Search

Rad prikazuje računalnu mrežu zagrebačke tvrtke srednje veličine i nedostatke zatečene u sigurnosnom dijelu postojeće implementacije servisa. Naime, sigurnost mreže korisnika najviše se oslanjala na tradicionalni pristup zaštiti koju pruža rubni vatrozid što je značilo da, ukoliko korisnik primjerice uđe pomoću VPN konekcije u mrežu, ima pravo pristupa na sve poslužitelje i ostalu opremu. Kako bi se pronađene potencijalne ranjivosti uklonile, odlučeno je pratiti najbolje prakse nulto povjerenje mrežnog modela, koje je objašenjeno u prvom dijelu rada. Drugi dio rada prikazuje implementaciju internog segmentacijskog vatrozida, od odabira istog do konfiguracije granularnih pravila filtiranja prometa. Time je omogućen najmanji funkcionalan pristup svakom zaposleniku dok je sve ostalo zabranjeno. Nadalje, rad prikazuje osnovne principe nultog povjerenja, implementaciju po koracima te daje uvid u izazove implementacije takvog rješenja. This paper shows the computer network of a medium-sized Zagreb company and shortcomings found in the security part of the existing service implementation. Namely, the security of the users' network relied mostly on the traditional approach to protection provided by the edge firewall, which meant that if, for example, the user enters the network using a VPN connection, he has the right to access all servers and other equipment. In order to remove the found potential vulnerabilities, it was decided to follow the best practices of the zero-trust network model, which was explained in the first part of the paper. The second part of the paper shows the implementation of the internal segmentation firewall, from its selection to the configuration of granular traffic filtering uses. This enables the least functional access to each employee while everything else is denied. Furthermore, the paper presents the basic principles of zero-trust, and its implementation in steps and provides an insight into the challenges of implementing such a solution.

In this paper, we find the solution for the system of nonlinear ordinary differential equations having fractional-order arising in network access control using fractional natural decomposition method (FNDM). The consider a model which consists of a system of five nonlinear ordinary differential equations (NODEs), which illustrate the sensor networks are interesting essentials for malicious outbreaks that attack the network with the intention of reducing the integrity, availability and confidentiality. Further, we captured the nature of FNDM results for different value of fractional order in terms of the plots. The considered scheme highly effective and structured while examining nonlinear models and which can be observed and confirm from the obtained results. Further, the conspiracies cited in plots confirm the hired fractional operator and algorithm can help to exemplify the more fascinating properties of the nonlinear system associated real-world problems.

Fog computing is a new computing paradigm for meeting ubiquitous massive access and latency-critical applications by moving the processing capability closer to end users. The geographical distribution/floating features with potential autonomy requirements introduce new challenges to the traditional methodology of network access control. In this paper, a blockchain-enabled fog resource access and granting solution is proposed to tackle the unique requirements brought by fog computing. The smart contract concept is introduced to enable dynamic, and automatic credential generation and delivery for an independent offer of fog resources. A per-transaction negotiation mechanism supports the fog resource provider to dynamically publish an offer and facilitates the choice of the preferred resource by the end user. Decentralized authentication and authorization relieve the processing pressure brought by massive access and single-point failure. Our solution can be extended and used in multi-access and especially multi-carrier scenarios in which centralized authorities are absent.

Information security plays critical roles in modern society. However, traditional security measures like passwords, tokens and personal ID numbers only provide limited protection. Inspired by the fast training speed of extreme learning machine (ELM) and the promising feature extraction capability of extreme learning machine auto-encoder (ELM-AE), this paper proposes a keystroke dynamics identification method for intelligent keyboard (IKB) based on multi-layer extreme learning machine (ML-ELM). The IKB, as first demonstrated by Wang’s group, is a self-powered, non-mechanical perforated keyboard that converts mechanical stimuli applied to the keyboard into electrical signals without the needing an external power source. ML-ELM is a multilayer neural network stacking on top of ELM-AE. Our major contribution is to develop an accurate and efficient keystroke dynamics identification method based on ML-ELM. One significant advantage of the proposed method is that it does not rely on manual feature extraction and selection. In other words, the raw current signals obtained by IKB are directly the input to the network. The network structure is determined by grid search, which minimizes the human involvement. The other one is that the whole training process of the model does not require fine tuning, which makes the training process significantly faster than that of existing deep networks. Experimental results demonstrate that the proposed method has excellent timeliness whereas obtaining high identification accuracy. The proposed method has great potential in applications to computer or network access control, online payment, and cyber security.

