Search

This article discusses the Obol protocol programming language that allows for testing and experimentation when constructing and using security protocols in real systems. An Obol program is called a script and describes a participant's role in the protocol. It provides features useful to the protocol programmer, such as control structures, interactivity and the use as a crypto coprocessor. Obol is also used by the GridKit project at the University of Lancaster in England to experiment with flexible security policies.

The article presents information on how to eliminate the volume of spam e-mails using other than traditional methods. Spoofing has been a well known technique, often used by spammers to make them harder to trace. As the spam filters and virus scanners can eliminate only a certain amount of spam, Simple Mail Transfer Protocol (SMTP) allows these e-mail headers to be faked and does not allow for the sender to be authenticated as the real sender of the message. SMTP is the basic mailing protocol used by servers to send e-mail messages to each other, which defines how the conversation should take place and the format of the data that is exchanged during the conversation. Information on an alternative for spamming unwanted mails have also been offered in the article. That alternate method is a Hashcash-based method, in which a textual stamp to the header of an e-mail is added to prove that the sender has expended a certain amount of CPU time calculating the stamp prior to sending the e-mail. Detailed information on the hashcash based spamming solution is offered in the article.

The article presents information related to security issues in Voice-over-IP (VoIP) networks. As most of the private-and public-sector organizations and service providers are planning to migrate to VoIP and the associated emerging real-time services, such as IP multimedia subsystem, IP TV, and conferencing, the need to secure VoIP communications is becoming increasingly urgent. The primitive differences between VoIP and data security are that, VoIP has characteristics such as high sensitivity to quality-of-service parameters, all VoIP communications are real-time, a wide range of new infrastructure devices are required, and the most important thing is that VoIP networks interact with the existing phone networks. With the diverse benefits of VoIP systems, including the reduced cost of deployment and management, it is predicted that by 2009, 91 percent of all enterprise phone systems worldwide will be represented by VoIP technology.

The article focuses on the security issues, associated with the Voice-over-IP (VoIP) communication technology. The VoIP technology has created both opportunities and security risks. VoIP is based on a very different architecture than traditional TDM-based private branch exchanges. VoIP is a realtime and mission-critical application which is the main cause for creating its own issues and challenges. In deployment of a VoIP, a variety of threats from different networking layers, as well as from different areas within the network have been noticed. It has been observed that an attacker can try to compromise a VoIP gateway and launch a denial-of-service attack against the call processing server exploit vulnerabilities in a vendor's SIP protocol implementation. A hacker can even try to hijack VoIP calls through traditional TCP hijacking, application manipulation, or UDP spoofing.

The article describes the mechanism of the Secure Shell (SSH) protocol Kerberos authentication using Generic Security Services Application Programming Interface and Microsoft's Security Support provider Interface. There are three steps in running SSH protocol: negotiate encryption, authenticate the user and open and use channels. The protocol uses a packetized binary protocol on the wire consisting of a shorter header, a message type, the payload and Message Authentication Code. On the other hand, SSH authentication using Kerberos, it can run over the SSH User Authentication protocol or over the SSH Transport protocol.

This article presents information on the new CryptoNetX line of security protocol processors unveiled by Broadcom as of December 2005. This next-generation line of security processors that combine Internet protocol Security and Secure Sockets Layer protocol processing, cryptographic acceleration, and hardware-based identity management and authentication into a single-chip solution. Recently announced are three new security protocol processors that include either PCI-X(R) or PCI Express(R) host bus architectures. Each of these new chips provides high-performance cryptographic acceleration and the ability to offload a significant amount of security processing functions from the host processor, resulting in higher performance and optimal central processing unit utilization.

This section offers steps on how to start with a service-oriented architecture (SOA). It was learned that SOA builds on the stack of protocols that define Web services. It is a broad, standards-based framework in which services are built, deployed, managed, and orchestrated in pursuit of new infrastructures that respond to shifting business demands. SOA starts with a business promise of enabling enterprises to re-engineer themselves. The more dynamic the business, the more it will benefit from a well-implemented SOA. Before implementation, it is recommended to survey surroundings. An SOA involves a sprawling set of technologies. Another step is the connection of first services. Coming next is the selection and deployment of a registry or repository. The issue of convergence should come next. Security plans must be laid and a messaging infrastructure must be built. The last two steps is the deployment of service management and orchestration.

