Securing Home Networks with SPIN
|
|
|
- Willis Robinson
- 5 years ago
- Views:
Transcription
1 Securing Home Networks with SPIN Elmer Lastdrager SIDN Labs 31 May 2018
2 What is the IoT? A simple definition: Stuff that was not networked before
3 So, about that IoT
4 So, about that IoT
5 So, what to do about this? Better practices for manufacturers? Better (free) standard software libraries? International policy, regulation, and certification? Generate market demand for secure products? Quarantine bad actors at ISP level? Educate users? Empower users?
6 So, what to do about this? Better practices for manufacturers? Better (free) standard software libraries? International policy, regulation, and certification? Generate market demand for secure products? Quarantine bad actors at ISP level? Educate users? Empower users? Yes
7 So, what to do about this? Better practices for manufacturers? Better (free) standard software libraries? International policy, regulation, and certification? Generate market demand for secure products? Quarantine bad actors at ISP level? Educate users? Empower users: SPIN
8 The SPIN project at SIDN Labs Security and Privacy for In-home Networks Research and prototype of SPIN functionality: Visualising network traffic (Automatic) blocking of 'bad' traffic Allow 'good' traffic
9 The SPIN project at SIDN Labs Open source in-home router/ap software that 1. helps protect DNS operators (like SIDN!) and other service providers against IoT-powered DDoS attacks 2. helps end-users controls the security of their home networks
10 Architecture
11 Architecture Traffic capture MQTT server Router Traffic block Visualiser Stats MUD test Policy enforcer
12 Prototype built on OpenWRT Currently bundled with Valibox: Source at prototype 2, GL-Inet hardware
13 Running prototype: visualiser Shows DNS queries Shows data traffic User can block traffic based on source or destination In beta: Select device and download (live) pcap for selected device
14 Running prototype: visualiser Shows DNS queries Shows data traffic User can block traffic based on source or destination In beta: Select device and download (live) pcap for selected device
15 Core components Currently: OpenWRT/Linux kernel module (in C) - Captures and blocks traffic Initial aggregation User-space daemon (in C) - Further aggregation and enrichment of data Sends to MQTT daemon MQTT Daemon (Mosquitto) - Distributes traffic data to clients (mqtt/websockets) Sends commands back to router Several Clients - Visualiser (Javascript) Statistics tool (Lua) PoC MUD tool (Lua) PoC (hardcoded) 'bad behaviour' tool (Lua) Recent history storage (currently 10 minutes) (Lua)
16 Current research/prototype topics:
17 Profiles: Conceptual Still very much in the 'idea forming' stage
18 Profiles: Conceptual Still very much in the 'idea forming' stage
19 Profiles: Conceptual Still very much in the 'idea forming' stage
20 Profiles: Implementation: MUD? Manufacturer Usage Description (MUD) Draft at IETF JSON description of internet traffic that is or is not allowed from and to the device Translates almost directly to firewall rules Our work: Provide (additional) early implementation for testing Looking into automatic generation of basic profiles Looking into extending it (e.g. to add a bandwidth limitation) Looking into 'reverse' profiles (any device that matches profile X is infected with Y, think IDS rules) And more wildly: A way for users and companies to create and share device profiles (that improve manufacturer-provided ones)
21 Profiles: Implementation: MUD Subproject: Lua-MUD Small MUD library for Lua Tiny subset for now (and pretty much hardcoded) Lua-mud-0.1 (on luarocks and github) Working on full version. Master student working on traffic analysis for MUD And generation of profiles like mudgee Research question: how much can you deduce from observation?
22 Incident report system Problem: If ISP s do anything about bad traffic from their customers in the first place, it s generally a full quarantine of the customer.
23 Incident report system
24 Incident report system
25 Incident report system
26 Incident report system
27 Incident report system
28 Running prototype Small (Django) web application for reports Notification to router (poll or push) Router finds device in history Router blocks device
29 Anomaly detection General research topic: Can 'bad' behaviour be recognized? Perhaps by looking at historic behaviour of device? We keep a (short) history of device traffic Extending that into a framework for researchers to do anomaly detection Currently nothing to show yet, though.
