Active Wall Professional 4 is a powerful simple tool that is used for controlling all the local network traffic up to and including internet usage.
After installing Active Wall to a single computer (which should always be online), all traffic on the entire network can be monitored and administration of other machines in the network can be performed with ease without any exrta software installation.
In the initial setup, the type of mode should be configured, as Active Wall Professional 4 supports 5 different modes suitable for any network configuration. They are,
1. Gateway,
2. Bridge,
3. Bypass,
4. Redirect and
5. Single.
All the computers should be added to your default workgroup before you can actually see any traffic going through the filter which can be added either by IP or by MAC address or the system can be set to auto detect machines when they are online in the network.
Different groups can be created so that individual policies can be defined later for each group. Each policy can have a combination of following: - Authorization, Time, port, MAC, IP, DNS, HTTP, HTTPS, POP3, FTP, P2P, Instant Messaging, Bandwidth Control and filtering.
Web filtering and email filtering can also be maintained as required.
Active Wall Professional 4 starts with 100 licenses to begin with and supports up to 10,000 individual users at any one time and process over 100 Million packet flow rate.
For detailed information, please visit, http://en.lanctri.com.vercomp.php.
Wednesday, March 16, 2011
FLEXCRYPT – A CRYPTOGRAPHIC TOOLKIT
Flexcrypt is a cryptographic toolkit that is used for encryption/decryption of data for individuals and small business, for communication and storage of emails, hard drive, instant messaging text, files, folders and others.
This tool has a very smooth step-wise installation process and once the installation is complete, it runs automatically, if the option in the last step of installation to Launch Flexcrypt is enabled.
Specifications for Flexcrypt are given below.
Operating Systems: -
1. Windows Vista (32-bit and 64-bit versions),
2. Windows XP (32-bit and 64-bit versions),
3. Windows 7 (32-bit and 64-bit versions),
Localization: -
- English
- German
- Spanish
- Chinese
Email Protocols: -
1. POP3,
2. IMAP,
3. MAPI &
4. SMTP.
Supported Email Clients: - All email clients.
Email Encryption Options: -
1. OpenPGP/MIME,
2. AES 256 bit (as ZIP) and
3. PkZIP.
Hashes: -
1. SHA-2 (up to 512-bit hashes),
2. SHA-1 and
3. MD5.
Public key algorithm: - Elgamal/DSS (up to 2048).
Supported Instant Message Clients: - MSN and ICQ.
Instant Message Encryption, File encryption, Hard drive encryption & Text encryption: - AES 256 bit
Shredding: -
- US Department of Defense DoD 5220.22-M (ECE)
- 7 passes
USB Encryption: - AES 256 bit.
Online services: - SSL Connection.
Patent: - Patent Pending.
Security Standards: - Encryption components from .NET are FIPS-140 validated.
REFERENCE:
- HAKIN9, IT Security Magazine, Vol 5 No.11, Issue 11/2010(36).
This tool has a very smooth step-wise installation process and once the installation is complete, it runs automatically, if the option in the last step of installation to Launch Flexcrypt is enabled.
Specifications for Flexcrypt are given below.
Operating Systems: -
1. Windows Vista (32-bit and 64-bit versions),
2. Windows XP (32-bit and 64-bit versions),
3. Windows 7 (32-bit and 64-bit versions),
Localization: -
- English
- German
- Spanish
- Chinese
Email Protocols: -
1. POP3,
2. IMAP,
3. MAPI &
4. SMTP.
Supported Email Clients: - All email clients.
Email Encryption Options: -
1. OpenPGP/MIME,
2. AES 256 bit (as ZIP) and
3. PkZIP.
Hashes: -
1. SHA-2 (up to 512-bit hashes),
2. SHA-1 and
3. MD5.
Public key algorithm: - Elgamal/DSS (up to 2048).
Supported Instant Message Clients: - MSN and ICQ.
Instant Message Encryption, File encryption, Hard drive encryption & Text encryption: - AES 256 bit
Shredding: -
- US Department of Defense DoD 5220.22-M (ECE)
- 7 passes
USB Encryption: - AES 256 bit.
Online services: - SSL Connection.
Patent: - Patent Pending.
Security Standards: - Encryption components from .NET are FIPS-140 validated.
REFERENCE:
- HAKIN9, IT Security Magazine, Vol 5 No.11, Issue 11/2010(36).
MICROSOFT WINDOWS SERVER 2008 AND 2008 R2 FEATURES
Microsoft had to delay Server 2008’s appearance by years due to the change in the network security environment, offering some nice upgrades and also its surprising followed release, Server 2008 R2. The features of Server 2008 and R2 can be comprised into six categories, given below.
