Don t Tread on Me: Moderating Access to OSN Data with SpikeStrip
|
|
|
- Tyrone Stevens
- 6 years ago
- Views:
Transcription
1 Don t Tread on Me: Moderating Access to OSN Data with SpikeStrip Christo Wilson, Alessandra Sala, Joseph Bonneau*, Robert Zablit, Ben Y. Zhao University of California, Santa Barbara *University of Cambridge
2 2 Problem: People Want Your Data from: to: date: subject: Birthday E-Cards Christo Wilson Monday, January 31, 2011 at 12:01 AM You got a Birthday E-Card! You ve received a Happy Birthday E-Card from Sandi Klopcic! Visit this link to view your card:
3 3 Big Data = Big Problems 450 Million 150 Million 70 Million Crawlers are actively collecting OSN data Pete Warden crawled 210 Million profiles crawls and sells OSN data to marketers offers crawling as a service (150K pages per $1) Yes, this includes researchers Many more emerging threats!
4 4 How Can the Crawlers Be Controlled? Users are unwilling/unable to defend themselves Privacy paradox paranoia vs. laziness Privacy conscious people (us) are the minority OSNs have notoriously difficult privacy settings OSNs must protect their users but how? Existing anti-crawler mechanisms are ineffective Designed in the mid 90s Broadband + botnets = massive, distributed crawlers More on this later New technology is necessary 9 pages 50 settings 170 options Image The New York Times
5 5 Introducing SpikeStrip Project goal: defend against malicious crawlers Seamless to end-users and beneficial crawlers Minimal impact on web server Compatible with existing technology SpikeStrip uses novel link-encryption primitive Used to track and rate-limit users Implement and evaluate SpikeStrip Can impose arbitrary slowdowns on rogue crawlers Only imposes 7% performance overhead on web server
6 6 Overview Existing Defenses (and why they don t work) Designing SpikeStrip Evaluation
7 7 Robots.txt File placed on web server that tells crawlers how to behave Problem: compliance is voluntary
8 8 HTTP Request Headers Filter requests based on HTTP Request Header information Problem: headers can be modified by clients HTTP Request GET /index.html HTTP/1.1 Host: User-Agent: Googlebot/2.1 Mozilla/5.0 Firefox/
9 9 IP Address Tracking Rate limit request on a per-ip basis Problem 1: NATs and Proxies
10 10 IP Address Tracking Rate limit request on a per-ip basis Problem 2: Botnets
11 11 Authenticated User Accounts OSNs require users to sign-up and log-in Ban user accounts that generate too much traffic Problem: URLs are session independent URL Queue User Accounts
12 12 Overview Existing Defenses (and why they don t work) Designing SpikeStrip Evaluation
13 13 Link-Encryption State of the art in crawler defense isn t enough URLs are still session independent Crawlers can switch accounts, share state between accounts Need a way to link URLs to clients Solution: server-side link-encryption Encrypt links using user s session key and server-side secret key Uniquely binds all served URLs to the user Link-encryption enables reliable per-session tracking Rate-limit sessions to throttle crawlers
14 14 Link-Encryption Example Session Key = XYZ789 Secret Key = ******** Get /index.html /SSA3OFLX7B9 /product.html /product.html /hf4%fjgg&zl Session Key = ABC123 <html> HTTP Not Forbidden Found Error <a Product href= info /product.html /SSA3OFLX7B9 and such. > Buy </html> this product</a> </html>
15 15 Implications of Link Encryption Consider a BFS on an OSN website Queued URLs are bound to session Prevents sessionswitching Frontier index.html Session Key = XYZ789 ABC123
16 16 Rate Tracking and Limiting Reliable tracking enables rate limiting Very tight limits no need to pad for NATs Enforcement drop requests, ban accounts, etc Challenge: Scaling to high volume OSN sites Solution: Counting Bloom Filters Often used in high-throughput network security contexts SpikeStrip uses d-left CBF fastest and most space efficient CBF variant
17 Summary New! 17 SpikeStrip Overview Link-encryption creates per-session views of the OSN URLs are unique within each view Binds URLs and clients Enables reliable client tracking Prevents bad behavior Crawlers can t switch sessions Distributed crawlers can t share URLs Enables strong rate-limiting Doesn t hinder normal users and useful crawlers Whitelist safe URLs using regex Whitelist IPs/domains of good crawlers
18 18 Overview Existing Defenses (and why they don t work) Designing SpikeStrip Evaluation