30 Discussion/questions Try it out! Missing something? Any other questions or comments?
The SPIN project. Jelte Jansen SIDN Labs. 20 april 2018
The SPIN project Jelte Jansen SIDN Labs 20 april 2018 So, about that IoT What is the IoT? Wikipedia definition: The Internet of things (IoT) is the inter-networking of physical devices, vehicles (also
SECURE HOME GATEWAY PROJECT
SECURE HOME GATEWAY PROJECT - PROTOTYPE DEVELOPMENT IoT SECURITY FOCUSED IDEA & VISION CHALLENGES Lead by: Jacques Latour, CTO, CIRA Labs Canadian Internet Registration Authority Jacques.Latour [@] cira.ca
SECURE HOME GATEWAY PROJECT
SECURE HOME GATEWAY PROJECT ICANN63 BARCELONA OCTOBER 22, 2018 Jacques Latour, CTO, CIRA Labs Canadian Internet Registration Authority Jacques.Latour [@] cira.ca Today's home network and IoT products and
Computer Networks. Routing
Computer Networks Routing Topics Link State Routing (Continued) Hierarchical Routing Broadcast Routing Sending distinct packets Flooding Multi-destination routing Using spanning tree Reverse path forwarding
Growing DDoS attacks what have we learned (29. June 2015)
Growing DDoS attacks what have we learned (29. June 2015) Miloš Kukoleča AMRES milos.kukoleca@amres.ac.rs financed by the European Union from the START Danube Region Network protection Strict network policy
F5 Networks Configuring BIG-IP AFM v13: Advanced Firewall Manager
F5 Networks Configuring BIG-IP AFM v13: Advanced Firewall Manager COURSE OVERVIEW: This course uses lectures and hands-on exercises to give participants real-time experience in setting up and configuring
Using DNS Service for Amplification Attack
Using DNS Service for Amplification Attack Outline Use DNS service to achieve load balancing for a server cluster Carry out an amplification attack by taking advantage of DNS service Enforce firewall rules
The GenCyber Program. By Chris Ralph
The GenCyber Program By Chris Ralph The Mission of GenCyber Provide a cybersecurity camp experience for students and teachers at the K-12 level. The primary goal of the program is to increase interest
Tech Day Home Network Registry Idea
Tech Day Home Network Registry Idea Jacques Latour, CTO Canadian Internet Registration Authority October 30, 2017 1 Today s Home Network & IoT implementation are disparate, kind of scary & need structure!
Firewalls Network Security: Firewalls and Virtual Private Networks CS 239 Computer Software March 3, 2003
Firewalls Network Security: Firewalls and Virtual Private Networks CS 239 Computer Software March 3, 2003 A system or combination of systems that enforces a boundary between two or more networks - NCSA
An Aflac Case Study: Moving a Security Program from Defense to Offense
SESSION ID: TTA-F02 An Aflac Case Study: Moving a Security Program from Defense to Offense Tim Callahan SVP & Global Chief Security Officer Aflac Threat Landscape Security risks are growing at a faster
10x Increase Your Team s Effectiveness by Automating the Boring Stuff
SESSION ID: TTA-R02 10x Increase Your Team s Effectiveness by Automating the Boring Stuff Jonathan Trull Chief Cybersecurity Advisor Microsoft @jonathantrull Vidhi Agarwal Senior Program Manager Microsoft
INTRODUCTION: DDOS ATTACKS GLOBAL THREAT INTELLIGENCE REPORT 2015 :: COPYRIGHT 2015 NTT INNOVATION INSTITUTE 1 LLC
INTRODUCTION: DDOS ATTACKS 1 DDOS ATTACKS Though Denial of Service (DoS) and Distributed Denial of Service (DDoS) have been common attack techniques used by malicious actors for some time now, organizations
Improving IoT Security: the role of the manufacturer. Eliot Lear
Improving IoT Security: the role of the manufacturer Eliot Lear Introduction The latest IoT Growth Chart IoT Units Installed Base Grand Total 25b+ 3.8b 4.9b 6.4b 2014 2015 2016 2017 2018 2019 2020 Source:
Automated Response in Cyber Security SOC with Actionable Threat Intelligence
Automated Response in Cyber Security SOC with Actionable Threat Intelligence while its biggest weakness is lack of visibility: SOCs still can t detect previously unknown threats, which is a consistent
