The use of monitoring and intrusion detection tools are common in today's network security architecture. The combination of tools generates an abundance of data which can result in cognitive overload of those analyzing the data. ID analysts initially review alerts generated by intrusion detection systems to determine the validity of the alerts. Since a large number of alerts are false positives, analyzing the data can severely reduce the number of unnecessary and unproductive investigations. The problem remains that this process is resource intensive. To date, very little research has been done to clearly determine and document the process of intrusion detection. In order to rectify this problem, research was conducted which involved several phases. Fifteen individuals were selected to participate in a cognitive task analysis. The results of the cognitive task analysis were used to develop a prototype interface which was tested by the participants. A test of the participants' knowledge after the use of the prototype revealed an increase in both effectiveness and efficiency in analyzing alerts. Specifically, the findings revealed an increase in effectiveness as 72% of the participants made better determinations using the prototype interface. The results also showed an increase in efficiency when 72% of the participants analyzed and validated alerts in less time while using the prototype interface. These findings, based on empirical data, showed that the use of the task diagram and prototype interface helped to reduce the amount of time it previously took to analyze alerts generated by intrusion detection systems.

Single-Request/Multiple-Response (SRMR) is an important messaging exchange pattern because it can be used to model many real world problems elegantly. However, SRMR messaging is not directly supported by Web services, and, since it requires Callback to function it is hampered by current in-practice security schemes, such as firewalls and proxy servers. In this thesis, a framework will be proposed to support SRMR and Callback in the context of Web services and the realities of network security. The central component of the proposed solution is a Clearinghouse Web service (CWS), which serves as a communication proxy and realizes the correlation of responses with requests. One and only one CWS will be needed per enterprise that wishes to handle any number of SRMR Web services and their respective clients. Using the framework and related code generation utilities, a non-trivial case study, a Purchase Order System, has been implemented.

O termo grade computacional faz referência a uma classe de sistemas distribuídos que permitem a associação e a integração de múltiplos domínios em organizações virtuais. Um serviço de controle de acesso coerente a sistemas com estas características deve ser flexível para integrar múltiplas políticas, permitindo que administradores, sítios e usuários determinem as regras e os mecanismos para proteger seus recursos. Esta tese apresenta o GridMultiPolicy, um sistema flexível para o gerenciamento e a integração de múltiplas políticas e mecanismos para a efetivação de controle de acesso em ambientes de grade computacional. Adicionalmente, foram desenvolvidas políticas para demonstrar a capacidade do sistema proposto em oferecer respostas às necessidades presentes em cenários de uso de uma grade computacional. O impacto da utilização do GridMultiPolicy e das políticas desenvolvidas foi avaliado por meio de testes de desempenho. Palavras-chave: Grade computacional. Grades. Sistemas distribuídos. Políticas de segurança em organizações virtuais. GridMultiPolicy. / The term computational grid refers to a class of distributed systems that allows for the association and integration of multiple independent domains in virtual organizations. A coherent access control services in such a system should be flexible to integrate multiple polices so as to permit administrators, sites, and users to determine roles and mechanisms to protect their resources. This thesis introduces the GridMultiPolicy, a flexible system that manages and integrates multiple policies and mechanisms to enforce access control in grid environments. Additionally, policies have been developed to show how the proposed system is able to offer answers to security needs present in grid use scenarios. The impact of the GridMultiPolicy and the developed policies was evaluated by performance tests. Key-words: Computational grid. Grid. Distribuited system. Virtual organization. Policy and security for virtual organization. GridMultiPolicy.

Propõe-se uma estratégia de modelagem e de análise formal de políticas de segurança para sistemas baseados em fluxos de trabalho (workflows) e contendo regras que envolvam aspectos de lógica de negócios. Verifica-se com o auxílio de uma política de exemplo que a estratégia proposta resulta em modelos amplamente capazes de expressar restrições lógicas em função de parâmetros de negócio sem comprometer a viabilidade de suas análises. A modelagem baseia-se no uso de um metamodelo definido a partir da identificação das entidades que caracterizam o estado de proteção de um sistema e representado na forma de uma rede de Petri colorida. Por meio da escrita de predicados para consulta sobre o espaço de estados da rede de Petri, verifica-se o atendimento às regras de segurança no modelo formal. A tratabilidade da análise é garantida pela adoção de um paradigma diferenciado principalmente pela busca de ramos inseguros em vez de nós inseguros no espaço de estados e por explorar a natureza independente entre serviços de negócio distintos, expressa por restrições ao fluxo de informação no metamodelo. Tais restrições permitem que a análise seja fracionada evitando o problema da explosão de estados. O exemplo discutido de modelagem e análise de um sistema de serviços bancários online fornece evidências suficientes para atestar a aplicabilidade do método à validação de políticas de segurança para sistemas reais. / A strategy is proposed for the formal modeling and analysis of workflow- -based security policies having rules which involve aspects of business logic. Aided by an example of security policy, the proposed strategy is shown to lead to models widely capable of expressing logical restrictions as functions of business parameters without compromising the feasibility of its analyses. The modeling is based on the usage of a metamodel defined from the identification of the entities that characterize the protection state of a system, and represented as a colored Petri net. By writing predicates for querying the Petri net state-space, compliance with security rules at the formal model is verified. The feasibility of the analysis is ensured by the adoption of a paradigm distinguished mainly for the search for insecure branches rather than insecure nodes in the state-space, and for exploiting the independent nature among different business services, expressed by restrictions to the information flow within the metamodel. Such restrictions allow the analysis to be fractioned, avoiding the state explosion problem. The example provided of modeling and analysis of an online banking services system offers enough evidence to attest the applicability of the method to the validation of security policies for real-world systems.

