DOCSLIB.ORG

Defense in Depth Project Pap

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Defense in Depth Project Pap A PROPOSED FRAMEWORK FOR BUSINESS INFORMATION SECURITY BASED ON THE CONCEPT OF DEFENSE-IN-DEPTH by MATTHEW K. BURNBURG A MASTER’S THESIS Submitted in partial fulfillment of the requirements for the degree of Master of Science in Management Information Systems SCHOOL OF BUSINESS AND MANAGEMENT UNIVERSITY OF ILLINOIS AT SPRINGFIELD SPRINGFIELD, ILLINOIS MAY 2003 i GRADUATE THESIS ACCEPTANCE PAGE ABSTRACT A PROPOSED FRAMEWORK FOR BUSINESS INFORMATION SECURITY BASED ON THE CONCEPT OF DEFENSE-IN-DEPTH by Matthew K. Burnburg Chairperson of the Supervisory Committee: Professor Rassule Hadidi Management Information Systems Department Information systems security is a complex area of study and practice. Communication of security requirements to business executives is difficult due to the highly specialized nature of the field and the accelerating deployment of new technologies. This study proposes a framework based on generally accepted domains of information security and the temporal nature and locality of data and information. The proposed framework also accounts for the small world network characteristics of the Internet. This study evaluates this framework within the context of an operating financial industry network. ii Table of Contents GRADUATE THESIS ACCEPTANCE PAGE II ABSTRACT II LIST OF FIGURES V LIST OF TABLES VI ACKNOWLEDGMENTS VII CHAPTER 1 1 INTRODUCTION 1 STATEMENT OF THE PROBLEM 2 PURPOSE OF THE STUDY 3 SIGNIFICANCE 5 SCOPE 6 ASSUMPTIONS AND LIMITATIONS 6 ORGANIZATION OF THE PAPER 8 CHAPTER 2 LITERATURE REVIEW 9 WHY IS INFORMATION SECURITY IMPORTANT? 9 WHAT IS THE GOAL? 16 WHAT IS THE RISK? 17 WHO ARE THE PLAYERS? 24 ATTACK METHOD 26 SECURITY FRAMEWORKS 28 A GENERAL FRAMEWORK FOR CONCEPTUALIZATION OF DEFENSE-IN- DEPTH 31 ORGANIZATIONAL ENVIRONMENT 34 LEGAL AND GOVERNMENTAL ENVIRONMENT 35 APPLICATION AND SYSTEM DEVELOPMENT 38 OPERATIONAL SECURITY 40 PHYSICAL SECURITY 41 ACCESS CONTROLS 41 ENCRYPTION AND CRYPTOGRAPHY 47 DISASTER RECOVERY AND ORGANIZATIONAL CONTINUITY 47 LOCALITY AND COMPLEXITY OF THE PROPOSED FRAMEWORK 48 DATA STORAGE 50 HOST 51 LOCAL AREA NETWORK 51 INTRANET 52 iii WIDE AREA NETWORK 52 BOUNDARY 53 INTERNET 54 EXTRANET 55 INTERACTION ON PUBLIC NETWORKS 56 CHAPTER 3 PROPOSED METHOD AND PROCEDURE 58 DATA COLLECTION 58 DATA ANALYSIS 59 THE ORGANIZATION’S NETWORK 59 CHAPTER 4 RESULTS 63 DATA SOURCES 63 OVERALL TRAFFIC 65 USER PASSWORD CONTROLS 72 NETWORK ACCESS CONTROL LAYERS 74 ANTI-VIRUS LAYERS 76 COMPLEXITY OF ATTACK 78 CHAPTER 5 DISCUSSION AND FUTURE DIRECTIONS 110 DISCUSSION 110 FUTURE DIRECTIONS 122 BIBLIOGRAPHY 123 APPENDIX A: POLICIES AND PROCEDURES 127 INTRANET AND INTERNET SECURITY POLICY 128 INFORMATION PROTECTION POLICY 133 RIGHT TO FINANCIAL PRIVACY POLICY AND PROCEDURES 155 APPENDIX B: CONFIGURATIONS 159 FIREWALL CONFIGURATION 159 EDGE ROUTER CONFIGURATION (BEFORE ACL MODIFICATION) 161 EDGE ROUTER CONFIGURATION (AFTER ACL MODIFICATION) 162 APPENDIX C: SELECTED DATA SETS 165 FIREWALL LOG EXCERPT (SANITIZED) 166 SOURCE COUNTRY BY IP ADDRESS 167 TRAFFIC BY DESTINATION PORT (IP) 169 NMAP SCAN SAMPLE DATA 187 HISTOGRAMS OF TOTAL AND ATTACK TRAFFIC 227 iv LIST OF FIGURES Discrete Attacking Hosts on Cable-Connected Home PC (Burnburg 2001)......................................... 13 Numbers of Discrete Attacks, Probes or Scans on Cable-Connected PC (Burnburg 2001) ................. 14 Reasons for not Reporting Intrusions (Computer Security Institute 2001) ........................................... 18 CERT Statistics through Q3 2001 (CERT®) .......................................................................................... 18 Attack Sophistication vs. Intruder Knowledge (Pethia 2001)................................................................ 19 Actions Taken to Computer Intrusions (Computer Security Institute 2001)......................................... 20 Unauthorized Use of Computer Systems Within the Last 12 Months................................................... 21 Security Technologies Used (Computer Security Institute 2001).......................................................... 22 Type of Attack or Misuse Detected in the Last 12 Months (Computer Security Institute 2001).......... 23 Point of Attack (Computer Security Institute 2001).............................................................................. 24 Likely Sources of Attack (Computer Security Institute 2001)............................................................... 26 Attacker Methodology ............................................................................................................................ 28 McCumber INFOSEC Model (1991) ..................................................................................................... 