Written on
April 3, 2008
by
editor
Authorization is the granting of specific types of privileges or barring privileges to an device or a user based on their previous authentication, what privileges they are requesting, and the current system state. This may be based on restrictions, for example time-of-day restrictions, or physical location restrictions, or restrictions against multiple logins by the same user. Most of the time the granting of a privilege constitutes the ability to use a certain type of service. Examples of types of service include, but are not limited to: IP address filtering, address assignment, route assignment, QoS/differential services, bandwidth control/traffic management, compulsory tunneling to a specific endpoint, and encryption.
Posted in : : Network Security - Web Security : : No Comments »
Written on
April 2, 2008
by
editor
The AAA Protocol (Authentication, Authorization, and Accounting) is a model designed to make computers secure.
Authentication is proving who you are. It refers to the process of establishing the digital identity of one entity to another entity (a user, client, computer, etc. to a server or computer). It is traditionally accomplished by using passwords but can include two factor authentication, one-time tokens, digital certificate, phone numbers, and biometrics. This comes before authorization because the entity’s identity must be checked before it is allowed access to the system.
Posted in : : Network Security - Web Security : : No Comments »
Written on
March 31, 2008
by
editor
Here are some simple ways on how to could keep yourself same from threats and vulnerabilities on the Internet.
• Install anti-spyware and anti-virus on your personal computer
• Update your operating system and software (especially your anti-virus and anti-spyware) promptly for security patches and other important updates.
• Install Firewall too. Most operating systems have built-in firewall all you have to do is to enable them.
• Avoid visiting malicious websites.
• Avoid downloading files that are malicious (especially .exe files).
• Do a regular maintenance of your personal computers (Update, Defrag, Virus scan and other things that can improve the security and stability of your system).
Image source: www.reliabletechaz.com
Posted in : : Prevention - Threats - Tips - Web Security : : No Comments »
Written on
March 20, 2008
by
Jerson
“Mendacious machines controlled by hackers that reroute Internet traffic from infected computers to fraudulent Web sites are increasingly being used to launch attacks, according to a paper published this week by researchers with the Georgia Institute of Technology and Google Inc.
The paper estimates roughly 68,000 servers on the Internet are returning malicious Domain Name System results, which means people with compromised computers are sometimes being directed to the wrong Web sites — and often have no idea.
The peer-reviewed paper, which offers one of the broadest measurements yet of the number of rogue DNS servers, was presented at the Internet Society’s Network and Distributed System Security Symposium in San Diego.
The fraud works like this: When a user with an affected computer tries to go to, for example, Google’s Web site, they are redirected to a spoof site loaded with malicious code or to a wall of ads whose profits flow back to the hackers.
The hackers who hijack DNS queries are looking to steal personal information, from e-mail login credentials to credit data, and take over infected machines.
The spoof sites run the gamut. Some are stunningly convincing, others amusingly bogus with spelling errors and typos.”
Source
Posted in : : Hacks - Info - Threats - Web Security : : No Comments »
Written on
March 17, 2008
by
Jerson
“The Scrapkut worm uses active code injection to spread between victims and their friends on Orkut. The malicious code appears on a victim’s scrapbook, containing a link to a supposed YouTube video.
People who click on the link are redirected to an external site hosting malware that’s disguised as a Flash upgrade. Users duped into installing the software get malicious Javascript code injected into their next active Orkut web session. This malicious scrapbook entry is then sent to all the victims’ friends, recommencing the infection cycle.
Source
Posted in : : Hacks - Info - Web Security : : No Comments »
Written on
March 15, 2008
by
editor
If you are fond of renting personal computers from the nearby Intenet café, be sure that your private information like e-mail address, browser history, cookies and others are still safe. How can you keep your private information safe? Here are some steps if you are using Internet Explorer:
1. On Internet Explorer, click on Tools
2. Click Internet Properties.
3. Now select Delete cookies, Delete Files, Clear History.
4. After everything else you click OK.
You private information are now delete on the workstation you rented. If you are using Mozilla Firefox all you have to do is click Tools then click Clear Private Data.
Image source: www.digitalbattle.com
Posted in : : Prevention - Threats - Tips - Web Security : : No Comments »
Written on
March 13, 2008
by
Jerson
1. Use Cases
1. Web intrusion detection and prevention
2. Continuous Security Assessment
3. Virtual (or just-in-time) patching
4. HTTP traffic logging and monitoring
5. Network building blocks
6. Web application hardening
2. Deployment models
1. Inline
2. Out of line
3. Embedded
3. Data Model
1. Model construction
2. Persisting information across requests
3. Distinguishing sessions
4. Distinguishing users
4. Analysis Model
1. Negative security
2. Positive security
3. Anomaly scoring
4. Learning
5. Evasion
6. Impedance mismatch
5. Traffic logging
6. Special protection techniques
1. Cookie protection
2. Cross-Site Request Forgery
3. Brute force attacks
4. Denial of Service attacks
5. PDF UXSS protection
Posted in : : Info - Web Security : : No Comments »
Written on
March 10, 2008
by
Jerson
QOS
Represents the level of consistent download capacity provided by your Broadband or DSL providor. The higher QOS percentage, the higher the overall quality of the internet connection. High quality plus internet speed provides better connections for VoIP (voice over IP), Citrix and other high traffic applications.
This figure should come in around 80 or higher yet. This does not mean that you won’t find success at lower speeds, but on average, the speed test should report >= 80.
RTT
The Round Trip Time (RTT) reports the total time in milliseconds (ms) to send a small data packet in our internet speed test and obtain a reply back. The faster (smaller) the RTT, the better broadband speed you’ll have.
For Voice over IP, round trip delays can occur when results exceed 250 mSec or 150 mSec one way which is also considered the maximum desired one-way latency to achieve high-quality voice.
Max Pause
Max Pause is the longest pause recorded during the Broadband Speed Test data download. This should be a very small number. If not, it could indicate Internet speed congestion or a bad broadband connection.
Posted in : : Info - Tips : : No Comments »
Written on
March 6, 2008
by
Jerson
A Brute Force attack is an automated process of trial and error used to guess a person’s username, password, credit-card number or cryptographic key.
Many systems will allow the use of weak passwords or cryptographic keys, and users will often choose easy to guess passwords, possibly found in a dictionary. Given this scenario, an attacker would cycle though the dictionary word by word, generating thousands or potentially millions of incorrect guesses searching for the valid password. When a guessed password allows access to the system, the brute force attack has been successful and the attacker is able access the account.
The same trial and error technique is also applicable to guessing encryption keys. When a web site uses a weak or small key size, its possible for an attacker to guess a correct key by testing all possible keys.
Essentially there are two types of brute force attacks, (normal) brute force and reverse brute force. A normal brute force attack uses a single username against many passwords. A reverse brute force attack uses many usernames against one password. In systems with millions of user accounts, the odds of multiple users having the same password dramatically increases. While brute force techniques are highly popular and often successful, they can take hours, weeks or years to complete.
Source
Posted in : : Hacks - Threats - Web Security : : No Comments »
Written on
March 3, 2008
by
Jerson
There are many pieces to intrusion prevention and like a puzzle, you must put them all together before you start surfing the net; miss just one piece and you’ve left yourself wide open to attack!
This is what you need to help prevent intrusions including the web security services you should use on a regular schedule.
For those of you that don’t want to read all the details and are ready to jump right into the web security audit, then follow the five steps below.
Posted in : : Network Security - Prevention - Tips - Web Security : : No Comments »
