DOCSLIB.ORG

Microsoft Windows Server 2008 PKI and Deploying the Ncipher Hardware Security Module

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Microsoft Windows Server 2008 PKI and Deploying the Ncipher Hardware Security Module This is a joint nCipher and IdentIT authored whitepaper Microsoft Windows Server 2008 PKI and Deploying the nCipher Hardware Security Module Abstract This paper discusses the benefits that are unique to deploying the integrated solution of the Windows Server 2008 PKI and the nCipher nShield and netHSM hardware security modules (HSM). This includes the essential concepts and technologies used to deploy a PKI and the best practice security and life cycle key management features provided by nCipher HSMs.. MicrosofT WIndoWs server 2008 PKI and dePloyIng The nCipher hardWare seCurity Module Introduction...............................................................................................................................................................................................3 PKI – A Crucial Component to Securing e-commerce ......................................................................................................................4 Microsoft Windows Server 2008 ...............................................................................................................................................................4 nCipher Hardware Security Modules ......................................................................................................................................................4 Best.Practice.Security.–.nCipher.HSMs.with.Windows.Server.2008.PKI................................................................................5 Overview...............................................................................................................................................................................................................5 Hardware vs. Software ...................................................................................................................................................................................5 Statutory and Regulatory Requirements ...............................................................................................................................................5 Windows.Server.2008.PKI.....................................................................................................................................................................7 Overview...............................................................................................................................................................................................................7 Windows Server 2008 Active Directory Certificate Services Role Services .............................................................................7 Active Directory Domain Services .............................................................................................................................................................8 What’s New in Certificate Services for Windows Server 2008............................................................... ......................................8 Hardware Security Modules ..................................................................................................................................................................... 10 HSM Form Factors ......................................................................................................................................................................................... 10 How.Hardware.Security.Modules.Integrate.with.Microsoft.Windows.Server.2008......................................................11 Integration with Active Directory Certificate Services Role Services ...................................................................................... 11 Deploying nCipher nShield HSMs for each CA in the CA Hierarchy ....................................................................................... 12 Deploying an nCipher netHSM for all CAs in the CA Hierarchy ................................................................................................ 12 Deploying a mix of nShields and netHSMs ....................................................................................................................................... 13 Integration with Online Responders..................................................................................................................................................... 14 CryptoAPI .......................................................................................................................................................................................................... 14 CAPICOM ........................................................................................................................................................................................................... 15 .NET Framework Cryptography ............................................................................................................................................................... 16 Cryptography Next Generation (CNG) ................................................................................................................................................. 16 Hardware Cryptographic Service Provider (CSP) .............................................................................................................................. 18 nCipher.Hardware.Security.Modules..............................................................................................................................................19 Overview............................................................................................................................................................................................................ 19 nCipher Security World – A Key Management Framework ........................................................................................................ 19 Security World Key Management Concepts ...................................................................................................................................... 20 Key Access and Storage............................................................................................................................................................................... 21 Key Life Cycle Management Features ................................................................................................................................................... 22 Key Security ...................................................................................................................................................................................................... 23 Key Generation .............................................................................................................................................................................................. 23 Shared Management and Role Separation ........................................................................................................................................ 23 The Ability to Support Key Policy ........................................................................................................................................................... 23 Secure and Simple Backup of Private Keys ......................................................................................................................................... 23 Secure and Simple Disaster Recovery ................................................................................................................................................... 24 Load Balancing ................................................................................................................................................................................................ 24 Failover ............................................................................................................................................................................................................... 24 Standards Compliance ................................................................................................................................................................................ 24 Scalability .......................................................................................................................................................................................................... 24 The.Synergy:.Windows.Server.2008.PKI.and.nCipher.HSMs...................................................................................................25 APPENDIX.................................................................................................................................................................................................27 Table 1.0 Supported Asymmetric Encryption Algorithms ........................................................................................................... 27 Table 2.0 Supported Symmetric Encryption Algorithms ............................................................................................................. 27 Table 3.0 Supported Hash Function Algorithms ............................................................................................................................. 28 Table 4.0 Supported Digital Signature Algorithms ........................................................................................................................ 29 Table 5.0 Supported Key Agreement Algorithms ...........................................................................................................................
