MVC View Not Found Misdirection

I recently came across the following error:

I was deploying to a discountasp.net and could think of an infinite causes of the problem. I decided to write a simple little code block to verify the view was there and accessible:

This confirmed that the file was in fact there. Sure that the problem had to be with discountasp.net, I sent them an email and slept on it. Their response was that it was my fault:

I tried searching their forum and found it lacking so did some google searching when I found this:

http://forums.asp.net/p/1592374/4038196.aspx

Which basically states the obvious – what about your master page? Yeah – what about my master page? Wait – why didn’t my master page publish…?

Well that would do it… no idea how that happened – I wouldn’t have changed it on purpose.

Problem resolved – hopefully this saves someone else some time.

PDC Downloader

Below is a super simple (hardly resilient) PDC downloader. Feel free to compile and tweak it to your hearts content.

using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Xml.Linq;

namespace ConsoleApplication1
{
     public class Video
    {
        public string title;
        public string description;
        public string url;
    }
    class Program
    {
        static void Main(string[] args)
        {

          

            var doc = XDocument.Load("http://videoak.microsoftpdc.com/pdc_schedule/Schedule.xml");
            var sessions = doc.Descendants("Sessions").Descendants("Session").Where(session => session.Descendants("DownloadableContent").Descendants("Content").Where(content=> content.Attribute("Title").Value.ToLower().Contains("mp4 high")).Count() > 0);
            var videos = sessions.Select(s =>
                                         new Video()
                                             {
                                                 title = s.Descendants("ShortTitle").Single().Value,
                                                 description = s.Descendants("ShortDescription").Single().Value,
                                                 url =
                                                     s.Descendants("DownloadableContent").Descendants("Content").Where(
                                                         content =>
                                                         content.Attribute("Title").Value.ToLower().Contains("mp4 high"))
                                                     .First().Attribute("Url").Value
                                             });
            var downloadableVideos = videos.ToList<Video>();

            var failedLog = new List<Video>();
            for (var count = 0; count < downloadableVideos.Count; count++)
            {
                var video = downloadableVideos[count];
                try
                {
                    DownloadFile(video);
                }
                catch
                {
                    Log("Failed to download " + video.title);
                    try
                    {
                        var path = video.title + ".mp4";
                        if (File.Exists(path))
                        {
                            File.Delete(path);
                        }
                    }
                    catch
                    {
                        Log("Failed to delete " + video.title+ ".mp4");
                    }
                }
            }
            var x = failedLog.Count;
        }

        private static void Log(string msg)
        {
            Console.WriteLine(msg);
        }

        private static void DownloadFile(Video video)
        {
            if (!System.IO.File.Exists(video.title + ".mp4"))
            {
                var webClient = new System.Net.WebClient();
                Log("Downloading " + video.title);
                webClient.DownloadFile(video.url, video.title + ".mp4");
            }
            else
            {
                Log("Skipping " + video.title + " - it has already been downloaded");
            }
        }
    }
}

XNA Conference–Lack of VB

I recently attended a user group meeting with http://augustadevelopers.org/ by Chris Williams http://geekswithblogs.net/cwilliams/Default.aspx covering XNA Games for Windows 7.

The new Windows 7 phone is living up to its hype. The little the I played with it  - it proved to be just as snappy as an iPhone. You won’t see me trading in my Droid just yet but credit is due!

I was surprised at the XNA conference to find that XNA currently doesn’t support VB. It is important to point out that the XNA team is small, and support for VB is on their (someday) feature list. The fact that it was even optional by MS came to me as a surprise.

I recently landed a new job where they prefer VB. This has forced me to take a step back and analyze the difference between C# and VB. I started out with VBA and VB.NET but in my last job I fell in love with C#. I now find myself wondering if I have a good reason to like C# over VB or if it is just a comfort bubble. I am finding that there are far more reasons to go with C# than VB.

One of the most convincing arguments has been the close relationship C# has with other languages. I have found very few developers embrace JavaScript and far fewer (none that I know personally) have been VB purists. JavaScript might as well be chinese to a VB purist, while a C# developer can stumble through it with little or no knowledge of the language rules.

Less important (for me) is the transition to other platforms like C++ and Java. VB has the advantage of VBA and VisualFoxPro but VisualFoxPro is already in end of life and I believe VBA is (or already has) gone to .NET which will mean that you can use either language.

Another point worth mentioning is that a majority of the documentation on the internet, in books, at conferences is all C#. Check out PDC – how many videos are in VB?

At the end of the day – I believe that each language has its strengths – and being flexible to the language is a must. But those that say you should be completely language agnostic ignore the fact that by focusing and embracing on a language – you become a master with the language. The language becomes a tool and as such – an extension of your creative ability. Being (too) language agnostic will create an implementation barrier as you are unable to gain momentum. Your intelligence is shifted from business logic problems and onto syntactic problems.