19 19 SpikeStrip Evaluation Questions: How much server overhead does SpikeStrip cause? Implemented SpikeStrip as an Apache 2 module 256-bit AES encryption, d-left CBF How effective is SpikeStrip at throttling crawlers? Created mock OSN called Fakebook Based on data from London 3.5 Million pages Typical LAMP setup (Linux, Apache, MySQL, Python) 10 load-balanced web servers, 1 DB
20 Time Per Request (µs) 20 SpikeStrip Micro-Benchmarks Handle Incoming Requests Process Outgoing HTML On average, SpikeStrip reduces Apache performance by 7% 0 Link Decryption Rate Limiting Link Encryption (0) Link Encryption (3) Link Encryption (10) Link Encryption (25)
21 % of Site Crawled 21 SpikeStrip vs. Crawlers Rate limit = 1000 requests per hour 0.25 Requests Per Second (RPS) Successfully 3.5 Million pages throttles in 3 hours crawlers Speed penalties can be made Each hour the request counters reset Crawl rate = 0.25 RPS * # of sessions arbitrarily harsh, depending ratelimiter parameters Complete Crawl 250 Session Keys 100 Session Keys Time (Hours)
22 22 Conclusion OSN users are defenseless against malicious crawlers It s up to OSNs to secure users data SpikeStrip uses novel link-encryption technique Overcomes traditional user tracking challenges Disambiguates users behind NATs/proxies Renders botnets ineffectual Minimal inconvenience for end-users SpikeStrip works in practice Imposes minimal overhead on server Successfully throttles crawlers Works with existing Apache setups
23 23 SpikeStrip for Apache 2.x is Open Source! Source code and benchmark tests available at
24 24 Why are OSNs so popular? Because everyone uses them! (Corollary: they have lots of data) Sharing and Socializing Convenience Games and Interaction
25 25 Existing Defenses Against Crawlers Passive Defenses Robots.txt HTTP Request Header Filtering Active Defenses Relies on identifying, tracking, and rate limiting clients Usually done by IP address Authentication Based Defenses Control access by authenticating users Use CAPTCHAs to control account creation Ban users who break the rules
26 26 Link Opacity Link-encryption makes links opaque bit.ly/bxrgmp facebook.com/secure/anvtr641z facebook.com/christowilson Not useful for security metadata allows disambiguation <a href= Christo Wilson s Profile </a>
27 27 Link Sharing Link-encryption makes it hard to share links Lots of web tech already does this Shopping carts AJAX Important pages to people important pages to crawlers Crawlers need friends lists and search results People want pictures Solution: permalinks en.wikipedia.org/wiki/facebook vs. en.wikipedia.org/w/index.php?title=facebook&oldid=
28 Time Per Request (S) 28 End-to-End Latency Apache with SpikeStrip Apache # of Requesting Threads 90ms of delay
29 29 Does SpikeStrip Ruin OSN Research? NO! SpikeStrip enables OSNs to set up controlled access channels for researchers i.e. *.ucsb.edu can crawl at rate X for Y days This arrangement benefits both parties Researchers can crawl in a secure way No need deal with account bans, etc OSNs can control who has access and their bandwidth allocation
Don t Tread on Me: Moderating Access to OSN Data with SpikeStrip
Don t Tread on Me: Moderating Access to OSN Data with SpikeStrip Christo Wilson, Alessandra Sala, Joseph Bonneau, Robert Zablit and Ben Y. Zhao Department of Computer Science, U. C. Santa Barbara, Santa
Approaches for application request throttling. Maarten
Approaches for application request throttling Maarten Balliauw @maartenballiauw 1 Who am I? Maarten Balliauw Antwerp, Belgium Developer Advocate, JetBrains Founder, MyGet AZUG Focus on web ASP.NET MVC,
PUBCRAWL: Protecting Users and Businesses from CRAWLers
PUBCRAWL: Protecting Users and Businesses from CRAWLers Grégoire Jacob 1,3, Engin Kirda 2, Christopher Kruegel 1, Giovanni Vigna 1 1 University of California, Santa Barbara / 2 Northeastern University
How to Make the Client IP Address Available to the Back-end Server
How to Make the Client IP Address Available to the Back-end Server For Layer 4 - UDP and Layer 4 - TCP services, the actual client IP address is passed to the server in the TCP header. No further configuration
CS 161 Computer Security
Paxson Spring 2017 CS 161 Computer Security Discussion 4 Week of February 13, 2017 Question 1 Clickjacking (5 min) Watch the following video: https://www.youtube.com/watch?v=sw8ch-m3n8m Question 2 Session
Web Crawling. Introduction to Information Retrieval CS 150 Donald J. Patterson
Web Crawling Introduction to Information Retrieval CS 150 Donald J. Patterson Content adapted from Hinrich Schütze http://www.informationretrieval.org Robust Crawling A Robust Crawl Architecture DNS Doc.
