Network monitoring and filtering solution Active Wall Professional 4.

Active Wall Professional 4 is a powerful simple tool that is used for controlling all the local network traffic up to and including internet usage.
After installing Active Wall to a single computer (which should always be online), all traffic on the entire network can be monitored and administration of other machines in the network can be performed with ease without any exrta software installation.
In the initial setup, the type of mode should be configured, as Active Wall Professional 4 supports 5 different modes suitable for any network configuration. They are,
1. Gateway,
2. Bridge,
3. Bypass,
4. Redirect and
5. Single.

All the computers should be added to your default workgroup before you can actually see any traffic going through the filter which can be added either by IP or by MAC address or the system can be set to auto detect machines when they are online in the network.
Different groups can be created so that individual policies can be defined later for each group. Each policy can have a combination of following: - Authorization, Time, port, MAC, IP, DNS, HTTP, HTTPS, POP3, FTP, P2P, Instant Messaging, Bandwidth Control and filtering.
Web filtering and email filtering can also be maintained as required.
Active Wall Professional 4 starts with 100 licenses to begin with and supports up to 10,000 individual users at any one time and process over 100 Million packet flow rate.
For detailed information, please visit, http://en.lanctri.com.vercomp.php.

FLEXCRYPT – A CRYPTOGRAPHIC TOOLKIT

Flexcrypt is a cryptographic toolkit that is used for encryption/decryption of data for individuals and small business, for communication and storage of emails, hard drive, instant messaging text, files, folders and others.
This tool has a very smooth step-wise installation process and once the installation is complete, it runs automatically, if the option in the last step of installation to Launch Flexcrypt is enabled.
Specifications for Flexcrypt are given below.
Operating Systems: -
1. Windows Vista (32-bit and 64-bit versions),
2. Windows XP (32-bit and 64-bit versions),
3. Windows 7 (32-bit and 64-bit versions),
Localization: -
- English
- German
- Spanish
- Chinese
Email Protocols: -
1. POP3,
2. IMAP,
3. MAPI &
4. SMTP.
Supported Email Clients: - All email clients.
Email Encryption Options: -
1. OpenPGP/MIME,
2. AES 256 bit (as ZIP) and
3. PkZIP.
Hashes: -
1. SHA-2 (up to 512-bit hashes),
2. SHA-1 and
3. MD5.
Public key algorithm: - Elgamal/DSS (up to 2048).
Supported Instant Message Clients: - MSN and ICQ.
Instant Message Encryption, File encryption, Hard drive encryption & Text encryption: - AES 256 bit
Shredding: -
- US Department of Defense DoD 5220.22-M (ECE)
- 7 passes
USB Encryption: - AES 256 bit.
Online services: - SSL Connection.
Patent: - Patent Pending.
Security Standards: - Encryption components from .NET are FIPS-140 validated.

REFERENCE:
- HAKIN9, IT Security Magazine, Vol 5 No.11, Issue 11/2010(36).

