Showing papers on "Internet security published in 1999"

Multi-level security network system

Abstract: A network prevents unauthorized users from gaining access to confidential information. The network has various workstations (14) and servers (16) connected by a common medium (20) and through a router (22) to the Internet (30). The network has two major components, a Network Security Center (NSC) and security network interface cards or devices (5). The NSC is an administrative workstation through which the network security officer manages the network as a whole as well as the individual security devices. The security devices are interposed between each of the workstations, including the NSC, and the common medium and operate at a network layer (layer 3) of the protocol hierarchy. The network allows trusted users to access outside information, including the Internet, while stopping outside attackers at their point of entry. At the same time, the network limits an unauthorized insider to information defined in their particular security profile. The user may select which virtual network to access at any given time. The result is trusted access to multiple secure Virtual Private Networks (VPN), all from a single desktop machine.

Inside Java 2 Platform Security: Architecture, API Design, and Implementation

Abstract: From the Book: Give me a lever and a fulcrum, and I can move the globe. —Archimedes Since Java technology's inception, and especially its public debut in the spring of 1995, strong and growing interest has developed regarding the security of the Java platform, as well as new security issues raised by the deployment of Java technology. This level of attention to security is a fairly new phenomenon in computing history. Most new computing technologies tend to ignore security considerations when they emerge initially, and most are never made more secure thereafter. Attempts made to do so typically are not very successful, as it is now well known that retrofitting security is usually very difficult, if not impossible, and often causes backward compatibility problems. Thus it is extremely fortunate that when Java technology burst on the Internet scene, security was one of its primary design goals. Its initial security model, although very simplistic, served as a great starting place, an Archimedean fulcrum. The engineering talents and strong management team at JavaSoft are the lever; together they made Java's extensive security architecture a reality. From a technology provider's point of view, security on the Java platform focuses on two aspects. The first is to provide the Java platform, primarily through the Java Development Kit, as a secure, platform on which to run Java-enabled applications in a secure fashion. The second is to provide security tools and services implemented in the Java programming language that enable a wider range of security-sensitive applications, for example, in the enterprise world. I wrote this book with many purposes inmind. First, I wanted to equip the reader with a brief but clear understanding of the overall picture of systems and network security, especially in the context of the Internet environment within which Java technology plays a central role, and how various security technologies relate to each other. Second, I wanted to provide a comprehensive description of the current security architecture on the Java platform. This includes language features, platform APIs, security policies, and their enforcement mechanisms. Whenever appropriate, I discuss not only how a feature functions, but also why it is designed in such a way and the alternative approaches that we—the Java security development team at Sun Microsystems—examined and rejected. When demonstrating the use of a class or its methods, I use real-world code examples whenever appropriate. Some of these examples are synthesized from the JDK 1.2 code source tree. Third, I sought to tell the reader about security deployment issues, both how an individual or an enterprise manages security and how to customize, extend, and enrich the existing security architecture. Finally, I wanted to