Load more

Recommended publications
  • Servicio Fitosanitario Del Estado Risk Advisory
    Servicio Fitosanitario del Estado Risk Advisory Informe de Control Interno “Resultados del estudio de auditoría relativo a la evaluación del sistema de control interno en materia de tecnologías de la información, implementado para cumplir con lo dispuesto en el Decreto Ejecutivo N.° 37549-JP (Reglamento para la Protección de los Programas de Cómputo en los Ministerios e Instituciones adscritas al Gobierno Central)” Ref.: N° AI-SFE-SA-INF-005-2016 00 Servicio Fitosanitario del Estado | Tabla de contenido Tabla de contenido Tabla de contenido 1 Resumen ejecutivo 3 Introducción 4 Resultados del estado de los inventarios y del licenciamiento 14 Seguimiento al informe AI-SFE-SA-INF-005- 2015 34 Resultados - Hallazgos 36 Anexos 61 01 Servicio Fitosanitario del Estado | TablaInforme de decontenido Control Interno “Resultados del estudio de auditoría relativo a la evaluación del sistema de control interno en materia de tecnologías de la información, implementado para cumplir con lo dispuesto en el Decreto Ejecutivo N. 37549-JP (Reglamento Informe de Control Interno “Resultados del estudio de auditoría relativo a la evaluación del sistema de control interno en materia de tecnologías de la información, implementado para cumplir con lo dispuesto en el Decreto Ejecutivo N.° 37549-JP (Reglamento para la Protección de los Programas de Cómputo en los Ministerios e Instituciones adscritas al Gobierno Central)” 02 Servicio Fitosanitario del Estado | Resumen ejecutivo Resumen ejecutivo Objetivo El presente estudio de auditoría relacionado con la “Evaluación del sistema de control interno en materia de tecnologías de la información, implementado para cumplir con lo dispuesto en el Decreto Ejecutivo N.° 37549-JP (Reglamento para la Protección de los Programas de Cómputo en los Ministerios e Instituciones Adscritas al Gobierno Central)”, se llevó a cabo en atención al Plan Anual de Labores (2016) de la Auditoría Interna del Servicio Fitosanitario del Estado (SFE).
    [Show full text]
  • Middleware in Action 2007
    Technology Assessment from Ken North Computing, LLC Middleware in Action Industrial Strength Data Access May 2007 Middleware in Action: Industrial Strength Data Access Table of Contents 1.0 Introduction ............................................................................................................. 2 Mature Technology .........................................................................................................3 Scalability, Interoperability, High Availability ...................................................................5 Components, XML and Services-Oriented Architecture..................................................6 Best-of-Breed Middleware...............................................................................................7 Pay Now or Pay Later .....................................................................................................7 2.0 Architectures for Distributed Computing.................................................................. 8 2.1 Leveraging Infrastructure ........................................................................................ 8 2.2 Multi-Tier, N-Tier Architecture ................................................................................. 9 2.3 Persistence, Client-Server Databases, Distributed Data ....................................... 10 Client-Server SQL Processing ......................................................................................10 Client Libraries ..............................................................................................................
    [Show full text]
  • Vmware Vrealize Configuration Manager Installation Guide Vrealize Configuration Manager 5.8
    VMware vRealize Configuration Manager Installation Guide vRealize Configuration Manager 5.8 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www.vmware.com/support/pubs. EN-001815-00 vRealize Configuration Manager Installation Guide You can find the most up-to-date technical documentation on the VMware Web site at: Copyright http://www.vmware.com/support/ The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: [email protected] © 2006–2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. VMware, Inc. 3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com 2 VMware, Inc. Contents About This Book 5 Preparing to Install VCM 7 Typical or Advanced Installation 7 VCM Installation Configurations 8 Create VCM Domain Accounts 8 VCM Account Configuration 9 VCM Administrator Account 10 VCM User Accounts 10 Service Accounts 10 Network Authority Account 11 ECMSRSUser Account 12 SQL Server Permissions and Constructs 12 Gather Supporting Software
