Athens access and identity management

Athens is an Access and Identity Management service that is supplied by Eduserv to provide single sign-on to protected resources combined with full user management capability. Organisations adopting the Athens service can choose between the Classic Athens service, where usernames are held by Eduserv, or Local Authentication where usernames are held locally and security tokens are exchanged via a range of protocols: SAML, Shibboleth or Athens Devolved Authentication (AthensDA). Over 4.5 million users worldwide can gain access to over 300 protected online resources via the Athens service.

Athens replaces the multiple usernames and passwords necessary to access subscription based content with a single username and password that can be entered once per session. It operates independently of a user’s location or IP address.

Infrastructure

There are two main elements to Athens. Firstly, the ability to manage large numbers of users, their credentials, and associated access rights, in a devolved manner where administration can be delegated to organisations, or within an organisation. Secondly, Athens provides a managed infrastructure which facilitates the exchange of security tokens across domains in a secure and trusted way.

Trust

The Athens service is a trust federation where Identity Providers, Service Providers and Athens operate under common rules and licenses. Trust is enforced by the use of public-key cryptography and other security mechanisms.

Trust is enforced at the Identity Provider through an appointed administrator who uses browser-based tools provided as part of the Athens service to manage their user accounts in a truly federated manner. Accounts can be grouped into categories with different attributes, and given access to different sets of resources.

The Athens service is neutral; it is not involved in the selling process between a Service Provider (SP) and an Identity Provider (IdP). The SP informs Athens when access to its resource is to be enabled to an IdP, and Athens then allows the IdP to allocate the resource to appropriate user accounts.

Adoption

Athens is used extensively within UK Higher and Further Education institutions, the UK National Health Service, and in more than 90 countries worldwide. It has been adopted by over 2,000 organisations, and over 300 online resources since it was first launched in 1996. Over 4.5 million accounts are now registered with Athens. The majority of IdPs use Classic Athens; however more than 60 organisations, representing around one million users have moved to the fully federated Local Authentication model. In 2006 Athens was represented at the Medical Library Association Annual Meeting. Since then hospital libraries in the United States have begun using Athens as method for providing off campus access to library resources.

Standards

Once SAML became a ratified standard, Athens adopted SAML and Shibboleth interfaces to the Athens system to facilitate inter-working with a larger number of systems. The Athens service offers SAML and Shibboleth connectivity for both IdPs and SPs through Gateways where native connectivity is not practical.

Attributes

Athens makes a number of attributes relating to its organisations and its user accounts available to its Service Providers through its agent technology. These are generally organisation-related as in the case of the ‘issuing organisation identity number’ or ‘issuing organisation country’, or pseudonymous like the persistent unique identifier for a user account.

Attribute-based authorisation

Athens user management facilities, whether for Classic or Locally Authenticated users, allow the administrator to allocate a different set of resources to each user account. This provides fine-grained authorisation for resources. However, the ability to deliver attributes through the agent technology will offer a long term ability to authorise based on attributes, when attributes and their meaning are commonly understood by IdPs and SPs.

History

Conceived in 1996 at the University of Bath, the service was originally named Athena after the Greek goddess of knowledge and learning. It is rumoured that the name change was partially caused by a common typo, but it was actually due to the name Athena being already trademarked.

As from 1996, the service has had two periods of significant expansion. The first in 2000 due to a central contract that made the service freely available to almost all UK Higher and Further education, and the second in 2003 when adopted by the UK National Health Service.

http://en.wikipedia.org/

Application-level gateway

In the context of computer networking, an application-level gateway (also known as ALG or application layer gateway) consists of a security component that augments a firewall or NAT employed in a computer network. It allows customized NAT traversal filters to be plugged into the gateway to support address and port translation for certain application layer "control/data" protocols such as FTP, BitTorrent, SIP, RTSP, file transfer in IM applications etc. In order for these protocols to work through NAT or a firewall, either the application has to know about an address/port number combination that allows incoming packets, or the NAT has to monitor the control traffic and open up port mappings (firewall pinhole) dynamically as required. Legitimate application data can thus be passed through the security checks of the firewall or NAT that would have otherwise restricted the traffic for not meeting its limited filter criteria.