1. Active Directory (AD),
2. New setup technologies,
3. Changes the underlying operating system,
4. Networking changes,
5. File and print services and
6. Web-based services.
The Active Directory (AD) is the central database of user and machine authentication data, also the keystone piece of Windows networking and Microsoft has included several new capabilities mainly simplifying AD security and disaster recovery with new admin tools providing more flexibility to the system.
- Read-Only Domain Controllers (RODC) has been added which used to be only domain controller (DC) in previous versions which can act as a DC and that it can help users get authenticated to the file, print and web servers that those users need to access.
New Windows backup has been introduced, known as Windows Server Backup which can do a bare metal backup in which if a server has hardware failure, then new server hardware can be placed and the backup can be restored, thus making it the old server.
Password policies have been finely grained, offering creation of as many different password policies as you like and attach them to groups or users.
Server 2008 and R2 offered new technologies to simplify undeleting AD objects. A solution to the AD undelete problem was introduced with AD Recycle bin, which is actually a set of command-line tools.
Another feature is the PowerShell and AD Administrative Center. PowerShell lets you create GUI tools and R2 includes an example PowerShell GUI AD administration tool called the Active Directory Administration Center (ADAC) offering two user management tools- ADUC and ADAC.
With these features, DCPromo Improvements for converting Windows servers to DCs (promotion) or converting DCs to simple member servers (demotion) after Windows 2000. Also, for networking it introduced IPv6, Network Access Protection (NAP), Secure Socket Tunneling Protocol (SSTP) VPN and management tools called Server Manager has been added, with remote tools-WinRM (Windows Remote Management) and WinRS.
1. Active Directory (AD),
2. New setup technologies,
3. Changes the underlying operating system,
4. Networking changes,
5. File and print services and
6. Web-based services.
The Active Directory (AD) is the central database of user and machine authentication data, also the keystone piece of Windows networking and Microsoft has included several new capabilities mainly simplifying AD security and disaster recovery with new admin tools providing more flexibility to the system.
- Read-Only Domain Controllers (RODC) has been added which used to be only domain controller (DC) in previous versions which can act as a DC and that it can help users get authenticated to the file, print and web servers that those users need to access.
New Windows backup has been introduced, known as Windows Server Backup which can do a bare metal backup in which if a server has hardware failure, then new server hardware can be placed and the backup can be restored, thus making it the old server.
Password policies have been finely grained, offering creation of as many different password policies as you like and attach them to groups or users.
Server 2008 and R2 offered new technologies to simplify undeleting AD objects. A solution to the AD undelete problem was introduced with AD Recycle bin, which is actually a set of command-line tools.
Another feature is the PowerShell and AD Administrative Center. PowerShell lets you create GUI tools and R2 includes an example PowerShell GUI AD administration tool called the Active Directory Administration Center (ADAC) offering two user management tools- ADUC and ADAC.
With these features, DCPromo Improvements for converting Windows servers to DCs (promotion) or converting DCs to simple member servers (demotion) after Windows 2000. Also, for networking it introduced IPv6, Network Access Protection (NAP), Secure Socket Tunneling Protocol (SSTP) VPN and management tools called Server Manager has been added, with remote tools-WinRM (Windows Remote Management) and WinRS.
HARDENING DATABASES
System hardening is the process in which a system is configured securely to protect it from unauthorized access. Hardening of a system is necessary in any system that has a range of configuration options and is viable in any system that has enough security measures to make them suitable for usage in security-oriented environments.
Oracle has evolved all these years and there are many options available that offer new ways to access data, sometimes even by unauthorized users if used inappropriately. The larger the footprint and capabilities of a system, the harder it is to harden with more security risks present. So, it has become equally important to harden Oracle databases and luckily, with evolution of Oracle, different security options have been also developed that can be used to secure data. The most important guideline of hardening a system is that if there is a feature that you so not use, remove it. The fact that you don’t use something does not mean that an attacker won’t. The smaller the surface area of a system, the more secure it is. Some examples are given below.
1. Remove or lock predefined accounts that are not in use and change the password for accounts that have a predefined password, like Oracle 11g already comes configured that way.
2. Remove predefined roles that you do not use.
3. Remove components in the database software that are not in use.
4. Remove options that you do not use, like it is advisable to remove EXTPROC from your listener if you do not use external procedures.
5. Remove privileges from PUBLIC that you do not require.
As Oracle database has many capabilities and configuration options, hardening is usually an exercise that involves hundreds of activities from choosing a hardening guideline like Database Security Technical Implementation Guide (STIG) developed by Defense Information Systems Agency (DISA) for the Department of Defense (DOD) and another is Center for internet Security (CIS) Benchmark for Oracle developed by the CIS.