The digital identity (or electronic identity) of a person is about being able to prove upon authentication who one is on the Internet, with a certain level of assurance, such as by means of some attributes obtained from a trustworthy Identity Provider. In Europe, the eIDAS Network allows the citizens to authenticate securely with their national credentials and to provide such personal attributes when getting access to Service Providers in a different European country. Although the eIDAS Network is more and more known, its integration with real operational services is still at an initial phase. This paper presents two eIDAS-enabled services, Login with eIDAS and Wi-Fi access with eIDAS, that we have designed, implemented, deployed, and validated at the Politecnico di Torino in Italy. The validation study involved several undergraduate students, who have run the above services with their authentication credentials and platforms and with minimal indications on their usage. The results indicate that the services were beneficial. Several advantages exist both for the users and for the Service Providers, such as resistance to some security attacks and the possibility to adopt the service without prior user registration (e.g. for short meetings, or in public places). However, some students expressed doubts about exploiting their national eID for Wi-Fi access, mainly in connection with usability and privacy issues. We discuss also these concerns, along with advantages and disadvantages of the proposed services.

Modern cloud computing platforms based on virtual machine monitors (VMMs) host a variety of complex businesses which present many network security vulnerabilities. In order to protect network security for these businesses in cloud computing, nowadays, a number of middleboxes are deployed at front-end of cloud computing or parts of middleboxes are deployed in cloud computing. However, the former is leading to high cost and management complexity, and also lacking of network security protection between virtual machines while the latter does not effectively prevent network attacks from external traffic. To address the above-mentioned challenges, we introduce a novel customized network security for cloud service (CNS), which not only prevents attacks from external and internal traffic to ensure network security of services in cloud computing, but also affords customized network security service for cloud users. CNS is implemented by modifying the Xen hypervisor and proved by various experiments which showing the proposed solution can be directly applied to the extensive practical promotion in cloud computing.

The term BYOD (Bring Your Own Device) refers to the use of employees' personal devices (for example smartphones, tablets, laptops, netbooks) to do their work and manage corporate data from anywhere at any time. BYOD has been widely applied in the business world, hospitals, and education. With the ease that can be achieved by using BYOD, the security aspect is very important to consider. It starts with the security of the device to the security of company data that can be accessed by employees. Five dimensions of security control that must be considered in implementing BYOD: 1) data control; 2) access control; 3) network access control; 4) device management; 5) create a supporting framework. With the five BYOD implementation solutions presented in this study, there is only one solution that accommodates the five dimensions of BYOD security control, the use of Mobile Device Management (MDM) technology.

In the year, 2019, South African enterprises have seen a substantial increase in the number of cybersecurity incidents. From the public-sector to the private-sector, many enterprises have had to redirect large sums of their budgets towards responding to cybersecurity incidents that could have been averted. For most enterprises, having experienced, or seen the impact of a number of disclosed cybersecurity incidents in South Africa (SA) during 2019, the majority of enterprises had begun to strengthen their cybersecurity defenses in order to avert future cybersecurity incidents. To a large extent, most enterprises have implemented security measures such as firewalls, proxy gateways, patch management solutions, intrusions prevention or detection systems, encryption, network access control and so on. However, whilst these measures are implemented, in 2020, security architects saw a shift in the enterprise perimeter due to COVID-19 pandemic. Owing to the pandemic, on the 26th of March 2020, the South African government implemented a countrywide lock-down effectively enforcing all its citizens to stay at homes thus translating to an unintended remote workforce. During this time, employees found themselves overnight without any training working outside of the secured layered cybersecurity defenses of their enterprises. This arrangement negatively affected the security posture of many organizations. It effectively forced all enterprise employees to work from home, away from the secure enterprise network forcing information technology administrators to find ways to extend the enterprise perimeter in order to allow these inexperienced overnight remote workers to continue to securely work remotely. This article explores the consequences of the shift in the enterprise perimeter and also suggests practical technical steps that enterprises can apply in order to avert possible cybersecurity incidents.

