With the vast number of viruses and spyware that most people contract in their everyday exposure to the web, the need for consistent and reliable anti-virus protection software is the foremost concern of most people. To date, the awareness for such deceiving acts done over the Internet without the user even noticing it is rampant. Such viruses have caused discomfort and havoc in more cases than one and it has been the battle cry of most security software developers to adhere and answer such miscues that usually occur everyday.

[tags]malware, spyware, virus, security, anti-virus[/tags]
Network and workstation security has always been the subject of most people, especially the vulnerability that most computer stations are prone to. Updates and patches are usually the way to update reliable anti-virus software partners, but in most cases, there will always be a loophole to which hackers and advanced technology harassers would be able to come up with. Hence the needs to find a reliable software partner that can truly protect a workstation from such harmful intrusions evolve and change in time. It is just a matter of being up to date with regards to their reliability and efficiency in providing a safe surfing and exposure level once they are logged on to the World Wide Web.

Tags: anti-virus, IT Security Basics, Malware, Network Security, Programming, Real-World Issues, security, Security Policies, Spyware, virus

Categories: IT Security Basics, Malware, Network Security, Programming, Real-World Issues, Security Policies, Spyware

Comments Off

At the rate that hackers and more people are becoming wiser as far as discovering technology and its flaws today, the best way is to have ready back-up procedures for databases and important documents and spreadsheets just in case of system intrusion and crashes. While it is true that most companies are continuously developing software to be able to limit such malicious intentions, it cannot be discounted that the safest way is to have ready back-ups which can be easily restored at any time of their liking.

The question is when to back-up and what to back up. For most people, backing up periodically is the common practice. But for more important documents and reference materials, archiving them as often as possible is the safest way to be sure. People should not wait for the last minute to back-up their files since with the fast pace of technology comes the fast pace development of hackers today.

[tags]backup,archiving,network security[/tags]

Tags: archiving, backup, Backups, IT Security Basics, Network Security, Security Policies, Storage, Tips

Categories: Backups, IT Security Basics, Network Security, Security Policies, Storage, Tips

Comments Off

802.11 Wired Equivalent Privacy (WEP) doesn’t provide enough security for most enterprise wireless LAN applications. Because of static key usage, it’s fairly easy to crack WEP with off-the-shelf tools. This motivates IT managers to use stronger dynamic forms of WEP.

The problem to date, however, is that these enhanced security mechanisms are proprietary, making it difficult to support multi-vendor client devices. The 802.11i standard will eventually solve the issues, but it’s not clear when the 802.11 Working Group will ratify the 802.11i standard.

As a result, the Wi-Fi Alliance has taken a bold step forward to expedite the availability of effective standardized wireless LAN security by defining Wi-Fi Protected Access (WPA) while promoting interoperability. With WPA, an environment having many different types of 802.11 radio NICs, such as public hotspots, can benefit from enhanced forms of encryption.
Inside WPA

WPA is actually a snapshot of the current version of 802.11i, which includes Temporal Key Integrity Protocol (TKIP) and 802.1x mechanisms. The combination of these two mechanisms provides dynamic key encryption and mutual authentication, something much needed in WLANs.

As with WEP, TKIP uses the RC4 stream cipher provided by RSA Security to encrypt the frame body and CRC of each 802.11 frame before transmission. The issues with WEP don’t really have much to do with the RC4 encryption algorithm. Instead, the problems primarily relate to key generation and how encryption is implemented.

TKIP adds the following strengths to WEP:

48-bit initialization vectors. WEP produces what’s referred to as a “keyschedule” by concatenating a shared secret key with a randomly-generated 24-bit initialization vector (IV). WEP inputs the resulting keyschedule into a pseudo-random number generator that produces a keystream equal to the length of the 802.11 frame’s payload. With a 24 bit IV, though, WEP eventually uses the same IV for different data packets. In fact, the reoccurrence of IVs with WEP can happen within an hour or so in busy networks. This results in the transmission of frames having encrypted frames that are similar enough for a hacker to collect frames based on the same IV and determine their shared values, leading to the decryption of the 802.11 frames. WPA with TKIP, however, uses 48-bit IVs that significantly reduce IV reuse and the possibility that a hacker will collect a sufficient number of 802.11 frames to crack the encryption.

Per-packet key construction and distribution. WPA automatically generates a new unique encryption key periodically for each client. In fact, WPA uses a unique key for each 802.11 frame. This avoids the same key staying in use for weeks or months as they do with WEP. This is similar to changing the locks on a house each time you leave, making it impossible for someone who happened to make a copy of your key to get in.

Message integrity code. WPA implements the message integrity code (MIC), often referred to as “Michael,” to guard against forgery attacks. WEP appends a 4-byte integrity check value (ICV) to the 802.11 payload. The receiver will calculate the ICV upon reception of the frame to determine whether it matches the one in the frame. If they match, then there is some assurance that there was no tampering. Although WEP encrypts the ICV, a hacker can change bits in the encrypted payload and update the encrypted ICV without being detected by the receiver. WPA solves this problem by calculating an 8-byte MIC that resides just before the ICV.