9 STEPS FOR FIGHTING AGAINST DDOS ATTACKS IN REAL-TIME.
9 STEPS FOR FIGHTING AGAINST DDOS ATTACKS IN REAL-TIME www.haltdos.com info@haltdos.com Slow network performance or a single website downtime can cause serious revenue damage to any online business, both
TALK. agalaxy FOR THUNDER TPS REAL-TIME GLOBAL DDOS DEFENSE MANAGEMENT WITH A10 DATA SHEET DDOS DEFENSE MONITORING AND MANAGEMENT
DATA SHEET agalaxy FOR THUNDER TPS DDOS DEFENSE MONITORING AND MANAGEMENT The A10 agalaxy management system is integrated with PLATFORMS the Thunder TPS (Threat Protection System) for DDoS protection.
Novetta Cyber Analytics
Know your network. Arm your analysts. Introduction Novetta Cyber Analytics is an advanced network traffic analytics solution that empowers analysts with comprehensive, near real time cyber security visibility
Backscatter A viable tool for threat of the past and today. Barry Raveendran Greene March 04, 2009
Backscatter A viable tool for threat of the past and today Barry Raveendran Greene March 04, 2009 bgreene@senki.org Agenda Backscatter: What is it? VzB s use with the Backscatter Traceback Technique. Using
ANALYSING RA/RD BIT USAGE IN ROOT SERVER TRAFFIC
ANALYSING RA/RD BIT USAGE IN ROOT SERVER TRAFFIC Jim Reid, RTFM LLP jim@rfc1035.com Mitigating Name Collision: ICANN s Approach If whatever.newtld appears in DITL data, just arrange for the name s to return
Artificial Intelligence Drives the next Generation of Internet Security
Artificial Intelligence Drives the next Generation of Internet Security Sam Lee Regional Director sam.lee@cujo.com Copyright 2017 CUJO LLC, All rights reserved. Artificial Intelligence Leads the Way Copyright
STUDENT LEARNING OUTCOMES Beacom College of Computer and Cyber Sciences
STUDENT LEARNING OUTCOMES Beacom College of Computer and Cyber Sciences Undergraduate Programs - Bachelor B.S. Computer Game Design Upon completion of the B.S. degree in Computer Game Design, students
First Look Showcase. Expanding our prevention, detection and response solutions. Marco Rottigni Chief Technical Security Officer, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 First Look Showcase Expanding our prevention, detection and response solutions Marco Rottigni Chief Technical Security Officer, Qualys, Inc. Secure Enterprise Mobility
Consumer Broadband Monitoring: A Proof-of-Concept
Consumer Broadband Monitoring: A Proof-of-Concept Luca Deri RIPE 53 - October 2006 1 A bit of history The purpose of TTM is to independently measure the performance parameters of the Internet
DEFENCE IN DEPTH HOW ANTIVIRUS, TRADITIONAL FIREWALLS, AND DNS FIREWALLS WORK TOGETHER
DEFENCE IN DEPTH HOW ANTIVIRUS, TRADITIONAL FIREWALLS, AND DNS FIREWALLS WORK TOGETHER D-Zone DNS Firewall 18-10-20171 EXECUTIVE SUMMARY Cyber attacks continue to grow at an alarming rate with ransomware
SharePoint 2013 Developer
SharePoint 2013 Developer Duration: 5 Days Overview Thorough education is key to working with SharePoint 2013 productively. This course guides you through essential 2013 elements, from pre-requisites to
Network Defenses 21 JANUARY KAMI VANIEA 1
Network Defenses KAMI VANIEA 21 JANUARY KAMI VANIEA 1 Similar statements are found in most content hosting website privacy policies. What is it about how the internet works that makes this statement necessary
Configuring Antivirus Devices
CHAPTER 9 Revised: November 11, 2007 Antivirus (AV) devices provide detection and prevention against known viruses and anomalies. This chapter describes how to configure and add the following devices and
Hacking TP-Link Devices. Fernando Gont
Hacking TP-Link Devices Fernando Gont About... Security Researcher and Consultant at SI6 Networks Published: 30 IETF RFCs 10+ active IETF Internet-Drafts Author of the SI6 Networks' IPv6 toolkit https://www.si6networks.com/tools/ipv6toolkit
Nippon-European Cyberdefense-Oriented Multilayer Threat Analysis (NECOMA Project)
Nippon-European Cyberdefense-Oriented Multilayer Threat Analysis (NECOMA Project) Director : Youki Kadobayashi Nara Institute of Science and Technology Presentator : Yuji Sekiya The University of Tokyo
IBM C IBM Security Network Protection (XGS) V5.3.2 System Administration.
