CLOUD STRIFE. Mitigating the Security Risks of Domain-Validated Certificates
|
|
- Joseph Boone
- 5 years ago
- Views:
Transcription
1 CLOUD STRIFE Mitigating the Security Risks of Domain-Validated Certificates Kevin Borgolte Tobias Fiebig Shuang Hao Christopher Kruegel Giovanni Vigna Applied Networking Research Workshop (ANRW 2018) / IETF 102
2
3 STALE DNS RECORDS AND IP ADDRESS RE-USE cloudstrife.seclab.cs.ucsb.edu How to migrate DNS gracefully? When to release ? TTL? Longer? What about failure and automatic scaling? Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018)!3
4 DOMAIN-VALIDATED CERTIFICATES Standard TLS certificate Trusted by major browsers and operating systems Credited for the rise in HTTPS adoption Cheap or free No identity verification Top SSL Issuers Let s Encrypt Comodo GeoTrust via Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018)!4
5 HTTP-BASED DOMAIN-VALIDATION 1 Request certificate Client 3 Host challenge at 2 Respond with challenge 4 Verify challenge ACME CA example.com Webserver If you control the host behind the domain, then you can prove domain ownership successfully. Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018)!5
6 IMPACT? Trusted TLS certificates (MitM) Malicious and remote code loading Subdomain attacks (no MX = A record) Spam & phishing (residual trust) Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018)!6
7 SCALE? How many active domains point to free IPs? Looking at cloud IP address (AWS, Azure) 1.6 million unique IPs, 14 million allocations 130 million unique domains >700,000 domains can be taken over within minutes by attacker Time Between Reoccurence (Seconds)log 2weeks 1week 1day 1hour 1min 10sec ap-southeast-2 ap-southeast-1 ap-south-1 ap-northeast-2 ap-northeast-1 ca-central-1 eu-west-2 eu-west-1 eu-central-1 sa-east-1 us-west-2 us-west-1 us-east-2 us-east-1 Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018) Availability Zone!7
8 CLOUD STRIFE Assume takeovers can and will happen in the future Major changes to DNS or deployment impractical Aim to prevent attacks higher up Focus on TLS services Leverage existing standards when possible Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018)!8
9 MITIGATING TAKEOVER ATTACKS HTTP, simple idea: HTTPS with trusted certificates domain-validated certificates HTTP Strict Transport Security HTTP Public Key Pinning deprecated since Chrome 67 Takeover attacks now require pinned certificate. Reduces takeover attacks to denial of service attacks. Doesn t work for SMTP etc. though Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018)!9
10 MITIGATING TAKEOVER ATTACKS HTTP, better idea: HTTPS with trusted certificates Prevent certificate issuance for domains (likely) taken over HTTP Strict Transport Security No trusted certificate = also works for SMTP etc. How do you prevent certificate issuance? Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018)!10
11 CERTIFICATE TRANSPARENCY LOGS Public append-only log for issued certificates Monitor for suspicious certificates Real-time(ish) audit trail In itself: Reactive: attacker s window of opportunity remains Must be actively monitored (by domain owners) Can be used for historic lookups Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018)!11
12 PREVENTIVE HTTP-BASED DOMAIN-VALIDATION 1 Request certificate 2 Check for existing certificates Client 4 Host challenge at 3 Respond with challenge 5 Verify challenge and existing certificate ACME CA CT Logs example.com Webserver 1 2 If an old certificate was found, require it to be current HTTPS certificate. Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018)!12