29 Information Assurance Model (Maconachy et al 2001)......................................................................... 30 Proposed Framework (Front View)........................................................................................................ 33 Proposed Framework (Rear View) ......................................................................................................... 33 Proposed Framework (Cross-sectional View)........................................................................................ 49 The security framework in relation to other organizations .................................................................... 56 Organization Network before September 2002...................................................................................... 60 Organization Network after September 2002......................................................................................... 62 Total Daily Traffic .................................................................................................................................. 65 Percentage of Total Traffic (US vs. Foreign) ......................................................................................... 66 Daily Total and Attack Traffic................................................................................................................ 69 Percentage of Attack vs. Total Traffic.................................................................................................... 71 Network User Login Failures ................................................................................................................. 72 Network Access Control Services .......................................................................................................... 75 Private IP Address Spoofing Attempts................................................................................................... 76 Virus Detection by Layer........................................................................................................................ 77 Simple Mail Transfer Protocol Probes ................................................................................................... 83 File Transfer Protocol Probes ................................................................................................................. 86 Secure Shell Probes................................................................................................................................. 88 Domain Name Service Probes ................................................................................................................ 90 Hypertext Transport Protocol Probes ..................................................................................................... 92 Identification Protocol Probes................................................................................................................. 95 Remote Procedure Call Probes ............................................................................................................... 97 NetBIOS Name Service Probes.............................................................................................................. 99 NetBIOS Session Service Probes ......................................................................................................... 101 Microsoft SQL Server Probes............................................................................................................... 103 Top Ten Trojan Horse Probes............................................................................................................... 105 SubSeven Trojan Probes....................................................................................................................... 106 GateCrasher Trojan Probes................................................................................................................... 108 v LIST OF TABLES Attack Types Detected By IDS Software (Burnburg 2001)................................................................... 15 Attack Classification (Burnburg 2001)................................................................................................... 16 Total Traffic ............................................................................................................................................ 66 Foreign Total Traffic > Total US Traffic ............................................................................................... 67 Total Traffic Day of Week...................................................................................................................... 67 Total Traffic vs. Attack Traffic............................................................................................................... 70 Unique IP Addresses..............................................................................................................................