help developers avoid programming errors by discussing a number of common mistakes and by providing tips for safe programming that can be immediately applied to ongoing projects. How This Book Is Organized This book is organized as follows: Chapter 1. A general background on computer, network, and information security Chapter 2. A review of the original Java security model, the sandbox Chapter 3. An in-depth look at the new security architecture in JDK 1.2, which is policy-driven and capable of enforcing fine-grained access controls Chapter 4. An explanation of how to deploy and utilize the new security features in JDK 1.2, including security policy management, digital certificates, and various security tools Chapter 5. A demonstration of how to customize various aspects of the security architecture, including how to move legacy security code onto the JDK 1.2 platform Chapter 6. A review of techniques to make objects secure and tips for safe programming Chapter 7. An outline of the Java cryptography architecture along with usage examples Chapter 8. A look ahead to future directions for Java security This book is primarily for serious Java programmers and for security professionals who want to understand Java security issues both from a macro (architectural) point of view as well as from a micro (design and implementation) perspective. It is also suitable for nonexperts who are concerned about Internet security as a whole, as this book clears up a number of misconceptions around Java security. Throughout this book, I assume that the reader is familiar with the fundamentals of the Java language. For those who want to learn more about that language, the book by Arnold and Gosling is a good source. This book is not a complete API specification. For such details, please refer to JDK 1.2 documentation. Acknowledgments It is a cliche to say that writing a book is not possible without the help of many others, but it is true. I am very grateful to Dick Neiss, my manager at JavaSoft, who encouraged me to write the book and regularly checked on my progress. Lisa Friendly, the Addison-Wesley Java series editor, helped by guiding me through the writing process while maintaining a constant but "friendly" pressure. The team at Addison-Wesley was tremendously helpful. I'd like particularly to thank Mike Hendrickson, Katherine Kwack, Marina Lang, Laura Michaels, Marty Rabinowitz, and Tracy Russ. They are always encouraging, kept faith in me, and rescued me whenever I encountered obstacles. This book is centered around JDK 1.2 security development, a project that lasted fully two years, during which many people inside and outside of Sun Microsystems contributed in one way or another to the design, implementation, testing, and documentation of the final product. I would like to acknowledge Dirk Balfanz, Bob Blakley, Josh Bloch, David Bowen, Gilad Bracha, David Brownell, Eric Chu, David Connelly, Mary Dageforde, Drew Dean, Satya Dodda, Michal Geva, Gadi Guy, Graham Hamilton, Mimi Hills, Larry Koved, Charlie Lai, Sheng Liang, Tim Lindholm, Jan Luehe, Gary McGraw, Marianne Mueller, Tony Nadalin, Don Neal, Jeff Nisewanger, Yu-Ching Peng, Hemma Prafullchandra, Benjamin Renaud, Roger Riggs, Jim Roskind, Nakul Saraiya, Roland Schemers, Bill Shannon, Tom van Vleck, Dan Wallach, and Frank Yellin. I also appreciate the technical guidance from James Gosling and Jim Mitchell, as well as management support from Dick Neiss, Jon Kannegaard, and Alan Baratz. I have had the pleasure of chairing the Java Security Advisory Council, and I thank the external members, Ed Felten, Peter Neumann, Jerome Saltzer, Fred Schneider, and Michael Schroeder for their participation and superb insights into all matters that relate to computer security. Isabel Cho, Lisa Friendly, Charlie Lai, Jan Luehe, Teresa Lunt, Laura Michaels, Stephen Northcutt, Peter Neumann, and a number of anonymous reviewers provided valuable comments on draft versions of this book. G. H. Hardy once said that young men should prove theorems, while old men should write books. It is now time to prove some more theorems. Li Gong Los Altos, California June 1999