13 CLOUD STRIFE Prevents TLS certificates to be issued for takeovers No certificate = takeover attacks less useful (= DoS) Drawbacks for users only for disaster recovery Re-bootstrap chain of trust ACME validation challenge draft next? Kevin Borgolte Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates (ANRW 2018)!13
14 Thank you! Questions? seclab THE COMPUTER SECURITY GROUP AT UC SANTA BARBARA
DANE, why we need it. Daniel Stirnimann Bern, 29. March SWITCH 1
DANE, why we need it Daniel Stirnimann daniel.stirnimann@switch.ch Bern, 29. March 2017 2017 SWITCH 1 Why do we trust this website? 2017 SWITCH 2 Why do we trust this website? 1. DNS lookup for www.credit-suisse.com
More informationTrusted Identities. Foundational to Cloud Services LILA KEE CHIEF PRODUCT OFFICER GLOBALSIGN
Trusted Identities Foundational to Cloud Services LILA KEE CHIEF PRODUCT OFFICER GLOBALSIGN WHAT YOU WILL LEARN TODAY Strong identity verification as a security measure and business enabler Authentication
More informationSecurity+ SY0-501 Study Guide Table of Contents
Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators
More informationIn rdns We Trust Revisiting rdns Use by Clients on the Internet
In rdns We Trust Revisiting rdns Use by Clients on the Internet Tobias Fiebig 1,2,3, Kevin Borgolte 2, Shuang Hao 4, Christopher Kruegel 2, Giovanni Vigna 2, Anja Feldmann 3,5 1 TU Delft 2 UC Santa Barbara
More informationIBM SmartCloud Notes Security
IBM Software White Paper September 2014 IBM SmartCloud Notes Security 2 IBM SmartCloud Notes Security Contents 3 Introduction 3 Service Access 4 People, Processes, and Compliance 5 Service Security IBM
More informationCan HTTP Strict Transport Security Meaningfully Help Secure the Web? nicolle neulist June 2, 2012 Security B-Sides Detroit
Can HTTP Strict Transport Security Meaningfully Help Secure the Web? nicolle neulist June 2, 2012 Security B-Sides Detroit 1 2 o hai. 3 Why Think About HTTP Strict Transport Security? Roadmap what is HSTS?
More informationTwilio cloud communications SECURITY
WHITEPAPER Twilio cloud communications SECURITY From the world s largest public companies to early-stage startups, people rely on Twilio s cloud communications platform to exchange millions of calls and
More informationTitle: Planning AWS Platform Security Assessment?
Title: Planning AWS Platform Security Assessment? Name: Rajib Das IOU: Cyber Security Practices TCS Emp ID: 231462 Introduction Now-a-days most of the customers are working in AWS platform or planning
More informationIntroduction to the DANE Protocol
Introduction to the DANE Protocol ICANN 46 April 10, 2013 Internet Society Deploy360 Programme Providing real-world deployment info for IPv6, DNSSEC and other Internet technologies: Case Studies Tutorials
More informationUsing Trustwave SEG Cloud with Exchange Online
.trust Using Trustwave SEG Cloud with Exchange Online Table of Contents About This Document 1 1 Trustwave SEG Cloud for Anti-Malware with Exchange Online 2 2 Networking and DNS Setup 2 3 Provisioning Trustwave
More informationHow can we provide the devices with valid certificates?
How can we provide the devices with valid certificates? What kind of TLS server certificate should we adopt for the devices? https://github.com/httpslocal/usecases/blob/master/certificates.md A) Public
More informationWeb Application & Cloud Computing What are the new threats?