Wireless computing has become increasingly popular and inexpensive in the past few years. As this new field of computing continues to grow at a very fast rate, do the threats against wireless networks concurrently increase? What are the real threats facing wireless networks today, and what can be done to mitigate such threats? This column reviews the wireless worries and common points of abuse and wisdom to counter such threats. Topics covered include: wireless network protocol, common wireless devices, weaknesses in a wireless network, technical terms and steps that can be taken to harden a network against attack.

This article focuses on apprehensions of enterprise wireless holdouts for Wi-Fi. Even so, with the exception of ultrahigh-security installations, it's better to embrace WLANs than to fight them. Prohibiting Wi-Fi in an organization would require a bulletproof enforcement policy and monitoring tools to protect against rogue deployments. Gartner projects enterprise WLAN spending to hit $1.6 billion by 2009, assuming a compound annual growth rate of 12 percent from 2004 to that time. A properly engineered Wi-Fi security system can not only provide robust security for wireless users, it can also act as a platform to better secure wired network segments that have, for too long, relied on nothing more than physical security to combat abuse. Like any enterprise-class security system, an effective wireless security strategy must be multi-layered. Messages transported across wireless links must be protected by strong encryption. Even the most careful IT manager must accept that, for some wireless threats, there's no defense.

The article reports that after months spent testing a field of powerful deep-inspection Firewalls, the computer software company Juniper's NetScreen captured the crown, with Fortinet and Check Point trailing close behind. Historically, firewalls have been assigned blue-collar access-control duties while intrusion-detection systems take on the task of inspecting data traffie for signs of attack or anomalous packets. But over the past couple of years rebuilds in the firewall space reminiscent of old rods being retrofit with superchargers and nitrous oxide has been seen. Researchers thought the hard part would be building a test bed that could mimic an enterprise network and traffic load. But after a month and a half of testing, it was the third component, that came back to bite them. Problems ranged from misconfigured firewall rules to a demonically possessed switch that killed two days of testing before we finally replaced it. Researchers found that most vendors had problems configuring their firewalls in accordance with the required rule sets. INSETS: DEEP-INSPECTION FIREWALLS.;HOW WE TESTED DEEP-INSPECTION FIREWALLS..

A general overview of the operation of Internet Protocol Security (IPsec) has been presented and the advantages and disadvantages of the architecture have been discussed. IPsec incorporates all of the most commonly employed security services, including authentication, integrity, confidentiality, encryption and nonrepudiation. However, the major drawbacks to IPsec are its complexity and the confusing nature of its associated documentation. In spite of these various drawback, IPsec is believed by many to be one of the best security system available. It is hoped that considerable improvement will be evidenced in future revisions of IPsec and that the problems identified with the architecture will be remedied.

The article discusses protocol and application awareness on security vendors. Offerings of providers of intrusion detection system; Approach of vendors to protocol anomaly detection; Uses of application proxy.

Focuses on wireless networking capability for classroom connectivity at the West Point Military Academy. Software solution for security concerns of wireless networking; Advantages of using the bandwidth 802.11a; Configuration control of computers using the wireless technology.

The computer industry is emphasizing on the use of Extensible Markup Language (XML), a way to encode information so that it can easily be understood by anyone with a text editor. Vendors are suggesting that network managers use XML to make their internal databases accessible from outside the firewall, and even to run executable code found on the public Internet. The new XML-based standards are more flexible than current security technologies, allowing different cryptographic keys and algorithms to be applied to different parts of a file. XML Encryption allows individual elements to be encrypted. An XML-based messaging protocol, Simple Object Access Protocol (SOAP), is used for transferring automated information requests and short pieces of code. The inability to distinguish SOAP and other potentially dangerous content from ordinary HTML is what concerns most security professionals. Selective encryption and signing is useful in traditional firewall.