Load more

Recommended publications
  • Red Hat Enterprise Linux 3 Security Guide
    Red Hat Enterprise Linux 3 Security Guide Red Hat Enterprise Linux 3: Security Guide Copyright © 2003 by Red Hat, Inc. Red Hat, Inc. 1801 Varsity Drive Raleigh NC 27606-2072 USA Phone: +1 919 754 3700 Phone: 888 733 4281 Fax: +1 919 754 3701 PO Box 13588 Research Triangle Park NC 27709 USA rhel-sg(EN)-3-Print-RHI (2003-07-25T17:12) Copyright © 2003 by Red Hat, Inc. This material may be distributed only subject to the terms and conditions set forth in the Open Publication License, V1.0 or later (the latest version is presently available at http://www.opencontent.org/openpub/). Distribution of substantively modified versions of this document is prohibited without the explicit permission of the copyright holder. Distribution of the work or derivative of the work in any standard (paper) book form for commercial purposes is prohibited unless prior permission is obtained from the copyright holder. Red Hat, Red Hat Network, the Red Hat "Shadow Man" logo, RPM, Maximum RPM, the RPM logo, Linux Library, PowerTools, Linux Undercover, RHmember, RHmember More, Rough Cuts, Rawhide and all Red Hat-based trademarks and logos are trademarks or registered trademarks of Red Hat, Inc. in the United States and other countries. Linux is a registered trademark of Linus Torvalds. Motif and UNIX are registered trademarks of The Open Group. XFree86 is a trademark of The XFree86 Project, Inc, and is pending registration. Intel and Pentium are registered trademarks of Intel Corporation. Itanium and Celeron are trademarks of Intel Corporation. AMD, Opteron, Athlon, Duron, and K6 are registered trademarks of Advanced Micro Devices, Inc.
    [Show full text]
  • SILC-A SECURED INTERNET CHAT PROTOCOL Anindita Sinha1, Saugata Sinha2 Asst
    ISSN (Print) : 2320 – 3765 ISSN (Online): 2278 – 8875 International Journal of Advanced Research in Electrical, Electronics and Instrumentation Engineering Vol. 2, Issue 5, May 2013 SILC-A SECURED INTERNET CHAT PROTOCOL Anindita Sinha1, Saugata Sinha2 Asst. Prof, Dept. of ECE, Siliguri Institute of Technology, Sukna, Siliguri, West Bengal, India 1 Network Engineer, Network Dept, Ericsson Global India Ltd, India2 Abstract:-. The Secure Internet Live Conferencing (SILC) protocol, a new generation chat protocol provides full featured conferencing services, compared to any other chat protocol. Its main interesting point is security which has been described all through the paper. We have studied how encryption and authentication of the messages in the network achieves security. The security has been the primary goal of the SILC protocol and the protocol has been designed from the day one security in mind. In this paper we have studied about different keys which have been used to achieve security in the SILC protocol. The main function of SILC is to achieve SECURITY which is most important in any chat protocol. We also have studied different command for communication in chat protocols. Keywords: SILC protocol, IM, MIME, security I.INTRODUCTION SILC stands for “SECURE INTERNET LIVE CONFERENCING”. SILC is a secure communication platform, looks similar to IRC, first protocol & quickly gained the status of being the most popular chat on the net. The security is important feature in applications & protocols in contemporary network environment. It is not anymore enough to just provide services; they need to be secure services. The SILC protocol is a new generation chat protocol which provides full featured conferencing services; additionally it provides security by encrypting & authenticating the messages in the network.
    [Show full text]
  • Applications Log Viewer