Web Application & Cloud Computing What are the new threats? David Calligaris OWASP Italy Day Cagliari, 19th October 2018 $: whoami Geek & Nerd Director Security Testing Automation Huawei Munich (DE) Former
More informationNigori: Storing Secrets in the Cloud. Ben Laurie
Nigori: Storing Secrets in the Cloud Ben Laurie (benl@google.com) April 23, 2013 1 Introduction Secure login is something we would clearly like, but achieving it practically for the majority users turns
More informationIn Certificates We Trust? Mark Piper Insomnia Security
In Certificates We Trust? Mark Piper Insomnia Security Certificate Authorities A certificate authority (CA) is a trusted entity that issues electronic documents that verify a digital entity's identity
More informationHosting Roadmap Upgrades, Improvements and Changes
Hosting Roadmap 2014 Upgrades, Improvements and Changes Objectives First and Foremost : Uptime Denial of Service (DDoS) Attack Mitigation Mitigate Hacking Attempts Eliminate Media Outages (95% of the data)
More informationDistributed Authenticated Mappings DINRG IETF-101
Distributed Authenticated Mappings DINRG IETF-101 Sydney Li 1, Colin Man 2, Jean-Luc Watson 2 1 Electronic Frontier Foundation, 2 Stanford University I. Authenticated Mappings What s broken? Problem Private
More informationLayer Security White Paper
Layer Security White Paper Content PEOPLE SECURITY PRODUCT SECURITY CLOUD & NETWORK INFRASTRUCTURE SECURITY RISK MANAGEMENT PHYSICAL SECURITY BUSINESS CONTINUITY & DISASTER RECOVERY VENDOR SECURITY SECURITY
More informationInnovative uses as result of DNSSEC
Innovative uses as result of DNSSEC AKA: Some happenings in the DANE* WG in the IETF. * DNS-based Authentication of Named Entities Some background... When you connect to https://www.example.com you use
More informationSecuring, Protecting, and Managing the Flow of Corporate Communications
Securing, Protecting, and Managing the Flow of Corporate Communications Getting mailflow right Dave Stork Technical Consultant OGD ict-diensten QR: URL to Presentation Who am I? Dave Stork Technical consultant
More informationPractical Issues with TLS Client Certificate Authentication
Practical Issues with TLS Client Certificate Authentication Arnis Parsovs February 26, 2014 1 / 10 Motivation 2 / 10 Motivation Problems with password authentication: 2 / 10 Motivation Problems with password
More informationExtensions to ACME for (TLS, S/MIME)
Extensions to ACME for email (TLS, S/MIME) draft-ietf-acme-email-tls-02 draft-ietf-acme-email-smime-01 Alexey Melnikov, Isode Ltd 1 Changes in draft-ietf-acme-emailtls-02 since Prague Removed TLS SNI challenge,
More informationStep 1 - Set Up Essentials for Office 365
For each Barracuda Cloud Control account, you can have either a linked Barracuda Email Security Gateway appliance or a Barracuda Email Security Service subscription. You cannot use a single Barracuda Cloud
More informationScan Report Executive Summary
Scan Report Executive Summary Part 1. Scan Information Scan Customer Company: Date scan was completed: Vin65 ASV Company: Comodo CA Limited 11/20/2017 Scan expiration date: 02/18/2018 Part 2. Component
More informationDANE Best Current Practice
DANE Best Current Practice draft-dukhovni-dane-ops-01 Viktor Dukhovni & Wes Hardaker IETF 87, Berlin July 2013 General DANE Guidelines (Type Independent) Large DNS payload issues Issues with large UDP
More informationDNSSEC Basics, Risks and Benefits
DNSSEC Basics, Risks and Benefits Olaf M. Kolkman olaf@ripe.net This presentation About DNS and its vulnerabilities DNSSEC status DNSSEC near term future DNS: Data Flow Registry/Registrar Provisioning
More informationDNSSEC Basics, Risks and Benefits
DNSSEC Basics, Risks and Benefits Olaf M. Kolkman olaf@ripe.net This presentation About DNS and its vulnerabilities DNSSEC status DNSSEC near term future DNS: Data Flow Registry/Registrar Provisioning
More informationMission Accomplished? HTTPS Security after DigiNotar
Mission Accomplished? HTTPS Security after DigiNotar Johanna Amann* Oliver Gasser* Quirin Scheitle* Lexi Brent Georg Carle Ralph Holz ICSI / LBL / Corelight Technical University of Munich Technical University
More informationWEBSCALE CONVERGED APPLICATION DELIVERY PLATFORM
SECURITY ANALYTICS WEBSCALE CONVERGED APPLICATION DELIVERY PLATFORM BLAZING PERFORMANCE, HIGH AVAILABILITY AND ROBUST SECURITY FOR YOUR CRITICAL WEB APPLICATIONS OVERVIEW Webscale is a converged multi-cloud
More informationManaging Certificates
CHAPTER 12 The Cisco Identity Services Engine (Cisco ISE) relies on public key infrastructure (PKI) to provide secure communication for the following: Client and server authentication for Transport Layer
More informationTHE BUSINESS VALUE OF EXTENDED VALIDATION
THE BUSINESS VALUE OF EXTENDED VALIDATION How Internet Browsers Support EV and Display Trusted Websites +1-888-690-2424 entrust.com Table of contents Introduction Page 3 Objectives Page 4 How to bring
More informationLet s Encrypt and DANE
Let s Encrypt and DANE CaribNOG 13 Barbados 18 Apr 2017 The Deploy360 Programme The Challenge: The IETF creates protocols based on open standards, but some are not widely known or deployed People seeking
More informationPublic Key Infrastructures
Public Key Infrastructures Ralph Holz Network Architectures and Services Technische Universität München November 2014 Ralph Holz: Public Key Infrastructures 1 Part 3: Proposals to enhance or replace X.509
More informationFireware-Essentials. Number: Fireware Essentials Passing Score: 800 Time Limit: 120 min File Version: 7.