Discusses the PacketCable Security Specification for Internet Protocol telephony networks. Information on the various security threats to IP networks; Details on the authentication process supervised by a Key Distributor Center; Key strength of the PacketCable security architecture.

Focuses on the security of computer network protocols, focusing on Internet protocol (IP). Information on Internet communication based on transmission control protocol; Advantages of having IP protocol security; Application of general-purpose protocols; Features of dial-up protocols.

The article talks about the computer network protocol 802.1X. It offers information on its uses in security appliances and virtual local area network (VLAN)-based quaratine. The three system components of 802.1X setup, the supplicant, the authenticator and the authentication server, are discussed. It also discusses wireless LAN authentication and the protocol's focus on improved device integrity.

Reports on the availability of OCTEON XL Accelerator cards, targeted at secure network services and compression acceleration in Appliances and Storage Systems, from Cavium Networks. The cards deliver the industry's highest performance, enabling the fastest time to market for existing system configurations. The products are being adopted by Tier-1 vendors for security and networking appliances and storage products as the way to deliver advanced security and application acceleration. The cards are offered in three distinct families with a range of processor performance.

The article presents the author's experiences of designing a 5,000-site IP security virtual private network (VPN) solution for a company that encompassed 125 countries. While doing some laboratory tests, the author got success in talking over VPN through Voice-over-IP (VoIP) solution. It was the first VoIP of VPN call with Cisco gear. This invention made international calls cheap, but the author was concerned about security threats on the Internet applications. But now the industry has begun to respond with VoIP enabled firewalls, intrusion prevention systems, and intrusion detection systems.

Features the IEEE 802.1x authentication standard for wireless networks. Details of its operation; Difficulties of deploying an 802.1 architecture; Advantage of adding the ability to check the security status of devices to the protocol.

This article reports on the Astaro Security Linux v5.1 perimeter security software from Astaro Corp. that includes major spam protection enhancements, dramatically improving the blocking of unwanted email messages as of February 2005. Astaro Security Linux v5.1 also enables easy integration with network management systems, and adds features that allow customers to monitor bandwidth usage. Astaro Security Linux V5.1 key new features include SPF record checking, greylisting, BATV reverse path signing, list of quarantined emails for users, use of additional spam databases. All anti-spam features can be enabled or disabled from the Astaro Security Linux WebAdmin interface, and in some cases can be enabled or disabled for specific email recipients. Astaro Security Linux V5.1 supports the use of Simple Network Management Protocol (SNMP) Traps to communicate system information like anti-virus and network outages in real time to network management systems such as HP OpenView, CA Unicenter, and IBM Tivoli. SNMP trap sending can be configured from the Astaro Security Linux WebAdmin interface. This feature provides alerts when bandwidth limits are exceeded and allows administrators to respond quickly to unexpected changes.

Examines which of the two primary technology, Internet protocol security (IPSec) and secure sockets layer (SSL), should be used for mobile work force. Key benefits of IPSec; Development of SSL; Factors to consider before choosing the appropriate solution.

Deals with time synchronization in companies' network systems. Importance of time synchronization for resolving a network failure or security breach; Mechanism of action of the automation approaches Network Time Protocol (NTP) and Simple Network Time Protocol (STNP); Steps involved in implementing NTP and STNP. INSETS: Setting Your NTP Time Model;step by step;SITES TO SEE.

Offers information on computer network security. Difficulties with such Internet protocols (IP) as POP3 (Post Office Protocol) and IMAP4 (Internet Messaging Access Protocol) with their default to plain-text authentication; Solutions for non-clear-text POP and IMAP authentication; Details of APOP (Authentication POP), KPOP (Kerberos POP).

Discusses how to make Internet Protocol Security (IPSec) work. Virtual private network (VPN) map; Sub-net-specific problems; Policy issues; Asymmetric virtual private network. INSET: The Many Modes of IPSec With IKE.