For authentication, WPA uses a combination of open system and 802.1x authentication. Initially, the wireless client authenticates with the access points, which authorizes the client to send frames to the access point. Next, WPA performs user-level authentication with 802.1x. WPA Interfaces to an authentication server, such as RADIUS or LDAP, in an enterprise environment. WPA is also capable of operating in what’s known as “pre-shared key mode” if no external authentication server is available, such as in homes and small offices.

An issue that WPA does not fix yet is potential denial of service (DoS) attacks. If someone, such as a hacker or disgruntled employee, sends at least two packets each second using an incorrect encryption key, then the access point will kill all user connections for one minute. This is a defense mechanism meant to thwart unauthorized access to the protected side of the network.

You will be able to upgrade existing Wi-Fi-compliant components to use WPA through relatively simple firmware upgrades. As a result, WPA is a good solution for providing enhanced security for the existing installed base of WLAN hardware.

The eventual 802.11i standard will be backward compatible with WPA; however, 802.11i will also include an optional Advanced Encryption Standard (AES) encryption. AES requires coprocessors not found in most access points today, which makes AES more suitable for new WLAN installations.

Tags: IT Security Basics, Network Security, Real-World Issues, Security Policies, Storage, Tips, Wireless Security

Categories: IT Security Basics, Network Security, Real-World Issues, Security Policies, Storage, Tips, Wireless Security

Leave a Comment

Companies these days provide for mobile devices their employees use to ensure they’re available at all times. The downside of this is that their employees may also use these laptops and phones for personal use, all at the company’s expense, and the real risk of losing valuable data if they’re stolen. We’ve talked about data breaches caused by stolen laptops before. Companies should begin weighing the advantage of employee mobility with the disadvantages of possible data loss and decreased productivity.

It’s become much easier for employees to download movies, music, and watch video streaming while in the office and then load them to their mobile devices. Instead of working, they might be tempted to watch their downloads during company hours. Some pornography and gambling sites have begun to exploit this trend by offering their services for phones. These are the very same sites most hackers use to spread their viruses. This way confidential data on these devices can be breached and destroyed even without the user’s knowledge.

For the past few years companies have filtered e-mail and limited web access in the office, but similar control does not exist for mobile devices. Until the advent of similar filtering software, companies can opt to acquire and manage the distribution of their phones to their employees. In such a situation each employee is responsible for their usage. They can also create guidelines and policies to limit how the employees can and cannot use their phones, though they should be aware that their employees will resist stringent control.

[tags]mobility,productivity,mobile devices,filtering software,usage,software,employess[/tags]

Tags: employess, filtering-software, mobile-devices, mobility, productivity, Real-World Issues, Security Policies, software, usage

Categories: Real-World Issues, Security Policies

Comments Off

How do you feel about the security policies being implemented by your company? Do you think you’re secure even from the visitors that drop by? Maybe the old adage about an ounce of prevention still serves us well in these days.

I once visited a company that had what I thought was a strange security precaution at the door. At first I wondered why they didn’t allow CDs, mp3 players, and other portable devices, but then it made perfect sense when I was ushered into a section with open computers and left to my own devices. Had I come in with any sort of malicious intent I could get files off the computer.

Though the term podslurping has gotten attention because of the i-pod’s popularity as the mp3 player of choice by employees, any form of removable media device can be used. Cameras, thumb drives, and mp3 players can be used to get the data without being caught. This is actually quite easy nowadays because of the plug and play feature of most operating systems. There are already programs designed to search a network and find critical data. Simply insert the device of choice to an empty USB drive, and from there anyone can download possibly highly-sensitive data. That’s why some companies limit the use of those items at work, but it’s not the best solution. There are policies that don’t have to limit the employees’ and visitors’ use of mp3 players and cameras. One is to not allow storage devices to be mounted on any computers in the system. Another would be to use encryption on files and restrict access to confidential data.
[tags]podslurping,security policies[/tags]

Tags: Physical Security, podslurping, Security Policies

Categories: Physical Security, Security Policies

Comments Off

If you look on any major forum which discusses computer security, you will probably find people, or teams of people, who dedicate a large proportion of their time to helping users remove malware from their computers.

These teams typically dedicate several hours a day to going through posts on the forum and helping users locate and remove malware. This process is aided by one or more tools which scan a system for malware and optionally remove some of it. My concern is that people rely far too much on other people to fix their mistakes, than trying not to make them in the first place.

These malware-removal types have started to make documents on generic ways to detect and remove malware, which is a start, but really they need to emphasise the methods of keeping your system clean to begin with. In fact, not only that, but ISPs and IT sellers should emphasise the importance of antivirus software which is regularly updated, to their customers.

Considering that there are several free antivirus programs around, there really is no excuse for not running one! Note, here, that “I’m running Linux” still is not a valid excuse for not having virus scanners; even if Linux is itself immune to most viruses, worms, etc, it can still be used as a node along the path to infecting more users.

Especially since mail attachments sent to a Linux system without a virus scanner would not be scanned, and the Linux user may then go on to send that attachment to a Windows user, who would open it thinking it comes from a reliable source. Using a virus scanner, and educating users in prevention rather than cure, is the direction I’d like to see being taken more often.