IBM C2150-620 IBM Security Network Protection (XGS) V5.3.2 System Administration http://killexams.com/exam-detail/c2150-620 C. Use a Web application object with the stream/download action for the website
Cisco Security Manager 4.1: Integrated Security Management for Cisco Firewalls, IPS, and VPN Solutions
Data Sheet Cisco Security Manager 4.1: Integrated Security Management for Cisco Firewalls, IPS, and VPN Solutions Security Operations Challenges Businesses are facing daunting new challenges in security
Meeting 40. CEH Networking
Cyber@UC Meeting 40 CEH Networking If You re New! Join our Slack ucyber.slack.com SIGN IN! Feel free to get involved with one of our committees: Content, Finance, Public Affairs, Outreach, Recruitment
Improving IoT Security: the role of the manufacturer. Eliot Lear
Improving IoT Security: the role of the manufacturer Eliot Lear Introduction A View Through a Light Bulb Connected Spaces is a big deal Automated and efficient lighting Room assignment and scheduling Changing
Lesson 12 Lab Key Lab Exercises
Lab 1 Doing a Ping Test Lesson 12 Lab Key Lab Exercises The purpose of this lab is to familiarize the student with running a ping test. This lab will also help the student correctly interpret the results
Network Traffic Visibility and Anomaly October 27th, 2016 Dan Ellis
Network Traffic Visibility and Anomaly Detection @Scale: October 27th, 2016 Dan Ellis Introduction Network traffic visibility? Introduction Network traffic visibility? What data is available on your network
A proactive and collaborative DDoS mitigation strategy for the Dutch critical infrastructure
A proactive and collaborative DDoS mitigation strategy for the Dutch critical infrastructure Cristian Hesselman 1, Jeroen van der Ham 2, Roland van Rijswijk 3, Jair Santanna 2, Aiko Pras 2 1) SIDN Labs,
Measuring the IPv6 Internet by active DNS and HTTP measurements (work in progress)
Measuring the IPv6 Internet by active DNS and HTTP measurements (work in progress) emile.aben@ripe.net Early 21st centry http://www.ripe.net 1 The 2 Internets The IPv4 Internet The IPv6 Internet How are
Junos Security Bundle, JSEC & AJSEC
Junos Security Bundle, JSEC & AJSEC COURSE OVERVIEW: This bundle combines JSEC & AJSEC at a discounted rate. Please Contact SLI to purchase this bundle. This five-day course covers the configuration, operation,
Last time. Security Policies and Models. Trusted Operating System Design. Bell La-Padula and Biba Security Models Information Flow Control
Last time Security Policies and Models Bell La-Padula and Biba Security Models Information Flow Control Trusted Operating System Design Design Elements Security Features 10-1 This time Trusted Operating
Flow Measurement. For IT, Security and IoT/ICS. Pavel Minařík, Chief Technology Officer EMITEC, Swiss Test and Measurement Day 20 th April 2018
Flow Measurement For IT, Security and IoT/ICS Pavel Minařík, Chief Technology Officer EMITEC, Swiss Test and Measurement Day 20 th April 2018 What is Flow Data? Modern method for network monitoring flow
Anycast vs. DDoS: Evaluating Nov. 30
Anycast vs. DDoS: Evaluating Nov. 30 Giovane C. M. Moura 1, Ricardo de O. Schmidt 2, John Heidemann 3, Wouter B. de Vries 2, Moritz Müller 1, Lan Wei 3, Cristian Hesselman 1 1 SIDN Labs 2 University of
DoH and DoT experience. Ólafur Guðmundsson Marek Vavrusa
DoH and DoT experience Ólafur Guðmundsson Marek Vavrusa Announced April 1 st 2018 Our mission: to help build a better Internet. We use 1.1.1.1 and 1.0.0.1 (easy to remember) for our resolver. DNS resolver,
Virtual Networks: Host Perspective
Networks: Host Perspective IETF-77 Anaheim, CA Network Research Group March 23rd, 2010 Sunay Tripathi Sunay.Tripathi@Oracle.Com 1 Evolving ization Landscape Physical OS Hypervisor Server Server Server
An Introduction to Developing for Cisco Kinetic
An Introduction to Developing for Cisco Kinetic Krishna Chengavalli Technical Marketing Engineer IoT Software Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session
Denial of Service. Serguei A. Mokhov SOEN321 - Fall 2004
Denial of Service Serguei A. Mokhov SOEN321 - Fall 2004 Contents DOS overview Distributed DOS Defending against DDOS egress filtering References Goal of an Attacker Reduce of an availability of a system
2020: Time to Shutdown DDoS?