    [Show full text]
  • Curriculum Vitae Di Tommaso Cucinotta
    Curriculum Vitae: Prof. Tommaso Cucinotta Personal data Birth date and place: April 1974, Potenza (Italy) Phone: +39 (0)50 882 028 Skype Id: t.cucinotta E-mail: Home page: http:// retis . santannapisa .it/~tommaso Current status Dec 2015 to date: Associate Professor at the Real-Time Systems Laboratory (ReTiS) of Scuola Superiore Sant'Anna RESEARCH TOPICS & COMPETENCIES ❑ Real-time and reliable NoSQL Database systems for cloud services ❑ Adaptive resource management and scheduling in Cloud Computing & Network Function Virtualization infrastructures ❑ Artificial Intelligence and Machine Learning to support Data Center Operations in Cloud & NFV infrastructures ❑ Platforms for real-time data streaming and analytics ❑ Quality of service control for adaptive soft real-time applications, including multimedia and IMS systems ❑ Operating Systems for real-time and embedded applications and many-core and massively distributed systems ❑ Trusted computing and confidentiality in cloud computing ❑ Smart-cards: interoperability, protocols and architectures ❑ Digital signatures, biometrics identification, multicast security Experience highlights (details below) ❑ 7 Granted and 25 Filed EU and US Patents in the areas of security, resource management and scheduling ❑ 25 International Journal Publications, including IEEE Transaction on Computers, IEEE Transaction on Industrial Informatics and ACM Transactions on Embedded and Computing Systems ❑ 65 International Conference and Workshop Peer-reviewed Publications and 13 Book Chapters ❑ 3 EU Projects scientific
    [Show full text]
  • Invisimole: the Hidden Part of the Story Unearthing Invisimole’S Espionage Toolset and Strategic Cooperations
    ESET Research white papers TLP: WHITE INVISIMOLE: THE HIDDEN PART OF THE STORY UNEARTHING INVISIMOLE’S ESPIONAGE TOOLSET AND STRATEGIC COOPERATIONS Authors: Zuzana Hromcová Anton Cherepanov TLP: WHITE 2 InvisiMole: The hidden part of the story CONTENTS 1 EXECUTIVE SUMMARY � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 4 2 ATTACKS AND INVESTIGATION � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 4 2.1 InvisiMole’s toolset ������������������������������������������������������������������������������������������������������������������������ 5 2.2 Cooperation between InvisiMole and Gamaredon . 5 3 BUILDING BLOCKS � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 6 3.1 Structure ������������������������������������������������������������������������������������������������������������������������������������������6 3.1.1 InvisiMole blobs . 6 3.1.2 Execution guardrails with DPAPI ���������������������������������������������������������������������������������7 3.2 Payload ��������������������������������������������������������������������������������������������������������������������������������������������8 3.2.1 TCP downloader ��������������������������������������������������������������������������������������������������������������9 3.2.2 DNS downloader . 9 3.2.3 RC2CL backdoor �������������������������������������������������������������������������������������������������������������13
    [Show full text]
  • Patch Management Vendor and Application List
    Patch Management Vendor and Application List Vendor Application 7-Zip 7-Zip 7-Zip 3 7-Zip 7-Zip 4 7-Zip 7-Zip 9 7-Zip 7-Zip 15 7-Zip 7-Zip 16 7-Zip 7-Zip 18 Acro Software Acro Software CutePDF Writer 2 Acro Software CutePDF Writer 3 Adobe Adobe Acrobat 5 Adobe Acrobat 6 Adobe Acrobat 7 Adobe Acrobat 8 Adobe Acrobat 9 Adobe Acrobat X Adobe Acrobat XI Adobe Acrobat DC Adobe Acrobat DC 17 Adobe Acrobat DC 18 Adobe Acrobat DC 19 Adobe Adobe Photoshop 11 Adobe Adobe Photoshop 12 Adobe Adobe Photoshop 13 Adobe Adobe Photoshop 15 Adobe Adobe Photoshop 16 Adobe After Effects 13.5 Adobe AIR Adobe AIR 2 Adobe AIR 3 Adobe AIR 4 Adobe AIR 13 Adobe AIR 14 Adobe AIR 15 Adobe AIR 16 Adobe AIR 17 Adobe AIR 18 Adobe AIR 19 Adobe AIR 20 Adobe AIR 21 Adobe AIR 22 Adobe AIR 23 Adobe AIR 24 Adobe AIR 25 Adobe AIR 26 Adobe AIR 27 Adobe AIR 28 Adobe AIR 30 Adobe AIR 31 Adobe AIR 32 Adobe Bridge 