Cool videos on WCF

http://mtaulty.com/CommunityServer/blogs/mike_taultys_blog/archive/2006/09/13/8875.aspx

MCITP SQL Server 2008 Cram

Data Types:

• Filestream - data is actually stored in NTFS NOT in SQL. SQL provides the filestream to access the data. For those that don't have experience programming or with file streams: a when not using file stream, the file must be loaded from the database into SQL memory, then served to the client. If the file is large, this consumes a great deal of memory. With filestreams we essentially stream the file to the client as we can - minimizing the strain on memory. Research shows that > 1 MB is more efficient in NTFS. Also NTFS doesn't share the SQL 2 GB Blob limit. Source
  

Performance / Monitoring

• Data Collectors can be used to collect data from several sources, for example if you want to correlate performance issues it would be helpful to see what TSQL statements are running (otherwise you would use SQL Profiler), blocking and deadlock (otherwise you would use SQL Profiler or Dynamic Management Views), and system counters like cpu, memory, disk (System Monitor). Using Data Collectors you can capture all of these and correlate the data to determine when the server is slow, what query is running, and why.
  
• Affinity - is the coupling of a thread to a processor. From an OS perspective - it is ideal to be able to move threads from one processor to another as the OS sees fit. So from an OS perspective affinity is a bad thing. So why would we have affinity - the SQL server can recognize that the data required by the thread is also going to be needed by other threads. So it can queue them together using affinity. When affinity is not set - the OS - not knowing better - will move the thread - then the required data (which is already in the preferred processor cache) will have to also be loaded into that processor's cache. Source 1, 2
• Extended Events - ...
• Partitioning - Vertical partitioning - think one-to-one relationship - which allows us to move a group of columns to another table. This can be very beneficial if we have a group of columns that are often needed together but not very often. Now the queries that happen more often will not have to include these columns (by not joining to this table). Horizontal partitioning - think union - move certain rows to another table (or filegroup). This is often done by moving records(rows) older than X (3 months) to a History/Archive table. This can greatly improve performance as indexes and the like don't have to reconstruct for every record but only those in the current (within 3 months) data. What is even cooler, is that this can be done at a lower layer by using file groups - so that to the client (user / application) it is just one table, but under the covers, using a partition function, old data goes to one file group while new data goes to another file group. Source
• 
  

High Availability / Disaster Recovery

• Log shipping - allows you to transmit your log (record of every transaction) to another instance - likely far away over serial link - if the primary server goes down - the data is not lost and clients can be pointed to this backup and resume operations

Security

• Trustworthy - Database option - while a database is offline - someone could tamper with the database (ie, execute as SA, etc.). This trustworthy flag allows you to limit what the database can do. By default it is off and the database should not need trust beyond its scope. Source
• EXTERNAL_ACCESS vs SAFE - SAFE is more restrictive as it doesn't allow you to be able to access external like files, networks, environment variables, registry. Source
  

FREENAS and iSCSI for Server 2008 Clustering

Great walk through http://www.trainsignaltraining.com/how-to-setup-iscsi-drive-using-freenas/2009-01-19/

PS. Once the drive shows up in computer management on Server 2008 - it may be offline (with some bogus error about security policy). Right click offline and click online. You will likely also need to right click again and initialize. Then you should be able to right click the drive and partition.

Great video on Server 2008 Quorum http://www.youtube.com/watch?v=j9E1LgLwG88

CISSP - Operations Security

Scanning identifies open ports - fingerprinting identifies OS / Application - this can be active (creating the traffic) or passive (watching existing traffic)

War Chalking - used to indicate where wireless networks are

TCSEC Assurance Levels -

1. System Architecture
2. System Integrity
3. Covert Channel Analysis
4. Trusted Facility Management
5. Trusted Recovery

Common Criteria - Recovery

1. Manual Recovery
2. Automated Recovery
3. Automated Recovery without Undue Loss

Componenets
1. failure preparation(backups), system recovery

CISSP - Information Security and Risk Management

RFC 2196 - Site Security Handbook

Formulai

Total Risk = Threat * Vulnerability * Asset Value

Annual Loss Expectancy = Single Loss Expectancy * Annualized Rate of Occurence

Residual Risk = Annual Loss Expectancy * Control Gap

Single Loss Expectancy = Asset Value * Exposure Factor

Risk Analysis

FRAP - Facilitated Risk Analysis Process - team gets together to brainstorm through. 26 commong controls.

Delphi - answers are in written form - good for getting some quiet opinions - not good for discussion

Risk Assessment Steps
1. Reduce, Transfer, or avoid risk
2. Derive annual loss potential
3. Perform a threat analysis
4. Estimate potential loss
5. assign value to assets

Labeling

Government = Unclassified -> Top Secret

Commercial = Public -> Confidential

Roles

Information Security Officer - Functional Role of Security

Auditors -> provide reports on effectiveness to senior management

Senior Management - ultimately responsible for security

CISSP - Application Security

Waterfall Model - discrete sequential steps

SDLC Phases
1. Project Initiation and Planning
2. Functional Requirements Definition
3. System Design Specifications
4. Development and Implementation
5. Documentation and Common Program Controls
6. Testing and Evaluation Control, Certification, and Accredidation
7. Transition to Production (Implementation)
8. Operations and Maintenance Support
9. Revisions and System Replacement

Data Dictionary - database of schemas

Mobile Code - code that can be executed in network browsers (ie, firefox)

Software Capability Maturity Model

1. Initiating
2. Repeatable (Project Management has been documented)
3. Defined (quantitative process improvement)
4. Managed
5. Optimizing

replaced in 2007 by CMMI = CMM + Integration

now has 22 process areas

Distributed System Requirements

1. interoperability
2. portability
3. transparency
4. extensibility
5. security

spoofing is changing the ip address, masquerading is changing the email from or caller id

perturbation - is injecting noise (meaningless data) to prevent inferrence.