Fireware-Essentials Number: Fireware Essentials Passing Score: 800 Time Limit: 120 min File Version: 7.0 http://www.gratisexam.com/ Fireware Essentials Fireware Essentials Exam Exam A QUESTION 1 Which
More informationPOA Bridge. Security Assessment. Cris Neckar SECUREWARE.IO
POA Bridge Security Assessment Cris Neckar SECUREWARE.IO Executive Summary The engagement team performed a limited scope, source code assessment of POA Network s POA Bridge. The purpose of this assessment
More informationKey Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
More informationKerio Cloud. Adam Bielawski. Cloud Hosted Enterprise-Class , Calendars, Contacts, Tasks, and Instant Messaging. Twitter LinkedIn Facebook
Kerio Cloud Cloud Hosted Enterprise-Class Email, Calendars, Contacts, Tasks, and Instant Messaging Twitter LinkedIn Facebook Presented by Adam Bielawski June 15, 2016 Why Kerio? Kerio provides safe, simple,
More informationWHITE PAPER. Authentication and Encryption Design
WHITE PAPER Authentication and Encryption Design Table of Contents Introduction Applications and Services Account Creation Two-step Verification Authentication Passphrase Management Email Message Encryption
More informationUsing Trustwave SEG Cloud with Cloud-Based Solutions
.trust Using Trustwave SEG Cloud with Cloud-Based Email Solutions Table of Contents About This Document 1 1 Trustwave SEG Cloud for Anti-Malware with Cloud-Based Email Solutions 2 2 Networking and DNS
More informationCertificate reputation. Dorottya Papp
Certificate reputation Dorottya Papp Motivation Verification on a digital certificate does not reveal important factors Is it a fake certificate? (Hash collision) Was it mistakenly issued? (Comodo scandal)
More informationGet the Most Out of GoAnywhere: Achieving Cloud File Transfers and Integrations
Get the Most Out of GoAnywhere: Achieving Cloud File Transfers and Integrations Today s Presenter Dan Freeman, CISSP Senior Solutions Consultant HelpSystems Steve Luebbe Director of Development HelpSystems
More informationConnecting to Mimecast
Page 1 of 5 0 KBID10577 Connecting to Mimecast Congratulations and welcome to Mimecast! Thank you for making the choice to move your email management to the cloud with the Mimecast Unified Email Management
More informationScan Report Executive Summary
Scan Report Executive Summary Part 1. Scan Information Scan Customer Company: Date scan was completed: Vin65 ASV Company: Comodo CA Limited 08/28/2017 Scan expiration date: 11/26/2017 Part 2. Component
More informationCryptography SSL/TLS. Network Security Workshop. 3-5 October 2017 Port Moresby, Papua New Guinea
Cryptography SSL/TLS Network Security Workshop 3-5 October 2017 Port Moresby, Papua New Guinea 1 History Secure Sockets Layer was developed by Netscape in 1994 as a protocol which permitted persistent
More informationIntroduction to the DANE Protocol And Updates From IETF 88
Introduction to the DANE Protocol And Updates From IETF 88 Dan York, Senior Content Strategist Internet Society ICANN 48, Buenos Aires, Argentina November 20, 2013 A Quick Overview of DANE www.internetsociety.org
More informationMeasuring Adoption of Security Additions to the HTTPS Ecosystem
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Measuring Adoption of Security Additions to the HTTPS Ecosystem Quirin Scheitle July 16, 2018 Applied
More informationStep 1 - Set Up Essentials for Office 365
The standalone Office 365 Standalone Email Security option is available for purchase only through the Barracuda Self-Service Gateway or Barracuda MSP. This article assumes you are deploying Barracuda Services
More informationCitiDirect BE Portal Security, technical requirements and configuration
CitiDirect BE Portal Security, technical requirements and configuration CitiService CitiDirect BE Helpdesk tel. 801 343 978, +48 22 690 15 21 Monday to Friday; 8:00 17:00 helpdesk.ebs@citi.com www.citihandlowy.pl
More informationSecurity & Privacy. Web Architecture and Information Management [./] Spring 2009 INFO (CCN 42509) Contents. Erik Wilde, UC Berkeley School of
