Internet Sicherheit 2

Get Started. It's Free
or sign up with your email address
Internet Sicherheit 2 by Mind Map: Internet Sicherheit 2

1. Risk Management

1.1. Risiko

1.1.1. Assets (Information)

1.1.2. Protection

1.1.3. Vulernabilities

1.1.4. Threats

1.2. ISO

1.2.1. 27005 Information security risk management

1.2.2. 27001 Risikoidentifikation Risikobewertung Fehler-Möglichkeits- und Einflus-Analyse Hazard and Operability Study Hazard Analysis and Critical Control Points Zurich Hazard Analysis NIST - Risk Management Guide for Information Technology Systems Risikosteuerung Vermeiden Vermindern Abwälzen Selbst tragen Risikoüberwachung, Reporting

1.2.3. 27002 von BSI UK

1.3. British Standards Insitute

1.3.1. BS 25999 (BCM) Analysis Solution Design Implementation Testing and organization acceptance Maintenance

1.4. BSI Grundschutzhandbuch

1.4.1. Schichten Anwendungen übergreifende Aspekte Infrastruktur IT-Systeme Netze/Netzwerke

1.4.2. Gefährdungskatalog höhere Gewalt Blitz, Unwetter, Feuer, Wasser, Krankheit Technisches Versagen Ausfall von Komponenten (Disk, Power) Organisatorische Mängel Zuständigkeiten nicht klar Menschliches Fehlverhalten Fehler beim Einspielen von Patches, Auskunft an falsche Personen (Social Engineering), vertrauliche Informationen im Zug diskutiert vorsätzliche Handlungen Hacking, Vandalismus, Einspielen von Malware

1.4.3. Massnahmenkatalog Infrastruktur Hardware/Software Kommunikation Organisation Personal Notfallvorsorge

2. Server Side Security

2.1. Open Web Application Security Project( OWASP)

2.1.1. 1. Injection SQL Injection ' OR 1 = 1' Counter measures escaping prepared statements (Java) parameter collection (.NET)

2.1.2. 2. Cross-Site Scripting (XSS) Reflected XSS Link an Opfer mit JS Code Stored XSS Daten speichern (Forum)

2.1.3. 3. Broken Authentication and Session Management Verbose login forms (Username is wrong) Session-IDs stored in server logs Prevention Send session id over HTTPS only Use restrictive cookie parameters Use non-persistent session tracking techniques Non-guessable session ids Provide a logout button for users Change Session after successful authentication

2.1.4. 4. Insecure Direct Object Reference Access to lower layer/backend with a technincal user access to restricted sites

2.1.5. 5. Cross-Site Request Forgery (XSRF) Prevention nonce for special actions (buy, sell ...)

2.1.6. 6. Security Misconfiguration Telling about system (exposing details)

2.1.7. 7. Insecure Cryptographic Storage eg. passwords stored in cleartext using own "security algorithms" keys/salt publicly available hash=SHA-256(password + salt) => store hash, salt

2.1.8. 8. Failure to Restrict URL Access Pages with admin actions are not or weakly protected Access to pages, which aren't allowed with the logged in profile evaluating user rights only on the client Prevention Input Validation Server Hardening

2.1.9. 9. Insufficient Transport Layer Protect Vulnerabilities SSL/TLS missing Weak SSL version enabled (SSLv2) Weak cipher suites enabled (e.g. NULL cipher) Invalid server certificate Weak server certificate Remediation Enable SSL/TLS to protect session information Enable SSLv3, TLSv1 only Enable strong cipher suites only (SHA-1 in combination with AES-128+) Acquire publicly trusted server certificate Ensure certificate key material has at least 2048 Bits

2.1.10. 10. Unvalidated Redirects and Forwards Prevention Validate parameters containing redirect URLs Use "symbols" for redirections which get mapped to URLs server-side Prefix URL with / to get an URL relative to the current site

2.1.11. OWASP Enterprise Security API (ESAPI)


2.2.1. Open Source Security Testing Methodology Manual

2.2.2. Netzwerk Security, weniger Anwendungsecurity

2.2.3. Vorgehen Quantifizierbarkeit / RAV (Risk Assesment Value) Verhaltenskodex für Tester Security Test Audit Report Dokumentation Vollständigkeit und Genauigkeit Gesetzt- und Standartkonform Zertifizierungsmöglichkeit

2.2.4. Components Physical Security Human Spectrum Security Wireless Communications Security Data Networks Telecommunications

2.2.5. Definition Security Test Scope Assets/Targets Definition Areas of interactions External impacts on assets Interactions of asset with itself and outside Equipment needed for test Expected results of the test Compliance with rules of engagement

3. True Random Number Generation

3.1. HMAC

3.2. Sources

3.2.1. Key Stroke Timing

3.2.2. Mouse Movements

3.2.3. Sample Sound Card Input verify entropy but pretty in combination with other methods

3.2.4. Network Packet Arrival Time can be manipulated

3.2.5. Serial numbers very, very bad idea, can be guessed / calculated

3.2.6. Lava Lamps

3.2.7. Radioactive Decay

4. Smartcards

4.1. Filesystem

4.1.1. 3F00 MF Root Directory

4.1.2. 0000 EF Pin & Puk #1

4.1.3. 0100 EF Pin & Puk #2

4.1.4. 0011 EF Management Keys

4.1.5. 0001 EF Application Keys

4.2. Usage

4.2.1. Public Key based login

4.2.2. SSL/TLS client side authentication

4.2.3. S/MIME

4.2.4. VPN User/Host authentication

5. Voice-over-IP Security

5.1. Securing the media stream

5.1.1. SRTP needs secret master key Multimedia Internet KEYing

5.1.2. IPsec IKE large overhead in RTP audio packet 60 - 80 bytes / packet

5.2. MIKEY

5.2.1. Diffie Hellman

5.2.2. RSA Public Key Encryption Method

6. Anonymity

6.1. Mix Functionality

6.1.1. Drop message duplicates doppelt ankommende Packete löschen, da sonst Packete verfolgt werden können

6.1.2. Decryption Server muss mit privatem Schlüssel Packet entpacken, um nächsten HOP zu erkennen und mit richtigem Schlüssel zu verschlüsseln

6.1.3. Message re-sorting buffer soll Timing-Analysis-Attack verhindern Packete verlassen HOP in zufälliger Reihenfolge

7. Buffer Overflows

8. Software Security

9. Web Services Security

10. Client Side Security