Focuses on the use of Point-to-Point Protocol (PPP) in remote access to computer networks. Operating system-specific ways to trace PPP; Where PPP can be used; The four steps to a PPP connection; Troubleshooting PPP connections; Common problems with PPP; Tools which are available for working with PPP. INSET: PPP Messages Decoded.

The article focuses on IETF (Internet Engineering Task Force) NEA initiative. The IETF aims to solve proprietary security architecture problems by offering a standardized way for compliant endpoints to interoperate with various computer architectures like Cisco Systems' Network Admission Control and others. The NEA framework focuses on standardizing protocols which include the PA (Posture Attribute) Protocol, the PB (Posture Broker) Protocol, and the PT (Posture Transport) Protocol. A diagram of the NEA Model is also included.

This article discusses emerging information technology (IT) standards that have an impact on computer security, data protection, and computer network security in enterprises. The Control Objectives for Information and Related Technology (COBIT) is gaining acceptance as good practice for control of data, systems, and related risk. ISO 27001 is entitled "Information Security Management—Specification With Guidance for Use. The book series "IT Infrastructure Library" is designed to help technology-usage costs. The Statement on Auditing Standards Number 70 came from the American Institute of Certified Public Accountants. INSET: Future Of NIST.

The article reports on the network-based monitoring systems, which will detect and block outbound traffic containing sensitive data. The problem is not just the content within e-mail messages, but the explosion of alternative communication mechanisms that employees are using, including instant messaging, blogs, File Transfer Protocol transfer, Web mail and message boards. Network-based content monitoring and control tools take a broad-brush approach, examining all crosses the network unlike security tools that protect specific applications such as e-mail or instant messaging. INSET: Block That Swap.

This article deals with the use of a Virtual Private Network (VPN) device for computer security. For any network that connects remote users to the Internet, a VPN gateway provides three essentials for data: authentication, confidentiality and integrity. Authentication can be accomplished using certificates, passwords, smart cards or shared secret keys. Confidentiality is achieved through encryption. VPN are designed so that someone intercepting traffic cannot decode it. And integrity means that data has not been modified in transit. VPN detects any modification to data and reject it. VPN by themselves can cause security and network infrastructure problems because packets are encrypted, the unencrypted data cannot be inspected inside the encryption tunnel. When selecting a VPN device, consider these four factors: supported protocols, supported platforms, speed and price. A remote-access VPN is more of a challenge. Unfortunately, using standard Internet Protocol Securing Protocol (IPsec) will not work in this environment, as the IPsec protocol does not support dynamic and changing Internet Protocol, which would occur with remote users. Some VPN vendors partner with third-party developers to offer firewall, antivirus or intrusion-detection capabilities with the VPN client for a slightly higher price. When organizations use both antivirus and firewalling, bundling client-side security into one package is less expensive than ordering and may offer better centralized management capabilities.

This article reports that Business Communications Review has awarded Aruba's wireless local area network (WLAN) system as Best-in-Test for delivering the most comprehensive suite of capabilities and highest performance of any enterprise-class WLAN system, as of December 2004. The evaluation, conducted by independent testing center Miercom, tested a wide range of wireless and security capabilities including configuration, security, management, administration and performance against products from Aruba, Bluesocket, Chantry and Meru. For security, Miercom ran through a battery of tests that addressed five key areas: authentication of wireless users; strong encryption of wireless LAN traffic; defending the network from wireless security threats; detecting, monitoring and locating unauthorized rogue APs; disabling rogue APs through containment or mitigation capabilities. Aruba took the top prize delivering the highest throughput for encrypted and unencrypted traffic while exhibiting the lowest delays and packet loss. Aruba also showed the best inter-switch failover times, an essential requirement for enterprise wireless deployments. Finally, Aruba's management and administration capabilities were viewed among the strongest. Reviewers noted strong features and functionality including graphical planning, auto-configuration tools for APs and RF calibration, simple network management protocol support and very good integral reports.

