Network Intrusion Detection System (IDS) - Sax2

Ax3soft Sax2 is a professional intrusion detection and prevention system (IDS) used to detect intrusion and attacks, analyze and manage your network which excels at real-time packet capture, 24/7 network monitor, advanced protocol analysis and automatic expert detection.

With insight into all operations in your network, Sax2 makes it easy to isolate and solve your network security problems - detect network vulnerabilities, identify network security threats, catch actions against of security strategy and signs of been attacked. Finally, intercept and stop these connections.

Sax2 offers many kinds of intrusion analysis reports, such as events, type, source address and destination address of attacks, and many crossover reports and compositive reports. Furthermore, sax2 allows customize the time range which administrator will flexible monitor and evaluate the network security.

Sax2, enhanced detection, analysis, response and management features, supports almost all common used protocols, self-contained and high speed update event database. It will compose an active detection as the core of dynamic Security Defense System with other network security software, such as Firewall and anti-virus.

Key Features:

Intrusion Detection and Prevention

Detects variety of complex attacks in your network, including pre-attack detection, password guessing, denial of service attacks (DoS/DDoS), buffer overflow attacks, CGI/WWW attacks, windows vulnerabilities attacks, Unix vulnerabilities attacks, unauthorized access, SQL inject attacks, worms, backdoor Trojans, ARP spoof, and so on. And then, Sax2 intrusion detection system will initiatively stop the dangerous behavior to prevent your whole network.
Real-Time Alert and Response.

Multiple response modes - send console message, logs, e-mail inform, real-time cut off the connection, flexible logs.
Stable performance.
Sax2 works in 7/24/365 with stable performance.
Real-time monitor analyze and alarm.
Besides real-time monitor network communication, Sax2 also offers analyze and alarm in real time to protect your network security.
Huge data storage.

Sax2 supports many database, such as SQL Server, Access and so on, which let user to store the huge data flexibly.
Plenty reports

With the plenty reports, administrator will easily to monitor attacks and evaluate network security with Sax2.
Customize Security Policy
According to your own network, IT professional may customize the security policy to improve the accuracy of intrusion detection.
Network Based
Sax2 intrusion detection system is a network-based IDS. It collects, filters, and analyzes traffic that passes through a specific network location. A single Sax2 monitor, strategically placed at a key network junction, can be used to monitor all incoming and outgoing traffic for the entire site. Sax2 does not use or require installation of client software on each individual, networked computer.
Other Features
Name Table

The name table allows you to make or edit alias for addresses, ports and protocols, you may also specify the text color for a selected item. This useful feature can make packet-related information familiar and intelligible.
support multi-adapters..

If you have more than one adapters installed on the local machine, Sax2 intrusion detection system can capture the traffic on all the adapters.
In-depth Packet Decoding

Provides detail packet decoding information.
Conversation & Packet Stream.

Monitor all conversations and reconstruct packet stream.
Logs of Events
Records the actions and sensitive events in whole network, including the WEB browse, Email transmission, FTP transfers and instant message - MSN to help network administrators identify potential threats.

Who Needs Intrusion Detection Systems (IDS) - Sax2?

Want to monitor and prevent hacker attacks, Protect network & business from internal threats!
Wanted to log the websites that your users were visiting.
Needed to monitor corporate communications, both in email messages and on instant messaging platforms.
Wanted a network monitoring solution that did not require client installation at individual workstations.

Gpg4win

Gpg4win

The Gpg4win initiative aims to provide a current Gpg4win Windows installation package including the GnuPG encryption tool and associated applications. The documentation ("Gpg4win Compendium" and "Novices") is directly maintained as part of the Gpg4win project.

Another goal is to support both relevant cryptographic standards, OpenPGP and S/MIME in a unified way.

Gpg4win is an international effort. Due to the origin of the project and many members, there is a full German translation. Additional translators are welcome!

