I recently came across a very nifty online tool for analyzing a host’s network called Netalyzr. It’s basically a java applet that, when started, kicks off a series of tests that can help users troubleshoot problems with their network. The Netalyzr analyzes various properties of your Internet connection that you should care about — including blocking of important services, HTTP caching behavior and proxy correctness, your DNS server’s resilience to abuse, NAT detection, as well as latency & bandwidth measurements — and reports its findings in a detailed report. Of course, it doesn’t seem to offer anything that other network analysis tools don’t, and it’s not very customizable with regards to which tests are run. However, the benefit is that[…]
Category: Technology & Tool Thursday
Each Thursday, Security Musings features a security-related technology or tool. Featured items do not imply a recommendation by Gemini Security Solutions.
One of the more common problems that I see among clients, especially smaller ones, is appropriate destruction of data before retiring/selling/destroying computer systems. If you’ve got a relatively modern system (i.e., SCSI, ATA or SATA drives), you can use Darik’s Boot And Nuke (DBAN). If you have an older system (mainframe, etc…), DBAN won’t really be able to help you out – I suggest a chainsaw and a hammer (or pay someone else to do it). If you can use DBAN though, it’s easy to use and comes with several types of wipes depending on your situation. DBAN supports a Quick Erase, RCMP TSSIT OPS-II, DoD Short (3 passes), DoD 5220.22-M (7 passes), Gutmann Wipe, and PRNG Stream as the[…]
Recently, Nick discussed how cross-site scripting (XSS) is one of the major areas of concern for Web application security and showed us how to avoid attacks from a coding perspective. Now, Mozilla Security has proposed a new defense against XSS called Content Security Policy (CSP).
Les Jordan from Microsoft recently wrote a blog post entitled Identity Management: a key to seamless CTMS and EDC. In it, he presents some of the solutions Microsoft is introducing in the identity management space, currently under the name of Microsoft Geneva including the Geneva Framework, and the Microsoft Identity Federation Gateway. The idea is fairly simple. Many (most?) large enterprises already manage their users and systems using Active Directory. Geneva allows publishing the components of your Active Directory required for doing identity federation on the Internet. The publishing is performed in a standards-compliant way (using WS-* and SAML 2.0) and allows it to be used for claims between enterprises. …the issue of Identity Management, Username and Password proliferation, and[…]
With the release of the new iPhone 3.0, I thought it would be worth visiting some useful security-related iPhone applications. These are 4 good security applications for the iPhone that will make you the coolest person at the next IT security conference. 1Password (Cost: $4.99) – This application encrypts your iPhone data using AES, effectively features single sign-on to websites, and adds an extra unlock code layer to your device – using a single password. The power of this application is in the encryption, and has some other goodies like password generation and secure notes built in as well as a desktop version and syncing (for extra). RSA SecurID Software Token (Cost: Free) – SecurID relies on 2-factor authentication, and[…]
This post isn’t going to deal with security directly, but rather with two command line tools that come with the .NET framework. The tools, WSDL.exe and XSD.exe, are used to easily create .NET wrapper classes to deal with web services and XML files, respectively. Both of these command line tools are installed alongside the .NET framework (on my machine, they’re located in C:\Program Files\Microsoft SDKs\Windows\v6.0A\bin, although if you start the Visual Studio command prompt, they should be accessible via PATH entries anyway). The WSDL tool can quickly create a .NET class that can invoke remote web services given a WSDL service definition. A quick example of how to use the tool would be to open a command prompt and type:[…]