MICROSOFT WINDOWS SERVER 2008 AND 2008 R2 FEATURES

Microsoft had to delay Server 2008’s appearance by years due to the change in the network security environment, offering some nice upgrades and also its surprising followed release, Server 2008 R2. The features of Server 2008 and R2 can be comprised into six categories, given below.
1. Active Directory (AD),
2. New setup technologies,
3. Changes the underlying operating system,
4. Networking changes,
5. File and print services and
6. Web-based services.
The Active Directory (AD) is the central database of user and machine authentication data, also the keystone piece of Windows networking and Microsoft has included several new capabilities mainly simplifying AD security and disaster recovery with new admin tools providing more flexibility to the system.
- Read-Only Domain Controllers (RODC) has been added which used to be only domain controller (DC) in previous versions which can act as a DC and that it can help users get authenticated to the file, print and web servers that those users need to access.
New Windows backup has been introduced, known as Windows Server Backup which can do a bare metal backup in which if a server has hardware failure, then new server hardware can be placed and the backup can be restored, thus making it the old server.
Password policies have been finely grained, offering creation of as many different password policies as you like and attach them to groups or users.
Server 2008 and R2 offered new technologies to simplify undeleting AD objects. A solution to the AD undelete problem was introduced with AD Recycle bin, which is actually a set of command-line tools.
Another feature is the PowerShell and AD Administrative Center. PowerShell lets you create GUI tools and R2 includes an example PowerShell GUI AD administration tool called the Active Directory Administration Center (ADAC) offering two user management tools- ADUC and ADAC.
With these features, DCPromo Improvements for converting Windows servers to DCs (promotion) or converting DCs to simple member servers (demotion) after Windows 2000. Also, for networking it introduced IPv6, Network Access Protection (NAP), Secure Socket Tunneling Protocol (SSTP) VPN and management tools called Server Manager has been added, with remote tools-WinRM (Windows Remote Management) and WinRS.

HARDENING DATABASES

System hardening is the process in which a system is configured securely to protect it from unauthorized access. Hardening of a system is necessary in any system that has a range of configuration options and is viable in any system that has enough security measures to make them suitable for usage in security-oriented environments.
Oracle has evolved all these years and there are many options available that offer new ways to access data, sometimes even by unauthorized users if used inappropriately. The larger the footprint and capabilities of a system, the harder it is to harden with more security risks present. So, it has become equally important to harden Oracle databases and luckily, with evolution of Oracle, different security options have been also developed that can be used to secure data. The most important guideline of hardening a system is that if there is a feature that you so not use, remove it. The fact that you don’t use something does not mean that an attacker won’t. The smaller the surface area of a system, the more secure it is. Some examples are given below.
1. Remove or lock predefined accounts that are not in use and change the password for accounts that have a predefined password, like Oracle 11g already comes configured that way.
2. Remove predefined roles that you do not use.
3. Remove components in the database software that are not in use.
4. Remove options that you do not use, like it is advisable to remove EXTPROC from your listener if you do not use external procedures.
5. Remove privileges from PUBLIC that you do not require.
As Oracle database has many capabilities and configuration options, hardening is usually an exercise that involves hundreds of activities from choosing a hardening guideline like Database Security Technical Implementation Guide (STIG) developed by Defense Information Systems Agency (DISA) for the Department of Defense (DOD) and another is Center for internet Security (CIS) Benchmark for Oracle developed by the CIS.
With the proper guidelines, Vulnerability Assessment (VA) tools or vulnerability scanners should be used for automation of the process of checking and modification like AppDetective, AppSentry, Guardium, IPLocks and NGS Squirrel.
The organization should perform encryption of data-at-rest and data-at-transit with strong authentication, use and manage audit trails and assess risks and also make use of advanced tools and options available like Advanced Security Options, Virtual Private Database, Audit Vault and Database Vault.

REFERENCE:
- Database Security, How to Secure and Audit Oracle 10g and 11g.
By Ron Ben Natan.