    4/1/2017 Sophos Applications Log Viewer MONITOR & ANALYZE Control Center Application List Application Filter Traffic Shaping Default Current Activities Reports Diagnostics Name * Mike App Filter PROTECT Description Based on Block filter avoidance apps Firewall Intrusion Prevention Web Enable Micro App Discovery Applications Wireless Email Web Server Advanced Threat CONFIGURE Application Application Filter Criteria Schedule Action VPN Network Category = Infrastructure, Netw... Routing Risk = 1-Very Low, 2- FTPS-Data, FTP-DataTransfer, FTP-Control, FTP Delete Request, FTP Upload Request, FTP Base, Low, 4... All the Allow Authentication FTPS, FTP Download Request Characteristics = Prone Time to misuse, Tra... System Services Technology = Client Server, Netwo... SYSTEM Profiles Category = File Transfer, Hosts and Services Confe... Risk = 3-Medium Administration All the TeamViewer Conferencing, TeamViewer FileTransfer Characteristics = Time Allow Excessive Bandwidth,... Backup & Firmware Technology = Client Server Certificates Save Cancel https://192.168.110.3:4444/webconsole/webpages/index.jsp#71826 1/4 4/1/2017 Sophos Application Application Filter Criteria Schedule Action Applications Log Viewer Facebook Applications, Docstoc Website, Facebook Plugin, MySpace Website, MySpace.cn Website, Twitter Website, Facebook Website, Bebo Website, Classmates Website, LinkedIN Compose Webmail, Digg Web Login, Flickr Website, Flickr Web Upload, Friendfeed Web Login, MONITOR & ANALYZE Hootsuite Web Login, Friendster Web Login, Hi5 Website, Facebook Video
    [Show full text]
  • Netcat and Trojans/Backdoors
    Netcat and Trojans/Backdoors ECE4883 – Internetwork Security 1 Agenda Overview • Netcat • Trojans/Backdoors ECE 4883 - Internetwork Security 2 Agenda Netcat • Netcat ! Overview ! Major Features ! Installation and Configuration ! Possible Uses • Netcat Defenses • Summary ECE 4883 - Internetwork Security 3 Netcat – TCP/IP Swiss Army Knife • Reads and Writes data across the network using TCP/UDP connections • Feature-rich network debugging and exploration tool • Part of the Red Hat Power Tools collection and comes standard on SuSE Linux, Debian Linux, NetBSD and OpenBSD distributions. • UNIX and Windows versions available at: http://www.atstake.com/research/tools/network_utilities/ ECE 4883 - Internetwork Security 4 Netcat • Designed to be a reliable “back-end” tool – to be used directly or easily driven by other programs/scripts • Very powerful in combination with scripting languages (eg. Perl) “If you were on a desert island, Netcat would be your tool of choice!” - Ed Skoudis ECE 4883 - Internetwork Security 5 Netcat – Major Features • Outbound or inbound connections • TCP or UDP, to or from any ports • Full DNS forward/reverse checking, with appropriate warnings • Ability to use any local source port • Ability to use any locally-configured network source address • Built-in port-scanning capabilities, with randomizer ECE 4883 - Internetwork Security 6 Netcat – Major Features (contd) • Built-in loose source-routing capability • Can read command line arguments from standard input • Slow-send mode, one line every N seconds • Hex dump of transmitted and received data • Optional ability to let another program service established connections • Optional telnet-options responder ECE 4883 - Internetwork Security 7 Netcat (called ‘nc’) • Can run in client/server mode • Default mode – client • Same executable for both modes • client mode nc [dest] [port_no_to_connect_to] • listen mode (-l option) nc –l –p [port_no_to_connect_to] ECE 4883 - Internetwork Security 8 Netcat – Client mode Computer with netcat in Client mode 1.
    [Show full text]
  • The Application Usage and Risk Report an Analysis of End User Application Trends in the Enterprise
    The Application Usage and Risk Report An Analysis of End User Application Trends in the Enterprise 8th Edition, December 2011 Palo Alto Networks 3300 Olcott Street Santa Clara, CA 94089 www.paloaltonetworks.com Table of Contents Executive Summary ........................................................................................................ 3 Demographics ............................................................................................................................................. 4 Social Networking Use Becomes More Active ................................................................ 5 Facebook Applications Bandwidth Consumption Triples .......................................................................... 5 Twitter Bandwidth Consumption Increases 7-Fold ................................................................................... 6 Some Perspective On Bandwidth Consumption .................................................................................... 7 Managing the Risks .................................................................................................................................... 7 Browser-based Filesharing: Work vs. Entertainment .................................................... 8 Infrastructure- or Productivity-Oriented Browser-based Filesharing ..................................................... 9 Entertainment Oriented Browser-based Filesharing .............................................................................. 10 Comparing Frequency and Volume of Use