Contents Security & Privacy Contents Web Architecture and Information Management [./] Spring 2009 INFO 190-02 (CCN 42509) Erik Wilde, UC Berkeley School of Information Abstract 1 Security Concepts Identification
More informationIn Log We Trust: Revealing Poor Security Practices with Certificate Transparency Logs and Internet Measurements
Chair of Network Architectures and Services Department of Informatics Technical University of Munich In Log We Trust: Revealing Poor Security Practices with Certificate Transparency Logs and Internet Measurements
More informationSSL / TLS. Crypto in the Ugly Real World. Malvin Gattinger
SSL / TLS Crypto in the Ugly Real World Malvin Gattinger 2016-03-17 SSL/TLS Figure 1: The General Picture SSL or TLS Goal: Authentication and Encryption Secure Sockets Layer SSL 1 (never released), 2 (1995-2011)
More informationAccess Control. Access Control Overview. Access Control Rules and the Default Action
The following topics explain access control rules. These rules control which traffic is allowed to pass through the device, and apply advanced services to the traffic, such as intrusion inspection. Overview,
More informationHow to configure Sophos for all other clients
How to configure Sophos Email for all other clients 1. Add Your Domain & Verify Ownership 2. Add Mailboxes to Sophos Email 3. Restrict Delivery to Sophos IP Addresses 4. Modify MX records to point to Sophos
More informationOffice 365 Integration Guide Software Version 6.7
rat Office 365 Integration Guide Software Version 6.7 Guide Version 6.7.061418 Comodo Security Solutions 1255 Broad Street Clifton, NJ 07013 Table of Contents 1 Introduction...3 1.1 Email Flow Explanation...3
More informationGood Fences Make Good Neighbors: Rethinking Your Cloud Selection Strategy
Good Fences Make Good Neighbors: Rethinking Your Cloud Selection Strategy SESSION ID: CSV-W01 Bryan D. Payne Director of Security Research Nebula @bdpsecurity Cloud Security Today Cloud has lots of momentum
More informationManaging Security While Driving Digital Transformation
Avivi Siman-Tov, Senior Product Manager AlgoSec Managing Security While Driving Digital Transformation Goals for today 01 02 03 Will my organization s applications be migrated to the cloud? Why or why
More informationbuilding an effective action plan for the Department of Homeland Security
Customer Guide building an effective action plan for the Department of Homeland Security Binding The recently issued directive from the Department of Homeland Security (DHS), Binding Operational Directive
More informationSecurity for the Cloud Era
Security for the Cloud Era Make the Most Out of Your Cloud Journey Fadhly Hassim Sales Engineer South East Asia & Korea Barracuda Networks Current Weather Situation Customer Provisions & Manage On-Premises
More informationBEST PRACTICES FOR PERSONAL Security
BEST PRACTICES FOR PERSONAL Email Security Sometimes it feels that the world of email and internet communication is fraught with dangers: malware, viruses, cyber attacks and so on. There are some simple
More informationCERTIFIED SECURE COMPUTER USER COURSE OUTLINE
CERTIFIED SECURE COMPUTER USER COURSE OUTLINE Page 1 TABLE OF CONTENT 1 COURSE DESCRIPTION... 3 2 MODULE-1: INTRODUCTION TO DATA SECURITY... 4 3 MODULE-2: SECURING OPERATING SYSTEMS... 6 4 MODULE-3: MALWARE
More informationSteal this Movie. Automatically Bypassing DRM Protection in Streaming Media Services
Steal this Movie Automatically Bypassing DRM Protection in Streaming Media Services Ruoyu Fish Wang 12, Yan Shoshitaishvili 1, Christopher Kruegel 1, Giovanni Vigna 1 1 UC Santa Barbara 2 Tsinghua Unversity
More informationVMworld disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no
LHC3296BUS OVH: Shields Up! Building a True Security Barrier in the Cloud Chris Romano, Principal Systems Engineer #VMworld #LHC3296BUS VMworld disclaimer This presentation may contain product features
More informationPlanning and Preparation. VMware Validated Design 4.0 VMware Validated Design for Remote Office Branch Office 4.0
