field for over 13 years, focusing on information security for the last seven. He was the primary author of Hack Proofing Your Network: Internet Tradecraft (Syngress Publishing, ISBN: 1-928994-15-6), and is a frequent technical editor for the Hack Proofing series of books. Ryan founded the vuln-dev mailing list, and moderated it for three years under the alias "Blue Boar." Ryan is the Director of Software Engineering for AnchorIS, where he's developing the anti-worm product, Enforcer.

Network Security: The Complete Reference

noreply@blogger.com (iSecurity) — Fri, 27 Jun 2008 11:02:00 +0000

Information Security Magazine, February 2004
The breadth and quality of its information coverage should earn this book a place on your shelf.

Product Description
Teaches end-to-end network security concepts and techniques. Includes comprehensive information on how to design a comprehensive security defense model. Plus, discloses how to develop and deploy computer, personnel, and physical security policies, how to design and manage authentication and authorization methods, and much more.

Book Info
Reference provides the information necessary to plan, implement, and maintain a secure network. Shows how to protect confidential information such as customer lists, credit card numbers, stockholder names, and addresses. Includes a security dictionary and contributions from topical experts.

From the Back Cover

The Most Authoritative Volume Available on Network Security

Includes a Security Dictionary and contributions from topical experts!

The solution to today's computer system security ills will only be solved when organizations obtain and implement a network security program. This comprehensive resource provides all the information necessary to formulate strategies to reach that goal. Learn to plan, implement, and maintain a secure network, and protect confidential information such as customer lists, credit card numbers, and stockholder names, and addresses. Prevent the attack or theft of specialized information such as trade secrets, formulas, production details, and other intellectual property. Network Security: The Complete Reference provides critical strategies, concepts, techniques, and solutions to keep your network system secure.

Learn what it takes to build a solid security architecture
Manage and control all access points to your digital data
Anticipate incidents using risk analysis, threat definition, and vulnerability assessment
Secure confidentiality, integrity, privacy, and availability
Understand how HIPAA, Gramm-Leach-Bliley and other security legislation affects you
Learn about a California law that requires compliance from all organizations, no matter what state they reside in
Technical Experts:

Dr. Nick Efford & Steve Wright, Windows .NET Security
Ken Pfeil, Physical Security
Ben Rothke, Operating System Security
Roger A. Grimes, Intrusion Detection
Anil Desai & Rob Kraft, Database Security
Ole Drews Jensen, Router & Device Security
Dr. Andrew A. Vladimirov & Stephen Prendergast, Wireless Security
Michael Howard, Secure Software
Thaddeus Fortenberry & Eric Maiwald, VPN Security
Michael O'Dea, Windows Security
Brian Buege, Michael Judd & Jim Keogh, J2EE Security
Bernard Chapple, Disaster Recovery
Glen Carty & Steve Thomas, Novell Security
Christian Genetski & Curtis Karnow, Legal Issues
Curtis W. Rose, Incident Response & Computer Forensics
Thomas Knox & Robert Clugston, Linux/UNIX Security
Barak Weicheselbaum, Application Security

About the Author
Roberta Bragg (CISSP, MCSE: Security; Security+, ETI Client Server, Certified Technical Trainer, IBM Certified Trainer, DB2-UDB, Citrix Certified Administrator) has been a Security Advisor columnist for Microsoft Certified Professional Magazine for five years, is a Security Expert for SearchWin2000.com, and writes for the “SecurityWatch” newsletter, which has more than 55,000 subscribers. Roberta designed, planned, produced, and participated in the first Windows Security Summit, held in Seattle, Washington, in 2002. In September and October of 2002, Roberta was an instructor for four sessions of SANS Gold Standard Windows 2000 Training. Roberta has participated in numerous security audits and is a security evangelist traveling all over the world consulting, assessing, and training on network and Windows security. Roberta has served as adjunct faculty at Seattle Pacific University and at Johnson County Community College teaching courses on Windows 2000 Security Design and Network Security Design. Mark Rhodes-Ousley (CISSP) has been a practicing security professional for more than ten years. Mark has advised, designed, and installed security technologies and policies for dozens of companies, including Fortune 500 companies, large, medium-sized, and many small companies. All this experience with companies in different stages of growth leads to a unique perspective on how to manage security for a growing company—where to begin, what to do when moving forward, and how to plan for future growth. Mark holds certifications from the International Information Systems Security Certification Consortium, known as (ISC)2, Cisco Systems, Security Dynamics, Raptor Systems, Hewlett Packard, and Digital Equipment Corporation, along with a Bachelor degree in Applied Mathematics and Electrical Engineering from the University of California, San Diego (UCSD). Keith Strassberg (CPA, CISSP) is an independent security consultant with more than seven years of experience in information security. Most recently, he worked as a senior security engineer for a mid-sized technology consulting company. Keith’s professional experiences cover all facets of information security, including, but not limited to, designing and deploying secure infrastructures, implementing firewalls and intrusion detection systems, performing computer forensic investigations, developing policies and procedures, and performing vulnerability testing.

Product Details

Paperback: 896 pages
Publisher: McGraw-Hill Osborne Media; 1 edition (November 17, 2003)
Language: English
ISBN-10: 0072226978
ISBN-13: 978-0072226973
Product Dimensions: 9 x 7.4 x 2 inches
Shipping Weight: 3.3 pounds (View shipping rates and policies)

MIH 802.21 standard: Current Progress and Future Outlook

noreply@blogger.com (iSecurity) — Sat, 31 May 2008 14:47:00 +0000

Current Progress and Future Outlook
The MIH 802.21 standard is still a work in progress. With the newly elected chair as of May 2005, Vivek Gupta, the working group hopes to make progress at a faster rate. The team is actively communicating with one another via email (email archives can be found here: http://www.ieee802.org/21/email21/) and scheduled meetings. The next coming teleconference meeting for the team is April 20, 2006. The following subsections describe the milestones achieved and expectations for the 802.21 standard.

Accomplished Milestones
The milestones accomplished [1] are listed with the least recently achievement on top and ending with the most recent.
2003 — IEEE working group chair people discuss need for standard support “media-independent handover services.”
March 2004 — 802.21 working group launches to address potential standards for MIHS.
September 2004 — Call for proposals for the new standard. Initial work items defined.
November 2004 — Proposals received by 802.21 group. Submissions closed.
January 2005 — Debate and discussion regarding submitted proposals and how to reach compromise.
May 2005 — 802.21 working group complete first draft for standard.
Shortly after finalizing the documentation for design of the 802.21 standard, implementation will begin. The working group will then work closely with companies to get the 802.21 standard established.
5.2 Expectations and Future Outlook
Standards take from 1-3 years to complete. It may take up to 3 years for the 802.21 standard to be complete, but the “typical time frame for IEEE standards more complex than 802.21” is three years [2].
The expectations for this standard, listed below, are quoted from Wikipedia [7]:
• Allow roaming between 802.11 networks and 3g cellular networks.
• Allow users to engage in ad hoc teleconferencing.
• Apply to both wired and wireless networks.
• Allow for use by multiple vendors and users.
• Compatibility and conformance with other IEEE 802 standards.
• Include definitions for managed objects that are compatible with management standards like SNMP.
• Although security algorithms and security protocols will not be defined in the standard authentication, authorization, and network detection and selection will be supported by the protocol.
As with all other projects, it takes time and effort to design and implement a complete, accurate and well-thought system. Many companies are keeping an eye on 802.21 because they want to be able to implement this technology within their existing client devices. It would of no surprise when 802.21 becomes a standard acquired by every company and end user.

Similar Technology
Unlicensed Mobile Access (UMA) is a similar technology of Media Independent Handover (IEEE 802.21). Basically, UMA is a private version of 802.21. It has the same concept of 802.21, which is to provide roaming and handover services between same and different types of network through different handover mechanisms.

UMA (Unlicensed Mobile Access) Overview
UMA technology allows users to access to GSM and GPRS mobile services over unlicensed spectrum technologies such as 802.11 and Bluetooth. With providers who have deployed UMA technology, subscribers can smoothly roam and handover between cellular networks and public and private unlicensed wireless network using dual-mode mobile handsets. As subscribers transition between networks, they can still experience a consistent mobile service of voice, data and and IMS/SIP (IP Multimedia Subsystem/Session Initiation Protocol) applications through their handsets.
A number of leading companies within wireless industry have joined the developing open specifications of UMA. They are actively working with 3GPP standard organization to develop and maintain these specifications and use them as a formal standard of development. These specifications are open to vendors and carriers of wireless communications systems and applications to develop and deploy UMA related solutions.
All these help to promote the widespread of UMA technology. The following is a list of companies which are participating in UMA development.
Alcatel
British Telecom
Cingular
Ericsson
Kineto Wireless

Motorola
Nokia
Nortel Network
O2
Research In Motion

Rogers Wireless
Siemens
Sony Ericsson
T-Mobile US

How UMA Works
UMA technology works as follows on a mobile subscriber: When a subscriber goes within range of an unlicensed wireless network, his/her UMA-enabled dual-mode handset will check whether the network allows it to connect. If it does, the handset will contact the UMA Network Controller (UNC) over the broadband IP access network to be authorized to access the mobile voice and data services via that network. If the access is approved, all mobile voice and data services would be routed to the handset via that unlicensed wireless network instead of the cellular radio access network (RAN) and the current location of the subscriber will be updated. When the subscriber moves out of range of that unlicensed wireless network, the UNC and handset facilitate will roam back to the cellular radio access network and all the voice and data services will be via the cellular network again. The transitions between networks are totally transparent to the subscriber.