SODA - Secure Object-Oriented Database Access - uses polyinstantiation to remedy the multiparty update conflict

Change Control Process

1. formal request
2. analyze
3. record
4. approve
5. develop (ie. scripts)
6. report to management

CISSP - Telecommunications and Network Security

WAN

ISDN BRI = 2 B and 1 D

Packet Switched = Frame Relay, X.25, ATM

Circuit Switched = DDS

Networking Models

OSI Model is an ISO Standard

TCP IP Model = Network Interface -> Inter networking -> Transport -> Application

SSL is between transport and session layers

802.15 = Wireless personal area - think bluetooth

IP

protocol field of packet -> 0x01 = ICMP, 0x06 = TCP, 0x11 = UDP, 0x58 = IGRP

determine Class
0xxxxxxx = <128 = A
10xxxxxx = <192 = B
110xxxxx = <224 = C
1110xxxx = <240 = D

private addresses
10.0.0.0/8
*127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.168.0.0/16


RAID

0 = Striping
1 = Mirroring
2 = bit level striping w/ parity
3 = byte level striping w / parity
4 = block level striping w/ parity
5 = block level striping w / distributed parity
6 = block level striping w/ double distributed parity (requires 4 disks but can tolerate 2 down disks)

VPN

PPTP (PPP w/ MPPE, MS-CHAP, EAP-TLS), L2TP, IPSEC, L2F

Authentication

EAP, RADIUS, TACACS, PAP, CHAP

Wireless Security

WEP, WAP, WPA, TKIP

WAP 1 = no authentication, 2 = server authentication, 3 = server and client authentication

Attacks

Wormhole - a shortcut(wormhole) is created between 2 networks tricking routing protocols into using the wormhole. Then all traffic can be monitored or disrupted.

Firewalls

Dual-homed / bastion = think pc w/ 2 nics filtering traffic

Screened host = separation is logical instead of physical - in other words - only one nic. I picture this as a router only allowing 80 traffic to a proxy server, and the proxy server being the screened host firewall - though dependent on the router.

Screened subnet = 3 nics - think DMZ

CISSP - Physical Security

Types of Motion Detectors:
Wave pattern: think microwave, if the frequency bouncing back changes from norm then there is motion.
Capacitance: monitors an eletrical field for change - used for small area - think of an area surrounding an object in a museum.
Audio: listens for noise
Photoelectric: think grid of light (visible or not)

Types of fire suppression systems
Water Sprinklers
Wet Pipe: Pipe is full of water to the sprinkler head - quit to get water to fire - but if it was a false alarm, can cause equipment damage for no reason
Dry Pipe: Pipe is not full of water - providing a little bit of time to react to a false alarm - pipes could have leaks that aren't realized until a fire forces water into the pipes.
Deluge: Similar to dry pipe - but for high volumes of water - which is why they are not used around computer equipment
Preaction: dry until heat sensor primes it (now wet pipe) - then another heat sensor releases the water

Classes of Fire
A - Common combustibles - like wood
B - Burnable fules - like gas
C - Electrical - like a data center
D - Grease or chemical - like a kitchen

Halon 1301 (1211 - portable) above 10% and >900 degrees it degrades into hydrogen flouride, hydrogen bromide, and bromine which is toxic. For this reason, it has been replaced (via Environmental Protection Act of 1990) by FM-200 (Argon and Inergen are also options but not as effective). If a Halon system is in place - it CAN continue to be used, but extra measures must be taken when it is used

CCTV: Closed Circuit Television - Decrease Focal Length to widen view larger iris for less light areas

CPTED: Crime Prevention Through Environmental Design

Fences:
2 inch - Normal
1 inch - High
3/8 inch - Extremely high
Gauge - smaller gauge = bigger diameter (tougher fence)
3-4 feet - Deter casual
8 feet - deter determined

Piezoelectric: think kinetic energy - not really related but it was thrown in as a decoy answer and I didn't know what it was

Exterior Lighting: 2 feet of candlepower at 8 feet above the fence so as to blind intruders from seeing past the fence and illuminating them for the cameras

Glare Protection: pointing lights towards potential intruders and away from guards.

Fixed lighting = Fixed Iris as it doesn't need to adjust for changes in light

Classes of Gates:
1 - Residential
2 - Commercial
3 - Industrial
4 - Restricted

Static Electricity
1500 static volts can damage a HDD and as little as 10 static volts can damage some electrical components. Humans cannot perceive until 1500 and the typical scuff on the carpet produces closer to 12,000.