With the proper guidelines, Vulnerability Assessment (VA) tools or vulnerability scanners should be used for automation of the process of checking and modification like AppDetective, AppSentry, Guardium, IPLocks and NGS Squirrel.
The organization should perform encryption of data-at-rest and data-at-transit with strong authentication, use and manage audit trails and assess risks and also make use of advanced tools and options available like Advanced Security Options, Virtual Private Database, Audit Vault and Database Vault.
REFERENCE:
- Database Security, How to Secure and Audit Oracle 10g and 11g.
By Ron Ben Natan.
Oracle has evolved all these years and there are many options available that offer new ways to access data, sometimes even by unauthorized users if used inappropriately. The larger the footprint and capabilities of a system, the harder it is to harden with more security risks present. So, it has become equally important to harden Oracle databases and luckily, with evolution of Oracle, different security options have been also developed that can be used to secure data. The most important guideline of hardening a system is that if there is a feature that you so not use, remove it. The fact that you don’t use something does not mean that an attacker won’t. The smaller the surface area of a system, the more secure it is. Some examples are given below.
1. Remove or lock predefined accounts that are not in use and change the password for accounts that have a predefined password, like Oracle 11g already comes configured that way.
2. Remove predefined roles that you do not use.
3. Remove components in the database software that are not in use.
4. Remove options that you do not use, like it is advisable to remove EXTPROC from your listener if you do not use external procedures.
5. Remove privileges from PUBLIC that you do not require.
As Oracle database has many capabilities and configuration options, hardening is usually an exercise that involves hundreds of activities from choosing a hardening guideline like Database Security Technical Implementation Guide (STIG) developed by Defense Information Systems Agency (DISA) for the Department of Defense (DOD) and another is Center for internet Security (CIS) Benchmark for Oracle developed by the CIS.
With the proper guidelines, Vulnerability Assessment (VA) tools or vulnerability scanners should be used for automation of the process of checking and modification like AppDetective, AppSentry, Guardium, IPLocks and NGS Squirrel.
The organization should perform encryption of data-at-rest and data-at-transit with strong authentication, use and manage audit trails and assess risks and also make use of advanced tools and options available like Advanced Security Options, Virtual Private Database, Audit Vault and Database Vault.
REFERENCE:
- Database Security, How to Secure and Audit Oracle 10g and 11g.
By Ron Ben Natan.
SECURING YOUR DATA AND MEETING PCI DSS REQUIREMENTS BY USING GUARDIUM
With the widespread use of payment cards, and growing global use, the industry has faced a high rise in the number of incidents of financial fraud. So, the leading payment card companies worked together to develop a set of technical and operational requirements designed to protect cardholder data, commonly referred as PCI DSS (Payment Card Industry Data Security Standard).
The recent high profile data thefts, along with industry statistics, indicate that significant work remains to be done in most organizations to implement PCI DSS.
Most organizations subject to PCI DSS are currently relying on various forms of log management to try to achieve compliance with the monitoring and auditing aspects of the standard. Logging at the detailed level required to achieve compliance imposes a severe performance penalty on systems, while requiring substantial technical resources on an on-going basis to collect and analyze the logs. Security Information and Event Management (SIEM) or centralized logging systems can help with aggregation but lack the detailed data views or analytical tools to address the needs of the payment card industry. And other additional drawbacks in the logging approach include the fact that it does not deal with the substantial issue of insider threats or provide the separation of duties (SOD) required by auditors. So, this clearly indicates that the logging process is inadequate.
So, the solution is Guardium that can,
1. Automatically locate and classify sensitive information, like cardholder data.
2. Assess database vulnerabilities and configuration flaws,
3. Provide 100% visibility at a granular level into all database transactions involving sensitive data,
4. Monitor and enforce a wide range of policies like restricting sensitive data access, privileged user actions and database change control,
5. Create a single secure centralized audit repository across large numbers of heterogeneous systems and databases,
6. Automate the entire compliance auditing process, including creating and distributing reports as well as capturing comments and signatures.
Guardium provides a comprehensive solution that addresses database security and auditing needs across the enterprise, securing all kinds of sensitive data such as financial statements, personnel records and intellectual property. It also has PCI accelerator, an optional software module designed to harness the capabilities of the core Guardium product in order to address the specific requirements of PCI DSS. The key goal of PCI DSS is to ensure protection of cardholder data as stated in Requirement 3. Requirement 10 stipulates very granular data requirements for monitoring movement of sensitive data such as CVV or PIN data.