UMA Technology Highlights and Architecture
Highlights of UMA Technology [8]:
• To deliver smooth and consistent voice and data services over unlicensed wireless networks.
• To provides the same identity for mobile services over unlicensed wireless networks and cellular radio access networks.
• To transit (roam and handover) smoothly between unlicensed wireless networks and radio access networks.
• To be independent of underlying unlicensed wireless network type (e.g. 802.11, Bluetooth)
• To use the same security as current GSM mobile networks.
• Capable to operations of cellular radio access networks.
• Transparent to current existing network device (e.g. router, access point, modem)
• To utilize standard broadband IP access networks (e.g. DSL, Cable. T1/E1, Broadband wireless, FTTH, …)
• To ensure the low cost of existing or future mobile core network infrastructure.

Architecture of UMA Technology
Advantage and Disadvantage of UMA technology
Advantages [9]:
• Allows providers or carriers to increase coverage using low cost Wifi access point instead of expensive base stations.
• Subscribers have perfect coverage at home.
• Subscribers can have once single number for both home and cellular phone services.
• Subscribers have only one bill for both internet and cell phone plans.
Disadvantages [9]:
• It is hard to determine the current geographic location of a handset over the internet. As a result, a subscriber in U.S. might buy a UMA handset and give it to his relatives in England so they can enjoy cheap calls.
• Battery life is quite limited because handsets must have two radios on board and both radio must keep scanning for networks all the time.
6.3 Comparison of UMA and 802.21
Since UMA and 802.21 are similar technologies, at some level, we should be able to predict the future outlook of 802.21 based on the current progress of UMA. Some companies already have products of UMA technology. One of the goals of UMA is that every subscriber could have only one number for both home and cellular services. Therefore, we can assume that for 802.21, we may be able to use one account to access the ADSL/Cable internet services at home and Wifi/Hot Spot wireless internet services outdoor. Moreover, we may have only one bill for cable TV, cellular phone and internet services in near future since 802.21 provides handover between wired and wireless network. Can you imagine that one day, while we are having a video conference, we can just unplug our laptop from our home network, go out to our cars, to the airport and still have the video conference going on?
7.0 Conclusion
Media Independent Handover simplifies our life with networks. After studying MIH in a certain depth, we can see that it is a really powerful tool that can connect all the different networks together to act like one. Nowadays, network is already a part of our daily life. Cellular phones, Internet, e-mail, instant messages, etc, are all related to networks. MIH breaks the walls between networks and let us take a shortcut without going on the old, long and winding way. That definitely simplifies things a lot, and that is what technology should be.

Media Independent Handover Function and Protocol

noreply@blogger.com (iSecurity) — Sat, 31 May 2008 14:33:00 +0000

MIHF provides asynchronous and synchronous services through SAPs for lower layers and upper layers. For a system with multiple network interfaces of arbitrary type, we can use the Event service, Command service and Information service provided by MIH to manage, determine, and control the state of the underlying interfaces.
These services helps the L3MP and other protocols in maintaining service continuity, service adaptation to varying quality of service, battery life conservation, and network discovery and link selection. In a system containing heterogeneous network interfaces of 802 types and cellular 3GPP, 3GPP2 types, the Media Independent Handover Function can help the L3MP to implement effective procedures to couple services across heterogeneous network interfaces.
The MIH Function provides the exchanging functionality of information between the network and host entities of the same media type. However, if information exchange mechanism is already exists in a given type of media (such as some cellular media types), the MIH Function will use of the existing mechanism whenever possible.

Media Independent Event Service
The event service will typically be used to facilitate handover detection within the L3MP. Events defined include Link Up, Link Down, Link Parameters Change, Link Going Down, L2SDU Transmission Status, Link Event Rollback, Pre trigger (L2 Handoff Imminent), etc.

Media Independent Command Service
The command service refers to the commands sent from the higher layers to the lower layers in the reference model. It includes the commands from upper layer to MIH (e.g. upper layer mobility protocol to MIH, or policy engine to MIH, etc), and from MIH to lower layer (e.g. MIH to MAC, or MIH to PHY). Commands can also be sent from a local MIH entity to a peer MIH entity. These commands mainly carry the upper layer decisions to the lower layers on local device entity or at remote entity, and thus control the behavior of lower layers.

Media Independent Information Service
Media Independent Information Service (MIIS) provides a framework and corresponding mechanisms by which a MIHF (Media Independent Handover Function) entity can discover and obtain network information existing within a geographical area to facilitate the handovers. MIIS primarily provides a set of information elements (IEs), the information structure and its representation and a query/response type of mechanism for information transfer. This contrasts with the asynchronous push model of information transfer for the event service. The information may be stored within the MIH functional (MIHF) entity or maybe present in some information server from where the MIH in the station can access it. The definition of the information server and the mechanism to access it are out of scope.

Media Independent Handover Protocol
The Media Independent Handover protocol defines frame formats for exchanging messages between peer MIH Function entities. These messages are based on the primitives which are part of Media Independent Event service, Media Independent Command service and Media Independent Information service. IEEE 802.21 supports Media Independent Handover Function in mobile terminal, and network. The MIHF Protocol allows peer MIH Function entities to interact with each other.
The Media Independent Handover Protocol provides the following services:
 MIH capability discovery: MIHF in mobile terminal or MIHF in the network discovers which entity supports MIHF. Thereafter the peer MIH Functions negotiate/discover an optimum transport for communication. The MIH Function entities also discover list of supported events and commands. The MIH Function can also query the information schema for list of supported information elements.
 MIH remote registration: Remote MIHF in different entities can register with each other to receive Media Independent Handover Messages including remote MIES. No registration is required for command services.
 MIH message exchange: MIHF can exchange MIH messages using MIH payload and MIH protocol over a suitable transport. As part of message exchange the peer MIH Function entities can use the MIES, MICS and MIIS for effective handovers.

MIH Protocol Transport
The table below shows the various transport options for different media types.

No Media Type Preferred
Transport L2 Transport L3 Transport
1 Ethernet L2 Data Frames IP based
2 802.11 L2 Data Frames, Management Frames IP based
3 802.16 L2 Data Frames, Management Frames IP based
4 3GPP L3 Requires protocol stack changes IP based
5 3GPP2 L3 Requires protocol stack changes IP based
Table 1: MIH Protocol Transport [5].

MIH General Packet Format
MIH messages can be transported over L2 using data frames or media specific management frames. MIH messages can also be sent over L3 using a suitable L3 transport protocol.

The description for each of the fields in the MIH general packet format is detailed in Table 2.
Name of the Field Size Description
Protocol Version 1 octet Version of the MIH protocol. Default: 0x01
MIH Service ID 1 octet MIH Service Identifier
1:Event Service
2:Command Service
3: Information Service
MIH Opcode 1 octet Operation to be performed
1: Request
2: Response
3: Indication
Transaction ID 1 octet Transaction Identifier used to match requests and responses wherever applicable.
Fr 1 bit Fragmentation flag.
1: Specifies current packet has more than 1 fragment
0: Current packet is not fragmented
Fragment No 7 bit Fragment Number of this packet
Message Length 2 octets Total length of whole message in bytes (header + payload)
MIH Function Identifier Length (MIHFL) 4 octets Length of each of Source and Destination MIH Identifier fields
Source MIH Function Identifier MIHFL octets This is the Source MIHF identifier. This can be the L2 hardware address of the interface at the source node. This can also be IP based for L3 transports. This can also be something generated.
Destination MIH Function Identifier MIHFL octets This is the Destination MIHF identifier. This can be the L2 hardware address of the interface at the destination node. This can also be IP based for L3 transports. This can also be something generated during MIHF discovery and connectivity phase.
MIH Message ID 4 octet Actual MIH Message identifier for the service identified above.
e.g. Link_Going_Down Event Indication for Event Service
MIH Message Data Variable MIH Service specific data of variable length
Table 2: Description for each field in the MIH Packet [5].