Access to Server room - the technician side of me says that admins need access. The CISSP side of me (needs to) says that the server room should be highly controlled. Admins should be able to do most everything remotely.

HVAC
Must have positive pressurization - meaning if the doors are opened - air rushes out as opposed to pulling dusty dirty air in.
Too much moisture = corrosion
Too little moisture = static electricity
Too much heat = over heat
Too little heat = slowed performance

Doors
Fail-safe - doors are open
Fail-secure - doors are closed with an emergency bar(or other method) to keep people from being trapped in

Locks
Warder < Pin&Tumbler
Bump key is cut to number 9 position (not sure what that means) - and allows the lock picker to bump the key while applying pressure to the lock to open the lock

Annunciation System verbally alerts guards so that they can take action

Bollard - blocks a vehicle from passing - usually metal or cement and arranged in a line of columns.

Mantrap is two sets of doors - like in castles where you go through two sets of gates and in between they are ready to poor boiling oil on you!!

CISSP - System Architecture and Design

Evaluation Criteria

TCSEC: US Based - Trusted Computer System Evaluation Criteria AKA Orange Book superseded by Common Criteria. A is higher then D. B3 is higher than B1.
A -> Verified - A1 = Configuration Management
B -> Mandatory Access Control - B1 = Labeled - B2 = Structured, B3 = Security Domains, Covert Channels
C -> Discretionary Access Control
D -> Minimal Security

ITSEC (1980s) - Europe Based - Seven Assurance (Effectiveness) levels: E0 - E6 and 10 Functionaly levels: F1 - F10

CTCPEC - Canada Based

Common Criteria - ISO around 1990 - Bridge gap between national versions - 7 Assurance Levels: EAL1 < EAL2 (structurally tested) < EAL4 (methodically designed, tested, and reviewed) < EAL6 (semi-formally verified, designed, and tested) < EAL7 (formally verified, designed, and tested)


Covert Channel Analysis: Finding channels being hidden inside of other channels - HTTP is very common for this as people are doing all sorts of things over HTTP that the system may not have been intended to do. DOD has an entire book (Light Pink Book) dedicated to this.

Security Models

Bell-LaPadula - Confidentiality Model - Simple = No read up, Star = no write down

Biba - Integrity Model - Simple = No read down, Star = no write up

Clark Wilson (1987) - Security Labels (MAC) - meets all goals of integrity. IVP (Integrity Verification Procedure) confirms integrity. Constrained Data Item is being protected, Unconstrained is not yet protected. Transformational Procedure...

Take-Grant - Create, revoke, grant, take

Brewer-Nash - Conflict of Interest

Sutherland - Inference

Goguen-Meseguer

Bobert-Kain

Low Level

Memory Management - requirements - relocation, protection, sharing, physical organization, logical organization

CPU States - Ready, Supervisor (privileged), Problem (user - processing - not really a problem), Wait

Process States - New (to be loaded into memory), Blocked (waiting for input), ready (waiting to give to cpu), running (waiting for CPU to finish)

PLC - Programmable Logic Controller - think micro controller

PSW - Program Status Word register - holds applications operating state

Rings of Protection - 0 is Security Kernel - home of the Reference Monitor

Bus Interface Unit - Managing access from Bus Resources (PCI, serial, etc) to CPU



Accreditation

NIACAP - National Information Assurance Certification and Accreditation Process - types: site, type, system

DITSCAP - Defense Information Technology Security Certification and Accreditation Process - 4 phases - replaced by DIACAP - Defense Information Assurance Certification and Accreditation Process

The Books

Neon Orange - NCSC-TG-003 - A Guide to Understanding Discretionary Access Control in Trusted Systems

Purple - Guidelines for formal Verification System

Tan - A Guide to Understanding Audit in Trusted Systems

Green - DOD 5220.22-M - DOD Password Management Guidelines

Orange - TCSEC

Light Pink - Covert Channels

Light Yellow - CSC-STD-003-85

Attacks

TOC / TOU - Time of Check / Time of Use - Asynchronous attack against the timing of when something was checked vs when it is actually used - ie. if a user had admin rights taken away, but hasn't logged off

Van Ecks Phreaking - NOT phones - early version of TEMPEST - project to sniff CRT / VGA emissions


Trusted Computing Base: all of the protection mechanisms in a computer system (hardware, firmware, software). Trusted Path - user / process <-> kernel. Trusted shell AKA sandbox.

CISC: Complex Instruction Set Computing - each instruction can perform multiple low level operations. Meant to bridge the gap between simple low level instructions (1+1 = 2) and high level programming logic / loops. Think x86

RISC: Reduced Instruction Set Computing - based on the philosophy that the CPU can be more efficient if it focuses on the simple operations (contrary to CISC) - modern development has been a balance between the two. SPARC.

CISSP - Legal, Regulations, Investigations, and Compliance

Due Care - doing what is reasonably expected

Witness: has direct personal knowledge of the event

Expert Witness: opinion based on facts and expertise (not personal knowledge of the event)

Enticement: Getting a criminal to do something that can be tracked (think - making a file appear to be valuable and monitoring it, so that you will have evidence of the intruder)
Entrapment: Telling someone that they should try and get this file when they weren't already thinking about it.