An ALG may offer the following functions:1

* allowing client applications to use dynamic ephemeral TCP/ UDP ports to communicate with the known ports used by the server applications, even though a firewall-configuration may allow only a limited number of known ports. In the absence of an ALG, either the ports would get blocked or the network administrator would need to explicitly open up a large number of ports in the firewall — rendering the network vulnerable to attacks on those ports.
* converting the network layer address information found inside an application payload between the addresses acceptable by the hosts on either side of the firewall/NAT. This aspect introduces the term 'gateway' for an ALG.
* recognizing application-specific commands and offering granular security controls over them
* synchronizing between multiple streams/sessions of data between two hosts exchanging data. For example, an FTP application may use separate connections for passing control commands and for exchanging data between the client and a remote server. During large file transfers, the control connection may remain idle. An ALG can prevent the control connection getting timed out by network devices before the lengthy file transfer completes.

Deep packet-inspection of all the packets handled by ALGs over a given network makes this functionality possible. An ALG understands the protocol used by the specific applications that it supports.

For instance, Session Initiation Protocol (SIP) Back-to-Back User agent (B2BUA). An ALG can allow firewall traversal with SIP. If the firewall has its SIP traffic terminated on an ALG then the responsibility for permitting SIP sessions passes to the ALG instead of the firewall. An ALG can solve another major SIP headache: NAT traversal. Basically a NAT with inbuilt ALG can re-write information within the SIP messages and can hold address-bindings until the session terminates.

An ALG is very similar to a proxy server, as it sits between the client and real server, facilitating the exchange. There seems to be an industry convention that an ALG does its job without the application being configured to use it, by intercepting the messages. A proxy, on the other hand, usually needs to be configured in the client application. The client is then explicitly aware of the proxy and connects to it, rather than the real server.

ALG service in Microsoft Windows

The Application Layer Gateway service in Microsoft Windows provides support for third-party plugins that allow network protocols to pass through the Windows Firewall and work behind it and Internet Connection Sharing. ALG plugins can open ports and change data that is embedded in packets, such as ports and IP addresses. Windows Server 2003 also includes an ALG FTP plugin. The ALG FTP plugin is designed to support active FTP sessions through the NAT engine in Windows. To do this, the ALG FTP plugin redirects all traffic that passes through the NAT and that is destined for port 21 (FTP control port) to a private listening port in the 3000-5000 range on the Microsoft loopback adapter. The ALG FTP plugin then monitors/updates traffic on the FTP control channel so that the FTP plugin can plumb port mappings through the NAT for the FTP data channels. The FTP plugin will also update ports in the FTP control channel stream.

http://en.wikipedia.org/

Anti-worm

Anti-worm has multiple meanings within the field of computer security. It can be a piece of software designed to protect against computer worms, combining the features of anti-virus software and a personal firewall. It can also mean a worm designed to do something that its author feels is helpful.

Concept

The concept of "anti-worms" is a proactive method of dealing with virus and computer worm outbreaks. Just like malicious computer worms, anti-worms reach computers by scanning IP ranges and placing a copy of themselves on vulnerable hosts. The anti-worm then patches the computer's vulnerability and uses the affected computer to find other vulnerable hosts. Anti-worms have the ability to spread just as fast as regular computer worms, utilizing the same "scan, infect, repeat" model that malicious computer worms use.

Criticism

Many computer security experts have denounced the so-called "anti-worm". Their position is that no code should be run on a system without the system owner's consent. Worm code, even if its author has good intentions, can wreak havoc on a network. It can overflow the traffic capacity of the network. Its author does not know the exact configuration of the system on which the code is running, and it could render that system useless for its intended purpose.

It is important to note that most jurisdictions which have computer crime laws covering worms do not distinguish "worms" from "anti-worms," thus making the author(s) of such code liable to prosecution.