Media Independent Handover (802.21) Reference Model

noreply@blogger.com (iSecurity) — Sat, 31 May 2008 14:05:00 +0000

Media Independent Handover Reference Model (MIH) is a new layer that resides between the Network Layer (Layer 3 of OSI model) and lower layers: MAC and PHY (IEEE interfaces) or RRC and LAC ( 3GPP or 3GPP2). It provides asynchronous and synchronous services through Service Access Points (SAPs) for lower layers and upper layers. MIH Function (MIHF) helps Layer 3 Mobility Protocol in maintaining service continuity between different interfaces, adaptation to reach Quality of Service (QoS), link selection and network discovery.

The communication between MIHF on the network side is depends on MIHF location and type of scenario. When MIHF is in the access network such as Access Point (AP), Layer 2 or Layer 3 transport can be used over access. When network decides where and when to handover, the source MIHF can send messages to destination MIHF to inform destination MIHF to begin “preparation”. The preparation includes checking availability of appropriate resources including acceptable QoS levels at new PoA, procuring an IP address for the mobile station, etc. Another possible scenario is where the MIHF in an AP communicates with MIHF in an Access Router (AR). This type of communication includes events such as Link Up, Link Down, etc.
The IEEE 802.21 standard supports the Media Independent Event service, Media Independent Command service and Media Independent Information service. A management protocol is required for the exchange of information between MIH entities within a terminal and a network.

MIH Reference Model for Ethernet (802.3)
For 802.3 there are no peer management facilities in CSMA/CD. Thus, if the MIH services are supported over wired ethernet networks, in order to carry the payload over normal ethernet data frames, a L2 protocol with a new ethertype is necessary. The MIH ethertype is encoded in the SNAP header. At the same time 802 networks don’t support data frames in unauthenticated state. Hence the MIH Protocol cannot be used in this case. Only management frames can be used to transport information in the unauthenticated state.
The IEEE 802.21 standard should define the packet format and payloads in media independent manner in standard TLV format. Thereafter these packets can be encapsulated in a L2 MIH Protocol using MIH ethertype when the payload needs to be sent over normal data frames as in case of ethernet. In other cases the TLV based messages and payload can be directly encapsulated in media specific management frames.

MIH Reference Model for Wi-Fi (802.11)
The above figure shows the MIH functions for 802.11 stations and network PoA (APs). The MIH_MAC_SAP is the MIH interface to the data plane and can encapsulate MIH protocol packets in data packets. However since 802.11 does not currently support Class 1 data frames, traffic can be sent over the data plane only when the client is connected with the AP. The MIH_MGMT_SAP provides interface with the management plane (MLME) and allows MIH protocol packets to be stored in management frames.
The MIH_SAP shows the interface of MIH Function with other higher layer entities such as Transport, Handover policy, L3 Mobility protocol, etc. The MIH Function may interface with the OS or the system using the MIH_ME_SAP.

MIH Reference Model for WiMAX (802.16)
In 802.16 based system, the MIH_MGMT_SAP provides the MIH functionality over management plane and help with transporting MIH protocol messages across peer MIHFs. The MIH_SAP shows the interface of MIHF with other higher layer such as Transport, Handover policy, L3 Mobility protocol, etc. The MIH Function may interface with the OS or the system using the MIH_ME_SAP.

MIH Reference Model for 3rd Generation Mobile System (3GPP)
A potential realization of MIH functions for 3GPP enabled Mobile Stations is illustrated above. The MIH_RRC_SAP defines the MIH interface to the 3GPP Radio Resource Control (RRC) layer. The MIH_MGMT_SAP defines the MIH interface to the 3GPP GPRS Mobility Management or Global System (GMM) for Mobile Communication (GSM). Most of the MIH services may utilize the information that is already defined in the RRC layer and GMM/SM. The desired information from MIH Event Services, Command Services and Information Services will be provided to MIH_RRC_SAP and MIH_MGMT_SAP which will be further defined by 3GPP SDO. In the case of MIH in the Mobile Stations, the PHY and MAC SAPs communicate to the RRC as defined in the 3GPP standards. No new interfaces and primitives need to be defined for these SAPs.

Spanning Across Different Media
This figure shows how the MIH Function spans across different media specific technologies and provides a common abstraction of handover services to higher layers.

IEEE 802.21 Media Independent Handover [1]

noreply@blogger.com (iSecurity) — Sat, 31 May 2008 14:01:00 +0000

The emerging IEEE 802.21 standard, Media Independent Handover, has the ability to seamlessly handover networks for both wired and wireless networks, which is addresses a prevalent problem when roaming. Interoperability between homogenous network types of 802 and non 802 networks is also a key feature of the 802.21 standard. This report consists of the understanding of 802.21 services and its functionality, specifically at the Data Link and Network Layers of the OSI Networking Model. Currently at the stage of proposal, the 802.21 working group hopes to finalize the standard’s document and begin implementation shortly thereafter. Future outlook of this standard is good when comparing with the existing proprietary UMA (Unlicensed Mobile Access), which is a similar technology, but fails to offer interoperability. The expectations for this standard are, but are not limited to: ability to roam between 802.11 and 3G networks, allowance for use by multiple vendors and users, application for both wired and wireless networks, and ability to engage in a teleconference.

Introduction
Wireless networking has provided us the ability to freely utilize our mobile devices (i.e. computer notebook, cellular phones, PDA, GPS) wherever and whenever a wireless access point is available. With the multitude of existing wireless standards (Wi-Fi, GSM, etc), a smooth transition from one network to another is utterly impossible with the current technology. Existing IEEE 802 standards go through a series of failures before acquiring the correct network access. For instance, as soon as a user unplugs the Ethernet cable from his or her computer, an error appears indicating that the user is no longer connected to a LAN network. If the computer has wireless capability (i.e. 802.11b), then the user may be able to connect to a wireless network, but network discovery would take some time to establish. An interruption of service is inevitable, thus, a network handover standard is necessary. This emerging standard is the IEEE 802.21, which working efforts debuted in March 2004 and implementation is still in progress [4].
IEEE 802.21 is a developing standard which enables handover and interoperability between heterogeneous network types including both 802 and non 802 networks [6]. The standard provides information to allow handing over to and from cellular and wireline, GSM, GPRS, WiFi, WiMAX, Personal Area Network (PAN), Bluetooth and 802.11 networks through different handover mechanisms [1].

Background
Initiated in March 2004, the working group for the 802.21 standard was chaired by Ajay Rajkumar from Lucent Technologies. The members involved include over 50 companies. These companies are the “largest vendors of end-to-end network infrastructure, device companies, chipset developers, and even service providers” [1]. One of the contributing companies, Intel Corporation, expressed enthusiasm towards providing users with the ability to move from a hotspot to a cellular connection without noticing. Envisioned is the idea of a future that unites network connectivity across a wide range of networks. Figure 1 shows a prototype mobile phone that has four different wireless networks: Bluetooth, GPS, GPRS, and Wi-Fi. With the implementation of 802.21, this device is expected to intellectually select available networks, with an ease of transition and without any interruption, when roaming [3].

standards: Bluetooth, GPS, GPRS, and Wi-Fi [3].

Objective
The objective is to enable an innovative fast Layer 2 and Layer 3 handoff algorithm between networks (for both wired and wireless networks). Network discovery and selection are factors that affect the quality of service during a handover decision. With this technology, end-user devices will have the ability to “automatically choose the best available network connection type and to seamlessly hand off sessions among networks during roaming without user involvement” [2]. 802.21 is expected to unite the multitude of existing networks.

Organization
The next immediate section describes the proposed 802.21 standard in detail. The specifics include the four Media Independent Handover services provided, packet format and information, and functionality in Layers 2 and 3 (Data Link and Network, respectively) of the OSI Networking Model. We will discuss the current progress, including accomplished milestones towards completing the 802.21. In addition to this standard’s expectations, we will also mention its future outlook. The report concludes with comparison of 802.21 and existing similar technologies.

Routing Information Protocol (RIP)

noreply@blogger.com (iSecurity) — Sat, 17 May 2008 18:47:00 +0000

The Routing Information Protocol (RIP) was one of the most commonly used interior gateway protocol (IGP) routing protocols on internal networks (and to a lesser extent, networks connected to the Internet), which helps routers dynamically adapt to changes of network connections by communicating information about which networks each router can reach and how far away those networks are. The Routing Information Protocol, or RIP, as it is more commonly called, is one of the most enduring of all routing protocols. RIP is also one of the more easily confused protocols because a variety of RIP-like routing protocols proliferated, some of which even used the same name! RIP and the myriad RIP-like protocols were based on the same set of algorithms that use distance vectors to mathematically compare routes to identify the best path to any given destination address. The most popular of the TCP/IP interior routing protocols is the Routing Information Protocol (RIP). The simplicity of the name matches the simplicity of the protocol—RIP is one of the easiest to configure and least resource-demanding of all the routing protocols. Its popularity is due both to this simplicity and its long history. In fact, support for RIP has been built into operating systems for as long as TCP/IP itself has existed. These algorithms emerged from academic research that dates back to 1957.