Unfortunately, there is no accountability for ISPs or vendors, so this won’t happen.

Tags: IT Security Basics, Malware, Real-World Issues, Security Policies

Categories: IT Security Basics, Malware, Real-World Issues, Security Policies

Comments Off

AOL are planning to charge for emails. Mass mailers will be able to pay for a higher priority delivery, bypassing the AOL spam filters and ensuring that mail is received directly in the end users inbox.

This is, obviously, a bad thing since spammers will be able to pay a small offset to ensure that their messages are delivered direct to the end users inbox, whilst legitimate messages will face the AOL spam filter gauntlet. Programmes such as this will only see a rise in spam, and a fall in the success rate of legitimate mail being successfully delivered.

Tags: News, Privacy-&-Anonymity, Real-World Issues, Security Policies

Categories: News, Privacy & Anonymity, Real-World Issues, Security Policies

Comments Off

Many people I speak to think that simply because they are on a switched network, they are immune to packet sniffing, a process whereby a computer listens for packets not intended for that address, and logs them, potentially gathering usernames, passwords, and other useful information within network traffic. For example, every time you log into a website which does not use SSL (Secure Sockets Layer), your username and password are transmitted in plain text as part of the HTTP (HyperText Transfer Protocol) request. If another user is running packet sniffing software, this request will get logged for later analysis, which could lead to that user gaining access to the website you visited, under your account.

Packet sniffing was easy on networks connected using hubs, as a hub is a device which sends every packet it receives to every computer connected. This is bad for a number of reasons, including reducing transfer rates due to collisions and unnecessary transmission; if data is not destined for a computer, it would still be sent there. It does, however, also allow for easy packet sniffing; simply set a network card to pass every packet up to the application layer, instead of only those addressed to the specific computer. These can be logged for later analysis.

On a switched network, packets usually go only to the computer to which they are addressed, based on MAC address resolution of the IP. The switch then sends packets to the port hosting that MAC address, and only that port.

So, how is it that switched networks are still vulnerable to packet sniffing, if packets only get transmitted to their destination?

This is where ARP Poisoning comes in. ARP is the Address Resolution Protocol, and maps IP addresses to MAC addresses. In an ARP Poisoning attack, a system sends out faked ARP responses claiming to be the MAC associated with an IP. As such, packets destined for that IP will be sent to the computer doing the ARP poisoning, as they traverse the switch, instead of the real destination.

Using this mechanism, it is possible to redirect packets between a computer on the network to the border router, forcing them to be delivered to a system running a packet sniffer, instead. From here, they can be logged and then sent on to the real MAC address of the router. This is known as a man-in-the-middle ARP Poisoning based network sniffing attack, and is effective against switched networks.

Because this attack is based on ARP requests and responses, which are a local network mechanism, this attack cannot traverse routers or any other level 3 or higher device.

Tags: Network Security, Real-World Issues, Review, Security Policies

Categories: Network Security, Real-World Issues, Review, Security Policies

Comments Off

Transmarit is a guide to hardening Slackware Linux 10.2.0. It was written by Jeffrey Denton in January 2006, and covers most of the steps you’d want to take to securely lock down a Slackware server.

Locking down a system this much is probably unsuitable for home users, or on most workstations, but in the server environment, most of the security precautions mentioned make sense.

Of course, locking down a system brings with it inconvenience as well as security, and most sites will want to find a balance between security and usability. The document does lean somewhat more toward security, though.

There are actually some interesting tricks in there, such as checking if a user with UID zero is in fact root, and, if not, killing their processes and e-mailing the real root.

For those wishing to secure their Slackware servers, this makes an excellent read. In fact, even if you’re just looking to slightly increase the security of your home system, I’d say that reading this document would be a good place to start getting some ideas as to what you can and can’t do, and what sort of thing makes for good security.

Hardening a Linux system is the topic of many books and documents. Some try to be generic and cover the things you can do regardless of distribution, but many are written for the “popular” enterprise distributions such as RedHat and SuSE. It’s nice to see a Slackware one out there, and with such sound security information in it, Slackware should keep its reputation for security as well as speed and stability.

Tags: Operating Systems, Security Policies

Categories: Operating Systems, Security Policies

1 Comment

Tunneling is a method of using an internetwork infrastructure to transfer data for one network over another network. The data to be transferred (or payload) can be the frames (or packets) of another protocol. Instead of sending a frame as it is produced by the originating node, the tunneling protocol encapsulates the frame in an additional header. The additional header provides routing information so that the encapsulated payload can traverse the intermediate internetwork.

The encapsulated packets are then routed between tunnel endpoints over the internetwork. The logical path through which the encapsulated packets travel through the internetwork is called a tunnel. Once the encapsulated frames reach their destination on the internetwork, the frame is decapsulated and forwarded to its final destination. Tunneling includes this entire process (encapsulation, transmission, and decapsulation of packets).

Tags: IT Security Basics, Network Security, Physical Security, Privacy-&-Anonymity, Security Policies

Categories: IT Security Basics, Network Security, Physical Security, Privacy & Anonymity, Security Policies

1 Comment