Example

The Santy worm was released shortly before Christmas 2004 and spread quickly, using Google to search for vulnerable versions of phpBB. The worm exploited a bug in the phpBB software to infect the host, defacing the website and deleting all of the messages stored on the forums. The worm was poised to spread to hundreds of thousands of other websites running the phpBB forum. Approximately 10 days after the worm's launch, someone released another worm to combat the Santy worm and patch the vulnerable phpBB forum. The anti-Santy worm spread quickly affecting thousands of servers running the phpBB.

However, the anti-santy worm caused problems of its own. Many site administrators reported that the anti-worm crashed their systems by flooding them with requests, resulting in a denial-of-service attack. Others reported that the patch did not work.

Whether or not the anti-worm had a significant positive impact on the spread Santy worm is unknown. Within several hours of Santy's release, Google blocked the search string the worm was using to find vulnerable hosts. Thus, the worm could not find new hosts to infect. There is no way to determine if Google's actions or the anti-Santy worm did more to protect hosts.

Anti-worms have also been used to combat the effects of the Code Red worm.

http://en.wikipedia.org/

Anti-replay

Anti-replay is the concept of not allowing an intercepted packet message to be sent to the recipient multiple times without the original sender knowing. This method is seen mainly in TCP/IP communication.

http://en.wikipedia.org/

Anti-phishing software

Anti-phishing software consists of computer programs that attempt to identify phishing content contained in websites and e-mail. It is often integrated with web browsers and email clients as a toolbar that displays the real domain name for the website the viewer is visiting, in an attempt to prevent fraudulent websites from masquerading as other legitimate web sites. Anti-phishing functionality may also be included as a built-in capability of some web browsers.

Network-based Anti-Phishing Programs

* Untangle - Phish Blocker

Client-based Anti-Phishing Programs

* PhishTrap guaranteed anti-phishing protection for $16
* Avira Premium Security Suite - complete security package with virus scanner and proactive Anti-Phishing
* Microsoft Windows Internet Explorer 7
* Firefox 3.0.10

* Safari 3.2
* Opera 9.2
* Netscape 8.1
* Norton 360
* McAfee SiteAdvisor
* Netcraft Toolbar
* Google Safe Browsing (usable with Firefox)
* Reasonable Software | Reasonable Anti-phishing Software (free)
* eBay Toolbar
* Earthlink ScamBlocker (recently discontinued)
* GeoTrust TrustWatch
* Phishtank SiteChecker
* CarrotMail
* Mozilla Thunderbird - e-mail client which warns users of e-mails which may be part of an e-mail scam.
* Windows Mail, an e-mail client that comes with Windows Vista
* Gralicwrap free anti-phishing software tool
* Kaspersky Internet Security
* ESET Smart Security

Anti-Phishing Effectiveness

A study conducted by 3Sharp released on September 27, 2006 tested the ability of eight anti-phishing solutions to block known phishing sites, warn about phishing sites, and allow good sites. The study, which was commissioned by Microsoft and titled "Gone Phishing: Evaluating Anti-Phishing Tools for Windows", concluded that Internet Explorer and Netcraft Toolbar were the most effective anti-phishing tools.

A later independent study, conducted by Carnegie Mellon University CyLab titled "Phinding Phish: An Evaluation of Anti-Phishing Toolbars", released November 13, 2006, tested the ability of ten anti-phishing solutions to block known or warn about phishing sites, not block or warn about legitimate sites, as well as usability testing of each solution. Of the solutions tested, Netcraft Toolbar, EarthLink ScamBlocker and SpoofGuard were able to correctly identify over 75% of the sites tested, with Netcraft Toolbar receiving the highest score, without incorrectly identifying legitimate sites as phishing. Severe problems were however discovered using SpoofGuard, and it incorrectly indentified 38% of the tested legitimate sites as phishing, leading to the conclusion that "It would seem that such inaccuracies might nullify the benefits SpoofGuard offers in identifying phishing sites.". Google Safe Browsing (which has since been built into Firefox) and Internet Explorer both performed well, but when testing ability to detect fresh phishes Netcraft Toolbar scored as high 96%, while Google Safe Browsing scored as low as 0%, possibly due to technical problems with Google Safe Browsing. The testing was performed using phishing data obtained from Anti-Phishing Working Group, PhishTank and an unnamed email filtering vendor.