SECURING YOUR DATA AND MEETING PCI DSS REQUIREMENTS BY USING GUARDIUM

With the widespread use of payment cards, and growing global use, the industry has faced a high rise in the number of incidents of financial fraud. So, the leading payment card companies worked together to develop a set of technical and operational requirements designed to protect cardholder data, commonly referred as PCI DSS (Payment Card Industry Data Security Standard).
The recent high profile data thefts, along with industry statistics, indicate that significant work remains to be done in most organizations to implement PCI DSS.
Most organizations subject to PCI DSS are currently relying on various forms of log management to try to achieve compliance with the monitoring and auditing aspects of the standard. Logging at the detailed level required to achieve compliance imposes a severe performance penalty on systems, while requiring substantial technical resources on an on-going basis to collect and analyze the logs. Security Information and Event Management (SIEM) or centralized logging systems can help with aggregation but lack the detailed data views or analytical tools to address the needs of the payment card industry. And other additional drawbacks in the logging approach include the fact that it does not deal with the substantial issue of insider threats or provide the separation of duties (SOD) required by auditors. So, this clearly indicates that the logging process is inadequate.
So, the solution is Guardium that can,
1. Automatically locate and classify sensitive information, like cardholder data.
2. Assess database vulnerabilities and configuration flaws,
3. Provide 100% visibility at a granular level into all database transactions involving sensitive data,
4. Monitor and enforce a wide range of policies like restricting sensitive data access, privileged user actions and database change control,
5. Create a single secure centralized audit repository across large numbers of heterogeneous systems and databases,
6. Automate the entire compliance auditing process, including creating and distributing reports as well as capturing comments and signatures.
Guardium provides a comprehensive solution that addresses database security and auditing needs across the enterprise, securing all kinds of sensitive data such as financial statements, personnel records and intellectual property. It also has PCI accelerator, an optional software module designed to harness the capabilities of the core Guardium product in order to address the specific requirements of PCI DSS. The key goal of PCI DSS is to ensure protection of cardholder data as stated in Requirement 3. Requirement 10 stipulates very granular data requirements for monitoring movement of sensitive data such as CVV or PIN data.
Similarly, Requirement 7 calls for restricting access to hose with a business need to know. That is, it implements strong access control measure.
Requirement 2 states that vendor—supplied passwords and security parameter should not be used and requirement 11 specifies regular testing of security systems and processes for ensuring discovery of software vulnerabilities in your cardholder environment.

Deploying Multi-Vendors in network environments

On the basis of information collected from the two authors from hundreds of client interactions and detailed interviews of nine organizations which have introduced a second vendor into their network environments. So, the findings show that most organizations should consider a dual-vendor or multi-vendor solution as a viable approach to building their network which will also provide significant savings with no increase in network complexity, with improvement in the focus on meeting business requirements.
KEY FINDINGS of the research:
1. By introducing a second vendor into the network infrastructure, it will have no long tern impact on operational costs for organizations following best practices.
2. It will also reduce total cost of ownership (TCO) for most organization by at least 15% to 25% over a five year time frame.
3. No case was found where operational cost savings would offset the equipment cost premium that Cisco generally charges.
4. Most of the organizations also reported a lasting decrease in network complexity, compared with an all-Cisco network.
5. Network operations that are already using some form of multi vendor management tools for fault alerting, configuration management or performance management are well-positioned to take advantage of the second vendor opportunity.

RECOMMENDATIONS:
- The Network architects and CIOs must consider alternative network vendors to ensure that they deliver a functional network solution at an appropriate cost point.
- Network operations teams should invest in multivendor-capable tools to help enable the organization to deal with a second vendor in their infrastructure and to improve the operational capabilities with their incumbent solution.


REFERENCE:
- MARK FABBI, DEBRA CURTIS.
- © 2010 GARTNER Inc.

IEEE 802.11n: Will it replace switched Ethernet and The End of Ethernet?

The IEEE (Institute of Electrical and Electronics Engineers) 802.11n standard represents the beginning of the end for wired Ethernet as the dominant local area network (LAN) access technology in the enterprise. With the technology advancements over the next few years, developments in system silicon, radio design, network control, wireless security, power management and cost will improve 802.11n to the point where it will actually replace the switched Ethernet market.
Enterprise mobility can facilitate business continuity, improve collaboration, simplify teleworking and increase employee retention. The benefits and drawbacks of 802.11n have been discussed below.
1. Pervasive mobility:
The definitive and unalterable competitive advantage that 802.11 will provide over Ethernet is the ability to provide pervasive mobility.
2. Performance:
802.11n throughput is good enough for many enterprise users though Gigabit Ethernet provides greater throughput than 802.11n. And, 802.11n latency and jitter are well below most latency and jitter budgets though are much greater than that of Gigabit Ethernet.