    [Show full text]
  • Porte TCP/IP 19/09/2021
    1 MarkOne Tools Porte TCP/IP 19/09/2021 1 PORTS 0F TCP/IP Protocols and Services Introduction The port numbers are divided into three ranges: the Well Known Ports: are those from 0 through 1023. DCCP Well Known ports SHOULD NOT be used without IANA registration. The registration procedure is defined in [RFC4340], Section 19.9. the Registered Ports: are those from 1024 through 49151. DCCP Registered ports SHOULD NOT be used without IANA registration. The registration procedure is defined in [RFC4340], Section 19.9. the Dynamic and/or Private Ports: are those from 49152 through 65535 PLEASE NOTE THE FOLLOWING: 1. UNASSIGNED PORT NUMBERS SHOULD NOT BE USED. THE IANA WILL ASSIGN THE NUMBER FOR THE PORT AFTER YOUR APPLICATION HAS BEEN APPROVED. 2. ASSIGNMENT OF A PORT NUMBER DOES NOT IN ANY WAY IMPLY AN ENDORSEMENT OF AN APPLICATION OR PRODUCT, AND THE FACT THAT NETWORK TRAFFIC IS FLOW- ING TO OR FROM A REGISTERED PORT DOES NOT MEAN THAT IT IS "GOOD" TRAFFIC. FIREWALL AND SYSTEM ADMINISTRATORS SHOULD CHOOSE HOW TO CONFIGURE THEIR SYSTEMS BASED ON THEIR KNOWLEDGE OF THE TRAFFIC IN QUESTION, NOT WHETHER THERE IS A PORT NUMBER REGISTERED OR NOT. Socket: è costituito dal concatenamento di un indirizzo IP con il numero di porta di una specifica applicazione (p.es. 10.65.10.13:2001) TCP/IP protocols Port Name Alias 0 IP IP 1 icmp ICMP 3 ggp GGP 6 tcp TCP 8 egp EGP 12 pup PUP 17 udp UDP 20 hmp HMP 22 xns-idp XNS-IDP 27 rdp RDP 66 rvd RVD 1 last updated 2007-01-24 2 MarkOne Tools Porte TCP/IP 19/09/2021 WELL KNOWN PORT NUMBERS The Well Known Ports are assigned by the IANA and on most systems can only be used by system (or root) processes or by programs executed by privileged users.
    [Show full text]
  • Secure Internet Live Conferencing
    Einführung SILC vs. IRC vs. XMPP Architektur Nachrichten Protokoll Secure Internet Live Conferencing Frank Benkstein <[email protected]> 26.10.2007, 19:12:23h Frank Benkstein <[email protected]> Secure Internet Live Conferencing Einführung SILC vs. IRC vs. XMPP Architektur Nachrichten Protokoll Übersicht I Einführung I SILC vs. IRC vs. XMPP I Architektur I Protokoll Frank Benkstein <[email protected]> Secure Internet Live Conferencing Einführung SILC vs. IRC vs. XMPP Architektur Nachrichten Protokoll Geschichte Geschichte 1996 Idee und Entwurf durch Pekka Riikonen 1997 erster Code 1998 Rewrite in C++ 1999 Rewrite in C 2000 erste Veröffentlichung der Quelltexte Einreichung der Spezifikationen bei der IETF 2003 SILC-Client 1.0 Frank Benkstein <[email protected]> Secure Internet Live Conferencing Einführung SILC vs. IRC vs. XMPP Architektur Nachrichten Protokoll Design Ziele I Echtzeit-Text-Kommunikation I Viele-Zu-Viele (ähnlich IRC) I Eins-Zu-Eins (Instant Messaging) I Multimedia-Fähigkeit I Datei-Transfer I Sicherheit I Modularität Frank Benkstein <[email protected]> Secure Internet Live Conferencing Einführung SILC vs. IRC vs. XMPP Architektur Nachrichten Protokoll Protokoll-Eigenschaften Protokoll-Eigenschaften I Verschlüsselung I gesamte Kommunikation verschüsselt und authentifiziert I unverschlüsselte Kommunikation unmöglich* I Signatur von Nachrichten I Unicode (UTF-8) statt ASCII I Nicknames I Channel-Namen I Nachrichten I Peer-to-Peer für Dateitransfer I alles andere über Server Frank Benkstein <[email protected]> Secure Internet Live Conferencing Einführung SILC vs. IRC vs. XMPP Architektur Nachrichten Protokoll Protokoll-Eigenschaften Clients I eindeutige Client-ID I Nicknamen I nicht eindeutig* I UTF-8 I bis zu 128 Bytes (!) lang I gleicher Public-Key möglich Frank Benkstein <[email protected]> Secure Internet Live Conferencing Einführung SILC vs.