Enabling Performance & Stress Test throughout the Application Lifecycle
Enabling Performance & Stress Test throughout the Application Lifecycle March 2010 Poor application performance costs companies millions of dollars and their reputation every year. The simple challenge
Secure web proxy resistant to probing attacks
Technical Disclosure Commons Defensive Publications Series December 04, 2017 Secure web proxy resistant to probing attacks Benjamin Schwartz Follow this and additional works at: http://www.tdcommons.org/dpubs_series
DENIAL OF SERVICE VIA INTERNET OF THINGS DEVICES: ATTACK METHODOLOGIES AND MITIGATION TECHNIQUES
DENIAL OF SERVICE VIA INTERNET OF THINGS DEVICES: ATTACK METHODOLOGIES AND MITIGATION TECHNIQUES by RICHARD ROE Advisor Dr. Joshua Eckroth A senior research proposal submitted in partial fulfillment of
INTERNET ENGINEERING. HTTP Protocol. Sadegh Aliakbary
INTERNET ENGINEERING HTTP Protocol Sadegh Aliakbary Agenda HTTP Protocol HTTP Methods HTTP Request and Response State in HTTP Internet Engineering 2 HTTP HTTP Hyper-Text Transfer Protocol (HTTP) The fundamental
I was given the following web application: and the instruction could be found on the first page.
I was given the following web application: http://159.203.178.9/ and the instruction could be found on the first page. So, I had to find the path for the application that stores notes and try to exploit
CS101 Lecture 30: How Search Works and searching algorithms.
CS101 Lecture 30: How Search Works and searching algorithms. John Magee 5 August 2013 Web Traffic - pct of Page Views Source: alexa.com, 4/2/2012 1 What You ll Learn Today Google: What is a search engine?
Security and Privacy. SWE 432, Fall 2016 Design and Implementation of Software for the Web
Security and Privacy SWE 432, Fall 2016 Design and Implementation of Software for the Web Today Security What is it? Most important types of attacks Privacy For further reading: https://www.owasp.org/index.php/
Using the Cisco ACE Application Control Engine Application Switches with the Cisco ACE XML Gateway
Using the Cisco ACE Application Control Engine Application Switches with the Cisco ACE XML Gateway Applying Application Delivery Technology to Web Services Overview The Cisco ACE XML Gateway is the newest
OSN Attack Automated Identity Theft Attacks
OSN Attack Automated Identity Theft Attacks John LePage Department of Electrical & Computer Engineering Missouri University of Science and Technology jlpc5@mst.edu 9 November 2016 2014 John LePage Introduction
CS Paul Krzyzanowski
Computer Security 17. Tor & Anonymous Connectivity Anonymous Connectivity Paul Krzyzanowski Rutgers University Spring 2018 1 2 Anonymity on the Internet Often considered bad Only criminals need to hide
Corrigendum 3. Tender Number: 10/ dated
(A premier Public Sector Bank) Information Technology Division Head Office, Mangalore Corrigendum 3 Tender Number: 10/2016-17 dated 07.09.2016 for Supply, Installation and Maintenance of Distributed Denial
Screw You and the Script You Rode in On
Screw You and the Script You Rode in On David Byrne Managing Consultant dbyrne@trustwave.com Presented by: Charles Henderson Director, Application Security Services chenderson@trustwave.com Introductions
Robust Defenses for Cross-Site Request Forgery Review
Robust Defenses for Cross-Site Request Forgery Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka October 16, 2011 1 Introduction to the topic and the reason for the topic
SharePoint 2010 Technical Case Study: Microsoft SharePoint Server 2010 Enterprise Intranet Collaboration Environment
SharePoint 2010 Technical Case Study: Microsoft SharePoint Server 2010 Enterprise Intranet Collaboration Environment This document is provided as-is. Information and views expressed in this document, including
Metrics for Security and Performance in Low-Latency Anonymity Systems
Metrics for Security and Performance in Low-Latency Anonymity Systems Tor user Entry node Tor Network Middle node Exit node Bandwidth per node (kb/s) (log scale) 1e+01 1e+03 1e+05 Encrypted tunnel Web
Web, HTTP and Web Caching
Web, HTTP and Web Caching 1 HTTP overview HTTP: hypertext transfer protocol Web s application layer protocol client/ model client: browser that requests, receives, displays Web objects : Web sends objects
WEB SECURITY WORKSHOP TEXSAW Presented by Solomon Boyd and Jiayang Wang