The latest study, conducted by SmartWare for Mozilla, released November 14, 2006, concluded that the anti-phishing filter in Firefox was more effective than Internet Explorer by more than 10%. The results of this study have been questioned by critics , criticising that the testing data was sourced exclusively from PhishTank, itself an anti-phishing provider. The study only compared Internet Explorer and Firefox, and left out among others Netcraft Toolbar and the Opera browser, both of which use data from PhishTank in their anti-phishing solutions. This has led to speculations that, with the limited testing data, both Opera and Netcraft Toolbar would have gotten a perfect score had they been part of the study.

While the two later reports were released only one day apart, Asa Dotzler, Director of Community Development at Mozilla, has responded to the criticism of the Mozilla-commissioned report by saying "..so you're agreeing that the most recent legitimate data puts Firefox ahead. Good enough for me."

Since these studies were conducted, both Microsoft and Opera Software have started licensing Netcraft's anti-phishing data, bringing the effectiveness of their browser's built-in anti-phishing on par with Netcraft Toolbar and beyond.

http://en.wikipedia.org/

Anti-pharming

Anti-pharming techniques and technology are used to combat pharming.

Traditional methods for combating pharming include: Server-side software, DNS protection, and web browser add-ins such as toolbars. Server-side software is typically used by enterprises to protect their customers and employees who use internal or private web-based systems from being pharmed and phished, while browser add-ins allow individual users to protect themselves from phishing. DNS protection mechansims help ensure that a specific DNS server cannot be hacked and thereby become a facilitator of pharming attacks. Spam filters typically do not provide users with protection against pharming.

Currently the most efficient way to prevent pharming is for end users to make sure they are using secure web connections (HTTPS) to access privacy sensitive sites such as those for banking or taxing, and only accept the valid public key certificates issued by trusted sources. A certificate from an unknown organisation or an expired certificate should not be accepted all the time for crucial business. So-called active cookies provide for a server-side detection tool.

Legislation also plays an essential role in anti-pharming. In March 2005, U.S. Senator Patrick Leahy (D-VT) introduced the Anti-Phishing Act of 2005, a bill that proposes a five-year prison sentence and/or fine for individuals who execute phishing attacks and use information garnered through online fraud such as phishing and pharming to commit crimes such as identity theft.

For home users of consumer-grade routers and wireless access points, perhaps the single most effective defense is to change the password on the router to something other than the default, replacing it with a password that is not susceptible to a dictionary attack

http://en.wikipedia.org/

Anomaly-based intrusion detection system

An Anomaly-Based Intrusion Detection System, is a system for detecting computer intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous. The classification is based on heuristics or rules, rather than patterns or signatures, and will detect any type of misuse that falls out of normal system operation. This is as opposed to signature based systems which can only detect attacks for which a signature has previously been created.

In order to determine what is attack traffic, the system must be taught to recognise normal system activity. This can be accomplished in several ways, most often with artificial intelligence type techniques. Systems using neural networks have been used to great effect. Another method is to define what normal usage of the system comprises using a strict mathematical model, and flag any deviation from this as an attack. This is known as strict anomaly detection.

http://en.wikipedia.org/

Alert Logic

Alert Logic, a provider of hosted IT network security, was founded in 2002 and is based in Houston, Texas.

Alert Logic uses a Software as a Service (SaaS) platform to deliver IT network intrusion protection, vulnerability assessment and improved IT compliance for mid-sized businesses and institutions.

Alert Logic is a privately-held corporation. In August 2006, Dallas-based Hunt Ventures LP led a $5 million round of Series B funding for Alert Logic, which included participation from three other investors: DFJ Mercury of Houston, OCA Venture Partners LLC of Chicago and Denver-based Access Venture Partners.

Alert Logic provides protection against Internet computer worms, Trojan horse (computing) programs, Botnets and other IT security threats that can make their way past firewalls. Research has shown that firewalls are not by themselves sufficient to detect or eliminate all network threats.