FISMA: Federal Information Security Management Act -basically forces government agencies to have an information security program. Measures include inventory, assign risk level to systems, and implement pre-defined minimum security measures (FIPS 200). Process = System Documentation + Risk Assesment -> Reviewed -> Accredited -> Continous Monitoring + Change Management. Downside to FISMA is that it has turned into a checklist, which by itself isn't enough. The US Computer Security Act of 1987 was the first attempt to do this and was superceded by FISMA.

Computer Security Act: see FISMA

CFAA: Computer Fraud and Abuse Act of 1986 - makes it so that accessing a 'federal interest computer' is illegal. Must be across state boundaries and includes financial computers. This was part of the hacker crackdown.

FCPA: Foreign Corrupt Practices Act - civil / criminal if fail to maintain sufficient controls - think private organizations vs FISMA - which targets government

Gramm-Leach-Bliley - financial

HIPAA (1996) - AKA US Kennedy-Kassenbaum Act - Health Care

Federal Privacy Act (1996) - safeguards for Personally Identifiable Information

US National Information Infrastructure Protection Act (1996) - amendment to the Computer Fraud and Abuse Act - meant to clear up interpretation of government interest computer...

Habeas Corpus - unlawful detention

Data Diddling - changing records before / after transaction - charge the customer 99 cents but then record it as 50 cents and pocket the remainder

NIST: National Institute of Standards and Technology

Espionage: Getting secret information without permission.

Criminal, Civil/Tort (fines), Administrative

NSA is responsible for sensitive / classified systems, otherwise NIST (National Institute of Standards and Technology)

Event - noticeable occurrence

Incident - event that violates security policy or law

Forensics

Acquisition, Authentication, Analysis

Evidence lifecycle - collection, analysis, storage, presentation, return to victim

Locard's Exchange principle - when two object come into contact there is at least trace evidence of this contact

Evidence - Real, Direct(witness), demonstrative (not quite real - pictures, most computer evidence), documentary (letters, contracts)

Best Evidence is usual contract like

admissible evidence must be reliable, sufficient, and relevant

RFC 1087 - Ethics and the Internet (short read)

(a) seeks to gain unauthorized access to the resources of the Internet,
(b) disrupts the intended use of the Internet,
(c) wastes resources (people, capacity, computer) through such actions,
(d) destroys the integrity of computer-based information,
(e) compromises the privacy of users.

Morris Worm is a great example of why this was written

(ISC)2 code of ethics

Canons

protect society, commonwealth, and the infrastructure

act honorably, honestly, justly, responsibly, and legally

provide diligent and competent service to principals

advance and protect the profession




Incident Response

Identify, coordinate, mitigate, investigate, educate

Phreaking

Red Box - simulates sound of coins

Blue Box - simulates control tones

Black Box - manipulate voltage (signal)

and tons more

CISSP - Business Continuity and Disaster Recovery Planning

RPO vs RTO
Recovery Point Objective = How old is the recovery point - ie backup every 24 hours.
Recovery Time Objective = How long will it take to recover the system / data.

RPO & RTO = How long it will take to get the system back up and how much data entry will need to be duplicated to account for what was not backed up.

Software Escrow is software-protection mechanism. If the software vendor goes under - you can get the source code to the software so that your information system doesn't go under with the vendor.

Diverse Routing - using multiple service providers - be careful that the providers themselves don't share a single point of failure

Last Mile Protection - redundant connection to a single service provider

BCP - Business Continuity Plan

1. Scope and Plan Initiation
2. Business Impact Assessment (vulnerability assessment, downtime estimation - RTO/RPOs, resource requirements, criticality prioritization, documenting the strategy)
3. Business Continuity Development
4. Plan Approval and Implementation

Processes can be broken down into core (revenue generating, see the mission statement), discretionary (non essential), and supporting

DRP - Disaster Recovery Plan

reduce the complexity of the recovery
minimize the length and impact of the disaster's effects
develop an effective recovery team

Backups

GFS - Grandfather - Father - Son - hierarchical in design - for example 7 tapes for daily (son) are rotated, every sunday the son is promoted to a father (weekly), on the last day of the month, the father is promoted to a grand-father (monthly)

Electronic Vaulting - periodic bulk transfer of records - think full/differential/incremental backups - only they are sent to someone else to store - usually geographically isolated from you

Remote Journaling - change by change log - requires a full backup and then a complete journal since the backup was created

Sites

Reciprocal - aka mutual aid agreement - partner with another organization - not usually feasible

Redundant - hot site with same equipment as opposed to similar equipment

Hot - similar equipment on and ready to go - only thing missing is data

Warm - some equipment is ready (critical processes) but most are not

Cold - facility missing equipment and data

MTO - maximum tolerable outage - maximum time services can be provided at site

CISSP - Cryptography

Cryptography

Theory

Cryptograhpy - secret message between two parties

Crytanalysis - breaking cryptography - think - analysis - which is to remove complexity

Cryptology - cryptography and crytptanalysis

Block Ciphers: http://www.youtube.com/watch?v=OJuWOPSOOK4&feature=related

ECB - Electronic Code Book - Does not involve chaining - so input will always yield the same output. This makes it only good for small, short sensitivity-life data.