2020: Time to Shutdown DDoS? Stefano Vissicchio University College London @ Cosener s July 6th, 2018 2020: Time to Shutdown DDoS? Stefano Vissicchio NOT a security expert @ Cosener s July 6th, 2018 Isn
Windows Forensics Advanced
Windows Forensics Advanced Index: CF102 Description Windows Forensics - Advanced is the next step for forensics specialists, diving deeper into diverse processes on Windows OS serving computer investigators.
Authentication CS 4720 Mobile Application Development
Authentication Mobile Application Development System Security Human: social engineering attacks Physical: steal the server itself Network: treat your server like a 2 year old Operating System: the war
Data Plane Protection. The googles they do nothing.
Data Plane Protection The googles they do nothing. Types of DoS Single Source. Multiple Sources. Reflection attacks, DoS and DDoS. Spoofed addressing. Can be, ICMP (smurf, POD), SYN, Application attacks.
You will discuss topics related to ethical hacking, information risks, and security techniques which hackers will seek to circumvent.
IDPS Effectiveness and Primary Takeaways You will discuss topics related to ethical hacking, information risks, and security techniques which hackers will seek to circumvent. IDPS Effectiveness and Primary
COMPUTER NETWORKING LAB EXERCISES (TP) 4
Name 1: Name 2: Group number: COMPUTER NETWORKING LAB EXERCISES (TP) 4 IPV6 December 14, 2009 Abstract In this TP you will revisit some of the basic networking tools that were introduced in TP1, only this
An Aflac Case Study: Moving a Security Program from Defense to Offense
SESSION ID: CXO-W11 An Aflac Case Study: Moving a Security Program from Defense to Offense Tim Callahan SVP & Global CISO Aflac Threat Landscape Selected losses > 30,000 records (updated 10/15/16) Security
Denial of Service Protection Standardize Defense or Loose the War
Denial of Service Protection Standardize Defense or Loose the War ETSI : the threats, risk and opportunities 16th and 17th - Sophia-Antipolis, France By: Emir@cw.net Arslanagic Head of Security Engineering
Linux Clusters Institute: Monitoring
Linux Clusters Institute: Monitoring Nathan Rini -- National Center for Atmospheric Research (NCAR) nate@ucar.edu Kyle Hutson System Administrator for Kansas State University kylehutson@ksu.edu Why monitor?