Similarly, Requirement 7 calls for restricting access to hose with a business need to know. That is, it implements strong access control measure.
Requirement 2 states that vendor—supplied passwords and security parameter should not be used and requirement 11 specifies regular testing of security systems and processes for ensuring discovery of software vulnerabilities in your cardholder environment.
The recent high profile data thefts, along with industry statistics, indicate that significant work remains to be done in most organizations to implement PCI DSS.
Most organizations subject to PCI DSS are currently relying on various forms of log management to try to achieve compliance with the monitoring and auditing aspects of the standard. Logging at the detailed level required to achieve compliance imposes a severe performance penalty on systems, while requiring substantial technical resources on an on-going basis to collect and analyze the logs. Security Information and Event Management (SIEM) or centralized logging systems can help with aggregation but lack the detailed data views or analytical tools to address the needs of the payment card industry. And other additional drawbacks in the logging approach include the fact that it does not deal with the substantial issue of insider threats or provide the separation of duties (SOD) required by auditors. So, this clearly indicates that the logging process is inadequate.
So, the solution is Guardium that can,
1. Automatically locate and classify sensitive information, like cardholder data.
2. Assess database vulnerabilities and configuration flaws,
3. Provide 100% visibility at a granular level into all database transactions involving sensitive data,
4. Monitor and enforce a wide range of policies like restricting sensitive data access, privileged user actions and database change control,
5. Create a single secure centralized audit repository across large numbers of heterogeneous systems and databases,
6. Automate the entire compliance auditing process, including creating and distributing reports as well as capturing comments and signatures.
Guardium provides a comprehensive solution that addresses database security and auditing needs across the enterprise, securing all kinds of sensitive data such as financial statements, personnel records and intellectual property. It also has PCI accelerator, an optional software module designed to harness the capabilities of the core Guardium product in order to address the specific requirements of PCI DSS. The key goal of PCI DSS is to ensure protection of cardholder data as stated in Requirement 3. Requirement 10 stipulates very granular data requirements for monitoring movement of sensitive data such as CVV or PIN data.
Similarly, Requirement 7 calls for restricting access to hose with a business need to know. That is, it implements strong access control measure.
Requirement 2 states that vendor—supplied passwords and security parameter should not be used and requirement 11 specifies regular testing of security systems and processes for ensuring discovery of software vulnerabilities in your cardholder environment.
Deploying Multi-Vendors in network environments
On the basis of information collected from the two authors from hundreds of client interactions and detailed interviews of nine organizations which have introduced a second vendor into their network environments. So, the findings show that most organizations should consider a dual-vendor or multi-vendor solution as a viable approach to building their network which will also provide significant savings with no increase in network complexity, with improvement in the focus on meeting business requirements.
KEY FINDINGS of the research:
1. By introducing a second vendor into the network infrastructure, it will have no long tern impact on operational costs for organizations following best practices.
2. It will also reduce total cost of ownership (TCO) for most organization by at least 15% to 25% over a five year time frame.
3. No case was found where operational cost savings would offset the equipment cost premium that Cisco generally charges.
4. Most of the organizations also reported a lasting decrease in network complexity, compared with an all-Cisco network.
5. Network operations that are already using some form of multi vendor management tools for fault alerting, configuration management or performance management are well-positioned to take advantage of the second vendor opportunity.
RECOMMENDATIONS:
- The Network architects and CIOs must consider alternative network vendors to ensure that they deliver a functional network solution at an appropriate cost point.
- Network operations teams should invest in multivendor-capable tools to help enable the organization to deal with a second vendor in their infrastructure and to improve the operational capabilities with their incumbent solution.
REFERENCE:
- MARK FABBI, DEBRA CURTIS.
- © 2010 GARTNER Inc.
KEY FINDINGS of the research:
1. By introducing a second vendor into the network infrastructure, it will have no long tern impact on operational costs for organizations following best practices.
2. It will also reduce total cost of ownership (TCO) for most organization by at least 15% to 25% over a five year time frame.
3. No case was found where operational cost savings would offset the equipment cost premium that Cisco generally charges.
4. Most of the organizations also reported a lasting decrease in network complexity, compared with an all-Cisco network.
5. Network operations that are already using some form of multi vendor management tools for fault alerting, configuration management or performance management are well-positioned to take advantage of the second vendor opportunity.
RECOMMENDATIONS:
- The Network architects and CIOs must consider alternative network vendors to ensure that they deliver a functional network solution at an appropriate cost point.
- Network operations teams should invest in multivendor-capable tools to help enable the organization to deal with a second vendor in their infrastructure and to improve the operational capabilities with their incumbent solution.