4 Adobe Bridge 5 Adobe Bridge CC Adobe Creative Cloud 3 Adobe Creative Cloud 4 Adobe Digital Editions 1 Adobe Digital Editions 2 Adobe Digital Editions 3 Adobe Digital Editions 4 Adobe Distiller 5 Adobe Distiller 6 Adobe Distiller 7 Adobe Dreamweaver 16 Adobe Elements 5 Adobe Elements 6 Adobe Elements 7 Adobe Fireworks CS6 Adobe Flash PPAPI MSI Adobe Flash Plugin MSI Adobe Flash MSI Adobe Flash Plugin Adobe Flash 5 Adobe Flash 6 Adobe Flash Plugin 6 Adobe Flash 7 Adobe Flash Plugin 7 Adobe Flash 8 Adobe Flash Plugin 8 Adobe Flash 9 Adobe Flash Plugin 9 Adobe Flash 10 Adobe Flash Plugin 10 Adobe Flash 11 Adobe Flash Plugin 11 Adobe Flash 12 Adobe Flash Plugin 12 Adobe
    [Show full text]
  • Game Programming Gems 7
    Game Programming Gems 7 Edited by Scott Jacobs Charles River Media A part of Course Technology, Cengage Learning Australia • Brazil • Japan • Korea • Mexico • Singapore • Spain • United Kingdom • United States Publisher and General Manager, © 2008 Course Technology, a part of Cengage Learning. Course Technology PTR: Stacy L. Hiquet Associate Director of Marketing: ALL RIGHTS RESERVED. No part of this work covered by the copyright Sarah Panella herein may be reproduced, transmitted, stored, or used in any form or by any means graphic, electronic, or mechanical, including but not limited to Heather Manager of Editorial Services: photocopying, recording, scanning, digitizing, taping, Web distribution, Talbot information networks, or information storage and retrieval systems, except Marketing Manager: Jordan Casey as permitted under Section 107 or 108 of the 1976 United States Copyright Senior Acquisitions Editor: Emi Smith Act, without the prior written permission of the publisher. Project/Copy Editor: Kezia Endsley CRM Editorial Services Coordinator: Jen Blaney For product information and technology assistance, contact us at Cengage Learning Customer & Sales Support, 1-800-354-9706 Interior Layout Tech: Judith Littlefield Cover Designer: Tyler Creative Services For permission to use material from this text or product, CD-ROM Producer: Brandon Penticuff submit all requests online at cengage.com/permissions Further permissions questions can be emailed to Valerie Haynes Perry Indexer: [email protected] Proofreader: Sue Boshers Library of Congress Control Number: 2007939358 ISBN-13: 978-1-58450-527-3 ISBN-10: 1-58450-527-3 eISBN-10: 1-30527-676-0 Course Technology 25 Thomson Place Boston, MA 02210 USA Cengage Learning is a leading provider of customized learning solutions with office locations around the globe, including Singapore, the United Kingdom, Australia, Mexico, Brazil, and Japan.
    [Show full text]
  • Mastering Windows XP Registry
    Mastering Windows XP Registry Peter Hipson Associate Publisher: Joel Fugazzotto Acquisitions and Developmental Editor: Ellen L. Dendy Editor: Anamary Ehlen Production Editor: Elizabeth Campbell Technical Editor: Donald Fuller Electronic Publishing Specialist: Maureen Forys, Happenstance Type-O-Rama Proofreaders: Nanette Duffy, Emily Hsuan, Laurie O'Connell, Yariv Rabinovitch, Nancy Riddiough Book Designer: Maureen Forys, Happenstance Type-O-Rama Indexer: Ted Laux Cover Designer: Design Site Cover Illustrator: Sergie Loobkoff Copyright © 2002 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved. The author(s) created reusable code in this publication expressly for reuse by readers. Sybex grants readers limited permission to reuse the code found in this publication or its accompanying CD-ROM so long as the author is attributed in any application containing the reusable code and the code itself is never distributed, posted online by electronic transmission, sold, or commercially exploited as a stand-alone product. Aside from this specific exception concerning reusable code, no part of this publication may be stored in a retrieval system, transmitted, or reproduced in any way, including but not limited to photocopy, photograph, magnetic, or other record, without the prior agreement and written permission of the publisher. First edition copyright © 2000 SYBEX Inc. Library of Congress Card Number: 2002100057 ISBN: 0-7821-2987-0 SYBEX and the SYBEX logo are either registered trademarks or trademarks of SYBEX Inc. in the United States and/or other countries. Mastering is a trademark of SYBEX Inc. Screen reproductions produced with FullShot 99. FullShot 99 © 1991-1999 Inbit Incorporated. All rights reserved.FullShot is a trademark of Inbit Incorporated.