With more than 550 customers across the U.S., Alert Logic is able to identify trends in network attacks against mid-sized organizations. In August 2006, Alert Logic's security lab detected a 1,000 percent increase in the number of Brute force attacks across its customers' networks. Targets of Brute force attacks are SSH, FTP and Windows networking among other services.

Alert Logic’s security solution consists of three layers: 1) a security operations center staffed on a full-time basis by certified security analysts who analyze and respond to security incidents on customer networks; 2) a hosted expert system that analyzes, correlates, and automatically mitigates IT security incidents and vulnerabilities, and 3) an on-premise appliance that monitors network traffic and continuously scans the network for threats and vulnerabilities.

In addition to protecting individual customer networks, Alert Logic also provides hosted network security for managed service providers and their customers.

Alert Logic’s reporting capabilities provide midsized companies with improved documentation and overall IT compliance to policies and regulations. The U.S. has experienced an increase in IT network security compliance laws in recent years. Since passage of the Health Insurance Portability and Accountability Act of 1996 and 2003, the Gramm-Leach-Bliley Act of 1999, and the Sarbanes-Oxley Act of 2002, penalties for inadequate network security have increased.

http://en.wikipedia.org/

AirSnort

AirSnort is a Linux and Microsoft Windows utility (using GTK+) for decrypting WEP encryption on an 802.11b network. Distributed under the GNU General Public License, AirSnort is free software.

Scott Fluhrer, Itsik Mantin and Adi Shamir (who was one of the inventors of the RSA encryption algorithm) released a paper entitled Weaknesses in the Key Scheduling Algorithm of RC4. In August 2001, based on the security flaws described therein, Blake Hegerle and Jeremy Bruestle made public a tool that must gather roughly five to ten million encrypted packets from a wireless access point before it can attempt to recover the wireless key. Depending on the environment, this can take as little as a few minutes or more commonly a few hours and possibly a few days.

http://en.wikipedia.org/

AEGIS (network)

AEGIS SecureConnect (or simply ‘AEGIS’) is a network authentication system popular in IEEE 802.1X networks. It was developed by Meetinghouse Data Communications, Inc. (since acquired by Cisco Systems and renamed “Cisco Secure Services Client”). The AEGIS Protocol is an 802.1X “Supplicant” (i.e. handles authentication for wired and wireless networks, such as those that use WPA-PSK, WPA-Radius, or Certificate-based authentication), and is commonly installed along with a Network Interface Card’s (NIC) drivers.

http://en.wikipedia.org/

Theta Networks

Theta Networks is a New Jersey based Telecommunication solutions company that was founded in 2005. The company develops Deep Packet Inspection-based software that can be used for monitoring, optimization, subscriber management and security on mobile networks. Theta Networks has been a major supplier to Nokia Siemens Networks, Ericsson, Motorola, Orange and China Mobile, and assisted China Mobile during the Olympic Games Recently, Theta Networks has also been working with China Mobile on monitoring and support for their new TD-SCDMA networks.

Theta's solutions reassembles and finds relationships between subscriber application sessions at Open Systems Interconnection layer 7 using Deep Packet Inspection, Cross Packet Inspection, and Cross Session Inspection. This technology can be applied to mobile use of WAP, MMS, SMS, HTTP, DNS, and Streaming Technology. Theta Networks also offers VirusGuardMax, a DPI-based network security product.

The company has office in New Jersey, South America, and China. Theta Networks company works in France through a partner, and also recently established partnerships in Australia, and Russia.

http://en.wikipedia.org/

Network security

Network security consists of the provisions made in an underlying computer network infrastructure, policies adopted by the network administrator to protect the network and the network-accessible resources from unauthorized access, and consistent and continuous monitoring and measurement of its effectiveness (or lack) combined together.

Comparison with information security

The terms network security and information security are often used interchangeably, however network security is generally taken as providing protection at the boundaries of an organization, keeping the intruders (e.g. black hat hackers, script kiddies, Trudy, etc.) out. Network security systems today are mostly effective, so the focus has shifted to protecting resources from attack or simple mistakes by people inside the organization, e.g. with Data Loss Prevention (DLP). One response to this insider threat in network security is to compartmentalize large networks, so that an employee would have to cross an internal boundary and be authenticated when they try to access privileged information. Information security is explicitly concerned with all aspects of protecting information resources, including network security and DLP.