REFERENCE:
- MARK FABBI, DEBRA CURTIS.
- © 2010 GARTNER Inc.
IEEE 802.11n: Will it replace switched Ethernet and The End of Ethernet?
The IEEE (Institute of Electrical and Electronics Engineers) 802.11n standard represents the beginning of the end for wired Ethernet as the dominant local area network (LAN) access technology in the enterprise. With the technology advancements over the next few years, developments in system silicon, radio design, network control, wireless security, power management and cost will improve 802.11n to the point where it will actually replace the switched Ethernet market.
Enterprise mobility can facilitate business continuity, improve collaboration, simplify teleworking and increase employee retention. The benefits and drawbacks of 802.11n have been discussed below.
1. Pervasive mobility:
The definitive and unalterable competitive advantage that 802.11 will provide over Ethernet is the ability to provide pervasive mobility.
2. Performance:
802.11n throughput is good enough for many enterprise users though Gigabit Ethernet provides greater throughput than 802.11n. And, 802.11n latency and jitter are well below most latency and jitter budgets though are much greater than that of Gigabit Ethernet.
3. Security:
It involves greater security threats than wired Ethernet in the areas of eavesdropping, Denial of Service (DoS) and MAC/PHY intrusion. Though technology exists to make an 802.11n network almost as secure as Ethernet, it costs greater than wired Ethernet network.
4. Management & Staffing:
It requires network managers to provide new tasks such as site planning and spectrum management and new tools must be used to manage WLANs such as spectrum analyzers and WLAN monitoring equipment.
And, also staffs must learn the new technology to deploy, maintain and upgrade their network.
5. Cost:
The cost for deployment of both technologies vary significantly and depend upon many enterprise-specific factors so it cannot simply be assumed that wireless is more expensive than wires Ethernet or vice-versa.
6. Market Impact:
The growth of Ethernet switching market will slow down due to WLAN substitution and also there are greater chances that vendors with unified wireless-wired solutions such as Cisco, HP ProCurve and Siemens-Enterasys will have an advantage over pure-play wireless vendors.
So, Enterprise should consider 802.11n an appropriate LAN access substitute for wires Ethernet if,
- The number of mobile device users is growing,
- The enterprise uses mobile applications
- Fast Ethernet throughput is good enough,
- The enterprise deploys Voice over Internet Protocol (VoIP),
- Moves/adds/changes are made frequently,
- The risk of deliberate DOS attack is low to moderate &
- Ethernet cable installation is difficult.
REFERENCE:-
- PAUL DEBEASI
Enterprise mobility can facilitate business continuity, improve collaboration, simplify teleworking and increase employee retention. The benefits and drawbacks of 802.11n have been discussed below.
1. Pervasive mobility:
The definitive and unalterable competitive advantage that 802.11 will provide over Ethernet is the ability to provide pervasive mobility.
2. Performance:
802.11n throughput is good enough for many enterprise users though Gigabit Ethernet provides greater throughput than 802.11n. And, 802.11n latency and jitter are well below most latency and jitter budgets though are much greater than that of Gigabit Ethernet.
3. Security:
It involves greater security threats than wired Ethernet in the areas of eavesdropping, Denial of Service (DoS) and MAC/PHY intrusion. Though technology exists to make an 802.11n network almost as secure as Ethernet, it costs greater than wired Ethernet network.
4. Management & Staffing:
It requires network managers to provide new tasks such as site planning and spectrum management and new tools must be used to manage WLANs such as spectrum analyzers and WLAN monitoring equipment.
And, also staffs must learn the new technology to deploy, maintain and upgrade their network.
5. Cost:
The cost for deployment of both technologies vary significantly and depend upon many enterprise-specific factors so it cannot simply be assumed that wireless is more expensive than wires Ethernet or vice-versa.
6. Market Impact:
The growth of Ethernet switching market will slow down due to WLAN substitution and also there are greater chances that vendors with unified wireless-wired solutions such as Cisco, HP ProCurve and Siemens-Enterasys will have an advantage over pure-play wireless vendors.
So, Enterprise should consider 802.11n an appropriate LAN access substitute for wires Ethernet if,
- The number of mobile device users is growing,
- The enterprise uses mobile applications
- Fast Ethernet throughput is good enough,
- The enterprise deploys Voice over Internet Protocol (VoIP),
- Moves/adds/changes are made frequently,
- The risk of deliberate DOS attack is low to moderate &
- Ethernet cable installation is difficult.
REFERENCE:-
- PAUL DEBEASI
Subscribe to:
Posts (Atom)