The main difference compared to all similar approaches (mainly GnuPP, GnuPT, Windows Privacy Tools and GnuPG-Basics) is that the first piece developed was the Gpg4win-Builder. This builder allows to easily create new gpg4win.exe installers with updated components. It runs best on a GNU/Linux system. Almost all products are even automatically cross-compiled for integration into the installer.

This concept raises hope to practically prevent quick aging of the installer package because updating is easier and does not depend on a single person.

You can choose all or some of the following modules during installation:

GnuPG: The core; this is the actual encryption tool.
Kleopatra: A certificate manager for OpenPGP and X.509 (S/MIME) and common crypto dialogs.
GPA: Another certificate manager for OpenPGP and X.509 (S/MIME).
GpgOL: A plugin for Microsoft Outlook 2003 and 2007 (email encryption).
GpgEX: A plugin for Microsoft Explorer (file encryption).
Claws Mail: A complete email program including the plugin for GnuPG.
Gpg4win Compendium: The new (German!) documentation about Gpg4win2 (translation already scheduled).
Gpg4win for Novices: The old English handbook about Gpg4win1 (for newbies).

Gpg4win can be installed and tested with just a few mouse clicks. Of course you should be administrator of your system or have administration rights.

Waht is CrypTool ?

CrypTool Introduction

The application CrypTool is a free e-learning application for Windows. You can use it to apply and analyze cryptographic algorithms. The current version of CrypTool (Download) is used all over the world. It supports both contemporary teaching methods at schools and universities as well as awareness training for employees and civil servants.
The current version offers beside others the following highlights:
Numerous classic and modern cryptographic algorithms (encryption and decryption, key generation, secure passwords, authentication, secure protocols, ...)
Visualisation of several methods (e.g. Caesar, Enigma, RSA, Diffie-Hellman, digital signatures, AES)
Cryptanalysis of certain algorithms (e.g. Vigenère, RSA, AES)
Crypt-analytical measuring methods (e.g. entropy, n-grams, autocorrelation)
Auxiliary methods (e.g. primality tests, factorisation, base64 coding)
Tutorial about number theory
Comprehensive online help
Supportive script with further information about cryptology
From its original use of information security training for a company, CrypTool has developed into an outstanding open source project for cryptology related topics.
Since spring 2008, the CrypTool project has been operating the Crypto Portal for Teachers. Thus far, the portal is only available in German and is intended to act as a platform for teachers to share teaching materials about cryptology and related links.
Since spring 2009, the CrypTool project has also been operating the webseite CrypTool-Online. This portal gives people interested in cryptology the possiblity to try out a variety of ciphers and encryption methods in their own browser without downloading and installing any kind of software. On this website for first-time users and young people we provide cryptology in an appealing and easy way. For advanced tasks and problems there is still the offline version of CrypTool which can be downloaded and installed.
Currently the CrypTool team is working on two projects intended to become the successors of the current release version CrypTool 1.4.x which has been written in C++. Both follow-up projects use state-of-the-art standards of software development, but are still in beta status:
CrypTool 2.0 is developed in C# with Visual Studio 2008 (Express Edition) and WPF. In July 2008 the first beta version (for developers and end users) has been released. It is continuously updated. CrypTool 2.0 provides a fully developed architecture and usable cryptographic functionality combined with a pathbreaking drag-and-drop GUI.
JCrypTool is developed in Java and based on Eclipse RCP. The current beta version (called milestone 5, intended for developers and users) has been released in September 2009. JCrypTool is platform independent (Windows, Linux, Mac) and makes use of the FlexiProvider (a powerful toolkit developed by the TU Darmstadt) and BouncyCastle for the Java Cryptography Architecture JCA.