    [Show full text]
  • Remote Process Control Over the Internet
    Session 1520 Remote Process Control over the Internet Mark Smith Purdue University North Central Abstract This paper presents remote process control over the Internet using remote-control computing software. Remote-control computing software allows you to connect to remote computers from your computer and control those systems. You can monitor and control attached system processes, provide problem solving assistance, upload and download files, and even change system parameters. This paper describes what remote-control computing is, who the major players in the industry are, and how it can be used to monitor and control remote processes. A case study of remote-control computing software in operation is also presented, describing how one off-the-shelf package was setup to monitor and control a plant floor production system. Introduction Networking technologies, and especially the Internet, have become a major component of application systems. As we teach the design and implementation of process control systems in the Engineering curriculum, we must recognize that these systems will require capabilities for control and support from remote locations. For example, the need for remote control may be driven by the high cost of a particular process. The Oak Ridge National Laboratory uses remote process control at its High Temperature Materials Laboratory to allow researches from across the country to use a million-dollar electron microscope1. Even when control of the process is not required across the country, there are times when it is helpful (or even critical) to monitor another node on a LAN. For example, Conquergood describes in his research the ability to monitor and control potentially high voltages from one location by gathering voltage information from PCs doing data acquisition from various plant processes2.
    [Show full text]
  • List of NMAP Scripts Use with the Nmap –Script Option
    List of NMAP Scripts Use with the nmap –script option Retrieves information from a listening acarsd daemon. Acarsd decodes ACARS (Aircraft Communication Addressing and Reporting System) data in real time. The information retrieved acarsd-info by this script includes the daemon version, API version, administrator e-mail address and listening frequency. Shows extra information about IPv6 addresses, such as address-info embedded MAC or IPv4 addresses when available. Performs password guessing against Apple Filing Protocol afp-brute (AFP). Attempts to get useful information about files from AFP afp-ls volumes. The output is intended to resemble the output of ls. Detects the Mac OS X AFP directory traversal vulnerability, afp-path-vuln CVE-2010-0533. Shows AFP server information. This information includes the server's hostname, IPv4 and IPv6 addresses, and hardware type afp-serverinfo (for example Macmini or MacBookPro). Shows AFP shares and ACLs. afp-showmount Retrieves the authentication scheme and realm of an AJP service ajp-auth (Apache JServ Protocol) that requires authentication. Performs brute force passwords auditing against the Apache JServ protocol. The Apache JServ Protocol is commonly used by ajp-brute web servers to communicate with back-end Java application server containers. Performs a HEAD or GET request against either the root directory or any optional directory of an Apache JServ Protocol ajp-headers server and returns the server response headers. Discovers which options are supported by the AJP (Apache JServ Protocol) server by sending an OPTIONS request and lists ajp-methods potentially risky methods. ajp-request Requests a URI over the Apache JServ Protocol and displays the result (or stores it in a file).
    [Show full text]
  • Unpermitted Resources
    Process Check and Unpermitted Resources Common and Important Virtual Machines Parallels VMware VirtualBox CVMCompiler Windows Virtual PC Other Python Citrix Screen/File Sharing/Saving .exe File Name VNC, VPN, RFS, P2P and SSH Virtual Drives ● Dropbox.exe ● Dropbox ● OneDrive.exe ● OneDrive ● <name>.exe ● Google Drive ● etc. ● iCloud ● etc. Evernote / One Note ● Evernote_---.exe ● onenote.exe Go To Meeting ● gotomeeting launcher.exe / gotomeeting.exe TeamViewer ● TeamViewer.exe Chrome Remote ● remoting_host.exe www.ProctorU.com ● [email protected] ● 888­355­3043 ​ ​ ​ ​ ​ ​ ​ Messaging / Video (IM, IRC) / .exe File Name Audio Bonjour Google Hangouts (chrome.exe - shown as a tab) (Screen Sharing) Skype SkypeC2CPNRSvc.exe Music Streaming ● Spotify.exe (Spotify, Pandora, etc.) ● PandoraService.exe Steam Steam.exe ALL Processes Screen / File Sharing / Messaging / Video (IM, Virtual Machines (VM) Other Saving IRC) / Audio Virtual Box Splashtop Bonjour ● iChat ● iTunes ● iPhoto ● TiVo ● SubEthaEdit ● Contactizer, ● Things ● OmniFocuse phpVirtualBox TeamViewer MobileMe Parallels Sticky Notes Team Speak VMware One Note Ventrilo Windows Virtual PC Dropbox Sandboxd QEM (Linux only) Chrome Remote iStumbler HYPERBOX SkyDrive MSN Chat Boot Camp (dual boot) OneDrive Blackboard Chat CVMCompiler Google Drive Yahoo Messenger Office (Word, Excel, Skype etc.) www.ProctorU.com ● [email protected] ● 888­355­3043 ​ ​ ​ ​ ​ ​ ​ 2X Software Notepad Steam AerooAdmin Paint Origin AetherPal Go To Meeting Spotify Ammyy Admin Jing Facebook Messenger AnyDesk