Ipsec: The New Security Standard for the Internet, Intranets, and Virtual Private Networks

Abstract: From the Book: PREFACE: Preface The Internet connects millions of people around the world and allows for immediate communication and access to a seemingly limitless amount of information. Data, video, voice, almost every single type of communication, travels across the Internet. Some of this communication is private. The language of the Internet is IP, the Internet Protocol. Everything can, and does, travel over IP. One thing IP does not provide, though, is security. IP packets can be forged, modified, and inspected en route. IPSec is a suite of protocols that seemlessly integrate security into IP and provide data source authentication, data integrity, confidentiality, and protection against replay attacks. With IPSec the power of the Internet can be exploited to its fullest potential: Communication is the lifeblood of business. Without a guarantee that a customer?s order is authentic it is difficult to bill for a service. Without a guarantee that confidential information will remain confidential it is impossible for businesses to grow and partnerships to be formed. Unless there is a guarantee that records and information can remain confidential, the health care industry cannot utilize the Internet to expand its services and cut its costs. Personal services, such as home banking, securities trading, and insurance can be greatly simplified and expanded if these transactions can be done securely. The growth of the Internet is truly dependent on security and the only technique for Internet security that works with all forms of Internet traffic is IPSec. IPSec runs over the current version of IP, IPv4, and also the next generationofIP, IPv6. In addition, IPSec can protect any protocol that runs on top of IP such as TCP, UDP, and ICMP. IPSec is truly the most extensible and complete network security solution. IPSec enables end-to-end security so that every single piece of information sent to or from a computer can be secured. It can also be deployed inside the network to form Virtual Private Networks where two distinct and disparate networks become one by connecting them with a tunnel secured by IPSec. This book discusses the architecture, design, implementation, and use of IPSec. Each of the protocols in the suite commonly referred to as "IPSec" (the Authentication Header, the Encapsulating Security Payload, and the Internet Key Exchange) is examined in detail. Common deployments of IPSec are discussed and future work on problem areas is identified. This book is intended for an audience with an interest in network security as well as those who will be implementing secure solutions using IPSec, including building VPNs, e-commerce, and end-to-end security. Cryptography and networking basics are discussed in early chapters for those who are neither cryptography nor networking professionals.Organization This book is split into three parts: overview, detailed analysis, and implementation and deployment issues. Part One is comprised of the first three chapters. Chapter One discusses the basic cryptographic building blocks upon which IPSec is built. Symmetric and public key cryptography and their use for both encryption and authentication are explained. Chapter Two discusses the basics of TCP/IP and the advantages and disadvantages of implementing security at various layers in the TCP/IP protocol stack. Chapter Three is an overview of IPSec. The IPSec Architecture is discussed and each of the protocolsNAH, ESP, and IKENand their interrelationship is touched upon. Part Two consists of chapters Four through Seven. Chapter Four is a detailed discussion of the IPSec Architecture. The basic concepts of IPSec, the different modes, selectors, security associations, and security policy are discussed. Chapters Five and Six discuss in detail the two protocols used to protect IP, the Encapsulating Security Payload and the Authentication Header, respectively. Construction and placement of protocol headers is discussed as are input and output processing rules. Chapter Seven is an in-depth discussion of the Internet Key Exchange. The different phases of negotiation, the different exchanges, the various authentication methods, and all the negotiable options are explained. Part Three is Chapters Eight through Eleven. Chapter Eight is a discussion of policy and its implication on IPSec. An architecture to support IPSec policy and a policy module is presented. Chapter Nine presents the issues surrounding the implementation of IPSec in a TCP/IP stack, in a platform-independent manner. Chapter Ten discusses different IPSec deployments: end-to-end security, virtual private networks, and the "road warrior" situation. Chapter Eleven discusses future work items for the IPSec community. These include integrating network layer compression with IPSec, extending IPSec to multicast traffic, issues associated with key recovery, IPSec interaction with the Layer Two Tunneling Protocol (L2TP), and public-key infrastructures.

Firmato: a novel firewall management toolkit

Abstract: In recent years, packet filtering firewalls have seen some impressive technological advances (e.g., stateful inspection, transparency, performance, etc.) and widespread deployment. In contrast, firewall and security management technology is lacking. We present Firmato, a firewall management toolkit, with the following distinguishing properties and components: (1) an entity relationship model containing, in a unified form, global knowledge of the security policy and of the network topology; (2) a model definition language, which we use as an interface to define an instance of the entity relationship model; (3) a model compiler translating the global knowledge of the model into firewall-specific configuration files; and (4) a graphical firewall rule illustrator. We demonstrate Firmato's capabilities on a realistic example, thus showing that firewall management can be done successfully at an appropriate level of abstraction. We implemented our toolkit to work with a commercially available firewall product. We believe that our approach is an important step towards streamlining the process of configuring and managing firewalls, especially in complex, multi firewall installations.

Method and system for distributed network address translation with network security features

Abstract: A method and system for distributed network address translation with security features. The method and system allow Internet Protocol security protocol (“IPsec”) to be used with distributed network address translation. The distributed network address translation is accomplished with IPsec by mapping a local Internet Protocol (“IP”) address of a given local network device and a IPsec Security Parameter Index (“SPI”) associated with an inbound IPsec Security Association (“SA”) that terminates at the local network device. A router allocates locally unique security values that are used as the IPsec SPIs. A router used for distributed network address translation is used as a local certificate authority that may vouch for identities of local network devices, allowing local network devices to bind a public key to a security name space that combines a global IP address for the router with a set of locally unique port numbers used for distributed network address translation. The router issues security certificates and may itself be authenticated by a higher certificate authority. Using a security certificate, a local network device may initiate and be a termination point of an IPsec security association to virtually any other network device on an IP network like the Internet or an intranet. The method and system may also allow distributed network address translation with security features to be used with Mobile IP or other protocols in the Internet Protocol suite.