WEB SECURITY WORKSHOP TEXSAW 2014 Presented by Solomon Boyd and Jiayang Wang Introduction and Background Targets Web Applications Web Pages Databases Goals Steal data Gain access to system Bypass authentication
Web Security. Course: EPL 682 Name: Savvas Savva
Web Security Course: EPL 682 Name: Savvas Savva [1] A. Barth and C. Jackson and J. Mitchell, Robust Defenses for Cross-Site Request Forgery, pub. in 15th ACM Conference, 2008. [2] L. Huang and A. Moshchuk
TeamViewer Security Statement
TeamViewer Security Statement 2017 TeamViewer GmbH, Last update: 05/2017 Target Group This document is aimed at professional network administrators. The information in this document is of a rather technical
Outline Key Management CS 239 Computer Security February 9, 2004
Outline Key Management CS 239 Computer Security February 9, 2004 Properties of keys Key management Key servers Certificates Page 1 Page 2 Introduction Properties of Keys It doesn t matter how strong your
Information Retrieval Spring Web retrieval
Information Retrieval Spring 2016 Web retrieval The Web Large Changing fast Public - No control over editing or contents Spam and Advertisement How big is the Web? Practically infinite due to the dynamic
Mobile Security Fall 2012
Mobile Security 14-829 Fall 2012 Patrick Tague Class #9 The Internet of Things Partial slide credit to L. Zoia and Y. Zhang Announcements If you haven't signed up for a Survey presentation (two teams,
TrafficDB: HERE s High Performance Shared-Memory Data Store Ricardo Fernandes, Piotr Zaczkowski, Bernd Göttler, Conor Ettinoffe, and Anis Moussa
TrafficDB: HERE s High Performance Shared-Memory Data Store Ricardo Fernandes, Piotr Zaczkowski, Bernd Göttler, Conor Ettinoffe, and Anis Moussa EPL646: Advanced Topics in Databases Christos Hadjistyllis
Announcements. me your survey: See the Announcements page. Today. Reading. Take a break around 10:15am. Ack: Some figures are from Coulouris
Announcements Email me your survey: See the Announcements page Today Conceptual overview of distributed systems System models Reading Today: Chapter 2 of Coulouris Next topic: client-side processing (HTML,
1-1. Switching Networks (Fall 2010) EE 586 Communication and. September Lecture 10
EE 586 Communication and Switching Networks (Fall 2010) Lecture 10 September 17 2010 1-1 Announcement Send me your group and get group ID HW3 (short) out on Monday Personal leave for next two weeks No
Towards Performance and Scalability Analysis of Distributed Memory Programs on Large-Scale Clusters
Towards Performance and Scalability Analysis of Distributed Memory Programs on Large-Scale Clusters 1 University of California, Santa Barbara, 2 Hewlett Packard Labs, and 3 Hewlett Packard Enterprise 1
When you don t want to lose your site s existing look and feel, you re
Bonus Chapter 2 Hosting Your Site In This Chapter Hosting at home (page) Giving your site a test Using tags on a page When you don t want to lose your site s existing look and feel, you re short on time,
Security and Privacy. Xin Liu Computer Science University of California, Davis. Introduction 1-1
Security and Privacy Xin Liu Computer Science University of California, Davis Introduction 1-1 What is network security? Confidentiality: only sender, intended receiver should understand message contents
BEST PRACTICES FOR PERSONAL Security
BEST PRACTICES FOR PERSONAL Email Security Sometimes it feels that the world of email and internet communication is fraught with dangers: malware, viruses, cyber attacks and so on. There are some simple
ESP Egocentric Social Platform
ESP Egocentric Social Platform T. J. Purtell, Ian Vo, Monica S. Lam With: Kanak Biscuitwala, Willem Bult, Dan Boneh, Ben Dodson, Steve Fan, and Frank Wang, Global Social Platforms Ideal for Meeting strangers
CSCI-1680 WWW Rodrigo Fonseca
CSCI-1680 WWW Rodrigo Fonseca Based partly on lecture notes by Sco2 Shenker and John Janno6 Administrivia HW3 out today Will cover HTTP, DNS, TCP TCP Milestone II coming up on Monday Make sure you sign
Managing Access to Web Applications
This chapter contains the following sections: Overview of, on page 1 Enabling the AVC Engine, on page 2 Policy Application Control Settings, on page 3 Controlling Bandwidth, on page 5 Controlling Instant
Resource Containers. A new facility for resource management in server systems. Presented by Uday Ananth. G. Banga, P. Druschel, J. C.