Microsoft Security Essentials Antiviruse

About Microsoft Security Essentials

Microsoft Security Essentials provides real-time protection for your home PC that guards against viruses, spyware, and other malicious software.
Microsoft Security Essentials is a free* download from Microsoft that is simple to install, easy to use, and always kept up to date so you can be assured your PC is protected by the latest technology. It’s easy to tell if your PC is secure — when you’re green, you’re good. It’s that simple.
Microsoft Security Essentials runs quietly and efficiently in the background so that you are free to use your Windows-based PC the way you want—without interruptions or long computer wait times.
Learn more at the Microsoft Malware Protection Center
Find information, definitions, and analyses of all the latest threats that Microsoft Security Essentials can help protect you against in the Microsoft Malware Protection Center
Need security for your business? Protect your computers with Microsoft Forefront Client Security
*Your PC must run genuine Windows to install Microsoft Security Essentials. Learn more about genuine

Free open-source disk encryption

Introduction

TrueCrypt is a software system for establishing and maintaining an on-the-fly-encrypted volume (data storage device). On-the-fly encryption means that data is automatically encrypted or decrypted right before it is loaded or saved, without any user intervention. No data stored on an encrypted volume can be read (decrypted) without using the correct password/keyfile(s) or correct encryption keys. Entire file system is encrypted (e.g., file names, folder names, contents of every file, free space, meta data, etc).

Files can be copied to and from a mounted TrueCrypt volume just like they are copied to/from any normal disk (for example, by simple drag-and-drop operations). Files are automatically being decrypted on the fly (in memory/RAM) while they are being read or copied from an encrypted TrueCrypt volume. Similarly, files that are being written or copied to the TrueCrypt volume are automatically being encrypted on the fly (right before they are written to the disk) in RAM. Note that this does not mean that the whole file that is to be encrypted/decrypted must be stored in RAM before it can be encrypted/decrypted. There are no extra memory (RAM) requirements for TrueCrypt. For an illustration of how this is accomplished, see the following paragraph.

Let's suppose that there is an .avi video file stored on a TrueCrypt volume (therefore, the video file is entirely encrypted). The user provides the correct password (and/or keyfile) and mounts (opens) the TrueCrypt volume. When the user double clicks the icon of the video file, the operating system launches the application associated with the file type – typically a media player. The media player then begins loading a small initial portion of the video file from the TrueCrypt-encrypted volume to RAM (memory) in order to play it. While the portion is being loaded, TrueCrypt is automatically decrypting it (in RAM). The decrypted portion of the video (stored in RAM) is then played by the media player. While this portion is being played, the media player begins loading next small portion of the video file from the TrueCrypt-encrypted volume to RAM (memory) and the process repeats. This process is called on-the-fly encryption/decryption and it works for all file types, not only for video files.

Note that TrueCrypt never saves any decrypted data to a disk – it only stores them temporarily in RAM (memory). Even when the volume is mounted, data stored in the volume is still encrypted. When you restart Windows or turn off your computer, the volume will be dismounted and files stored in it will be inaccessible (and encrypted). Even when power supply is suddenly interrupted (without proper system shut down), files stored in the volume are inaccessible (and encrypted). To make them accessible again, you have to mount the volume (and provide the correct password and/or keyfile).

Encryption Algorithms

TrueCrypt volumes can be encrypted using the following algorithms:

Algorithm	Designer(s)	Key Size (Bits)	Block Size (Bits)	Mode of Operation
AES	J. Daemen, V. Rijmen	256	128	XTS
Serpent	R. Anderson, E. Biham, L. Knudsen	256	128	XTS
Twofish	B. Schneier, J. Kelsey, D. Whiting, D. Wagner, C. Hall, N. Ferguson	256	128	XTS
AES-Twofish		256; 256	128	XTS
AES-Twofish-Serpent		256; 256; 256	128	XTS
Serpent-AES		256; 256	128	XTS
Serpent-Twofish-AES		256; 256; 256	128	XTS
Twofish-Serpent		256; 256	128	XTS

For information about XTS mode, please see the section Modes of Operation.

Two-Factor Authentication (2FA)

Two-Factor Authentication (2FA) is also known as Dual Factor Authentication (DFA)

When you think of all that happens online and you consider all that goes on in the ‘networked’ world, you can start to appreciate the tremendous need for strong security measures to protect online assets, data and communications.

