As vendors and network administrators increase their focus on security, information attacks are diversifying away from a reliance on traditional vulnerability vectors.  Currently, a patched machine behind a well-configured firewall can repel a significant portion of the malicious traffic being sprayed across the internet.  As a result, there has been an increase in focus on vulnerabilities that penetrate through most firewalls - browser-based vulnerabilities.  Whether malware is introduced inadvertently by an employee installing a game that includes spyware, or whether the hosted website, itself, has the capacity to compromise the hosts that visit the site, browser-based vulnerabilities are quickly becoming a prominent threat in network security arena.  Content-filtering software and hardware has been marketed to protect against these and similar threats.  We explore the problems that content filters hope to address, the methods by which they can address the problems, and mention a few selected content filtering products.

Available (pdf or doc)

Bitlocker is a new and well-publicized feature of Windows Vista intended to protect data on machines in the case that they are physically compromised.  Bitlocker encrypts an entire Windows volume and prevents access through a secure startup feature bound to either an existing Trusted Platform Module (TPM) or to a removable USB key.  Bitlocker has some limited effects on performance and data corruption.  Further, it affects typical "imaging" software in a way that may cause difficulties for larger operations.  It has also been advertised as a more efficient way to perform data destruction, a claim which we investigate.  Currently shipping PCs, especially from Dell, do not allow analysts to test the TPM features due to insufficient support in BIOS, but the basic functionality can be tested with USB keys, and no major problems have been identified.

Available (pdf or doc)

In an attempt to examine methods to reduce remote access breaches via SSH, the Security Center has compiled some recommendations on strengthening UNIX-based systems that use the SSH service.  The document focuses mainly on hardened SSH configuration and strong password enforcement and provides specific examples of changes that can be made.  With several simple changes to the default SSHd configuration and the use of TCP wrappers, systems can be made more secure against dictionary attacks and administrator-level account breaches.  Because the Security Center has observed most breaches to be attacks against weak passwords, tools for setting and enforcing strong password policies on FreeBSD and Linux are discussed.  Finally, implementation issues such as user acceptance, wide-scale configuration deployment, and auditing are commented on. 

Available (pdf or doc)

Recently, Microsoft has taken steps to promote Sender ID as part of its solution to the problems of spam and phishing.  Microsoft is adding Sender ID support in its next Service Pack for Exchange 2003, and it is utilizing Sender ID with its Hotmail service.  Sender ID works by verifying the sender's purported domain against permitted IP addresses designated in a text file in DNS.  Although the solution is helpful in conjunction with other anti-spam tools, it is not a silver bullet to the spam problem.  Sender ID is susceptible the same vulnerabilities as DNS because it is built upon DNS.  Moreover, it may also result in a high number of false positives resulting in the rejection of valid email because of the way it determines the sender's domain name.  This paper provides an overview of how Sender ID works, provides an installation guide for use in a Linux environment, evaluates the performance of Sender ID, and explains several shortcomings of the technology. 

Available (pdf or doc)

The SEWPSC has endeavored to simplify the description of the requirements mandated in FIPS 201 by creating a FAQ.

This document provides answers to commonly asked questions about Federal Information Processing Standard (FIPS) 201, which requires federal agencies to implement uniform identity management systems for physical and logical access to federal facilities and systems. FIPS 201 requires a uniform identity proofing process, as well as the use of an interoperable smart card. In FIPS 201, NIST refers to its Special Publication 800 series to provide additional guidance. We have provided summaries of and links to those documents. Additionally, this document provides information about the privacy requirements for FIPS 201 and an overview of the Privacy Act of 1974.

The FIPS 201 FAQ is available (pdf or doc)

On Tuesday, June 1st, 2004, the SEWP Security Center held a Symposium on Identity Management. The keynote speakers for the symposium were Whitfield Diffie and Kevin Mitnick. Technical presentations were supplied by speakers from Boeing, Lockheed Martin, Liberty Alliance, NIST, OASIS, The Open Group, and Microsoft. We would like to thank each of the presenters for helping to make the day a success. We were highly encouraged by the positive response through comments and through the evaluation scores.

The presentations and other information about the symposium are available here.