Resource Containers A new facility for resource management in server systems G. Banga, P. Druschel, J. C. Mogul OSDI 1999 Presented by Uday Ananth Lessons in history.. Web servers have become predominantly
pweb : A Personal Interface to the World Wide Web
pweb : A Personal Interface to the World Wide Web Presented by Reaz Ahmed School of Computer Science University of Waterloo Joint work with Shihabur Rahman Chowdhury, Alexander Pokluda, Md. Faizul Bari,
Performance Case Study
Performance Case Study @Fabian_Frank Yahoo! Search, Engineer Youthmedia.eu, Volunteer A Dynamic Website self-contained App self-contained App self-contained App node v0.4.x multi-core
PHP. MIT 6.470, IAP 2010 Yafim Landa
PHP MIT 6.470, IAP 2010 Yafim Landa (landa@mit.edu) LAMP We ll use Linux, Apache, MySQL, and PHP for this course There are alternatives Windows with IIS and ASP Java with Tomcat Other database systems
High Availability/ Clustering with Zend Platform
High Availability/ Clustering with Zend Platform David Goulden Product Manager goulden@zend.com Copyright 2007, Zend Technologies Inc. In this Webcast Introduction to Web application scalability using
Around the Web in Six Weeks: Documenting a Large-Scale Crawl
Around the Web in Six Weeks: Documenting a Large-Scale Crawl Sarker Tanzir Ahmed, Clint Sparkman, Hsin- Tsang Lee, and Dmitri Loguinov Internet Research Lab Department of Computer Science and Engineering
Karaoke. Distributed Private Messaging Immune to Passive Traffic Analysis. David Lazar, Yossi Gilad, Nickolai Zeldovich
Karaoke Distributed Private Messaging Immune to Passive Traffic Analysis David Lazar, Yossi Gilad, Nickolai Zeldovich 1 Motivation: Report a crime without getting fired You re Fired if you talk to the
An introduction to the Internet. Joining a connected world
An introduction to the Internet Joining a connected world Agenda 1.! What do you already know about using the Internet? 2.! What is this thing called the World Wide Web? 3.! How the Internet works 4.!
HOW DOES A SEARCH ENGINE WORK?
HOW DOES A SEARCH ENGINE WORK? Hector says... Hi there! Did you know that the World Wide Web is made up of over a trillion web pages? That s more information than you d find in a really big library and
Computer Networks. Wenzhong Li. Nanjing University
Computer Networks Wenzhong Li Nanjing University 1 Chapter 8. Internet Applications Internet Applications Overview Domain Name Service (DNS) Electronic Mail File Transfer Protocol (FTP) WWW and HTTP Content
Do Social Networks Improve e-commerce? A Study on Social Marketplaces
Do Social Networks Improve e-commerce? A Study on Social Marketplaces 1 GAYATRI SWAMYNATHAN, CHRISTO WILSON, BRYCE BOE, KEVIN ALMEROTH AND BEN Y. ZHAO UC SANTA BARBARA Leveraging Online Social Networks
Web Application Firewall Subscription on Cyberoam UTM appliances
On-Appliance Reporting Web Application Firewall Subscription on Cyberoam UTM appliances Protecting Web Applications from hackers Application Visibility and Control Bandwidth Management Firewall Web Application
OWASP AppSec Research The OWASP Foundation New Insights into Clickjacking
New Insights into Clickjacking Marco `embyte` Balduzzi iseclab @ EURECOM embyte@iseclab.org AppSec Research 2010 Joint work with Egele, Kirda, Balzarotti and Kruegel Copyright The Foundation Permission
Bitcoin, Security for Cloud & Big Data
Bitcoin, Security for Cloud & Big Data CS 161: Computer Security Prof. David Wagner April 18, 2013 Bitcoin Public, distributed, peer-to-peer, hash-chained audit log of all transactions ( block chain ).