Network access control is quite a blunt tool, which is not necessarily a bad thing. What this means is that you want to place access controls to your data warehouse based on the network origin of the traffic. This can be a quick and effective way to reduce security risks, as well as sometimes being part of compliance requirements (to have, as well as show that you have network access policies placed on top of your data access).

Knowledge and experience on how to operate IPv4 securely is available: whether it is the Internet or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes the security issues in the protocol but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues in several places of a network (enterprises, service providers and residential users) and proposes technical and procedural mitigations techniques. Some very specific places of a network such as the Internet of Things are not discussed in this document.

There are many advantages of managing services and products in the cyber security sector through a central system, but this can sometimes be a disadvantage. The adequacy of a cyber security product running on a virtual server is limited by the capacity of the virtual server. It is ideal for cyber security products to operate in a distributed structure so that they can work with redundancy and more reliably. One of these products, the network access control management solution, is a product that checks whether the devices are reliable and includes or blocks them in the network. In this study, the model and architecture of a network access control (NAC) management solution has been revealed by choosing blockchain technology because it has a distributed structure, uses cryptography and hash algorithms, and can be processed with smart contracts.

A deterministic network is one that can carry data flows for real- time applications with extremely low data loss rates and bounded latency. Deterministic networks have been successfully deployed in real-time operational technology (OT) applications for some years (for example [ARINC664P7]). However, such networks are typically isolated from external access, and thus the security threat from external attackers is low. IETF Deterministic Networking (DetNet) specifies a set of technologies that enable creation of deterministic networks on IP-based networks of potentially wide area (on the scale of a corporate network) potentially bringing the OT network into contact with Information Technology (IT) traffic and security threats that lie outside of a tightly controlled and bounded area (such as the internals of an aircraft). These DetNet technologies have not previously been deployed together on a wide area IP-based network, and thus can present security considerations that may be new to IP- based wide area network designers. This draft, intended for use by DetNet network designers, provides insight into these security considerations. In addition, this draft collects all security- related statements from the various DetNet drafts (Architecture, Use Cases, etc) into a single location Section 7.

Network functions virtualization intertwined with software-defined networking opens up great opportunities for flexible provisioning and composition of network functions, known as network service chaining. In the cloud, this allows providers to create service chains tuned to each application type while optimizing resources’ utilization. This is particularly useful to accommodate different tenants’ applications with different security needs. However, considering security provisioning from the single perspective of resources optimization may lead to deployment solutions that do not comply with well-known security-related best practices and recommendations. In this paper, we propose network security defense patterns (NSDP) aimed at leveraging the best practice and know-how from the security experts and at capturing various security constraints to efficiently select compliant security functions’ deployment options. The placement problem being a NP-Hard problem to solve, we also propose a scalable networking and computing resources aware optimization framework to efficiently provision different NSDPs. We further show the feasibility of implementing NSDPs in the cloud infrastructure through the integration of our approach into an open source cloud framework, namely OpenStack, in our test laboratory. The simulation results show the effectiveness of our approach in selecting an optimal placement of the security functions for large data centers with hundreds of thousands of computing nodes, while complying with the predefined security constraints and improving the scalability compared to the current placement algorithms.

The fast-growing Internet traffic is increasingly becoming content-based and driven by mobile users, with users more interested in data rather than its source. This has precipitated the need for an information-centric Internet architecture. Research in information-centric networks (ICNs) have resulted in novel architectures, e.g., CCN/NDN, DONA, and PSIRP/PURSUIT; all agree on named data based addressing and pervasive caching as integral design components. With network-wide content caching, enforcement of content access control policies become non-trivial. Each caching node in the network needs to enforce access control policies with the help of the content provider. This becomes inefficient and prone to unbounded latencies especially during provider outages. In this paper, we propose an efficient access control framework for ICN, which allows legitimate users to access and use the cached content directly, and does not require verification/authentication by an online provider authentication server or the content serving router. This framework would help reduce the impact of system down-time from server outages and reduce delivery latency by leveraging caching while guaranteeing access only to legitimate users. Experimental/simulation results demonstrate the suitability of this scheme for all users, but particularly for mobile users, especially in terms of the security and latency overheads.