Authentication is the cornerstone of any vigilant network security solution. And the authentication method used to protect the vast majority (90+%!) of networks (user names and passwords) is a 50 year-old solution designed when there were no networks, no Internet… in fact, next to no computers!

Passwords suffer from a number of weaknesses that make them an ineffective security measure for your network - they are easy to steal, easy to hack and hard to remember. The result is both reduced network security and increased help-desk costs for resetting passwords.

Solving the problem = Dual Factor Authentication (DFA)

Dual Factor Authentication (DFA), also known as Two-Factor Authentication (2FA) is directly analogous to the way one ‘authenticates’ to an Banking Machine – you use something only you have (your unique bank card) and something only you know (your secret PIN) to identify yourself to the system.

It is very similar in the networked world, the ‘something only you have’ is a password-generating authenticator or token. The ‘something only you know’ is, again, a secret PIN.

Token = One-Time Passwords

Your token is your key to the network – it generates a new password every time you logon. Your PIN validates that you are the rightful owner of the token. You can choose from several varieties of tokens all of which do the same thing, they generate a new secure, random ‘One-Time Password’ for every logon. Anyone key-logging or shoulder surfing your password will have a worthless string of letters and numbers as the password will work once and only once. Next logon a new random, One-Time Password is generated.

This secure method of dual factor authentication (DFA) does what static passwords cannot, it gives you the confidence and peace-of-mind that a user logging on to the network, really is who he or she claims to be and not someone just using a stolen, lost or shared password.

We are a leader and innovator in Dual Factor Authentication (DFA) /& Two-Factor Authentication (2FA) with our multi-award winning server and managed services based solutions.

Most two-factor systems rely on a password or PIN and something else, but that "something else" varies widely. In some cases, the "something else" is your computer. The system takes a hardware and software snapshot of your computer configuration and uses that information to identify you. This approach has the advantage of being as simple as using a password. The disadvantages are that the system has to go snooping around in your computer to identify you, and this setup ties your "identity" to a single computer.

Windows' authentication architecture makes it easy to add new forms of authentication. Windows uses a DLL called Graphical Identification and Authentication (GINA) to connect the authentication method to the Windows authentication system. It's easy to write alternate DLLs for GINA, to use any authentication method the software designer wants.

FTester -- Firewall and IDS Testing tool

Description:

The Firewall Tester (FTester) is a tool designed for testing firewalls filtering policies and Intrusion Detection System (IDS) capabilities.

The tool consists of two perl scripts, a packet injector (ftest) and the listening sniffer (ftestd). The first script injects custom packets, defined in ftest.conf, with a signature in the data part while the sniffer listens for such marked packets. The scripts both write a log file which is in the same form for both scripts. A diff of the two produced files (ftest.log and ftestd.log) shows the packets that were unable to reach the sniffer due to filtering rules if these two scripts are ran on hosts placed on two different sides of a firewall. Stateful inspection firewalls are handled with the 'connection spoofing' option. A script called freport is also available for automatically parse the log files.

Of course this is not an automated process, ftest.conf must be crafted for every different situation. Examples and rules are included in the attached configuration file.

The IDS (Intrusion Detection System) testing feature can be used either with ftest only or with the additional support of ftestd for handling stateful inspection IDS, ftest can also use common IDS evasion techniques. Instead of using the configuration syntax currently the script can also process snort rule definition file.

These two scripts were written because I was tired of doing this by hand (with packet-crafting tools and tcpdump). I hope that you enjoy them.

Andrea Barisani andrea@inversepath.com

Features:

- firewall testing
- IDS testing
- simulation of real tcp connections for stateful inspection firewalls and IDS
- connection spoofing
- IP fragmentation / TCP segmentation
- IDS evasion techniques

Requirements:

The following perl modules are required: Net::RawIP, Net::PcapUtils, NetPacket

Download:

The most recent release is ftester-1.0.tar.gz
All releases at available at http://dev.inversepath.com/ftester.

Documentation:

Man page (ftester.8)
README
TISC Insight, Volume 5, Issue 6: Testing firewalls and IDS with Ftester