The advancement of the internet across the globe has made computer users implement several ways of protection against possible network threats. The goal of this thesis is to analyse vulnerabilities and threats that may occur in a home network and design a vulnerability classification for home users with the help of Kali Linux. The classification is proposed and briefly evaluated. Computer network threats are also examined in this thesis together with the network vulnerabilities and corresponding network security recommendations for these systems. Home users have a need for security and privacy being provided. There have been a number of recent security breaches affecting home users leading to mistrust among the users. Due to different classification of threats, there is a need for a common threat classification scheme that can help to improve the understanding of threats among different researchers. This thesis focuses on investigating possible vulnerabilities in a home network and consequently designing a vulnerability classification for home users.

No description available.

Propõe-se uma estratégia de modelagem e de análise formal de políticas de segurança para sistemas baseados em fluxos de trabalho (workflows) e contendo regras que envolvam aspectos de lógica de negócios. Verifica-se com o auxílio de uma política de exemplo que a estratégia proposta resulta em modelos amplamente capazes de expressar restrições lógicas em função de parâmetros de negócio sem comprometer a viabilidade de suas análises. A modelagem baseia-se no uso de um metamodelo definido a partir da identificação das entidades que caracterizam o estado de proteção de um sistema e representado na forma de uma rede de Petri colorida. Por meio da escrita de predicados para consulta sobre o espaço de estados da rede de Petri, verifica-se o atendimento às regras de segurança no modelo formal. A tratabilidade da análise é garantida pela adoção de um paradigma diferenciado principalmente pela busca de ramos inseguros em vez de nós inseguros no espaço de estados e por explorar a natureza independente entre serviços de negócio distintos, expressa por restrições ao fluxo de informação no metamodelo. Tais restrições permitem que a análise seja fracionada evitando o problema da explosão de estados. O exemplo discutido de modelagem e análise de um sistema de serviços bancários online fornece evidências suficientes para atestar a aplicabilidade do método à validação de políticas de segurança para sistemas reais. / A strategy is proposed for the formal modeling and analysis of workflow- -based security policies having rules which involve aspects of business logic. Aided by an example of security policy, the proposed strategy is shown to lead to models widely capable of expressing logical restrictions as functions of business parameters without compromising the feasibility of its analyses. The modeling is based on the usage of a metamodel defined from the identification of the entities that characterize the protection state of a system, and represented as a colored Petri net. By writing predicates for querying the Petri net state-space, compliance with security rules at the formal model is verified. The feasibility of the analysis is ensured by the adoption of a paradigm distinguished mainly for the search for insecure branches rather than insecure nodes in the state-space, and for exploiting the independent nature among different business services, expressed by restrictions to the information flow within the metamodel. Such restrictions allow the analysis to be fractioned, avoiding the state explosion problem. The example provided of modeling and analysis of an online banking services system offers enough evidence to attest the applicability of the method to the validation of security policies for real-world systems.