VMware Validated Design 4.0 VMware Validated Design for Remote Office Branch Office 4.0 You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/ If you
More informationAdvanced Techniques for DDoS Mitigation and Web Application Defense
Advanced Techniques for DDoS Mitigation and Web Application Defense Dr. Andrew Kane, Solutions Architect Giorgio Bonfiglio, Technical Account Manager June 28th, 2017 2017, Amazon Web Services, Inc. or
More informationData Security & Operating Environment
Data Security & Operating Environment Version 1.0, Summer 2018 Last updated: June 21, 2018 https://www.kintone.com/contact/ Contents 1. Service Level Objective (SLO)... 1 2. Availability and Reliability...
More informationIntroduction and Overview. Why CSCI 454/554?
Introduction and Overview CSCI 454/554 Why CSCI 454/554? Get Credits and Graduate Security is important More job opportunities More research funds 1 Workload Five homework assignments Two exams (open book
More informationConsiderations for using short-term certificates
Considerations for using short-term certificates draft-nir-saag-star Yoav Nir Thomas Fossati Yaron Sheffer Toerless Eckert Why are we doing this? Lots of interest in short-term certificates In the standards
More informationSHA-1 to SHA-2. Migration Guide
SHA-1 to SHA-2 Migration Guide Web-application attacks represented 40 percent of breaches in 2015. Cryptographic and server-side vulnerabilities provide opportunities for cyber criminals to carry out ransomware
More informationApplied Open Source Intelligence OSINT. Not Just For Attackers David Mashburn All Rights Reserved
Applied Open Source Intelligence OSINT Not Just For Attackers 2019 David Mashburn All Rights Reserved David Mashburn, @d_mashburn SANS Certified Instructor GSE #157 Security mule Family guy 2 What is OSINT?
More informationOverview of SSL/TLS. Luke Anderson. 12 th May University Of Sydney.
Overview of SSL/TLS Luke Anderson luke@lukeanderson.com.au 12 th May 2017 University Of Sydney Overview 1. Introduction 1.1 Raw HTTP 1.2 Introducing SSL/TLS 2. Certificates 3. Attacks Introduction Raw
More informationSSL/TLS Server Test of grupoconsultorefe.com
SSL/TLS Server Test of grupoconsultorefe.com Test SSL/TLS implementation of any service on any port for compliance with PCI DSS requirements, HIPAA guidance and NIST guidelines. GRUPOCONSULTOREFE.COM FINAL
More informationA Federal Agency Guide to Complying with Binding Operational Directive (BOD) 18-01
Table of Contents Introduction... 2 Required Actions Overview... 2 Required Actions Email Security... 3 Required Actions Web Security... 9 Status of Implementation... 11 Roles and Responsibilities... 11
More informationSSL/TLS Server Test of
SSL/TLS Server Test of www.rotenburger-gruene.de Test SSL/TLS implementation of any service on any port for compliance with PCI DSS requirements, HIPAA guidance and NIST guidelines. WWW.ROTENBURGER-GRUENE.DE
More informationCrypto meets Web Security: Certificates and SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Crypto meets Web Security: Certificates and SSL/TLS Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
More informationEfficiently exposing apps on Kubernetes at scale. Rasheed Amir, Stakater
Efficiently exposing apps on Kubernetes at scale Rasheed Amir, Stakater Problem Kubernetes runs container workloads in Pods... but these are not automatically accessible outside the cluster What options
More informationHow to get a trustworthy DNS Privacy enabling recursive resolver
How to get a trustworthy DNS an analysis of authentication mechanisms for DNS s Willem Toorop NLnet Labs (presenter) Melinda Shore Fastly Benno Overeinder NLnet Labs DNS over TLS What are the actors, and
More informationAccess Control. Access Control Overview. Access Control Rules and the Default Action
The following topics explain access control rules. These rules control which traffic is allowed to pass through the device, and apply advanced services to the traffic, such as intrusion inspection. Overview,
More informationChapter 4: Networking and the Internet. Copyright 2015 Pearson Education, Inc.