Network security concepts

Network security starts from authenticating any user, commonly (one factor authentication) with a username and a password (something you know). With two factor authentication something you have is also used (e.g. a security token or 'dongle', an ATM card, or your mobile phone), or with three factor authentication something you are is also used (e.g. a fingerprint or retinal scan). Once authenticated, a stateful firewall enforces access policies such as what services are allowed to be accessed by the network users. Though effective to prevent unauthorized access, this component fails to check potentially harmful content such as computer worms being transmitted over the network. An intrusion prevention system (IPS) helps detect and inhibit the action of such malware. An anomaly-based intrusion detection system also monitors network traffic for suspicious content, unexpected traffic and other anomalies to protect the network e.g. from denial of service attacks or an employee accessing files at strange times. Communication between two hosts using the network could be encrypted to maintain privacy. Individual events occurring on the network could be tracked for audit purposes and for a later high level analysis.

Honeypots, essentially decoy network-accessible resources, could be deployed in a network as surveillance and early-warning tools. Techniques used by the attackers that attempt to compromise these decoy resources are studied during and after an attack to keep an eye on new exploitation techniques. Such analysis could be used to further tighten security of the actual network being protected by the honeypot.

A useful summary of standard concepts and methods in network security is given by in the form of an extensible ontology of network security attacks.

Security management

Security Management for networks is different for all kinds of situations. A small home or an office would only require basic security while large businesses will require high maintenance and advanced software and hardware to prevent malicious attacks from hacking and spamming.

Small homes

* A basic firewall like COMODO Internet Security or a unified threat management system.
* For Windows users, basic Antivirus software like AVG Antivirus, ESET NOD32 Antivirus, McAfee, or Norton AntiVirus. An anti-spyware program such as Windows Defender or Spybot would also be a good idea. There are many other types of antivirus or antispyware programs out there to be considered.
* When using a wireless connection, use a robust password. Also try and use the strongest security supported by your wireless devices, such as WPA or WPA2.
* Use passwords for all accounts.
* Have multiple account per family member. Disable the guest account (Control Panel> Administrative Tools> Computer Management> Users).
* Raise awareness about information security to children.

Medium businesses

* A fairly strong firewall or Unified Threat Management System
* Strong Antivirus software and Internet Security Software.
* For authentication, use strong passwords and change it on a bi-weekly/monthly basis.
* When using a wireless connection, use a robust password.
* Raise awareness about physical security to employees.
* Use an optional network analyzer or network monitor.
* It's important that company need an enlightened administrator or manager.

Large businesses

* A strong firewall and proxy to keep unwanted people out.
* A strong Antivirus software package and Internet Security Software package.
* For authentication, use strong passwords and change it on a weekly/bi-weekly basis.
* When using a wireless connection, use a robust password.
* Exercise physical security precautions to employees.
* Prepare a network analyzer or network monitor and use it when needed.
* Implement physical security management like closed circuit television for entry areas and restricted zones.
* Security fencing to mark the company's perimeter.
* Fire extinguishers for fire-sensitive areas like server rooms and security rooms.
* Security guards can help to maximize security.

School

* An adjustable firewall and proxy to allow authorized users access from the outside and inside.
* Strong Antivirus software and Internet Security Software packages.
* Wireless connections that lead to firewalls.
* Children's Internet Protection Act compliance.
* Supervision of network to guarantee updates and changes based on popular site usage.
* Constant supervision by teachers, librarians, and administrators to guarantee protection against attacks by both internet and sneakernet sources.

Large Government

* A strong firewall and proxy to keep unwanted people out.
* Strong Antivirus software and Internet Security Software suites.
* Strong encryption, usually with a 256 bit key.
* Whitelist authorized wireless connection, block all else.
* All network hardware is in secure zones.
* All host should be on a private network that is invisible from the outside.
* Put all servers in a DMZ, or a firewall from the outside and from the inside.
* Security fencing to mark perimeter and set wireless range to this.

http://en.wikipedia.org/