    [Show full text]
  • Chapter 3 Composite Default Screen Blind Folio 3:61
    Color profile: GenericORACLE CMYK printerTips & Techniques profile 8 / Oracle9i for Windows 2000 Tips & Techniques / Jesse, Sale, Hart / 9462-6 / Chapter 3 Composite Default screen Blind Folio 3:61 CHAPTER 3 Configuring Windows 2000 P:\010Comp\OracTip8\462-6\ch03.vp Wednesday, November 14, 2001 3:20:31 PM Color profile: GenericORACLE CMYK printerTips & Techniques profile 8 / Oracle9i for Windows 2000 Tips & Techniques / Jesse, Sale, Hart / 9462-6 / Chapter 3 Composite Default screen Blind Folio 3:62 62 Oracle9i for Windows 2000 Tips & Techniques here are three basic configurations of Oracle on Windows 2000: as T a management platform, as an Oracle client, and as a database server. The first configuration is the platform from which you will manage Oracle installations across various machines on various operating systems. Most system and database administrators are given a desktop PC to perform day-to-day tasks that are not DBA specific (such as reading e-mail). From this desktop, you can also manage Oracle components installed on other operating systems (for example, Solaris, Linux, and HP-UX). Even so, you will want to configure Windows 2000 to make your system and database administrative tasks quick and easy. The Oracle client software configuration is used in more configurations than you might first suspect: ■ Web applications that connect to an Oracle database: ■ IIS 5 ASPs that use ADO to connect to an Oracle database ■ Perl DBI application running on Apache that connects to an Oracle database ■ Any J2EE application server that uses the thick JDBC driver ■ Client/server applications: ■ Desktop Visual Basic application that uses OLEDB or ODBC to connect to an Oracle Database ■ Desktop Java application that uses the thick JDBC to connect to Oracle In any of these configurations, at least an Oracle client installation is required.
    [Show full text]
  • Major Qualifying Project
    Network Anomaly Detection Utilizing Robust Principal Component Analysis Major Qualifying Project Advisors: PROFESSORS LANE HARRISON,RANDY PAFFENROTH Written By: AURA VELARDE RAMIREZ ERIK SOLA PLEITEZ A Major Qualifying Project WORCESTER POLYTECHNIC INSTITUTE Submitted to the Faculty of the Worcester Polytechnic Institute in partial fulfillment of the requirements for the Degree of Bachelor of Science in Computer Science. AUGUST 24, 2017 - MARCH 2, 2018 ABSTRACT n this Major Qualifying Project, we focus on the development of a visualization-enabled anomaly detection system. We examine the 2011 VAST dataset challenge to efficiently Igenerate meaningful features and apply Robust Principal Component Analysis (RPCA) to detect any data points estimated to be anomalous. This is done through an infrastructure that promotes the closing of the loop from feature generation to anomaly detection through RPCA. We enable our user to choose subsets of the data through a web application and learn through visualization systems where problems are within their chosen local data slice. In this report, we explore both feature engineering techniques along with optimizing RPCA which ultimately lead to a generalized approach for detecting anomalies within a defined network architecture. i TABLE OF CONTENTS Page List of Tables v List of Figures vii 1 Introduction 1 1.1 Introduction .......................................... 1 2 VAST Dataset Challenge3 2.1 2011 VAST Dataset...................................... 3 2.2 Attacks in the VAST Dataset ................................ 6 2.3 Avoiding Data Snooping ................................... 7 2.4 Previous Work......................................... 8 3 Anomalies in Cyber Security9 3.1 Anomaly detection methods................................. 9 4 Feature Engineering 12 4.1 Feature Engineering Process ................................ 12 4.2 Feature Selection For a Dataset..............................
    [Show full text]