Today's open standard version of RIP, sometimes referred to as IP RIP, is formally defined in two documents: Request For Comments (RFC) 1058 and Internet Standard (STD) 56. As IP-based networks became both more numerous and greater in size, it became apparent to the Internet Engineering Task Force (IETF) that RIP needed to be updated. Consequently, the IETF released RFC 1388 in January 1993, which was then superceded in November 1994 by RFC 1723, which describes RIP 2 (the second version of RIP). These RFCs described an extension of RIP's capabilities but did not attempt to obsolete the previous version of RIP. RIP 2 enabled RIP messages to carry more information, which permitted the use of a simple authentication mechanism to secure table updates. More importantly, RIP 2 supported subnet masks, a critical feature that was not available in RIP.

In this section I describe the characteristics and operation of the TCP/IP Routing Information Protocol (RIP). There are three versions of RIP: RIP versions 1 and 2 for IP version 4 and RIPng (next generation) for IP version 6. The basic operation of the protocol is mostly the same for all three versions, but there are also some notable differences between them, especially in terms of the format of messages sent.

For this reason, I have divided my description of RIP into two subsections. In the first, I describe the fundamental attributes of RIP and its operation in general terms for all three versions. In the second, I take a closer look at each version, showing the message format used for each and discussing version-specific features as well.

RIP is a dynamic, distance vector routing protocol based around the Berkely BSD application routed and was developed for smaller IP based networks. RIP uses UDP port 520 for route updates. RIP calculates the best route based on hop count. Like all distance vector routing protocols, RIP takes some time to converge. While RIP requires less CPU power and RAM than some other routing protocols, RIP does have some limitations:

Metric: Hop Count
Since RIP calculates the best route to a destination based solely on how many hops it is to the destination network, RIP tends to be inefficient in network using more than one LAN protocol, such as Fast Ethernet and serial or Token Ring. This is because RIP prefers paths with the shortest hop count. The path with the shortest hop count might be over the slowest link in the network.

Hop Count Limit
RIP cannot handle more than 15 hops. Anything more than 15 hops away is considered unreachable by RIP. This fact is used by RIP to prevent routing loops.

Classful Routing Only
RIP is a classful routing protocol. RIP cannot handle classless routing. RIP v1 advertises all networks it knows as classful networks, so it is impossible to subnet a network properly via VLSM if you are running RIP v1, which
However, it must be pointed out that RIP is the only routing protocol that all routing devices and software support, so in a mixed equipment environment, RIP may be your only option for dynamic routing. This is changing with the widespread use of OSPF.

Description:

Protocol suite: TCP/IP.
Type: Application layer, interior gateway protocol, distance vector.
Multicast addresses: 224.0.0.9.
Port: 520 (UDP).
MIME subtype:
SNMP MIBs: iso.org.dod.internet.mgmt.mib-2.rip-2 (1.3.6.1.2.1.23).
Working groups: rip, Routing Information Protocol.
Links:

RIP version 1 (RIPv1) is a simple distance vector protocol. It has been enhanced with various techniques, including Split Horizon and Poison Reverse in order to enable it to perform better in somewhat complicated networks.

The longest path cannot exceed 15 hops.
RIP uses static metrics to compare routes.
The maximum datagram size is 512 bytes not including the IP or UDP headers.

RIP version 2 (RIPv2) added several new features.

External route tags.
Subnet masks.
Next hop router addresses.
Authentication.
Multicast support.
RFC 2453, section 3.2:

The protocol is limited to networks whose longest path is 15 hops. The designers believe that the basic protocol design is inappropriate for larger networks. Note that this statement of the limit assumes that a cost of 1 is used for each network. This is the way RIP is normally configured. If the system administrator chooses to use larger costs, the upper bound of 15 can easily become a problem.

The protocol depends upon "counting to infinity" to resolve certain unusual situations. If the system of networks has several hundred networks, and a routing loop was formed involving all of them, the resolution of the loop would require either much time (if the frequency of routing updates were limited) or bandwidth (if updates were sent whenever changes were detected). Such a loop would consume a large amount of network bandwidth before the loop was corrected. We believe that in realistic cases, this will not be a problem except on slow lines. Even then, the problem will be fairly unusual, since various precautions are taken that should prevent these problems in most cases.

This protocol uses fixed "metrics" to compare alternative routes. It is not appropriate for situations where routes need to be chosen based on real-time parameters such a measured delay, reliability, or load. The obvious extensions to allow metrics of this type are likely to introduce instabilities of a sort that the protocol is not designed to handle.

Intrusion Detection System (IDS) / Intrusion Prevention System (IPS)

noreply@blogger.com (iSecurity) — Wed, 07 May 2008 12:51:00 +0000

Types of Intrusion Detection Systems
An Intrusion Detection System (IDS) is a program that analyzes what happens or has
happened during an execution and tries to find indications that the computer has been
misused. An IDS detects and records evidence of intrusion activity that passes through the firewall, whether ultimately successful or not. When an attack occurs, IDS software helps you determine what happened and how to prevent the breach from recurring. Some IDSs can instruct other parts of the network infrastructure to shut down attacks in progress. However, IDSs are reactive--they report what has happened--and can only detect activity on the links they monitor. And IDS is not a "set it and forget it" technology, either. Firewalls and intrusion detection systems (IDS) are essential parts of a small or medium-size business's (SMB) network and its security. With the number of attacks on SMBs on the rise, a robust system is equally important for an SMB as it is for a large enterprise. And despite the challenges of recent Web and application-level attacks, a strong perimeter defense of firewalls -- as old-fashioned as it may sound -- is still necessary to protect your SMB.

Distributed IDS
A Distributed IDS (DIDS) consists of several IDS over a large network(s), all of which communicate with each other, or with a central server that facilitates advanced network monitoring. In a distributed environment, DIDS are implemented using co-operative intelligent agents distributed across the network(s)

Setting Up an IDS
Setting up firewalls is part of a day's work for networking types, and they should already have the appropriate skills without having to look for dedicated security professionals. So where do you set up an IDS? That depends on where (from which network or network segment) you expect threats to originate. The most obvious location is at the network perimeter, just inside the firewall. That's a hotspot because traffic that doesn't get through the firewall is of no interest, and any logging system that captures unfiltered Internet activity is likely to fill up quickly. Positioning an IDS inside the firewall helps you understand attacks that originate outside your network. It may not, however, cover exploits that originate from inside your network targeting your hosts, depending on your network's topology.

Managing an IDS
Intrusion detection is not for the faint at heart. But, if you are a network administrator chances are you're under increasing pressure to ensure that mission-critical systems are safe--in fact impenetrable--from malicious code, buffer overflows, stealth port scans, SMB probes, OS fingerprinting attempts, CGI attacks, and other network intruders. Designing a reliable way to detect intruders before they get in is a vital but daunting challenge. Because of this, a plethora of complex, sophisticated, and pricy software solutions are now available. In terms of raw power and features, SNORT, the most commonly used Open Source Intrusion Detection System, (IDS) has begun to eclipse many expensive proprietary IDSes. In terms of documentation or ease of use, however, SNORT can seem overwhelming. Which output plugin to use? How do you to email alerts to yourself? Most importantly, how do you sort through the immense amount of information Snort makes available to you? Many intrusion detection books are long on theory but short on specifics and practical examples. Not Managing Security with Snort and IDS Tools. This new book is a thorough, exceptionally practical guide to managing network security using Snort 2.1 (the latest release) and dozens of other high-quality open source other open source intrusion detection programs. Managing Security with Snort and IDS Tools covers reliable methods for detecting network intruders, from using simple packet sniffers to more sophisticated IDS (Intrusion Detection Systems) applications and the GUI interfaces for managing them. A comprehensive but concise guide for monitoring illegal entry attempts, this invaluable new book explains how to shut down and secure workstations, servers, firewalls, routers, sensors and other network devices. Step-by-step instructions are provided to quickly get up and running with Snort. Each chapter includes links for the programs discussed, and additional links at the end of the book give administrators access to numerous web sites for additional information and instructional material that will satisfy even the most serious security enthusiasts. Managing Security with Snort and IDS Tools maps out a proactive--and effective--approach to keeping your systems safe from attack.

Case study & Tips for administering a firewall
1. Keep all databases, or other systems with confidential customer information, tucked away inside your internal network and not in your DMZ. The same goes for any encryption keys or other mission-critical internal systems you wouldn't want exposed to the outside world.

2. Use your networking staff to administer your firewalls and IDS if you don't have a dedicated information security team. Setting up firewalls is part of a day's work for networking types, and they should already have the appropriate skills without having to look for dedicated security professionals. Set up paging on your IDS to alert networking staff members of intrusion attempts and possible incidents.

3. Establish firewall rules as a joint effort between the business and IT (or networking) staff. Make sure they work for everyone and aren't too restrictive or too open. Policies must include what types of applications and traffic are allowed into and out of your network through your firewalls.