Transport layer security: how much does it really cost?

Abstract: The last couple of years has seen a growing momentum towards using the Internet for conducting business. One of the key enablers for business applications is the ability to setup secure channels across the Internet. The Secure Sockets Layer (SSL) protocol provides this capability and it is the most widely used transport layer security protocol. In this paper we investigate the performance of SSL both from a latency as well as a throughput point of view. Since SSL is primarily used to secure Web transactions, we use the SPECWeb96 benchmark suitably modified for use with the SSL protocol. We benchmark two of the more popular Web servers that are in use today and find that they are a couple of orders of magnitude slower when it comes to serving secure Web pages. We investigate the reason for this deficiency by instrumenting the SSL protocol stack with a detailed profiling of the protocol processing components. Based on our findings we suggest two modifications to the protocol that reduce the latency as well as increase the throughput at the server.

Mobile internet access

Abstract: A method of enabling roaming of a mobile internet-access host (9) from a local area network (3) to a GSM network (6), each network having a home agent (HA) for routing internet datagrams between networks. The method comprises deregistering the mobile terminal (9) from said local area network (3) and registering it with the GSM network (6) and allocating to the mobile host (9) a new internet address in the GSM network (6). An internet security key is sent via the GSM Short Message Service from the local area network's home agent (HA) to the mobile terminal (9). The new internet address is transmitted, together with authentication data generated using the security key, via the internet (5) to the local area network's home agent (HA) which registers that address as a care-of-address for the mobile host (9).

Firewall security method and apparatus

Abstract: A technique for the delivering a client-based firewall. A firewall security device is configured for connecting to individual clients, e.g., personal computers, for providing firewall security measures directly to the client. The firewall security device is configured as a electronic dongle which is attached to an external communications port of the client, e.g., the parallel communications port. The incoming communications stream to the client from, e.g., public networks, is passed through the firewall security device. In this way, the firewall security device applies and delivers a set of standard network security measures thereby protecting the client from security breaches triggered by the communications stream received from the public network. Advantageously, the firewall is delivered directly by the client without intervention, use, or connection to a separate firewall server.

Internet vulnerabilities related to TCP/IP and T/TCP

Abstract: The Internet put the rest of the world at the reach of our computers. In the same way it also made our computers reachable by the rest of the world. Good news and bad news! Over the last decade, the Internet has been subject to widespread security attacks. Besides the classical terms, new ones had to be found in order to designate a large collection of threats: Worms, break-ins, hackers, crackers, hijacking, phrackers, spoofing, man-in-the-middle, password-sniffing, denial-of-service, and so on.Since the Internet was born of academic efforts to share information, it never strove for high security measures. In fact in some of its components, security was consciously traded for easiness in sharing. Although the advent of electronic commerce has pushed for "real security" in the Internet, there are still a large number of users (including computer scientists) that are very vulnerable to attacks, mostly because they are not aware of the nature (and ease) of the attacks and still believe that a "good" password is all they need to be concerned about.Aiming for a better understanding of the subject, we wrote a first paper [1] in which we discussed several threats and attacks related to TCP/IP. The present work is an extension of the first one, and its main goal is to include T/TCP in the discussion. Additionally, in an effort to make this paper more comprehensive, we included some sections from the former.Besides the description of each attack (the what), we also discuss the way they are carried out (the how) and, when possible, the related means of prevention, detection and/or defense.