This article presents of list of reviews of several security products, including virtual private networks, vulnerability assessment offerings and some backup solutions. Netilla Security Platform Release 4.0 is a reliable security platform with built-in fail-over support, this box offers solid security, straightforward policy definition and a nice portal for end-users. However, policy management is not as easy as it could be, the range of Secure Sockets Layer cipher levels is limited and it lacks Lightweight Directory Access Protocol support. Symantec DeepSight Threat Management System 5.0 is a boon to large enterprises that need a lot of warning to prepare for attacks on vulnerabilities. The service provides detailed intelligence about activities that could be attacks and confirmed vulnerabilities. Information is presented clearly, identifying threat levels and threat trends. Although pricey, the nCircle IP360 Vulnerability Management System is a thorough, well-designed network vulnerability scanning solution that would benefit any large network. Dispersed scanners allow continuous scanning without consuming a lot of bandwidth. Application detection accuracy is solid. Easy to operate and extremely thorough, Sanctum AppScan DE 1.7 is a worthwhile tool for developers interested in shoring up a Web application's security.

MessageLevel.com has unveiled Message Level Email Authentication Protocol in September 2004. This patent-pending technology enables full protection against e-mail spoofing, electronic messaging fraud, and e-mail phishing attacks. Using components of the e-mail messages themselves, the Message Level Protocol creates origination records for each outgoing message, which enables Receiving Systems to query back automatically as to the authenticity of received e-mail based upon whether or not the messages actually originated from the purported sender. As such, the Message Level Protocol creates an impenetrable solution against e-mail fraud, guarantees 100 percent detection of spoofed mails, and generates absolutely no false positives. The Message Level Protocol provides companies with a secure, reliable, and easily accessible solution to prevent spoofed e-mail and phishing attacks, which has previously been seen as impossible. Other solutions currently rely upon circumstantial evidence, such as whether or not pictures match in mails, looking for a key in the header, or publishing Internet protocol (IP) addresses for comparison are all subject to fraud. Moreover, e-mail phishing has now gone to the point of spoofing IP addresses in order to bypass current IP lookup measures in place. As such the Message Level Protocol is the only measure that guarantees complete protection and brings authenticity back to e-mail in order to stem direct losses for companies suffering from e-mail fraud.

Safety and security of Wi-Fi wireless local area network technology is a question that security analysts, industry executives, and information technology experts continue to debate as the technology begins to work its way into the enterprise environment. There have been vast improvements to WEP, the first edition of a security protocol that turned out to be a security failure. Then came WPA, which is considered secure for corporations and a strong foundation to the next version of security functions in 802.11i. WPA and WPA2 extend the encryption technology to 802.11i and Advanced Encryption System key support. This allows more cryptographically secure data and mirrors the security standards used by the United States government.

The article discusses the concerns among some security experts that denial-of-service (DoS) attacks could be launched against core routers and switches which were raised upon the disclosure in April 2004 of two serious flaws in widely used Internet technologies. One of the vulnerabilities involves Cisco Systems' implementation of the Simple Network Management Protocol in its Internetworking Operating System. The flaw could allow remote attackers to cause vulnerable systems to repeatedly restart when processing specific SNMP requests, eventually leading to DoS conditions. According to Amit Yoran, director of the U.S. Department of Homeland Security's National Cyber Security Division, the flaw is particularly dangerous because it affects a wide range of Cisco's routers and switches and is very easy to exploit. Meanwhile, a US-CERT advisory warned of a critical flaw in the Internet's core Transmission Control Protocol (TCP). The flaw allows remote attackers to create DoS conditions against TCP connections, with sustained attacks capable of disrupting portions of the Internet, the advisory stated. The flaw was disclosed by Great Britain's National Infrastructure Security Co-ordination Centre and involved a long-known weakness in TCP that allows attackers to constantly reset routers by guessing a unique 32-bit number needed for the process.

Evaluates the NetSwift iGate Pro Secure Sockets Layer Virtual Private Network appliance from Rainbow Technologies. Key features; Capabilities; Sites and connectors used in the iGate.