Chapter 4: Networking and the Internet Chapter 4: Networking and the Internet 4.1 Network Fundamentals 4.2 The Internet 4.3 The World Wide Web 4.4 Internet Protocols 4.5 Security 4-2 Network Classifications
More informationA Free, Automated, and Open Certificate Authority. Josh Aas Co-Founder, Executive Director
A Free, Automated, and Open Certificate Authority Josh Aas Co-Founder, Executive Director What is HTTPS HTTPS is HTTP over a connection secured by TLS (used to be called SSL). It s how websites encrypt
More informationApril 24, 1998 Expires in six months. SMTP Service Extension for Secure SMTP over TLS. Status of this memo
HTTP/1.1 200 OK Date: Tue, 09 Apr 2002 00:24:41 GMT Server: Apache/1.3.20 (Unix) Last-Modified: Mon, 27 Apr 1998 14:31:00 GMT ETag: "2e9b64-31dd-354496a4" Accept-Ranges: bytes Content-Length: 12765 Connection:
More informationSecuring Internet Communication: TLS
Securing Internet Communication: TLS CS 161: Computer Security Prof. David Wagner March 11, 2016 Today s Lecture Applying crypto technology in practice Two simple abstractions cover 80% of the use cases
More informationIntroduction to SSL. Copyright 2005 by Sericon Technology Inc.
Introduction to SSL The cornerstone of e-commerce is a Web site s ability to prevent eavesdropping on data transmitted to and from its site. Without this, consumers would justifiably be afraid to enter
More informationMODERN WEB APPLICATION DEFENSES
MODERN WEB APPLICATION DEFENSES AGAINST DANGEROUS NETWORK ATTACKS Philippe De Ryck SecAppDev 2017 https://www.websec.be SETUP OF THE HANDS-ON SESSION I have prepared a minimal amount of slides Explain
More informationCAN MICROSOFT HELP MEET THE GDPR
CAN MICROSOFT HELP MEET THE GDPR REQUIREMENTS? Danny Uytgeerts Microsoft 365 TSP / P-Seller Privacy Consultant (certified DPO) Member of DPO-Pro (Professional association of Belgian DPOs) danny.uytgeerts@realdolmen.com
More informationWeb Security. New Browser Security Technologies
OWASP AppSec APAC 2013 The OWASP Foundation http://www.owasp.org Web Security New Browser Security Technologies Tobias Gondrom OWASP London OWASP Global Industry Committee Chair of IETF Web Security WG
More informationElastic Load Balancing
Elastic Load Balancing Deep Dive & Best Practices Mariano Vecchioli, Sr. Technical Account Manager AWS Michaela Kurkiewicz, Principal Service Manager Co-op Tina Howell, Platform Lead - Co-op June 28 th,
More informationClientNet. Portal Admin Guide
ClientNet Portal Admin Guide Document Revision Date: June 5, 2013 ClientNet Portal Admin Guide i Contents Introduction to the Portal... 1 About the Portal... 1 Logging On and Off the Portal... 1 Language
More informationLegacy of Heartbleed: MITM and Revoked Certificates. Alexey Busygin NeoBIT
Legacy of Heartbleed: MITM and Revoked Certificates Alexey Busygin busygin@neobit.ru NeoBIT Notable Private Key Leaks 2010 DigiCert Sdn Bhd. issued certificates with 512-bit keys 2012 Trustwave issued
More informationVidder PrecisionAccess
Vidder PrecisionAccess Transparent Multi-Factor Authentication June 2015 910 E HAMILTON AVENUE. SUITE 430. CAMPBELL, CA 95008 P: 408.418.0440 F: 408.706.5590 WWW.VIDDER.COM Table of Contents I. Overview...