4. Have regular audits and log reviews to tune up your perimeter defenses and see if there are patterns in the types of attempted intrusions.

Vendors that offer affordable firewalls for small or medium-sized businesses include Juniper Networks Inc., SonicWALL Inc., NetScreen and Check Point Software Technologies Ltd. They're all nimble enough for small players and can be set up as part of a dual firewall system. Cisco PIX also offers a line of firewalls for the smaller enterprise. On the IDS side, Nessus and Snort are two popular products that are lightweight enough for small networks but strong enough to have stood the test of time.

Network Security 101

noreply@blogger.com (iSecurity) — Tue, 06 May 2008 01:26:00 +0000

As more people are logging onto the Internet everyday, Network Security becomes a larger issue. In the United States, identity theft and computer fraud are among the fastest rising crimes. It is important to protect your network and ensure the safety of all computers and users in that network.

What is a Network?

In order to fully understand network security, one must first understand what exactly a network is. A network is a group of computers that are connected. Computers can be connected in a variety of ways. Some of these ways include a USB port, phone line connection, Ethernet connection, or a wireless connection. The Internet is basically a network of networks. An Internet Service Provider (ISP) is also a network. When a computer connects to the internet, it joins the ISP’s network which is joined with a variety of other networks, which are joined with even more networks, and so on. These networks all encompass the Internet. The vast amount of computers on the Internet, and the number of ISPs and large networks makes network security a must.

Common Network Security Breeches

Hackers often try to hack into vulnerable networks. Hackers use a variety of different attacks to cripple a network. Whether you have a home network or a LAN, it is important to know how hackers will attack a network.

One common way for a hacker to wreak havoc is to achieve access to things that ordinary users shouldn’t have access to. In any network, administrators have the ability to make certain parts of the network “unauthorized access.” If a hacker is able to gain access to a protected area of the network, he or she can possibly affect all of the computers on the network. Some hackers attempt to break into certain networks and release viruses that affect all of the computers in the network. Some hackers can also view information that they are not supposed to see.

Destructive Attacks

There are two major categories for destructive attacks to a network. Data Diddling is the first attack. It usually is not immediately apparent that something is wrong with your computer when it has been subjected to a data fiddler. Data fiddlers will generally change numbers or files slightly, and the damage becomes apparent much later. Once a problem is discovered, it can be very difficult to trust any of your previous data because the culprit could have potentially fooled with many different documents.

The second type of data destruction is outright deletion. Some hackers will simply hack into a computer and delete essential files. This inevitably causes major problems for any business and can even lead to a computer being deemed useless. Hackers can rip operating systems apart and cause terrible problems to a network or a computer.

The Importance of Network Security

Knowing how destructive hackers can be shows you the importance of Network Security. Most networks have firewalls enabled that block hackers and viruses. Having anti-virus software on all computers in a network is a must. In a network, all of the computers are connected, so that if one computer gets a virus, all of the other computers can be adversely affected by this same virus. Any network administrator should have all of the essential files on back up disks. If a file is deleted by a hacker, but you have it on back up, then there is no issue. When files are lost forever, major problems ensue. Network security is an important thing for a business, or a home. Hackers try to make people’s lives difficult, but if you are ready for them, your network will be safe.
About the author:
For more Free Resources www.100computertips.com
Keywords: Computer Tips, Computer Help, PC Upgrade, Computer Information, Computer Terms.

From http://www.articlesbase.com/computers-articles/network-security-101-351319.html

Tips for Network Security

noreply@blogger.com (iSecurity) — Tue, 06 May 2008 01:20:00 +0000

Network in nowadays give us possibilities communicate and do more other things possible and much faster. But not everything is so nice how we thing in first moment. There are a lot of threats which grow up every day in networking!

Here are 10 information security awareness tips for network security, which helps to do network and communication via this network safer, and also give to you confidence that everything is O.K.

1.Use strong password.

Passwords are the simplest form of security. By leaving passwords blank or simple (i.e., password or admin), unauthorized users are practically invited to view sensitive data. Passwords are more secure when they contain letters,numbers and special characters in a combination of upper-case and lower-case characters, and they should be changed periodically.

2.Educate users.

Users need to know exactly what kinds of threats they can expect using e-mail, making faceless downloads and open unknown attachments. Uneducated computer users are often those who fall victim to viruses, spyware, and phishing attacks, all of which are designed to corrupt systems or leak personal information to a third party without the user's consent. The best way hot to make this education is to do special information security awareness training which provides some companies, for example, InfoSecurityLab.

3.Make backup copies.

Indulence is one of the biggest security threats. It's considerably more difficult to completely re-create a crippled system than it is to take the time to create proper backups. Create backups often, and do not immediately overwrite them with the next set of backups. In addition, make copies and keep them off-site in case of emergency.

4.Use protection software.

Without protection software information is like a hedgehog on the motorway-everyone can get this information and "smash" it! Ideally, network protection software should include virus protection, multiple spyware scanners, and a program that runs in the background to prevent malicious software from ever being installed.

5.Do regullary updates

Every day there are created new computer viruses and malicious softwares, so, what good are all those virus and spyware scanners if they're not updated? It\'s crucial to update what are called the "virus/spyware definitions" every week. This keeps the scanners up-to-date to detect the latest malicious software.

6.Install security patches

Security holes may exist in every operating system. There is no software which is perfect. Once an imperfection or hole is found, it's usually exploited within a very short period of time. Therefore, it is imperative to install security patches as soon as possible because otherwise you let these holes open for worms, trojan horses and other viruses.

7.Don't be creduloud

Ads on the Internet have become devious and deceptive. They now appear as "urgent system messages" and warnings designed to scare users into clicking. As a rule of thumb, if a popup window contains an ad claiming to end popups, chances are it's a scam of some sort.

8.Use encryption

Encryption is a way of coding the information in a file or e-mail message so that if it is intercepted by a third party as it travels over a network it cannot be read. Encryption is especially important when dealing with banking and credit cards. Storing and transferring unencrypted data is the equivalent of posting that data for everyone to see. If you\'re not comfortable implementing encryption technology, ask IT specialist assist you.

9.Trust proffesional service

Don't try to do all yourself, you can't be professional in every area. Setting up a network, applying proper security measures, and downloading and installing software can be tricky. Large companies have IT departments. Small business owners should also ask for advice or even hire help.

10.Proper instruction.

Security measures are most effective if everyone is aware of how the system operates. Better are inform all employies how security system work and what to do if something goes wrong! These tips is not so difficult make in life, but they can really increase your network and information security. Do networking safe or not - it's up to you!

The Basics of Network Security

noreply@blogger.com (iSecurity) — Tue, 06 May 2008 01:18:00 +0000

A network is two or more computers linked together in order to share data. From a security standpoint, the problem with networks is that unauthorized individuals might also be able to access that data. Network security is a term that encompasses your overall system for keeping your network as impenetrable as possible, be it hardware, software, or company policies.

Whether your network consists of two computers or two hundred computers, there are certain basic security measures you should have in place. Most of these measures aren’t complicated or expensive, and they don’t require any particular expertise in networking or computer security.

One of the most basic steps for securing your network is to have anti-virus software in place. Anti-virus software periodically sweeps your computer looking for known viruses. You can also choose to run a anti-virus test at any time. Once run, the software generates a report that lists the viruses detected. You are then able to select which, if any, of the viruses detected you want quarantined and removed. It’s more important that you keep your software up to date because new viruses are created and released every day.

Next, make sure you have a firewall in place. A firewall is like a gatekeeper. It’s a hardware/software combination that allows you to decide what goes in and out of your network. You determine the “trust level” to which your firewall is set. The trust level dictates which network connections will be automatically allowed and which will require specific permission. Firewalls come with a “default” setting which is unlikely to be stringent enough to meet your security needs. For optimum security, you should always manually set the trust settings to a higher degree of scrutiny.

Firewalls and anti-virus software are essential for another very important reason: they help protect your system from adware and spyware. Adware and spyware range from annoying to very dangerous. Adware slows down your system, and generates irritating pop-up ads that interfere with your work. Spyware is much more serious. It tracks your computer usage habits, and basically opens up a door to your network that allows hackers to penetrate your system without your knowing it.

Another simple measure is to regularly download patches for your software. Computer programs are tested for vulnerabilities and possible exploits before they are distributed to the public. However, it’s impossible to detect every single vulnerability in advance. As new exploits are discovered, companies “patch” their programs and software to prevent the exploitation of that vulnerability. Without these patches, the software and programs on your computer remain vulnerable.

Network security also depends on common sense. Weak passwords can cause big problems, but are easily avoided. Never use easy-to-guess passwords like your last name, phone number, or birth date. Always use a combination of letters and numbers. Your best bet is to avoid real words altogether and use a string of numbers and letters that stand for a saying or phrase you can easily remember.