    [Show full text]
  • Table of Contents
    A Comprehensive Introduction to Vista Operating System Table of Contents Chapter 1 - Windows Vista Chapter 2 - Development of Windows Vista Chapter 3 - Features New to Windows Vista Chapter 4 - Technical Features New to Windows Vista Chapter 5 - Security and Safety Features New to Windows Vista Chapter 6 - Windows Vista Editions Chapter 7 - Criticism of Windows Vista Chapter 8 - Windows Vista Networking Technologies Chapter 9 -WT Vista Transformation Pack _____________________ WORLD TECHNOLOGIES _____________________ Abstraction and Closure in Computer Science Table of Contents Chapter 1 - Abstraction (Computer Science) Chapter 2 - Closure (Computer Science) Chapter 3 - Control Flow and Structured Programming Chapter 4 - Abstract Data Type and Object (Computer Science) Chapter 5 - Levels of Abstraction Chapter 6 - Anonymous Function WT _____________________ WORLD TECHNOLOGIES _____________________ Advanced Linux Operating Systems Table of Contents Chapter 1 - Introduction to Linux Chapter 2 - Linux Kernel Chapter 3 - History of Linux Chapter 4 - Linux Adoption Chapter 5 - Linux Distribution Chapter 6 - SCO-Linux Controversies Chapter 7 - GNU/Linux Naming Controversy Chapter 8 -WT Criticism of Desktop Linux _____________________ WORLD TECHNOLOGIES _____________________ Advanced Software Testing Table of Contents Chapter 1 - Software Testing Chapter 2 - Application Programming Interface and Code Coverage Chapter 3 - Fault Injection and Mutation Testing Chapter 4 - Exploratory Testing, Fuzz Testing and Equivalence Partitioning Chapter 5
    [Show full text]
  • Technical Specification of Cryptomate64 USB Cryptographic
    CryptoMate64 USB Cryptographic Token Technical Specifications V1.06 Subject to change without prior notice [email protected] www.acs.com.hk Table of Contents 1.0. Introduction ............................................................................................................. 3 2.0. Features ................................................................................................................... 4 2.1. Cryptographic Smart Card and Crypto-processor Features .................................................. 4 2.2. Token Features ...................................................................................................................... 4 3.0. Typical Applications ................................................................................................ 5 4.0. Middleware ............................................................................................................... 6 5.0. Technical Specifications ......................................................................................... 7 List of Figures Figure 1 : CryptoMate64 System Block Diagram ................................................................................... 3 Figure 2 : Middleware Diagram .............................................................................................................. 6 Page 2 of 8 CryptoMate64 – Technical Specifications [email protected] Version 1.06 www.acs.com.hk 1.0. Introduction CryptoMate64 is a lightweight USB token that provides users with strong authentication solutions and the CCID-compliant
    [Show full text]
  • Mcafee Exploit Prevention Content 11535 Release Notes | 2021-06-15
    McAfee Exploit Prevention Content 11535 Release Notes | 2021-06-15 Content package version for – McAfee Endpoint Security Exploit Prevention: 10.6.0.115351 McAfee Host Intrusion Prevention: 8.0.0.115352 1 - Applicable on all versions of McAfee Endpoint Security Exploit Prevention including version 10.7.x 2 - Applicable on all versions of McAfee Host Intrusion Prevention content including Host IPS 8.0 Patch 16. IMPORTANT: McAfee V3 Virus Definition Updates (DATs) version 3786 or above is a mandatory prerequisite for this Exploit prevention content update on McAfee Endpoint Security versions 10.5.x and 10.6.x only. Refer to the below KB for more information: https://kc.mcafee.com/corporate/index?page=content&id=KB91867 IMPORTANT: Either of the below McAfee Host IPS 8.0 Extension packages is a mandatory prerequisite for receiving the new security or policy updates for this content 1. Host IPS 8.0 Patch 15 Extension (build 8.0.0.1334) – Applicable for Host IPS 8.0 Patch 15 and below 2. Host IPS 8.0 Patch 14 Extension Hotfix 114831 (build 8.0.0.1326) – Applicable for Host IPS 8.0 Patch 14 and below Refer to the below KB for more information: https://kc.mcafee.com/corporate/index?page=content&id=KB92596 Minimum Supported New Windows Signatures Product version Host Intrusion Endpoint Security Prevention Exploit Prevention Signature 6204: HTTP Protocol Stack Remote Code Execution Vulnerability 8.0.0 10.6.0 (Patch 13) Description: - HTTP.sys is a web server for ASP.NET Core that only runs on Windows independently or in conjunction with IIS.
    [Show full text]
  • Security Policy for FIPS 140-2 Validation
    Enhanced Cryptographic Provider Security Policy for FIPS 140‐2 Validation Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows RT Microsoft Surface Windows RT Microsoft Surface Windows 8 Pro Microsoft Windows Phone 8 Microsoft Windows Storage Server 2012 Enhanced Cryptographic Provider (RSAENH.DLL) DOCUMENT INFORMATION Version Number 1.2 Updated On December 17, 2014 © 2014 Microsoft. All Rights Reserved Page 1 of 25 This Security Policy is non‐proprietary and may be reproduced only in its original entirety (without revision). Enhanced Cryptographic Provider The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. This work is licensed under the Creative Commons Attribution-NoDerivs- NonCommercial License (which allows redistribution of the work). To view a copy of this license, visit http://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
    [Show full text]