More informationDNS Security. Wolfgang Nagele DNS Group Manager
DNS Security Wolfgang Nagele DNS Group Manager DNS: the Domain Name System Specified by Paul Mockapetris in 1983 Distributed Hierarchical Database Main purpose: Translate names to IP addresses Since then:
More informationMediaAUTH Draft Proposal
MediaAUTH Draft Proposal August 21, 2012 Contents 1 Introduction 2 2 Service & User Perspective 2 2.1 Login...................................... 2 2.2 Soft Login.................................... 3
More informationAUTHENTICATION AND LOOKUP FOR NETWORK SERVICES
Vol.5, No.1, pp. 81-90, 2014 doi: 10.7903/ijecs.1040 AUTHENTICATION AND LOOKUP FOR NETWORK SERVICES Daniel J. Buehrer National Chung Cheng University 168 University Rd., Min-Hsiung Township, Chiayi County,
More informationScan Report Executive Summary. Part 2. Component Compliance Summary Component (IP Address, domain, etc.):ekk.worldtravelink.com
Scan Report Executive Summary Part 1. Scan Information Scan Customer Company: Date scan was completed: Travolutionary ASV Company: Comodo CA Limited 10-03-2018 Scan expiration date: 01-01-2019 Part 2.
More informationSafeConsole On-Prem Install Guide
SafeConsole On-Prem Install Guide This guide applies to SafeConsole 5.0.5 Introduction This guide describes how to install a new SafeConsole server on Windows using the SafeConsole installer. As an option,
More informationLotus Protector Interop Guide. Mail Encryption Mail Security Version 1.4
Lotus Protector Mail Security and Mail Encryption Interop Guide Lotus Protector Interop Guide Mail Encryption 2.1.0.1 Mail Security 2.5.1 Version 1.4 Lotus Protector Mail Security and Mail Encryption Configuration
More informationKenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V3.0, MAY 2017 Multiple Layers of Protection Overview Password Salted-Hash Thank you
More informationOFF-PATH ATTACKS AGAINST PUBLIC KEY INFRASTRUCTURES. Markus Brandt, Tianxiang Dai, Elias Heftrig, Amit Klein, Haya Shulman, Michael Waidner
OFF-PATH ATTACKS AGAINST PUBLIC KEY INFRASTRUCTURES Markus Brandt, Tianxiang Dai, Elias Heftrig, Amit Klein, Haya Shulman, Michael Waidner 1 AGENDA Objectives Attacking Impact Mitigation Summary 2 AGENDA
More informationSecurity by Any Other Name:
Security by Any Other Name: On the Effectiveness of Provider Based Email Security Ian Foster, Jon Larson, Max Masich, Alex C. Snoeren, Stefan Savage, and Kirill Levchenko University of California, San
More informationCS 356 Internet Security Protocols. Fall 2013
CS 356 Internet Security Protocols Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5
More informationSupercharge Your SIEM: How Domain Intelligence Enhances Situational Awareness
Supercharge Your SIEM: How Domain Intelligence Enhances Situational Awareness Introduction Drowning in data but starving for information. It s a sentiment that resonates with most security analysts. For
More informationSecurity Best Practices. For DNN Websites
Security Best Practices For DNN Websites Mitchel Sellers Who am I? Microsoft MVP, ASPInsider, DNN MVP Microsoft Certified Professional CEO IowaComputerGurus, Inc. Contact Information msellers@iowacomputergurus.com
More information