Another common sense security measure is to delete suspicious-looking email. More importantly, never open or download an attachment from an email address you don’t recognize. Doing so could be inviting a virus right into your computer. When in doubt, follow this simple rule: delete without opening.

If your business, you should also put in place security policies to govern the behavior of authorized users. Even authorized users can pose a serious security risk, sometimes without realizing it. For instance, “I love to dance, I love to sing” could be “1L2D1L2S,” with the number 1 replacing the letter I.

Here are a few elements of a solid network security policy:

• Require your employees to change their passwords every 3 months.
• Do not allow employees to post their passwords on their desk or cubicle
• Immediately terminate a departing employee’s access to your network.
• Operate on the computer network equivalent to the “need to know” basis. Only allow an employee access to the programs and data that are essential to his or her job.
• Put all of your security guidelines down in writing, and post them where all of your employees can see them.

You want your network security policy to be tight, but not completely rigid. That is, if a given security measure is proving to be unworkable or a serious inconvenience, be willing to adjust. You can often achieve the same result through different means.

Last, but certainly not least, review your network security on a regular basis. A network that’s secure today may not be secure a few months down the road. Hackers are smart and are constantly developing ways to bypass security measures. Be smarter than the hackers by staying on the cutting edge of network security technology.

Book Inro: Network Security Tools

noreply@blogger.com (iSecurity) — Sat, 03 May 2008 13:34:00 +0000

Writing, Hacking, and Modifying Security Tools

By Nitesh Dhanjani, Justin Clarke
First Edition April 2005
Pages: 340
ISBN 10: 0-596-00794-9 | ISBN 13: 9780596007942

Book description

This concise, high-end guide shows experienced administrators how to customize and extend popular open source security tools such as Nikto, Ettercap, and Nessus. It also addresses port scanners, packet injectors, network sniffers, and web assessment tools. Network Security Tools is the one resource you want at your side when locking down your network.

If you're an advanced security professional, then you know that the battle to protect online privacy continues to rage on. Security chat rooms, especially, are resounding with calls for vendors to take more responsibility to release products that are more secure. In fact, with all the information and code that is passed on a daily basis, it's a fight that may never end. Fortunately, there are a number of open source security tools that give you a leg up in the battle. Often a security tool does exactly what you want, right out of the box. More frequently, you need to customize the tool to fit the needs of your network structure. Network Security Tools shows experienced administrators how to modify, customize, and extend popular open source security tools such as Nikto, Ettercap, and Nessus. This concise, high-end guide discusses the common customizations and extensions for these tools, then shows you how to write even more specialized attack and penetration reviews that are suited to your unique network environment. It also explains how tools like port scanners, packet injectors, network sniffers, and web assessment tools function. Some of the topics covered include:

* Writing your own network sniffers and packet injection tools
* Writing plugins for Nessus, Ettercap, and Nikto
* Developing exploits for Metasploit
* Code analysis for web applications
* Writing kernel modules for security applications, and understanding rootkits

While many books on security are either tediously academic or overly sensational, Network Security Tools takes an even-handed and accessible approach that will let you quickly review the problem and implement new, practical solutions--without reinventing the wheel. In an age when security is critical, Network Security Tools is the resource you want at your side when locking down your network.

Intrusion Prevention Systems (IPS)

noreply@blogger.com (iSecurity) — Wed, 23 Apr 2008 13:25:00 +0000

Intrusion detection systems (IDS) and intrusion prevention systems (IPS) are a significant growth area in the security market today -- and there's no sign of a slowdown.

Intrusion prevention systems (IPS) were invented in the late 1990s to resolve ambiguities in passive network monitoring by placing detection systems in-line. A considerable improvement upon firewall technologies, IPS make access control decisions based on application content, rather than IP address or ports as traditional firewalls had done. As IPS systems were originally a literal extension of intrusion detection systems, they continue to be related.

IP Security and NAT
Despite popular wisdom, IPsec and NAT can be employed together—in some configurations. We explore what you can do and what you can't, and the limitations inherent in today's solutions. One question asked frequently by those planning to implement virtual private networks concerns the ability to combine IP security (IPsec) and Network Address Translation (NAT). Many have heard rumors and war stories about incompatibilities between IPsec and NAT. Others have seen blanket denials issued by vendors who successfully combine IPsec and NAT within a single product.

What is Network Address Translation?
Most ISP admins are familiar with NAT (RFC 1631) and its many incarnations. Originally developed as an interim solution to combat IPv4 address depletion, NAT maps IP addresses from one realm to another, most often by mapping private IPs to public IPs.

The Intrusion Prevention System (IPS) feature set of Cisco IOS® contains several vulnerabilities.
These include:

Fragmented IP packets may be used to evade signature inspection.

IPS signatures utilizing the regular expression feature of the ATOMIC.TCP signature engine may cause a router to crash resulting in a denial of service.

There are mitigations and workarounds for these vulnerabilities. Cisco has made free software available to address these vulnerabilities for affected customers.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070213-iosips.shtml.

Cisco IOS IPS Security Bypass and Denial of Service
Two vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious people to bypass certain security restrictions or cause a DoS (Denial of Service).

1) Cisco IOS IPS signatures using regular expressions may not correctly identify malicious traffic within fragmented IP packets. This can be exploited to bypass the detection mechanism by sending specially crafted, fragmented IP packets.

2) An error exists within the ATOMIC.TCP scanning mechanism and signatures, which use regular expressions (e.g. Signature 3123.0 for Netbus Pro Traffic). This can be exploited to crash a device by producing specially crafted network traffic.

TippingPoint Intrusion Prevention Systems
The TippingPoint Intrusion Prevention System (IPS) delivers the most powerful network protection in the world. The TippingPoint IPS is an in-line device that is inserted seamlessly and transparently into the network. As packets pass through the IPS, they are fully inspected to determine whether they are legitimate or malicious. This instantaneous form of protection is the most effective means of preventing attacks from ever reaching their targets.

Authentication using Smart Card Technology

noreply@blogger.com (iSecurity) — Mon, 07 Apr 2008 10:36:00 +0000

Smart card is an important method for authentication mechanism. Its look like a credit card –sized plastic which has following parts.
1. Microprocessor
2. Rom, for encryption and decryption and installing operating system.

Although Smart Card has a small tiny structure but it can be used for variety of application from high level digital application to low-level phone identification application for individuals.

Do not be confused between concept of this posting (smart card) and RFID. Actually, RFID is just an automatic identification method, relying on storing and remotely retrieving data using devices called RFID tags. A RFID tag does not have both paths mentioned above.

Smart Card sub-system Architecture
Basic components of the smart card subsystem
o A resource manager that uses a Windows application programming interface (API)

o The smart card Resource Manager runs as a trusted service in a single process.
o Resource manager have access of all the information which is passed to smart card and smart card reader that contains the requested card.
o So the resource manager is responsible for managing and manipulating all the access for application for any smart card which is used with any reader and it can also control all the application for inserted smart card in any smart card reader.
o The Resource Manager provides a given application with a virtual direct connection to the requested smart card.
o The Resource Manager performs three basic tasks in managing access to multiple readers and cards. First, it identifies and tracks resources. Second, it controls the allocation of readers and resources across multiple applications. Finally, it supports transaction primitives for accessing services available on a specific card.
o This is important because current cards are single-threaded devices that often require execution of multiple commands to complete a single function. Transaction control allows multiple commands to be executed without interruption, ensuring that intermediate state information is not corrupted.
* A user interface (UI) that works with the resource manager.

Authentication Techniques
o Dynamic Password Authentication
o User Authentication
o Symmetric key cryptography
o Asymmetric key cryptography

Dynamic Password Authentication
Smart Card creates different passwords for each authentication attempt
Generates new pass codes many times a day.
The host executes the same algorithm as the smart card, so it knows the current valid password at any given time.
This method ensures card authenticity as the password keeps on changing dynamically and the algorithm is hard to crack down.

Symmetric key cryptography & Asymmetric key cryptography
Symmetric Key Authentication

Fig: Authenticating using Symmetric Key Crytography

There are many ways and method are available for the authentication of smart card. We can implement an authentication method using PKI infrastructure and without using Smart Card too. However these simpler cards have considerably lower prices because they do not require a cryptographic coprocessor that is needed for executing public key cryptographic operations with reasonable speed.

Fig: Public Key Authentication using RSA (Rivest Shamir Adelman Cryptosystem)

The server gives a random challenge to the smart card and requests a message authentication code (MAC, a kind of signature) generated over the card ID (identifier) and the challenge. Often, a password provided by the user has to be given to the smart card before the card generates the MAC. This procedure ensures that a thief or finder of a card cannot use it without knowledge of the password.

The smart card uses a key to generate the MAC over the card ID and the challenge obtained from the server. Then it will sends both the ID and the MAC back to the server and The server uses the card ID to derive the card key from a master key and uses that card key to verify the MAC sent from the card.