CBC - Cipher Block Chaining - Solves the problem with ECB about always producing the same output by introducing an IV (initialization vector).

CFB - Cipher Feedback Mode - Similiar to CBC but for streaming instead of block. It uses the ciphertext from the last block to XOR with this block - hiding the plain text.

OFB - Output Feedback Mode - Improvement of CFB

CTR - Counter Mode - Improvement of OFB

XOR - 1(true) if bits are different

Running Key - when the key is not as long as the message (which is usual), the key is repeated until it is

One time pad -> Vernam Cipher - key must be protected, >= message, resulting pad cannot be reused, random key gen

Stream ciphers do not alter the length of the message - block ciphers do as they pad the message to conform to block sizes

Clipper Chip: used the skipjack cipher. Was meant to give the government the ability to wiretap phones but didn't take.

Morris worm of 1988: While going to Cornell, Morris deployed the worm from MIT. He only meant to 'measure' the internet, but the worm reinfected computers over and over again, causing a DOS attack. He is now a professor at MIT.

Symmetric - Skytale (Spartans)-> Ceasar's Cipher -> Enigma (Germans WWI) -> Purple Machine (Japanese WWII) -> DES (32 rounds) -> IDEA(64 bit blocks, 128 bit key, used in PGP) -> MARS (IBM entrance for AES)-> Blowfish(64 bit blocks, 448bit key entrance for AES) -> AES (Rinjdael 128, 10 rounds)

Assymetric - LUC (Lucas Functions, discrete logarithms) -> RSA -> ElGamal (used in PGP)-> ECC

Diffie-Hellman is just for key exchange -> used by ElGamal

Collision - when two files produce the same hash.

Clustering - different keys yield the same result

Transposition -> Diffusion - moving things around

Substitution -> Confusion

PKI

4 Components - certificate and registration authorities, repository and archive

Revoked -> Revocation List, and online certification status protocol

SET - Secure Electronic Transaction - x.509 derivative that didn't gain traction

Integrity (Hasing)

HAVAL (variable bit), RIPEMD (europe version of MD4), MD Series(MD5 = 128 bit), SHA (>160 bit), TIGER (designed for 64 bit systems)

MD4 is for high-speed computations, MD5 is standard

DSS - Digital Signature Standard - 160 bits

Securing Email

S/MIME, PGP, PEM (uses AES or RSA), MSP

UUencode - encoding for email - to add support for binaries (attachments)

X.400 - standard for email (exchange)

Securing Wireless

WEP - RC4 - stream cipher - used because it was fast and exportable

Attacks

Side Channel - attack the encryption device itself

Remote Desktop slowness fixed

I was surprised to find that remote desktop was running very slowly to my directly connected server.

I came across the following link which discusses the issue. http://blog.tmcnet.com/blog/tom-keating/microsoft/remote-desktop-slow-problem-solved.asp

I entered the following command on my client computer and the problem was resolved.
netsh interface tcp set global autotuninglevel=highlyrestricted

Server 2008 - Wireless Feature Disabled

I recently found myself trying to set up a server to act as a bridge to get wireless from the hotel into my room and to a switch. I already had Server 2008 installed on a box running HyperV and thought it should be no trouble to plug in my wireless card and bridge the network.

Long story short: Wireless LAN 'Feature' is disabled by default. To enable it, go to Server Manager > Features > Wireless Lan Service.

Here is the link that led me to this: http://vspug.com/yazan/2008/02/21/windows-server-2008-wirless-connection/

Note the consistent inconsistency by Microsoft as this is called a service in the list of features.

CISSP - Access Control

Access Control

Role Based(Non-discretionary) vs Discretionary Access Control

Discretionary Access Control allows the owner to manage permissions of their resources. In theory this was a good idea but most owners aren't proficient enough to manage the security of their resources effectively. This also isn't usually a priority for them. A good example of this would be giving new users permission but never removing any of the old users.

Role Based Access Control is very similiar but permissions are based on a role. Now an administrator can manage the security by assigning users to their appropriate roles and giving that role the necessary permissions. The key distinction besides the obvious is that in the DAC, only the owner can make the changes.

Detective Access Control

CRC is a Detective Access Control because it detects that the integrity has been breached.

Preventive vs Deterrent: 4 foot fence is deterrent - and 8 foot fence is preventive. I would argue that deterrent is a subset of preventive.

Types of Authentication

Type 1 -> 3 - Something you know, have, are

Bio-Metrics

Accuracy of Bio-Metrics: Fingerprint > Palm Scan > Hand Geometry > Retina Scan > Iris Scan

Zephyr Chart is used to compare different bio metric systems (by factoring in acceptance, etc.) When comparing like systems - use the CER (Cross Over Erorr Rate - where FRR meets FAR) AKA EER (Equal Error Rate)

Lower CER the Better.