On-demand connection system for internet services

Abstract: This invention relates to a connection on-demand Internet network apparatus that accepts requests from browser clients to deliver multimedia services to the Internet over a switched network from a remote site without a permanent connection to the Internet. This invention provides a connection on-demand Internet network connection apparatus in two parts: The central site 'Network Exchange' comprising of a Network Traffic Manager remote access router function connected to the Internet, capable of mapping an IP address to a telephone number and handling PPP (Point to Point Protocol) and proprietary protocols to enable TCP/IP connection to a remote router; and a Network Services Platform to provide local community facilities such as: DNS servers, e-mail servers, cache memory, NNTP (News) services, Proxy servers and Firewall services. The remote site part of the apparatus comprises: a Web server, router,data communications equipment, Voice over IP hardware and software; Video hardware and software; Network Interface Module (s) and software; and various software tools for diagnostics, monitoring, Dial Up Networking and Website editing. Further functionality includes: The ability to provide secure co-located e-commerce Websites connected into a Local Area Network to provide integrated e-commerce solutions and real-time connection to internal databases via ODBC connectivity. Outbound multi-user access the Internet on-demand, and e-mail services. Secure virtual private networking on-demand for Voice over IP, Video, and 'Whiteboard' conferencing. Connection and access by mobile GSM phones to the Internet; corporate databases and order entry systems via the on-demand connection apparatus.

Method and system for securing data objects

Abstract: A method and system are disclosed for securing primarily private e-mail that can be conveyed to and from a user via an open network such as the Internet. Essentially, the e-mail messages are encrypted with a secure digital envelope type protocol which can be based on the use of digital certificates. An example of such a digital envelope encryption protocol is the S/MIME protocol. As such, a domain-to-user security relationship is used instead of a user-to-user or domain-to-domain security relationship. For example, a mobile radiotelephone user of a corporate network (22) can have certain incoming e-mail forwarded to an external mail server (16) (e.g., in the Internet). The mail to be forwarded is first encrypted into a secure digital envelope format (e.g., S/MIME format) with the user's secret key. Consequently, the protected e-mail from the corporate network (22) can be forwarded to the user via the external mail server (16) (e.g., in the Internet) without compromising security.

Design and evaluation of a high-performance ATM firewall switch and its applications

Abstract: We present the design of a value-added ATM switch that is capable of performing packet-level (IP) filtering at the maximum throughput of 2.88 Gbit/s per port. This firewall switch nicely integrates the IP level security mechanisms into the hardware components of an ATM switch so that most of the filtering operations are performed in parallel with the normal cell processing, and most of its cost is absorbed into the base cost of the switch. The firewall switch employs the concept of "last cell hostage" (LCH) to avoid or reduce the latency caused by filtering. We analyze in detail the performance of the firewall switch in terms of the throughput and the latency and address related design issues. Applications of our firewall switch as Internet and intranet security solutions are also discussed.

Application of virtual private networking technology to standards-based management protocols across heterogeneous firewall-protected networks

Abstract: There has been tremendous growth within DoD of enterprise-wide COTS-based messaging and communications systems, including the Defense Message System, the Global Command and Control System, and the Global Combat Support System. To economize on development costs, standards-based protocols-including SMTP, SNMP, FTP, Telnet, and HTTP-are used to implement the underlying functionality of these systems, including messaging and service management. Vulnerabilities in such standards-based protocols have been identified, and security over the Internet and its connected systems has become an ever-increasing concern. Network security policies have been created to address the dilemma of protecting local systems from external attack while permitting easy communications between authorized parties. A burgeoning industry of firewall manufacturers has arisen to meet the challenge of implementing these policies effectively, safely, and reliably. Virtual private networking (VPN) technology was developed to enable separate firewall-protected enclaves to safely exchange data over unsecured networks. This technology is still maturing and standardized-using IPSec, ISAKMP, and DES encryption-to enable separate VPN implementations to interoperate over shared networks. This paper studies how virtual private networking technology can be employed to protect the use of standards-based service management protocols-including FTP, Telnet, SNMP, and NTP-across heterogeneous firewall-protected networks, balancing the requirements of enterprise service management with the need for local-level network security.

A proxy approach to e-mail security

Abstract: New Internet applications and new releases of existing Internet applications appear with bewildering rapidity. Adding functionality to such applications can therefore be a time-consuming process. By contrast, Internet protocols are significantly less volatile. In some circumstances, the additional functionality can be provided by ‘tapping into’ the protocol exchanges rather than modifying the applications themselves. We claim that this represents a more manageable approach to the problem of adding additional facilities to applications. We demonstrate this approach using the example of e-mail security. Whenever possible, a proxy sitting between a mail client and server signs and encrypts outgoing mail. Incoming secured mail is automatically decrypted and verified. This means that any software that works with standard mail protocols gains security without requiring separate upgrading. The proxy attempts to keep the amount of user interaction required to a minimum providing security functionality for users without the need to learn a complex new user interface.Copyright © 1999 John Wiley & Sons, Ltd.