Cisco s Appliance-based Content Security: IronPort and Web Security
Cisco s Appliance-based Content Security: IronPort E-mail and Web Security Hrvoje Dogan Consulting Systems Engineer, Security, Emerging Markets East 2010 Cisco and/or its affiliates. All rights reserved.
Artificial Intelligence Super Medical Chain
2018.4.26 Aspiration Emerging technologies such as machine learning, big data analysis, and artificial intelligence, have put forward high requirements in computational overhead and high concurrency calculations.
Inferring the Source of Encrypted HTTP Connections. Michael Lin CSE 544
Inferring the Source of Encrypted HTTP Connections Michael Lin CSE 544 Hiding your identity You can wear a mask, but some distinguishing characteristics are visible: Height Weight Hair Clothing Even if
PYTHIA SERVICE BY VIRGIL SECURITY WHITE PAPER
PYTHIA SERVICE WHITEPAPER BY VIRGIL SECURITY WHITE PAPER May 21, 2018 CONTENTS Introduction 2 How does Pythia solve these problems? 3 Are there any other solutions? 4 What is Pythia? 4 How does it work?
Statistical Debugging for Real-World Performance Problems
Statistical Debugging for Real-World Performance Problems Linhai Song 1 and Shan Lu 2 1 University of Wisconsin-Madison 2 University of Chicago What are Performance Problems? Definition of Performance
18-642: Security Pitfalls
18-642: Security Pitfalls 4/18/2018 "On two occasions I have been asked [by members of Parliament]: 'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?' I am
Computer Security and Privacy
CSE P 590 / CSE M 590 (Spring 2010) Computer Security and Privacy Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for
Lecture 12. Application Layer. Application Layer 1
Lecture 12 Application Layer Application Layer 1 Agenda The Application Layer (continue) Web and HTTP HTTP Cookies Web Caches Simple Introduction to Network Security Various actions by network attackers
Crawling. CS6200: Information Retrieval. Slides by: Jesse Anderton
Crawling CS6200: Information Retrieval Slides by: Jesse Anderton Motivating Problem Internet crawling is discovering web content and downloading it to add to your index. This is a technically complex,
Authentication Provider - Facebook. Setup Guide
Authentication Provider - Facebook Setup Guide Disclaimer THIS DOCUMENTATION AND ALL INFORMATION CONTAINED HEREIN ( MATERIAL ) IS PROVIDED FOR GENERAL INFORMATION PURPOSES ONLY. GLOBAL REACH AND ITS LICENSORS
static phlapa.east.verizon.net /
The ICSI Netalyzr Beta Introduction» Analysis» Results Result Summary static-71-242-253-198.phlapa.east.verizon.net / 71.242.253.198 Recorded at 21:25 EDT (01:25 UTC next day) on Thu, August 27 2009. Permalink.
The Z-Files: Field reports from the world of business critical PHP applications
The Z-Files: Field reports from the world of business critical PHP applications By Axel Schinke Senior Manager of Global Operations for Global Services About this webinar Field reports from Zend Consulting
CNIT 129S: Securing Web Applications. Ch 3: Web Application Technologies
CNIT 129S: Securing Web Applications Ch 3: Web Application Technologies HTTP Hypertext Transfer Protocol (HTTP) Connectionless protocol Client sends an HTTP request to a Web server Gets an HTTP response
DIRECTORY INTEGRATION: USING ACTIVE DIRECTORY FOR AUTHENTICATION. Gabriella Davis The Turtle Partnership
DIRECTORY INTEGRATION: USING ACTIVE DIRECTORY FOR AUTHENTICATION Gabriella Davis The Turtle Partnership In This Session Review possible use cases for multiple directories Understand security implications
IIS Installation for.net Application. Md. Saifullah Al Azad
IIS Installation for.net Application Md. Saifullah Al Azad Contents 1 Mimimal... 2 1.1 Common HTTP Features... 2 1.1.1 Static Content... 2 1.1.2 Default Document... 2 1.2 Application Development... 2 1.2.1
Hypertext Transport Protocol HTTP/1.1
Hypertext Transport Protocol HTTP/1.1 Jim Gettys Digital Equipment Corporation, ISBU Visiting Scientist, World Wide Web Consortium 10/17/96 20-Apr-01 1 Acknowledgments HTTP/1.1 Authors Roy Fielding (UCI)