Cyber Security Guidelines Distributed Denial of Service (DDoS) Attacks
Cyber Security Guidelines Distributed Denial of Service (DDoS) Attacks Version: 1.0 Author: Cyber Security Policy and Standards Document Published Date: March 2018 Table of Contents Version: 1.0 Page 1
Three interface Router without NAT Cisco IOS Firewall Configuration
Three interface Router without NAT Cisco IOS Firewall Configuration Document ID: 13893 Contents Introduction Prerequisites Requirements Components Used Conventions Configure Network Diagram Configurations
CNIT 121: Computer Forensics. 9 Network Evidence
CNIT 121: Computer Forensics 9 Network Evidence The Case for Network Monitoring Types of Network Monitoring Types of Network Monitoring Event-based alerts Snort, Suricata, SourceFire, RSA NetWitness Require
Distributed Systems. 29. Firewalls. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 29. Firewalls Paul Krzyzanowski Rutgers University Fall 2015 2013-2015 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive data & systems not accessible Integrity:
Network Defenses KAMI VANIEA 1
Network Defenses KAMI VANIEA 26 SEPTEMBER 2017 KAMI VANIEA 1 First the news http://arstech nica.com/secu rity/2015/04/ meet-greatcannon-theman-in-themiddleweapon-chinaused-ongithub/ 2 First the news http://arstechni
How to Upload Device Data to a Remote Database Using the Log Upload Function
How to Upload Device Data to a Remote Database Using the Log Upload Function Contents Moxa Technical Support Team support@moxa.com 1 Introduction... 2 2 Application Scenario... 2 3 Prerequisites... 2 4
Magento Commerce Architecture and Security Model Last updated: Aug 2017
Magento Commerce Architecture and Security Model Last updated: Aug 2017 Architecture The Magento Commerce architecture is designed to provide a highly secure environment. Each customer is deployed into
Linux Clusters Institute: Monitoring. Zhongtao Zhang, System Administrator, Holland Computing Center, University of Nebraska-Lincoln
Linux Clusters Institute: Monitoring Zhongtao Zhang, System Administrator, Holland Computing Center, University of Nebraska-Lincoln Why monitor? 2 Service Level Agreement (SLA) Which services must be provided
Discovering Provisioning Domain Names and Data
Discovering Provisioning Domain Names and Data draft-bruneau-intarea-provisioning-domains-01 B. Bruneau, P. Pfister, D. Schinazi, T. Pauly, E. Vyncke Hosts and networks are multi-homed Just a few examples
Routing and router security in an operator environment
DD2495 p4 2011 Routing and router security in an operator environment Olof Hagsand KTH CSC 1 Router lab objectives A network operator (eg ISP) needs to secure itself, its customers and its neighbors from
Avanan for G Suite. Technical Overview. Copyright 2017 Avanan. All rights reserved.
Avanan for G Suite Technical Overview Contents Intro 1 How Avanan Works 2 Email Security for Gmail 3 Data Security for Google Drive 4 Policy Automation 5 Workflows and Notifications 6 Authentication 7
Distributed Cooperative Security Monitoring
Distributed Cooperative Security Monitoring Robin Sommer Lawrence Berkeley National Laboratory rsommer@lbl.gov http://www.icir.org/robin Cooperative Security Monitoring Internet sites monitor their network
Sharing is Caring: Improving Detection with Sigma
SANS Tactical Detection and Data Analytics Summit 2018 Sharing is Caring: Improving Detection with Sigma John Hubbard (@SecHubb) The Blue Team's Journey Sharing is Caring - John Hubbard @SecHubb 2 Blue
First Look Showcase. Expanding our prevention, detection and response solutions. Sumedh Thakar Chief Product Officer, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 First Look Showcase Expanding our prevention, detection and response solutions Sumedh Thakar Chief Product Officer, Qualys, Inc. Secure Enterprise Mobility Identity (X.509,
Multi-domain Internet Performance Sampling and Analysis Tools
Multi-domain Internet Performance Sampling and Analysis Tools Prasad Calyam, Ph.D., pcalyam@osc.edu Student Research Assistants: Jialu Pu, Lakshmi Kumarasamy ESCC/Internet2 Joint Techs, July 2010 Project
WHITE PAPER. Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale
WHITE PAPER Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale One key number that is generally
Tools, Techniques, and Methodologies: A Survey of Digital Forensics for SCADA Systems
Tools, Techniques, and Methodologies: A Survey of Digital Forensics for SCADA Systems Presenters: Rima Asmar Awad, Saeed Beztchi Co-Authors: Jared M. Smith, Stacy Prowell, Bryan Lyles Overview Supervisory
What is Distributed Denial of Service (DDoS)?