3. Security:
It involves greater security threats than wired Ethernet in the areas of eavesdropping, Denial of Service (DoS) and MAC/PHY intrusion. Though technology exists to make an 802.11n network almost as secure as Ethernet, it costs greater than wired Ethernet network.

4. Management & Staffing:
It requires network managers to provide new tasks such as site planning and spectrum management and new tools must be used to manage WLANs such as spectrum analyzers and WLAN monitoring equipment.
And, also staffs must learn the new technology to deploy, maintain and upgrade their network.

5. Cost:
The cost for deployment of both technologies vary significantly and depend upon many enterprise-specific factors so it cannot simply be assumed that wireless is more expensive than wires Ethernet or vice-versa.
6. Market Impact:
The growth of Ethernet switching market will slow down due to WLAN substitution and also there are greater chances that vendors with unified wireless-wired solutions such as Cisco, HP ProCurve and Siemens-Enterasys will have an advantage over pure-play wireless vendors.
So, Enterprise should consider 802.11n an appropriate LAN access substitute for wires Ethernet if,
- The number of mobile device users is growing,
- The enterprise uses mobile applications
- Fast Ethernet throughput is good enough,
- The enterprise deploys Voice over Internet Protocol (VoIP),
- Moves/adds/changes are made frequently,
- The risk of deliberate DOS attack is low to moderate &
- Ethernet cable installation is difficult.

REFERENCE:-
- PAUL DEBEASI

UNIFIED NETWORKING ON 10 GIGABIT ETHERNET (10GbE)

With the growth in Ethernet based storage, Intel and NetApp have developed unified networking over 10GbE in the data center offering compelling benefits, with a simplified infrastructure, lower equipment and power costs and flexible path to cost effective performance of next generation storage networks, meeting the needs of the evolving, virtualized data center.
As server virtualization has increased largely in recent years, Ethernet-based storage has also grown surpassing storage-specific fabrics. Also, the ubiquity of storage area network (SAN) access will be critical as virtualization deployments continue with emerging of new, on-demand data center models.
As IT departments look to reduce costs and improve server efficiency, they are turning increasingly to server visualization and consolidation, as benefits of virtualization are widely understood: less server hardware to purchase, lower power and cooling needs and centralized management.
Over 2.5 billion users will connect to the internet in the next five years and years with over 10 billion devices which will require eight times the amount of storage capacity, 16 times the network capacity and over 20 times the computer capacity by 2015, so a new infrastructure must emerge to power this growth and enable the most efficient use of resources that is cloud computing.
A 10GbE unified fabric simplifies the network infrastructure by consolidating LAN and SAN traffic. Internet small computer system interface (iSCSI) and network file system (NFS) are two examples of storage protocols that use Ethernet and the recent ratification of the Fibre Channel over Ethernet (FCoE) standard extends this capability. The recent Ethernet enhancements ensure QoS (Quality of Service) for critical traffic.
Intel and NetApp are two companies that are helping to advance the shift to 10GbE based unified networking in the data center.

Posted by: - D. Bishal

Advanced Persistent Threat (APT)