Type 1 = FRR = Annoying

Type 2 = FAR = Breach

Leap: Cisco Proprietary version of EAP

CVE: Common Vulnerabilities and Exposures

Policies are high level and do not say how.

MITM: Man in the Middle

ACLs are used in Discretionary Access Controls. On CISSP - think decentralized workgroup file ACLS (NOT AD centralized ACLS)

Enticement vs Entrapment: You entice someone that is committing a crime to do something that you can record to catch them. Entrapment is 'enticing' someone to commit the crime in the first place. The line can get gray quickly - entrapment is illegal/unethical and serves as a defense for the criminal.

Sesame is an Assymetric version of SSO (Kerberos)

Biba (Integrity - no write down)

Attacks

Rainbow Table: precomputed password hashes - big file instead of computing time

SATAN is the first vulnerability scanner - renamed SANTA

Superzapping - program that bypasses normal security

Smurf - ping users across a network with spoofed source so that the spoofed source (victim) gets overwhelmed

LAND - SYN packet with source and destination ip and port as the target (most NICs are no longer vulnerable to this)

TRINOO - sort of bot net that was part of the yahoo DDOS attack of 2000.

SYN attack - AKA half open attack - target runs out of memory while trying to keep track of an infinite number of TCP sessions.

Chargen - Character Generator - can be used to cause systems to go into an infinite loop talking to themselves.

Ping of Death - icmp packets that are larger than allowed

Fraggle - wrote by the same author as Smurf - this attack is similiar to smurf only it uses echo instead of ping

Teardrop - crashes a victim by sending malformed IP fragments that are over sized and/or overlapping

MEME - hoax - usually a chain letter looking for victims to forward it throughout the internet

EICAR - is used to verify the functionaly of antivirus software. Simply an innocent signature that all vendors flag for test purposes

CISSP Prep

In preparation for my CISSP I will collect sources and notes here.

I am reading CISSP for Dummies. I originally bought a much denser book but after learning that the CISSP certification is 50 miles wide and 10 inches deep, I figured a less dense book would suffice, and more importantly save me some time.

I went into CISSP for Dummies knowing that it would probably only go about 5 inches deep and that I would need to identify my areas of weakness and do more research to complement what I am reading. What follows is the other 5 inches addressing the areas I needed more work in.

Rainbow Books

Kerberos: http://www.youtube.com/watch?v=7-LjpO2nTJo&feature=related. I found this video to be very helpful. It is easy to get lost in all the keys and exchanges, especially when trying to read it in text format. In summary and from a higher more memorable level:

A secure connection between the client and authentication server is established by encrypting the traffic with the client's secret key. This secret key is based on the password that is stored in the authentication server. The user on the client computer enters a password and it is used to decrypt the messages from the authentication server. If it is not the right password then the messages will not be decipherable and the process halts. Over this secure connection, the Authentication Server sends the client it's Ticket Generating Service Session Key. It also sends it an encrypted message that only the Ticket Generating Service can decrypt. The client simply forwards this message along to the Ticket Generating Service.

When the Ticket Generating Service receives the message from the Authentication Server via the client it decrypts it using a secret key that only the Authentication Server and the Ticket Generating Service know. This reveals the Ticket Generating Service Session key and client associated with the key.

Next the Client establishes a secure connection with the Ticket Generating Service by using the Ticket Generating Service Session key that only Ticket Generating Service and the Client know. This is a dynamic key that was generated by the Authentication Server and not only establishes a secure connection between the Ticket Generating Service and the Client but also limits the time the connection can last.

Over this secure connection, the Ticket Generating Service sends the client a Client/Server Session key. It also sends an encrypted message to be sent to the Server that includes the Client/Server Session key and Client ID and time limit associated with the key.

Now the Server and Client can establish mutual trust.

In layman's terms:

You go to the security gate of a building and ask to go to the accounting department. The security guard verifies your identity and gives you a document that he signs stating that you are who you say you are and that you are allowed to go to the receptionist.

You arrive at the receptionist and she takes the document, verifies the signature, verifies that you are the person identified in the document and gives you a new signed document stating that you can go to the accounting department.

Upon arriving at the accounting department, they take the document, verify the signature, verify that you are the person identified in the document, and then asks, "so what can we do for you?"

And after all that, now imagine that this makes Single Sign On possible - in other words this is supposed to reduce complexity by reducing the number of logons needed to enter various systems.

Passed CCNA Security 640-553

I just passed the CCNA Security 640-553.

Obviously I can't go into the specifics - but its worth mentioning some highlights.

Lots on Zone Based Firewalls (being able to interpret zone-pairs -> policies -> class maps)

Layer 2 port security

Intimate understanding of how Phase 1 / 2 works in IPSEC. You should be able to teach this to a layman.

I had a couple questions on SSL VPNs (not sure if they were 'future' questions).

I used the Sybex study guide along with Jemery's CBT videos.

Good Luck

Subnetting - Memory Dump Cheat Sheet

There are times when a subnet calculator may not be available - Apocalypse and for your CCNA.