What is Distributed Denial of Service (DDoS)? Gregory Travis greg@iu.edu First, what is a Denial of Service? A denial of service is the deliberate or unintentional withholding of an expected service, utility,
HOW TO ANALYZE AND UNDERSTAND YOUR NETWORK
Handbook HOW TO ANALYZE AND UNDERSTAND YOUR NETWORK Part 3: Network Traffic Monitoring or Packet Analysis? by Pavel Minarik, Chief Technology Officer at Flowmon Networks www.flowmon.com In previous two
Layered Architecture
1 Layered Architecture Required reading: Kurose 1.7 CSE 4213, Fall 2006 Instructor: N. Vlajic Protocols and Standards 2 Entity any device capable of sending and receiving information over the Internet
RID IETF Draft Update
RID IETF Draft Update Kathleen M. Moriarty INCH Working Group 5 August 2004 This work was sponsored by the Air Force under Air Force Contract Number F19628-00-C-0002. "Opinions, interpretations, conclusions,
Intro to Niara. no compromise behavioral analytics. Tomas Muliuolis HPE Aruba Baltics Lead
Intro to Niara no compromise behavioral analytics Tomas Muliuolis HPE Aruba Baltics Lead THE SECURITY GAP SECURITY SPEND DATA BREACHES 146 days median time from compromise to discovery PREVENTION & DETECTION
Security in inter-domain routing
DD2491 p2 2011 Security in inter-domain routing Olof Hagsand KTH CSC 1 Literature Practical BGP pages Chapter 9 See reading instructions Beware of BGP Attacks (Nordström, Dovrolis) Examples of attacks
IPv6: Are we really ready to turn off IPv4? Geoff Huston APNIC
IPv6: Are we really ready to turn off IPv4? Geoff Huston APNIC The IPv6 Timeline 1990 2000 2010 2020 The IPv6 Timeline Yes, we ve been working on this for close to 30 years! 1990 2000 2010 2020 In-situ
Experiences in Setting Up Automatic Home Networking. Jari Arkko Ericsson Research
Experiences in Setting Up Automatic Home Networking Jari Arkko Ericsson Research 1 Background This is NOT about home gateway routers And NOT about ISPs and their IPv6 services But it IS about IPv6 networks
Avoiding Information Overload: Automated Data Processing with n6
Avoiding Information Overload: Automated Data Processing with n6 Paweł Pawliński pawel.pawlinski@cert.pl 26th annual FIRST conference Boston, June 23rd 2014 Who we are part of national CERT for Poland
Course Outline. Windows 7, Enterprise Desktop Support Technician LAB. Windows 7, Enterprise Desktop Support Technician LAB
Course Outline Windows 7, Enterprise Desktop Support Technician 13 Apr 2019 Contents 1. Course Objective 2. Expert Instructor-Led Training 3. ADA Compliant & JAWS Compatible Platform 4. State of the Art
Chapter 7. Denial of Service Attacks
Chapter 7 Denial of Service Attacks DoS attack: An action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units (CPU),
A MULTILAYERED SECURITY APPROACH TO KEEPING HEALTHCARE DATA SECURE
SESSION ID: SPO2-W12 A MULTILAYERED SECURITY APPROACH TO KEEPING HEALTHCARE DATA SECURE Frank Bunton VP, CISO MedImpact Healthcare Systems, Security @frankbunton Larry Biggs Security Engineer III - Threat
ANTIVIRUS SITE PROTECTION (by SiteGuarding.com)
ANTIVIRUS SITE PROTECTION (by SiteGuarding.com) USER GUIDE Version 0.1.0 1 Table of content 1. INTRODUCTION. 3 2. HOW IT WORKS.... 6 3. HOW TO CONFIGURE.. 7 2 1. INTRODUCTION Antivirus Site Protection
Configuring BIG-IP ASM v12.1 Application Security Manager
Course Description Configuring BIG-IP ASM v12.1 Application Security Manager Description The BIG-IP Application Security Manager course gives participants a functional understanding of how to deploy, tune,
SOTI SUMMER [state of the internet] / security ATTACK SPOTLIGHT
![SOTI SUMMER [state of the internet] / security ATTACK SPOTLIGHT](/thumbs/82/85290152.jpg "SOTI SUMMER [state of the internet] / security ATTACK SPOTLIGHT")
SOTI SUMMER 2018 [state of the internet] / security ATTACK SPOTLIGHT State of the Internet / Attack Spotlight ATTACK SPOTLIGHT Memcached 1.0 OVERVIEW Earlier this year, Akamai mitigated the largest DDoS