Opportunistic networks (OppNets) are a subclass of delay tolerant networks and are characterized by intermittent end-to-end connections. The sparsity in the network and the resource constraint of devices always restricts the use of cryptographic solutions for security needs in the OppNets for thwarting selfishness of the nodes. The trust-based mechanisms are capable of providing social security in terms of access control in the network. But the trust-based protocols do not solve the problem of isolating, avoiding, and detecting the malicious intent nodes with the provision of security services such as authentication, confidentiality, and message integrity through cryptographic means. In this work, a robust and scalable infrastructure based security overlay is designed over the base trust-based routing for detecting malicious nodes and providing security services through the established cryptographic mechanism. The proposed security-based algorithm is general enough to accommodate and use latest cryptographic techniques in trust-based routing for ensuring more participation through building confidence in the network. The simulation results are taken using ONE simulator and the results confirm that the application of security overlay above the base trust-based protocol helps in increasing the average performance by 35%.

With the continuous improvement of China’s scientific and technological level, computer network has become an indispensable part of people’s daily life. It can not only effectively improve the efficiency of production and life, and shorten the distance between people, but also further promote the speed of China’s social and economic development, which has a positive impact on the realization of China’s modernization. Under the new information security demand environment at present, we should pay attention to the related information security work and formulate effective security measures and strategies. In order to effectively prevent these information security problems, people should actively adopt firewall technology, encryption technology, network access control technology and network virus prevention technology for effective protection. This paper analyzes the security problems in the application of wireless sensor networks and explores the mechanism of defending information security, hoping to strengthen the security and stability of wireless sensor networks through effective measures, so that people can better enjoy the convenience brought by the network age.

Firewall is a cardinal element in network security paradigm, where it is a measure for providing network access control. Iptables/netfilter is the most popular Linux firewall and over the time iptables has been extensively evolved and extended but as a result of this it became complex. Fundamental design limitations of iptables and its inherent problems are hindrance for its scalability and performance. This paper presents impeding factors in development of iptables and discusses about nftables, a new futuristic Linux firewall framework. It brings out nftables design approach for overcoming the limitations of iptables. This paper also expatiate comparison of iptables and nftables frameworks on different aspects and discusses results and analysis of our experimentations, to find out “Is it right time to embrace nftables over iptables?”

Recent targeted attacks make it difficult for us to protect our corporate resources. Therefore, we need to focus not on protecting against intrusion but on mitigating the intrusion. We previously propose a countermeasure support system, which recommends proper countermeasures against targeted attacks. However, this system does not take into account lateral movement from hosts where bridgeheads are established. In this paper, we propose a countermeasure assessment system based on residual risks of information leakage. This system calculates the risk of a host on the basis of network access control and host behavior. It also calculates the importance of resources in terms of access control that describes access of authorized personnel to file servers and the roles of the personnel. Using this information, this system analyzes the residual risks of information leakage after the countermeasure is applied and presents it to the network administrator. This system allows network administrators to choose countermeasures for incidents in terms of residual risks that cannot be covered with previous systems.

In the current network environment, multiple wireless access technologies coexist. In order to meet the needs of various services in heterogeneous networks, in order to enable each user to select the most appropriate network to provide services and adapt to the dynamic changes of the network environment, this paper defines the markov decision-making process of network selection based on reinforcement learning, taking the heterogeneous network constructed by PDT and B-trunC as the background A network access control algorithm based on reinforcement learning is proposed, which fully considers the service type of session and the mobility of terminal, and realizes the adaptability of network selection.