Crypto-systems all around us ATM machines Remote logins using SSH Web browsers (https invokes Secure Socket Layer (SSL))
Introduction (Mihir Bellare Text/Notes: http://cseweb.ucsd.edu/users/mihir/cse207/) Cryptography provides: Data Privacy Data Integrity and Authenticity Crypto-systems all around us ATM machines Remote
Scaling DreamFactory
Scaling DreamFactory This white paper is designed to provide information to enterprise customers about how to scale a DreamFactory Instance. The sections below talk about horizontal, vertical, and cloud
Backend IV: Authentication, Authorization and Sanitization. Tuesday, January 13, 15
6.148 Backend IV: Authentication, Authorization and Sanitization The Internet is a scary place Security is a big deal! TODAY What is security? How will we try to break your site? Authentication,
SharePoint 2010 Technical Case Study: Microsoft SharePoint Server 2010 Social Environment
SharePoint 2010 Technical Case Study: Microsoft SharePoint Server 2010 Social Environment This document is provided as-is. Information and views expressed in this document, including URL and other Internet
Introduction to Internetworking
Introduction to Internetworking Stefano Vissicchio UCL Computer Science COMP0023 Internetworking Goal: Connect many networks together into one Internet. Any computer can send to any other computer on any
CS47300: Web Information Search and Management
CS47300: Web Information Search and Management Web Search Prof. Chris Clifton 18 October 2017 Some slides courtesy Croft et al. Web Crawler Finds and downloads web pages automatically provides the collection
Positive Security Model for Web Applications, Challenges. Ofer Shezaf OWASP IL Chapter leader CTO, Breach Security
Positive Security Model for Web Applications, Challenges and Promise Ofer Shezaf OWASP IL Chapter leader CTO, Breach Security Introduction Breach Security, Inc. Breach Security is the market leader in
Security Architect Northeast US Enterprise CISSP, GCIA, GCFA Cisco Systems. BRKSEC-2052_c Cisco Systems, Inc. All rights reserved.
Web 2.0 Security Recommendations Ken Kaminski Security Architect Northeast US Enterprise CISSP, GCIA, GCFA Cisco Systems 1 Agenda Reputation Services Web application security Secure Coding and Web Application
CSCI-1680 WWW Rodrigo Fonseca
CSCI-1680 WWW Rodrigo Fonseca Based partly on lecture notes by Scott Shenker and John Jannotti Precursors 1945, Vannevar Bush, Memex: a device in which an individual stores all his books, records, and
Lecture 11: Middleboxes and NAT (Duct tape for IPv4)
CSCI-351 Data communication and Networks Lecture 11: Middleboxes and NAT (Duct tape for IPv4) The slide is built with the help of Prof. Alan Mislove, Christo Wilson, and David Choffnes's class Middleboxes
Who We Are.. ideras Features. Benefits
:: Protecting your infrastructure :: Who We Are.. ideras Features Benefits Q&A Infosys Gateway Sdn Bhd. Incorporated in 2007 Bumiputra owned Company MSC Status Company Registered with Ministry of Finance
86% of websites has at least 1 vulnerability and an average of 56 per website WhiteHat Security Statistics Report 2013
Vulnerabilities help make Web application attacks amongst the leading causes of data breaches +7 Million Exploitable Vulnerabilities challenge organizations today 86% of websites has at least 1 vulnerability
HTTP Protocol and Server-Side Basics
HTTP Protocol and Server-Side Basics Web Programming Uta Priss ZELL, Ostfalia University 2013 Web Programming HTTP Protocol and Server-Side Basics Slide 1/26 Outline The HTTP protocol Environment Variables
CISCO NETWORKS BORDERLESS Cisco Systems, Inc. All rights reserved. 1
CISCO BORDERLESS NETWORKS 2009 Cisco Systems, Inc. All rights reserved. 1 Creating New Business Models The Key Change: Putting the Interaction Where the Customer Is Customer Experience/ Innovation Productivity/
Lie, Cheat and Deceive: Change the Rules of Cyber Defense
SESSION ID: SPO-W10A Lie, Cheat and Deceive: Change the Rules of Cyber Defense Sameh Sabry Associate Vice President Professional Services Spire Solutions Why continue to do things the way we always have?