Needle in a Haystack. Improving Intrusion Detection Performance in University settings by removing good traffic to better focus on bad traffic
Needle in a Haystack Improving Intrusion Detection Performance in University settings by removing good traffic to better focus on bad traffic The Person Talking Paul Tatarsky paul@tatarsky.com Network
M2M / IoT Security. Eurotech`s Everyware IoT Security Elements Overview. Robert Andres
M2M / IoT Security Eurotech`s Everyware IoT Security Elements Overview Robert Andres 23. September 2015 The Eurotech IoT Approach : E2E Overview Application Layer Analytics Mining Enterprise Applications
Windows. Not just for houses
Windows Not just for houses Windows 110 Windows Server Essentially a jacked up windows 8 box Still GUI based Still makes no sense No start menu :( (Install classic shell)... trust me... Windows Server
Increase Threat Detection & Incident Response
Martin Rudd Carrier Scale Network Security: Increase Threat Detection & Incident Response www.telesoft-technologies.com copyright 2017 by Telesoft Technologies. All rights reserved. Agenda Brief bio Threat
Checklist for Evaluating Deception Platforms
Checklist for Evaluating Deception Platforms With over 700 reported breaches occurring annually, a modern day adaptive security defense requires a combination of prevention, detection, response, and prediction
DNS Traffic Sampling
DNS Traffic Sampling A HyperLogLog seasoned implementation for dnscap Madrid 2017-05-14 Alexander Mayrhofer Head of R&D DNS Sampling - Background Operational Monitoring of DNS traffic Practice of many
Cisco Security Monitoring, Analysis and Response System 4.2
Q&A Cisco Security Monitoring, Analysis and Response System 4.2 GENERAL Q. What is the Cisco Security Monitoring, Analysis and Response System? A. The Cisco Security Monitoring, Analysis and Response System
FIREWALL PROTECTION AND WHY DOES MY BUSINESS NEED IT?
WHAT IS FIREWALL PROTECTION AND WHY DOES MY BUSINESS NEED IT? While firewalls started life simply protecting networks from outside hacks and attacks, the role of the firewall has greatly evolved to take
CompTIA Exam JK0-023 CompTIA Network+ certification Version: 5.0 [ Total Questions: 1112 ]
![CompTIA Exam JK0-023 CompTIA Network+ certification Version: 5.0 [ Total Questions: 1112 ]](/thumbs/89/98129936.jpg "CompTIA Exam JK0-023 CompTIA Network+ certification Version: 5.0 [ Total Questions: 1112 ]")
s@lm@n CompTIA Exam JK0-023 CompTIA Network+ certification Version: 5.0 [ Total Questions: 1112 ] Topic break down Topic No. of Questions Topic 1: Network Architecture 183 Topic 3: Troubleshooting 140
KTH/CSC, RIP lab, rev: 1.13 KTH/CSC. RIP lab. Juniper version. Group Nr. Name1. Name2. Name3. Name4. Date. Grade. Instructor s Signature
KTH/CSC RIP lab Juniper version Group Nr Name1 Name2 Name3 Name4 Date Grade Instructor s Signature Table of Contents 1 Goals...3 2 Preparations...3 3 RIP in pairs...4 4 Simple policy-options...5 5 RIP
Detecting Internet Traffic Interception based on Route Hijacking
Detecting Internet Traffic Interception based on Route Hijacking Alberto Dainotti alberto@caida.org Center for Applied Internet Data Analysis University of California, San Diego Joint work with: Pavlos
Jaal: Towards Network Intrusion Detection at ISP Scale
Jaal: Towards Network Intrusion Detection at ISP Scale A. Aqil, K. Khalil, A. Atya, E. Paplexakis, S. Krishnamurthy, KK. Ramakrishnan University of California Riverside T. Jaeger Penn State University
From Managed Security Services to the next evolution of CyberSoc Services
From Managed Security Services to the next evolution of CyberSoc Services Gianluca Busco Arré Country Manager pandasecurity.com MSSP / MDR Where the Industry is going leaders and laggers MSSP industry