RBAC on the Web by Secure Cookies

Abstract: Current approaches to access control on Web servers do not scale to enterprise-wide systems, since they are mostly based on individual users. Therefore, we were motivated by the need to manage and enforce the strong access control technology of RBAC in large-scale Web environments. Cookies can be used to support RBAC on the Web, holding users’ role information. However, it is insecure to store and transmit sensitive information in cookies. Cookies are stored and transmitted in clear text, which is readable and easily forged. In this paper, we describe an implementation of Role-Based Access Control with role hierarchies on the Web by secure cookies. Since a user’s role information is contained in a set of secure cookies and transmitted to the corresponding Web servers, these servers can trust the role information in the cookies after cookie-verification procedures and use it for role-based access control. In our implementation, we used CGI scripts and PGP (Pretty Good Privacy) to provide security services to secure cookies. The approach is transparent to users and applicable to existing Web servers and browsers.

JAVA 2 Network Security

Abstract: From the Book: PREFACE: Preface Java is fashionable, but is it reliable? Java is entertaining, but is it secure? Java is useful, but is it safe? The purpose of this book is to answer those questions, from the point of view of people who want to use Java, but want to do so reliably, securely and safely. That makes this book different from much recent writing on Java, which focuses, perfectly legitimately, on how a Java system can be broken into and how to avoid those dangers. On the contrary, this book focuses on how Java can be made secure and how to exploit its strengths. The goal is to provide practical help to the various groups involved in making a Java-based application or Web site into an industrial-strength commercial proposition. Various groups have different needs and different skills, which this book meets in its different parts. The first part is aimed at the intelligent non-specialist who oversees system management or application development, or incorporates Java into the security policy. Only a basic understanding of computers and a limited exposure to Java is assumed, but all the themes of Java security are introduced in a context that stresses over and over again how Java security must be seen as an integral part of system security. The second part goes into more detail on how Java security works, and is aimed more at system and network administrators and programmers, who need to know more of what is going on. The third part looks at the broader context in which Java operates, including some extensions to Java security and some aspects of its future. This book explains the evolution of the Java security model, andthenfocuses on the Java 2 security architecture and its revolutionary domains of protection. It offers a very large number of examples to give you a better understanding of the technology involved. The Team That Wrote This Redbook This redbook was produced by a team of specialists from around the world working at the International Technical Support Organization Raleigh Center.The leader of this project was Marco Pistoia. Marco Pistoia is a Network Security Specialist, working as a project leader at the International Technical Support Organization, Raleigh Center. He writes extensively and teaches IBM classes worldwide on all areas of the e-business Application Framework, WebSphere, Java and Internet security. Marco holds a degree with honors in Pure Mathematics from the University of Rome and a masters degree in Computer Science. Before joining the ITSO, he was a System Engineer in IBM Italy. He received an Outstanding Technical Achievement Award in 1996. Duane F. Reller is a Senior Software Engineer in the System/390 Programming Laboratory in Endicott, New York, USA. He has 25 years of experience in System/390 Hardware and Software development. He has served in technical and management positions. He holds a Bachelor's degree in Electrical Technology and a Master of Science degree in Computer Science from the State University of New York at Binghamton. His areas of expertise include Hardware and Software System's Architecture and Management. Deepak Gupta is a Senior Software Engineer in IBM, India. He has two and a half years of experience in Internet technologies. He holds a degree in Electronics and Communications from the University of Roorkee, India. His areas of expertise include Internet security and Electronic Commerce. Deepak was involved in IBM India's largest e-Commerce project and in India's first secured e-Commerce site allowing Rupee-based transactions, for which he was conferred the Employee of the Month Award. He has also given several talks on Internet security and e-Commerce. Milind Nagnur is a Senior Associate in the Operations and Systems Risk Management (OSRM) group of Price Waterhouse Coopers in Mumbai, India. He has a couple of years of exposure in Internet technologies, with emphasis on security and control issues in real business applications. He holds a degree in Mechanical Engineering from the Indian Institute of Technology in Bombay, India, and an MBA from the Indian Institute of Management in Calcutta, India.Ashok K. Ramani is a Senior Software Engineer in IBM India. He has two and a half years of experience in Internet technologies. He holds a degree in MSc.(Tech.) Information Systems from the Birla Institute of Technology and Science, Pilani, India. His areas of expertise include Internet security and Electronic Commerce. Ashok was involved in IBM India's largest e-Commerce project and in India's first secure e-Commerce site allowing Rupee-based transactions for which he was conferred the Employee of the Month Award. He has won special recognition awards at IBM India for his contribution to e-Commerce projects. He has also presented several talks on Internet security and e-Commerce. Comments Welcome Your comments are important to us! We want our redbooks to be as helpful as possible. Please send us your comments about this or other redbooks in one of the following ways: Fax the evaluation form found in "ITSO Redbook Evaluation" on page 713 to the fax number shown on the form. Use the online evaluation form found at ...