Here is the example of Authentication using public key smart cards. Here first The server sends a random challenge to the smart card then in reply The smart card uses its private key to generate a digital signature over the challenge then The digital signature and the certificate associated with the private key of the smart card are sent to the server. The server verifies the certificate and then uses the public key contained in the certificate to verify the signature .

Applications
o Secure network access Smart Cards can carry an individual's digital signature .
o Cellular phones, Smart Cards offer a mechanism to secure cellular phones against fraudulent use.
o Financial , The applications of smart cards include their use as credit or ATM cards

Benefits
o Strengthen security: The two-factor authentication of smart cards requires more than entering valid credentials. You must possess the smart card and know the personal identification number (PIN).
o Flexible: Smart card memory contains security certificates, and can be used for in-house development projects.
o Simple: Smart cards are easy to use. No cumbersome password generators to carry around. No bulky device to break.
o Leverage existing infrastructure: Using the PKI of Windows 2000 Server or Windows Server 2003, you can create your own security certificates and manage the process internally without dependence upon an external partner

IDS Techniques

noreply@blogger.com (iSecurity) — Mon, 07 Apr 2008 04:53:00 +0000

This posting will summarize the interesting techniques used in IDS system for both software IDS and hardware IDS (appliance).

Signature Detection
In this technique known representations of intrusions are stored in the IDS and are then compared to the system activity. When a known intrusion matches these signatures, an alert is raised. Signatures must be created to exactly match the characteristics (protocols or the contents of traffic) of a specific intrusion and no other activities to avoid false positives. This technique is most accurate for detecting known attacks e.g. DoS attack.

Signature engines also have their disadvantages. Because they only detect known attacks, a signature must be created for every attack, and novel attacks cannot be detected. Signature engines are also prone to false positives since they are commonly based on regular expressions and string matching. Both of these mechanisms merely look for strings within packets transmitting over the wire.

Anomaly Detection
An Anomaly-Based IDS, is a system for detecting computer intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous. The classification is based on heuristics or rules, rather than patterns or signatures, and will detect any type of misuse that falls outwith normal system operation. This is as opposed to signature based systems which can only detect attacks for which a signature has previously been created.

Anomaly detection detects a misuse by measuring norm overtime and then generating alert when a pattern differs from a norm. In this technique a set of data is gathered from the system activity of the user and this data set is base lined. If the flow of traffic deviates from the base lined data set pattern an alarm is raised.

A disadvantage of anomaly-detection engines is the difficultly of defining rules. Each protocol being analyzed must be defined, implemented and tested for accuracy. The rule development process is also compounded by differences in vendor implementations of the various protocols. Custom protocols traversing the network cannot be analyzed without great effort. Moreover, detailed knowledge of normal network behavior must be constructed and transferred into the engine memory for detection to occur correctly. On the other hand, once a protocol has been built and a behavior defined, the engine can scale more quickly and easily than the signature-based model because a new signature does not have to be created for every attack and potential variant.

Target Monitoring
Target monitoring works by means of generating a cryptographic hash for every file on the system and periodically comparing that hash to the original file to ensure that no change has occurred. This type of system is the easiest to implement, because it does not require constant monitoring by the administrator. Integrity checksum hashes can be computed at whatever intervals we wish on either all files or just the critical files.

Stealth Probes
Stealth probe technique attempts to detect any attackers that choose to carry out their mission over prolonged periods of time. Attackers, for example, will check for system vulnerabilities and open ports over a two-month period, and wait another two months to actually launch the attacks. This technique will collect a wide-variety of data throughout the system, checking for any methodical attacks over a long period of time. They take a wide-area sampling and attempt to discover any correlating attacks.

Conclusion
However, anomaly detection has an advantage over signature-based engines in that a new attack for which a signature does not exist can be detected if it falls out of the normal traffic patterns. The best example of this is how such systems detect new automated worms. When a new system is infected with a worm it usually starts scanning for other vulnerable systems at an accelerated or abnormal rate flooding the network with malicious traffic, thus triggering a TCP connection or bandwidth abnormality rule.

Five major types of IDS

noreply@blogger.com (iSecurity) — Mon, 07 Apr 2008 02:39:00 +0000

Intrusion Detection System as the name implies detects intrusion in the network. It implies both intrusions from inside and from outside the network.
IDS, these days, have become vital component in the security toolbox.

This posing will provide an overview of IDS, their types, detection techniques employed and various popular IDS tools that are widely used. This report also gives the overview of Snort IDS tool followed by a short demo showing the actual working of snort to catch intrusion based on the rules set. The intent of this presentation and report is to make the audience aware of the importance of IDS and also to make them familiar with the usage of Snort IDS tool.

Introduction
Intrusion Detection System is any hardware, software, or a combination of both that monitors a system or network of systems against any malicious activity. This is mainly used for detecting break-ins or misuse of the network. In short, we can say that IDS is the ‘burglar alarm’ for the network because much like a burglar alarm, IDS detects the presence of an attack in the network and raises an alert. An IDS provides three functions: monitoring, detecting and generating an alert.

IDS are often considered as the functionality of firewall. But there is a thin line of difference between them. A firewall must be regarded as a fence that protects the information flow and prevent intrusions where as IDS detects if the network is under attack or if the security enforced by the firewall has been breached. Together firewall and IDS enhance the security of network.

Intrusion Detection System uses a security policy (or rules) to detect unusual activity. These rules are defined by the administrator based on the needs of the organization. Any activity that violates this security policy will be considered a security threat and will be reported to the administrator via email or as page or as SNMP traps. These policies must be updated regularly to keep up with the threats and needs.

Of the security incidents that occur on a network, the vast majority (up to 85 percent by many estimates) come from inside the network. These attacks may consist of otherwise authorized users who are disgruntled employees. The remainder come from the outside, in the form of denial of service attacks or attempts to penetrate a network infrastructure. Intrusion detection systems remain the only proactive means of detecting and responding to threats that stem from both inside and outside a corporate network.

Types of IDS
There are three main types of Intrusion Detection Systems:
• Host Based
• Network Based
• Stack Based
• Signature Based
• Anomaly Based

Host Based IDS
Intrusion Detection System is installed on a host in the network. HIDS collects and analyzes the traffic that is originated or is intended to that host. HIDS leverages their privileged access to monitor specific components of a host that are not readily accessible to other systems. Specific components of the operating system such as passwd files in UNIX and the Registry in Windows can be watched for misuse. There is great risk in making these types of components available to NIDS to monitor.

Although HIDS is far better than NIDS in detecting malicious activities for a particular host, they have limited view of entire network topology and they cannot detect attack that is targeted for a host in a network which does not have HIDS installed.

Network Based IDS
Network IDSs (NIDS) are placed in key areas of network infrastructure and monitors the traffic as it flows to other host. Unlike HIDS, NIDS have the capability of monitoring the network and detecting the malicious activities intended for that network. Monitoring criteria for a specific host in the network can be increased or decreased with relative ease.

NIDS should be capable of standing against large amount number of network traffic to remain effective. As network traffic increases exponentially NIDS must grab all the traffic and analyze in a timely manner.

Stack Based IDS
Stack based IDS is latest technology, which works by integrating closely with the TCP/IP stack, allowing packets to be watched as they traverse their way up the OSI layers. Watching the packet in this way allows the IDS to pull the packet from the stack before the OS or application has a chance to process the packets.

Signature-Based IDS
Signature-Based IDS use a rule set to identify intrusions by watching for patterns of events specific to known and documented attacks. It is typically connected to a large database which houses attack signatures. It compares the information it gathers against those attack signatures to detect a match.

These types of systems are normally presumed to be able to detect only attacks “known” to its database. Thus, if the database is not updated with regularity, new attacks could slip through. It can, however, detect new attacks that share characteristics with old attacks, e.g., accessing 'cmd.exe' via a HTTP GET request. But, in cases of new, uncataloged attacks, this technique is pretty porous.

Also, signature based IDS’s may affect performance in cases when intrusion patterns match several attack signatures. In cases such as these, there is a noticeable performance lag. Signature definitions stored in the database need to be specific so that variations on known attacks are not missed. This sometimes leads to building up of huge databases which eat up a chunk of space.

Anomaly Based IDS
Anomaly-Based IDS examines ongoing traffic, activity, transactions and behavior in order to identify intrusions by detecting anomalies.

It works on the notion that “attack behavior” differs enough from “normal user behavior” such that it can be detected by cataloging and identifying the differences involved.

In most anomaly-based IDS’s the system administrator defines the baseline of normal behavior. This includes the state of the network's traffic load, breakdown, protocol, and typical packet size.

Anomaly detectors monitor network segments to compare their state to the normal baseline and look for current behavior which deviate statistically from the normal. This capability theoretically gives anomaly-based IDSs abilities to detect new attacks that are neither known nor for which signatures have been created.

On the other hand, anomaly-based IDS systems have been known to be prone to a lot of false positives. In these cases, the attacks are reported based on changes to the current system on which the IDS is installed. This is because there is a change in the normal state of the system which is not perceived by the IDS.