O termo grade computacional faz referência a uma classe de sistemas distribuídos que permitem a associação e a integração de múltiplos domínios em organizações virtuais. Um serviço de controle de acesso coerente a sistemas com estas características deve ser flexível para integrar múltiplas políticas, permitindo que administradores, sítios e usuários determinem as regras e os mecanismos para proteger seus recursos. Esta tese apresenta o GridMultiPolicy, um sistema flexível para o gerenciamento e a integração de múltiplas políticas e mecanismos para a efetivação de controle de acesso em ambientes de grade computacional. Adicionalmente, foram desenvolvidas políticas para demonstrar a capacidade do sistema proposto em oferecer respostas às necessidades presentes em cenários de uso de uma grade computacional. O impacto da utilização do GridMultiPolicy e das políticas desenvolvidas foi avaliado por meio de testes de desempenho. Palavras-chave: Grade computacional. Grades. Sistemas distribuídos. Políticas de segurança em organizações virtuais. GridMultiPolicy. / The term computational grid refers to a class of distributed systems that allows for the association and integration of multiple independent domains in virtual organizations. A coherent access control services in such a system should be flexible to integrate multiple polices so as to permit administrators, sites, and users to determine roles and mechanisms to protect their resources. This thesis introduces the GridMultiPolicy, a flexible system that manages and integrates multiple policies and mechanisms to enforce access control in grid environments. Additionally, policies have been developed to show how the proposed system is able to offer answers to security needs present in grid use scenarios. The impact of the GridMultiPolicy and the developed policies was evaluated by performance tests. Key-words: Computational grid. Grid. Distribuited system. Virtual organization. Policy and security for virtual organization. GridMultiPolicy.

Submitted by Sandro Camargo (sandro.camargo@unipampa.edu.br) on 2015-05-09T19:15:36Z No. of bitstreams: 1 107110009.pdf: 1750995 bytes, checksum: 7c771ac4e6d9517bfe5c709731c3743e (MD5) / Made available in DSpace on 2015-05-09T19:15:36Z (GMT). No. of bitstreams: 1 107110009.pdf: 1750995 bytes, checksum: 7c771ac4e6d9517bfe5c709731c3743e (MD5) Previous issue date: 2013-07-25 / Um dos maiores desafios da implantação da Universidade Federal do Pampa como uma instituição pública de ensino superior no interior do Rio Grande do Sul é a estruturação de sua rede de dados. Devido às suas peculiaridades a rede de computadores da UNIPAMPA necessita de controles eficientes para garantir sua operação com estabilidade e segurança. Dessa forma, torna-se imprescindível o uso de sistemas confiáveis de comunicação que interliguem todas estas unidades descentralizadas. Em geral, a confiabilidade dos sistemas de comunicação pode ser melhorada em três grandes frentes de ação. 1) manipulação e codificação da informação, 2) melhoria de recursos como potência e banda nos canais de comunicação físicos 3) levantamento de métricas nos pontos de transmissão e recepção. A fim de colaborar neste processo, nosso trabalho consistiu na elaboração de uma proposta do uso de métricas na política de segurança desta rede, tornando mais eficiente a detecção de vulnerabilidades e a orientação de novas políticas de segurança e investimentos. As 10 métricas apresentadas e o método que foi utilizado para gerá-las podem ser aplicados em qualquer rede com características similares à rede da Unipampa. / One of the biggest challenges in the implementation of the University of Pampa as a public university in the countryside of the state of Rio Grande do Sul is the structure of its data network. Due to its peculiarities, the Unipampa's computer network needs efficient controls to ensure operations with stability and safety. Thus, it ecomes essential to use reliable communication systems that interconnect all these decentralized units. In general, the reliability of communication systems can be improved in three major areas of action. 1) anipulation and encoding of information, 2) improving resources such as power and bandwidth in communication physical channels 3) survey metrics at points of transmission and reception. Aiming to contribute in this process, our research consisted in elaborating a proposal of metric use in the security policy of this network, making the vulnerability detection more efficient as well as the orientation of new policies of safety and investment. The 10 metrics and presented method was used to generate them may be applied in any network with similar characteristics to the network of Unipampa.

With the rising trend of personal devices like laptops and smartphones being used in businesses and significant enterprises, the concern for preserving security arises. In addition to preserving security measures in outside devices, the network speed and performance capable by these devices need to be balanced with the security aspect to avoid slowing down virtual private network (VPN) activity. Performance tests have been done in the past to evaluate available software, hardware, and network security protocol options that will best benefit an entity according to its specific needs. With a variety of comparable frameworks available currently, it is a matter of pick and choose. This study is dedicated to developing a unique process-testing framework for personal devices by comparing the default security encryptions of different VPN architectures to the Federal Information Processing Standards (FIPS) set of complying encryptions. VPN architectures include a vendor-supplied VPN, Palo Alto Networks, open-sourced OpenVPN application, and a Windows PPTP server to test security protocols and measure network speed through different operating platforms. The results achieved in this research reveal the differences between the default security configurations and the encryption settings enforced by FIPS, shown through the collected averaged bandwidth between multiple network tests under those settings. The results have been given additional analysis and confidence through t-tests and standard deviation. The configurations, including difficulty in establishing, between different VPNs also contribute to discovering OpenVPN under FIPS settings to be favorable over a Palo Alto firewall using FIPS-CC mode due to higher bandwidth rate despite following the same encryption standards.