Future-ready security for small and mid-size enterprises
First line of defense for your network Quick Heal Terminator (UTM) (Unified Threat Management Solution) Data Sheet Future-ready security for small and mid-size enterprises Quick Heal Terminator is a high-performance,
Firewalls for Secure Unified Communications
Firewalls for Secure Unified Communications Positioning Guide 2008 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 1 of 12 Firewall protection for call control
FAQ: Crawling, indexing & ranking(google Webmaster Help)
FAQ: Crawling, indexing & ranking(google Webmaster Help) #contact-google Q: How can I contact someone at Google about my site's performance? A: Our forum is the place to do it! Googlers regularly read
CMSC 332 Computer Networking Web and FTP
CMSC 332 Computer Networking Web and FTP Professor Szajda CMSC 332: Computer Networks Project The first project has been posted on the website. Check the web page for the link! Due 2/2! Enter strings into
Robust Defenses for Cross-Site Request Forgery
University of Cyprus Department of Computer Science Advanced Security Topics Robust Defenses for Cross-Site Request Forgery Name: Elena Prodromou Instructor: Dr. Elias Athanasopoulos Authors: Adam Barth,
Maximum Security with Minimum Impact : Going Beyond Next Gen
SESSION ID: SP03-W10 Maximum Security with Minimum Impact : Going Beyond Next Gen Wendy Moore Director, User Protection Trend Micro @WMBOTT Hyper-competitive Cloud Rapid adoption Social Global Mobile IoT
Review for Internet Introduction
Review for Internet Introduction What s the Internet: Two Views View 1: Nuts and Bolts View billions of connected hosts routers and switches protocols control sending, receiving of messages network of
Application Firewalls
Application Moving Up the Stack Advantages Disadvantages Example: Protecting Email Email Threats Inbound Email Different Sublayers Combining Firewall Types Firewalling Email Enforcement Application Distributed
The DNS. Application Proxies. Circuit Gateways. Personal and Distributed Firewalls The Problems with Firewalls
Network Security - ISA 656 Application Angelos Stavrou August 20, 2008 Application Distributed Why move up the stack? Apart from the limitations of packet filters discussed last time, firewalls are inherently
CS6200 Information Retreival. Crawling. June 10, 2015
CS6200 Information Retreival Crawling Crawling June 10, 2015 Crawling is one of the most important tasks of a search engine. The breadth, depth, and freshness of the search results depend crucially on
Overview of SSL/TLS. Luke Anderson. 12 th May University Of Sydney.
Overview of SSL/TLS Luke Anderson luke@lukeanderson.com.au 12 th May 2017 University Of Sydney Overview 1. Introduction 1.1 Raw HTTP 1.2 Introducing SSL/TLS 2. Certificates 3. Attacks Introduction Raw
Choosing a Full Disk Encryption solution. A simple first step in preparing your business for GDPR
Choosing a Full Disk Encryption solution A simple first step in preparing your business for GDPR beinformed Understand the impact Under GDPR, your organisation is required to protect data stored on devices,
Application Protocols and HTTP
Application Protocols and HTTP 14-740: Fundamentals of Computer Networks Bill Nace Material from Computer Networking: A Top Down Approach, 6 th edition. J.F. Kurose and K.W. Ross Administrivia Lab #0 due
SEEM4540 Open Systems for E-Commerce Lecture 03 Internet Security
SEEM4540 Open Systems for E-Commerce Lecture 03 Internet Security Consider 2. Based on DNS, identified the IP address of www.cuhk.edu.hk is 137.189.11.73. 1. Go to http://www.cuhk.edu.hk 3. Forward the
Administrivia. Crawlers: Nutch. Course Overview. Issues. Crawling Issues. Groups Formed Architecture Documents under Review Group Meetings CSE 454
Administrivia Crawlers: Nutch Groups Formed Architecture Documents under Review Group Meetings CSE 454 4/14/2005 12:54 PM 1 4/14/2005 12:54 PM 2 Info Extraction Course Overview Ecommerce Standard Web Search
CS 162 Operating Systems and Systems Programming Professor: Anthony D. Joseph Spring Lecture 21: Network Protocols (and 2 Phase Commit)
CS 162 Operating Systems and Systems Programming Professor: Anthony D. Joseph Spring 2003 Lecture 21: Network Protocols (and 2 Phase Commit) 21.0 Main Point Protocol: agreement between two parties as to
BUbiNG. Massive Crawling for the Masses. Paolo Boldi, Andrea Marino, Massimo Santini, Sebastiano Vigna
BUbiNG Massive Crawling for the Masses Paolo Boldi, Andrea Marino, Massimo Santini, Sebastiano Vigna Dipartimento di Informatica Università degli Studi di Milano Italy Once upon a time UbiCrawler UbiCrawler