Cyberspace security management

Abstract: Through the tremendous growth of Internet users during the last few years, organizations now realize the potential market of the information highway. However, these organizations now face the problem of Internet security. The open environment of the Internet contributes greatly to its success, but also plants inherent security problems. Discusses the security frameworks implemented in the cyberspace environment and the current developments and future trends involving this issue.

Computer network intrusion detection, assessment and prevention based on security dependency relation

Abstract: An approach to detection, assessment and prevention of further intrusions of distributed intrusions in a computer network is presented. Our approach uses audit data from multiple network nodes and services. To achieve accurate results, inherent security relations among different network nodes should be considered. In our approach, the security dependency relation (SDR) is defined to describe these relations, and ripple effect analysis is used to detect, assess, and prevent intrusions based on SDRs. Agents are used to improve the scalability and efficiency of our approach.

Operating firewalls outside the LAN perimeter

Abstract: Firewalls are well known for their task of securing the enterprise intranet from untrusted users attempting to gain access. The concept of firewalls got its start when routers began to be used to balance network load. The effort to balance network traffic load at the transport level was extended to the server operating system where application proxy service and application level filtering is provided. Firewalls allow selected communications data to pass from one side of the corporate network perimeter to the other side. Since the firewall is the primary entry point to a corporate LAN from the Internet, the firewall frequently comes under attack by hackers and crackers. One form of attack is "denial-of-service". "Denial-of-service" attacks are easier to detect than are attacks that allow the attacker through the firewall on a valid password that they obtained by performing social engineering. Spamming the corporate email system is one form of "denial-of-service" attack, while many other forms simply flood the firewall with useless packets to prevent other authorized users from gaining access through the firewall. The paper presents a plan to place firewalls outside the corporate network boundaries, into the Internet. By having firewalls out in the Internet acting as agents for the corporations we expect to see attackers stopped closer to their source gateway. This changes the firewall task from a defensive mode to an offensive one. By having firewalls working together to seek out and locate or block the attacker at the source gateway, we gain several benefits. The paper proposes that the gateway protocol be modified to include this filtering function.

Internet and Intranet Security Management: Risks and Solutions

Abstract: Security Risk Assessment - a Cross-Industry Analysis Security and Data Protection on the Internet - a New Zealand Perspective Developing Trust for Electronic Commerce Managing Security Functions Using Security Standards Managing Security in the World Wide Web - Architecture and Techniques Where are the Traitors? Analysis of Traffic Cryptography - Protecting Confidentiality, Integrity and Availability of Data Foundations for Cryptography Development in Security Mechanism Standards Legal Aspects of Electronic Mail in Public Organizations Protecting Personal Privacy in Cyberspace - Principles and Problems with the New Zealand Privacy Act 1993.