A high data capacity chipless radio frequency identification (chipless-RFID) system, useful for security and authentication applications, is presented in this paper. Reading is based on the near-field coupling between the tag, a chain of identical split-ring resonators (SRRs) printed on a (typically flexible) dielectric substrate (e.g., liquid crystal polymer, plastic, and paper), and the reader. Encoding is achieved by the presence or absence of SRRs at predefined (equidistant) positions in the chain, and tag identification (ID) is based on sequential bit reading. Namely, the tag must be longitudinally displaced, at short distance, over the reader, a microstrip line loaded with an SRR and fed by a harmonic signal. By this means, the harmonic signal is amplitude modulated, and the (ID) code is contained in the envelope function, which can be obtained by means of an envelope detector. With this system, tag reading requires proximity with the reader, but this is not an issue in many applications within the domain of security and authentication (e.g., secure paper for corporate documents and certificates). Several circularly shaped 40-bit encoders (implemented in a commercial microwave substrate), and the corresponding reader, are designed and fabricated as proof-of-concept demonstrators. Strategies for programming the tags and a first proof-of-concept chipless-RFID tag fabricated on plastic substrate through inkjet printing are included in this paper.

Assessing countermeasures and the sufficiency of security-relevant configurations within networked system architectures is a very complex task. Even the configuration of single network access control (NAC) instances can be too complex to analyse manually. Therefore, model-based approaches have manifested themselves as a solution for computer-aided configuration analysis. Unfortunately, current approaches suffer from various issues like coping with configuration-language heterogeneity or the analysis of multiple NAC instances as one overall system configuration, which is the case for the maturity of analysis goals. In this paper, we show how deriving and modelling NAC configurations��� effects solves the majority of these issues by allowing generic and simplified security analysis and model extension. The paper further presents the underlying modelling strategy to create such configuration effect representations (hereafter referred to as effective configuration) and explains how analyses based on previous approaches can still be performed. Moreover, the linking between rule representations and effective configuration is demonstrated, which enables the tracing of issues, found in the effective configuration, back to specific rules. Copyright �� 2021 by SCITEPRESS ��� Science and Technology Publications, Lda. All rights reserved

We’re addressing Network Access Control (NAC) solutions separately from the Firewall, DNS, and Load Balancer solutions we covered in Chapter 6 for two reasons: First, to give vendors credit—NAC solutions represent early (and ongoing) attempts at achieving some of the principles of Zero Trust—specifically, the ability to enforce identity-centric access policies at the network level. Second, NAC deployments are generally going to be impacted as organizations deploy a modern Zero Trust architecture—the value and importance of NAC (as an established category) is going to be diminished, replaced by the more effective ability of Zero Trust to serve as a broader and more capable network access control solution.

Network security has become crucial to our society and industry. A firewall is an essential function in network operations for security enhancement. Network access control lists (ACLs) have been used to describe multi-layer security rules to determine whether a packet is passed or dropped by the firewall. An entry in ACLs contains so-called don't care bits, and consequently, ACL matching is generalized as a ternary matching problem. As ternary matching typically relies on dedicated hardware, high-performance ternary matching with commodity CPUs is challenging. We propose a practical algorithm for network ACL matching trie, named Palmtrie, that allows the multi-bit stride extension to achieve better performance. We evaluate the Palmtrie using synthetic ACLs that emulate an existing campus network and Internet backbone policies. The evaluation results demonstrate that the Palmtrie outperforms the existing ACL matching algorithms on extensive ACLs. For example, the lookup performance of the optimized Palmtrie achieves 4.76 times faster than the algorithm implemented in the widely used library (DPDK) for the scanning attack traffic on an ACL with one million entries. We also prove that the Palmtrie solves the problem with the build time of data structures in the existing algorithms.

Application-level packet filtering is a technique for network access control in which an “application-level gateway” intercepts network packets at the application level (e.g., HTTP, FTP), scans them for security concerns and optionally logs, rewrites or discards them. Existing application-level filters express their filtering rules in general-purpose languages, which limits the correctness guarantees available for them. We present the first declarative language for application-level network filtering, developed at Advenica AB. Our DSL uses security assertions to express properties that packets must have to be allowed through the network (e.g., “IMAP packet contains no executable attachment” or “SQL reply contains only explicitly permitted columns”), along with remedies that either reject or rewrite undesirable packets. We have designed the language around the needs of network filter developers, with a focus on correctness: our language can statically verify several properties of filter programs, such as well-formedness of the outcome, confluence, and termination, with the help of an off-the-shelf SMT solver. Our initial results show that the language can express many typical filtering tasks, closely maps to the application domain, and provides strong correctness guarantees.