Presents information on the Security Assertion Markup Language (SAML) Extensible Markup Language-based language protocol. Discussion on the SAML documents and protocol, the two main components of the SAML standard; Use of SAML assertions without the direct involvement of an authority; General data categories of SAML. INSET: GLOSSARY.

Discusses concerns over the vulnerability of networks converged in Cisco Systems's Internetwork Operating System (IOS). Possibility of the disruption of a company's voice, video and data network caused by the Blaster worm; Launch of an Application-layer Distributed Denial of Service (DDOS) storm against routers and end users despite the implementation of QoS; Inability of Session Initiation Protocol (SIP) server and personal agents to protect networks from attacks in SIP devices.

Reports on the plan of Cisco Systems Inc. to issue a warning about a security threat to its user authentication technology for wireless local area networks. Vulnerability of Cisco's Lightweight Extensible Authentication Protocol (LEAP) algorithm to dictionary attacks; Services offered by Cisco; Decision of the University of British Columbia in Vancouver to use virtual private network technology instead of LEAP.

Discusses the application of Internet Protocol security (IPsec) for client/server information technology infrastructure. Application of IPsec for virtual private network; Implications of the proliferation of Web-based technology; Computer devices affected by the application of Secure Sockets Layer protocol.

Focuses on how to ensure the wireless data privacy of mobile workers. Reason for not using wired equivalent privacy in most Wi-Fi public-access locations; Basis of the Wi-Fi protected access system; Steps in implementing an enterprise Wi-Fi public access security procedure.

Provides information on Secure Sockets Layer (SSL) virtual private networks (VPN). Capabilities of SSL VPN; Comparison between SSL VPN and Internet Protocol Security-based VPN; Disadvantages of using SSL VPN.

Provides information on the Wi-Fi Protected Access security standard of the Wi-Fi Alliance in the U.S. Protocol used by the standard as a replacement for the Wired Equivalent Privacy; Features; Security methods on which vendors are focusing.

Focuses on the weaknesses in the Wi-Fi, or 802.1x, a security protocol for wireless networks. Three parts of 802.1x authentication; Vendors that have already begun adding 802.1x support to their products; Options to ensure a secure wireless network. INSET: THE BOTTOM LINE.

Focuses on the capability of the Simple Mail Transfer Protocol (SMTP) of alleviating the unsolicited electronic mail (e-mail) messages nuisance in the United States. Disadvantages of freeloading commercial e-mailers; Ways in tracking and terminating spammer interruptions in the computer network; Specifications of SMTP.

Focuses on the improvements for the Network Time Protocol's security and accuracy. Type of time-setting software installed on the product; Description of clock filters in the protocol.

Focuses on public-key infrastructure (PKI) digital certificate authentication applications. Computer security vendors like GTE CyberTrust, VeriSign Inc., Check Point Software Technologies Inc. and Xcert International Inc. which are offering PKI applications; How the rise in virtual private networks and the growing acceptance of the Internet Protocol (IP) Security standard have impacted PKI systems; The role that PKI systems play in business-to-business electronic commerce.

Two letters to the editor are presented in response to the articles "Do ISPs Pose a Bigger Online Privacy Threat Than Google?" in the September 15, 2008 issue and "Context of Collapse" in the September 22, 2008 issue.

The article suggests that one way to address security concerns caused by new technologies, such as peer-to-peer (P2P) applications like instant messaging (IM) and voice over IP (VoIP), is to add dedicated application security appliances, such as those designed specifically for P2P applications. The article explains that dedicated appliances designed specifically to assure protocol integrity before granting network access can be effective, but many enterprise networks already have that capability and more built into the deep-inspection and intrusion-detection capabilities of modern security products.

The article looks at intelligent power distribution units (PDU) and communication protocols such as simple network management protocols. According to the article, to provide the most flexibility for the user, the PDU software should be highly configurable and should include the ability to set outlet names, unit names, network settings, sequence times, and reboot times. For security, the intelligent PDU should allow for the setup of an administrator login level, plus permit the login of multiple users.