Security issues in Internet protocols over satellite links

Abstract: Security is an important issue in IP over satellite, since an attacker can easily intercept such communication and can even corrupt the transmitted data. In the first part of the paper we address the implications of optimizing the transport control protocol (TCP) on the security services provided by the IPSec protocol suite. We provide a set of rules for optimizing TCP without interfering with IPsec. In the second part of the paper, we address IP multicast security issues. We also introduce an efficient key distribution algorithm that can handle a large dynamic group.

Implementation of Virtual Private Networks at the Transport Layer

Abstract: Virtual Private Network (VPN) solutions mainly focus on security aspects. Their main aims are to isolate a distributed network from outsiders and to protect the confidentiality and integrity of sensitive information traversing a non-trusted network such as the Internet. But when security is considered the unique problem, some collateral ones arise. VPN users suffer from restrictions in their access to the network. They are not free to use traditional Internet services such as electronic mail exchange with non-VPN users, and to access Web and FTP servers external to the organization. In this paper we present a new solution, located at the TCP/IP transport layer that, while maintaining strong security features, allows the open use of traditional network services. The solution does not require the addition of new hardware because it is an exclusively software solution. As a consequence, the application is totally portable. Moreover, the implementation is located at the transport layer; thus, there is no need to modify any software previously installed, like FTP, Telnet, HTTP, electronic mail or other network applications.

Essential ATM Standards: RFCs and Protocols Made Practical

Abstract: INTERNET STANDARDS Internet Email Standards Internet Standards and Internet Protocols Internet Standards Bodies The Internet Standards Process Getting the RFCs Reading the RFCs INTERNET MESSAGING STANDARDS Messaging Standards Internet Message Format Standard Multipurpose Internet Mail Extensions (MIME) Simple Mail Transfer Protocol (SMTP) Post Office Protocol (POP) Internet Message Access Protocol (IMAP) SMTP Message Address Resolution Network News Transfer Protocol (NNTP) vCard Calendaring and Scheduling Standards Internet Messaging Security The Future of Internet Messaging Appendices Index

A public key cryptography-based security enhanced mail gateway with the mailing list function

Abstract: When sending corporate secrets by electronic mail (e-mail), care must be taken to protect the security of the information against the various kinds of illicit manipulation that can occur on the Internet. We have developed a security enhanced mail gateway (SEMAIL) that ensures the privacy of e-mail messages without requiring users to install new software or learn complicated operating procedures. The SEMAIL system, in which an encryption program PGP (Pretty Good Privacy) is used, is available for both POP3-based Unix mails and PC-LAN-based ones.

Coordination of security levels for Internet architectures

Abstract: Internet systems provide a variety of ways for exchanging information, contain a large amount and variety of data, and have become quite complex, making them vulnerable to attacks from determined hackers. There are many products currently being used to stop these attacks but they suffer from a lack of completeness, only applying to one type of attack. Several mechanisms are needed for a comprehensive defense but this incurs the problem of their lack of coordination, which can be exploited for attacks. We propose a way to coordinate different mechanisms based on a unified object-oriented modeling approach and a hierarchical architecture whose layers define the scope of each security mechanism.

Communication apparatus and method

Abstract: If e-mail awaiting transmission from a client such as a personal computer or workstation exists when a connection has been made from a dial-up server such as an Internet service provider to the Internet via a PSTN or ISDN, the e-mail is transmitted to a mail server on the Internet. If e-mail to the client exists in a mail server on the Internet, this e-mail is received and then forwarded.

Using public-key infrastructures for security and risk management

Abstract: Companies around the world are embracing electronic commerce, and within two years this long-heralded yet largely unrealized "killer application" for the Internet is poised for an explosive 300 percent growth, according to Deloitte Consulting's 1998 Global Survey of Chief Information Executives. Security is an essential ingredient in enabling these electronic transactions. The fundamental requirements are to identify and authenticate the parties involved, and to protect the information from compromise. This article describes the elements of public-key infrastructures (PKIs), and show how they are well suited to provide these security services. The pioneering experience of Scotiabank, an early adopter of PKI technology and operator of one of the largest deployed PKIs on the Internet, is outlined.

Firewall basics

Abstract: Every connection between a local network and the WAN respective Internet offers security risks. The intention of the article is to give a shortcut about the basics for protection, from the definition up to firewall implementation.