Sometimes, anomaly-based IDS systems can cause heavy processing overheads on the computer system they are installed on. It takes a short period of time for anomaly-based systems to create statistically significant baselines. During this period, they are relatively open to attack.

Packet sniffer

noreply@blogger.com (iSecurity) — Sun, 06 Apr 2008 09:44:00 +0000

A packet sniffer (also known as a network sniffer, network analyzer or protocol analyzer or, for particular types of networks, an Ethernet sniffer or wireless sniffer) is computer software or computer hardware that can intercept and log traffic passing over a digital network or part of a network.[1] As data streams flow across the network, the sniffer captures each packet and eventually decodes and analyzes its content according to the appropriate RFC or other specifications.

Capabilities
On wired broadcast LANs, depending on the network structure (hub or switch), one can capture traffic on all or just parts of the traffic from a single machine within the network; however, there are some methods to avoid traffic narrowing by switches to gain access to traffic from other systems on the network (e.g. ARP spoofing). For network monitoring purposes it may also be desirable to monitor all data packets in a LAN by using a network switch with a so-called monitoring port, whose purpose is to mirror all packets passing through all ports of the switch. When systems (computers) are connected to a switch port rather than a hub the analyzer will be unable to read the data due to the intrinsic nature of switched networks. In this case a shadow port must be created in order for the sniffer to capture the data.

On wireless LANs, one can capture traffic on a particular channel.

On wired broadcast and wireless LANs, in order to capture traffic other than unicast traffic sent to the machine running the sniffer software, multicast traffic sent to a multicast group to which that machine is listening, and broadcast traffic, the network adapter being used to capture the traffic must be put into promiscuous mode; some sniffers support this, others don't. On wireless LANs, even if the adapter is in promiscuous mode, packets not for the service set for which the adapter is configured will usually be ignored; in order to see those packets, the adapter must be put into monitor mode.

Uses
The versatility of packet sniffers means they can be used to:

Analyze network problems.
Detect network intrusion attempts.
Gain information for effecting a network intrusion.
Monitor network usage.
Gather and report network statistics.
Filter suspect content from network traffic.
Spy on other network users and collect sensitive information such as passwords (depending on any content encryption methods which may be in use)
Reverse engineer protocols used over the network.
Debug client/server communications.
Debug network protocol implementations.

Example uses
A packet sniffer for a token ring network could detect that the token has been lost or the presence of too many tokens (verifying the protocol).
A packet sniffer could detect that messages are being sent to a network adapter; if the network adapter did not report receiving the messages then this would localize the failure to the adapter.
A packet sniffer could detect excessive messages being sent by a port, detecting an error in the implementation.
A packet sniffer could collect statistics on the amount of traffic (number of messages) from a process detecting the need for more bandwidth or a better method.
A packet sniffer could be used to extract messages and reassemble into a complete form the traffic from a process, allowing it to be reverse engineered.
A packet sniffer could be used to diagnose operating system connectivity issues like web,ftp,sql,active directory,etc.
A packet sniffer could be used to analyse data sent to and from secure systems in order to understand and circumvent security measures, for the purposes of penetration testing or illegal activities.
A packet sniffer can passively capture data going between a web visitor and the web servers, decode it at the HTTP and HTML level and create web log files as a substitute for server logs and page tagging for web analytics.

This information was obtained from www.wikipedia.org :)

Honey Pots

noreply@blogger.com (iSecurity) — Sat, 05 Apr 2008 14:05:00 +0000

Network IDS: An IDS (Intrusion Detection System) detects unwanted manipulation to the computer network in a network. An intrusion detection system is used to detect all types of malicious network traffic and computer usage like network attacks against vulnerable services, data driven attacks on applications, host based attacks such as privilege escalation, unauthorized logins and access to sensitive files, and malwares.

We all know that in today’s society there are hackers and intruders attacking our computers from all directions. Moreover, most of these people feel as though the hackers will never fall victim to such a crime much less even be targeted by such an individual. But, there are some new advances in technology that allow users to actually set traps for hackers and virtually fight back. This trap is known as the Honeypot. Honeypot is an advance technology which is used to trace and catch the hackers/attackers who intend to attack a secure system.

Definition: It is a security resource used to detect, deflect or counter attacks attempts at unauthorized use of information system. It consist of a computer ,data or a network site that seems to be a part of network but actually it is not .It is an isolated ,protected and monitored terminal which seems to have valuable information for the attackers.Honeypots can be defined in three layered networks:

• Prevention: Honeypots can be used to slow down or stop automated attacks

• Detection: It is used to detect unauthorized activity and capture unknown attacks. Generate very few alerts, but when they do you can almost be sure that something malicious has happened.

• Response: Production honeypots can be used to respond to an attack. Information gathered from the attacked system can be used to respond to the break-in.
Honeypot in a real network environment:

Types of Honeypots
Honeypots can be classified on the basis of their deployment and on basis of their level of interaction/involvement in the network. On the basis of their deployment Honeypots can be classified in to two categories:
• Production Honeypots

• Research Honeypots

Production Honeypots:
The main purpose of this production honeypots is to mitigate the risk in an organization. Production Honeypots are placed under the production network with other production servers by the organization to improve their overall state of security .These are basically have a low level involvement with the network.

Research Honeypots:
Research Honeypots are run by volunteer non profit organization whose aim is to gather information about the black hat community .These Honeypots do not add any value to any companies but work independently.

On the basis of level of interaction Honeypots are classified as:
• Low-Interaction Honeypots: Honeyd• High Interaction Honeypots: HoneyNet

Honeyd:
Honeyd is an open-source solution which was created and maintained by NielsProvos. The primary purpose of Honeyd is intrusion detection; it does this by monitoring all the unused IPs in a network. Any attempted connection to an unused IP address is assumed to be unauthorized or malicious activity. After all, if there is no system using that IP, why is someone or something attempting to connect to it? For example, if your network has a class C address, it is unlikely that every one of those 254 IP addresses is being used. Any connection attempted to one of those unused IP addresses is most likely a threat to the network.

Honeyd can monitor all of these unused IPs at the same time. Whenever a connection is attempted to one of them, Honeyd automatically assumes the identity of the unused IP addresses and then interacts with the attacker. Honeyd can detect any activity on any UDP or TCP port, as well as some ICMP activity. The user doesn’t have to create a service or port listener on ports he wants to detect connections to, Honeyd does this all.

HoneyNet:
It is a high-interaction honeypot designed to capture extensive information on threats. High-interaction means a honeynet provides real systems, applications, and services for attackers to interact with, as opposed to low-interaction honeypots such as Honeyd which provide emulated services and operating systems. What makes a honeynet different from most honeypot is that it is a network of real computers for attackers to interact with. Conceptually honeynets are very simple; they are a network that contains one or more honeypots. Since honeypots are not production systems, the honeynet itself has no production activity, no authorized services. As a result, any interaction with a honeynet implies malicious or unauthorized activity. Any connections initiated inbound to your honeynet is most likely a threat. This makes analyzing activity within your honeynet very simple. With traditional security technologies, such as firewall logs or IDS sensors, you have to sift through gigabytes of data. A great deal of time and effort is spent looking through this information, attempting to eliminate false positives while identifying attacks or unauthorized activity.

Honeynet Architecture:
To successfully deploy a honeynet, you must correctly deploy the honeynet architecture. The key to the honeynet architecture is what we call a honeywall. This is a gateway device that separates your honeypots from the rest of the world. Any traffic going to or from the honeypots must go through the honeywall. This gateway is traditionally a layer 2 bridging device, meaning the device should be invisible to anyone interacting with the honeypots. Below we see a diagram of this architecture. Our honeywall has 3 interfaces. The first 2 interfaces (eth0 and eth1) are what separate our honeypots from everything else; these are bridged interfaces that have no IP stack. The 3rd interface (eth2, which is optional) has an IP stack allowing for remote administration.

There are several key requirements that a ho

neywall must implement; Data Control, Data Capture, Data Analysis, Data Collection.
1) Data Control: Our aim is to prevent the data from an attacker once he has entered the network.

2) Data Capture: is the monitoring and logging of all of the threat's activities within the honeynet.

3) Data Analysis: A honeynet is worthless if we have no means to analyze he data collected. Every organization has different means to apply this.4) Data Collection: This only applies to organizations with multiple honeynets as it is necessary to collect data from all the sources.

Advantages and Disadvantages of Honeypots

Advantages:

• Productive environment: It distracts the attention of attacker from the real target.• We can peek in to the guest operating system at any time.

• We can reinstall the contaminated guest easily.

• It is really simple to implement and use honeypots.

Disadvantages:

• Sub-optimal utilization of computational resources.

• Reinstallation of polluted system is very difficult.

• Difficulty in monitoring of such system in a safe way.

• Detecting the honeypot is easy