The word APT originated first when Google became victim of a targeted attack originating from China along with 30 other technology firms, defense contractors and large enterprises which were penetrated by hackers with the use of an array of social engineering, targeted malware and monitoring technologies to quietly access reams of sensitive corporate data.
Advanced Persistent Threat has been defined by security professionals actively countering APT as an adversary such that ADVANCED means adversary being able to operate in full spectrum of computer intrusion, like using publicly available exploit against well known vulnerability or ca n also elevate their game to research new vulnerabilities and develop custom exploits depending on target’s condition.
PERSISTENT means the adversary is formally tasked to accomplish a mission though they are not simply opportunistic intruders, but work as an intelligent unit, receiving directives and working to satisfy their masters. It does not mean that they are continuously executing malicious code on victim computers. They maintain their level of interaction needed to execute their goals.
THREAT means that the adversary is not only a piece of mindless code but an organized, funded and motivated threat.
In brief, APT is an adversary who conducts offensive digital operations also known as computer network operations or computer network exploitation for supporting different state-related objectives.
APT are just 4 years old and its target can be divided into four phases: -
1. Late 1990s –military victim,
2. 2000-2004 non-military government victims,
3. 2005-2009 defense industrial base and
4. 2009-present – intellectual property rich targets and software companies.
COUNTERING APT: -
The most effective counter-APT weapon is a trained and knowledgeable information security analyst though many vendors have marketed adopting APT and even registered APT themed domain names, but the best way would be to provide knowledge to business leaders about the threat so that they support organizational security programs suggested by competent and informed staff.
Counter APT awareness should be developed and local Federal Bureau of Investigation office should be contacted and threat briefing can be requested to promote managerial attention.
From the technical view, Visibility should be built which will provide situational awareness with a chance to discover and hopefully frustrating APT activities.
The goal of counter-APT operations should be to make it as difficult as possible for the adversary to steal intellectual property, “increasing the cost per megabyte,” .

REFERENCE:
- RICHARD BEJTLICH – director of incident response for General Electric.

Securing Networked Databases from SQL Injection attacks

Though SQL Injection has been a common database and attack on web application & vendors of RDBMS (Relational Database Management System) are familiar with these type of attacks, it is still very difficult to be find out and prevent these attacks without disturbing the organization's operations. So, every events in the database has to be checked thoroughly inm detail.
For this, Database Activity Monitoring (DAM) systems can be deployed for finding out any suspicious activities in the RDBMS.
DAM systems provide advanced security platforms that analyze database queries and find out the normal operations and database attacks. This system collects information and provides several forms of advaced analysis that alerts or even the half malicious activities which no other security products provides this level of security.
For deploying DAM, first you'll need to prioritize data or transactions to be protected as it is impractical to monitor each and every database events, so you can follow the three steps provided below,
1. First interview database administrators and application developers because they know where the senstitive data resides and databases that support critical business functions.
2. Secondly, Inspect database contents using data discovery and database crawlers. Some tools of inspection are provided by vendors for searching database content as an add on option which locates sensitive information through meta data and content analysis techniques.
3. Lastly, Observe SQL statements and database transactions. As, most DAM systems are used in monitor-only mode for the first week, fromwhich the organization can develop an understanding of database operations and also have an idea of applications that use the database and format of a typical query. Then, policies can be developed and implemented for detecting misuse of database.
Now, database events have to captured which also has to be specified.
- Like Native audit features collect events but not always gather original SQL queries and cost performance overhead.
- Network collectors collect most of SQL activities though miss some transactions and activity performed by administrators working at the console.
- And, Agents are de facto delployment for security of critical databases. Native auditing for compliance and network monitoring of non-critical databases is common, but used in more special cases.
Then, basic database security should be defined for implementing security policies as DAM works by analyzing database queries and the fundamental features a DAM provides are:
1. Monitoring and discovery,
2. Alerts and reports,
3. Verification of work orders,
4. Catching misuse &
5. SQL capture for auditing.
With the advancing technologies, DAM systems also have advanced features like,
1. SQL injection detection,
2. Blocking & Virtual patching,
3. Identifying specifig application users,
4. Session termination,
5. Behavioral monitoring and insider threat detection.
For advanced features of DAM, advanced policies have to be definedspecific to your environment & you need to define legitimate SQL queries.
For the advanced features, you need to customize policies as the DAM vendors provide templates and tools from which policies can be developed.
Lastly, for deploying DAM, several points should be kept inmind to save time and trouble inthe long run and these include,
1. Separation of duties,
2. Long-term storage and
3. Scalability.

Posted by : D. Bishal
REFERENCE:
- Adrian Lane.