So during an Apocalypse - if you decide that you need to be able to subnet you only need to remember how to create this cheat sheet. Using this table - you can ultimately solve all subnetting problems.

Bits (borrowed)	2n(host/networks)	Interval	Mask
1	2	128	128
2	4	64	192
3	8	32	224
4	16	16	240
5	32	8	248
6	64	4	252
7	128	2	254
8	256	1	255

Remembering how to create this table is not as hard as it looks. First you must remember the columns. Bits Borrowed, 2ⁿ (hosts/networks), Interval, and Mask.

Then you must fill in the Bits column, starting from 1 to 8 bits (per octet).

Then you can fill in the Bits Borrowed, 2ⁿ (hosts/networks) column by simply doing the math. What is 2 to the power specified by the Bits (borrowed) row.

The next part is a little tricky. You must simply rewrite the 2ⁿ (hosts/networks) column into the Interval column in reverse order but skip 256 as this interval really means the interval is the whole octet. Think about what your doing, is 256 valid? so skip it.

Lastly, for the mask column - sum the intervals up as you go.

Now why do all this?

If you know what the mask is you can determine what the interval is. For example: 10.11.12.13 255.255.248.0

We can match 248 to the interval 8 in the third octet. Using this interval we can find the IP range. The nearest lower multiple of 8 in the third octet from 12 is 8. So the network address is 10.11.8.0. The next network address is an interval of 8 in the 3rd octet, so the next network address is 10.11.16.0. The broadcast address is then 1 less, 10.11.15.255. Knowing both the network and broadcast address we can determine the IP range as 10.11.8.1 - 10.11.15.254.

If we were to use CIDR notation, 10.11.12.13/21. We can determine how many bits we have borrowed. 8 (first octet) + 8 (second octet) + 5 (third octet). Using the table we can match 5 bits borrowed to the interval 8 and continue as we did before.

Lastly, we can solve problems like how many hosts do we have or many many networks do we have. 150.160.170.180/20 is a class B address. From the 16 bits associated with class B we have borrowed an additional 4 bits. The formula for networks is 2 ⁿ. So we find 4 and go to the 2 ⁿ column to find that we can have 16 subnets. We have 12 out of 32 bits left for hosts. To determine our hosts we use the formula 2 ⁿ - 2. But our table is not big enough. We simply extend it out by multiplying by 2 until it is big enough.

Bits (borrowed)	2n(host/networks)	Interval	Mask
1	2	128	128
2	4	64	192
3	8	32	224
4	16	16	240
5	32	8	248
6	64	4	252
7	128	2	254
8	256	1	255
9	512
10	1024
11	2048
12	4096

And now we know that we can support 4094 hosts in each subnet.

This is a tool that you can easily use during the CCNA as you can write it down on the provided paper as soon as you start your test.

Hopefully you find this helpful - let me know if you have any questions.

Webpage Mirage

Imagine that you have a domain (some_domain.com) and want another domain (some_other_domain.com) to point to the same files. While there are a number of ways to do this if you are running your own servers, but if you are using a hosting provider, most options are not available to you - or only at an extra cost.

A few months back I came across a rather unusual solution. I asked my hosting provider to implement this for me, and what they did is the following.

<html>
<frameset border="'0'">
<frame src="'http://some_domain.com'">
</frameset>
</html>



The result of this is when you go to some_other_domain.com, you will get the above html file, which contains a full screen frame that is actually some_domain.com. In most cases, the important thing here is the address bar. The address bar will reflect some_other_domain.com.

Essentially there is a mirage that you are on one domain, when the content is really coming from another domain.

I recently came across another use for this workaround. I have several files and links that are helpful in pursuing a CCNA. Directory Browsing works great for the files. If I delete a file or add a new file, the change will be reflected to the user when they next browse the directory. The problem is then links. A windows shortcut will not work directly from directory browsing, the user would have to download it to their computer and then open it as a windows shortcut - which is also limiting it to the windows platform. So I came up with what I thought was a clever little solution.

I created a very simple html file that simply redirected you to the desired destination - the user would never even realize it happened.


<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title></title>
</head>
<body>
Redirecting to <a href="http://www.securecottage.com/demo/rsa2.html">http://www.securecottage.com/demo/rsa2.html</a>
</body>
<script type="text/javascript">
window.location = 'http://www.securecottage.com/demo/rsa2.html';
</script>
</html>



This worked great until one of my peers told me that the back button didn't work. Moments later it clicked - of course back doesn't work, back brings you back to this page - which then redirects you to the originally-desired page. Ever had to fight with the back button! This is usually why!

While I know I could write some javascript that would solve this problem. I decided to use the mirage approach. So the above is now:


<html>
<FRAMESET border='0'>
<FRAME SRC='http://www.securecottage.com/demo/rsa2.html'>
</FRAMESET>
</html>


There is a drawback here though - now it appears that my domain is hosting the above page when it really isn't (by just looking at the address bar). But given that I am just looking for a simple solution for a link; this does it as well as solves the back button problem and even has fewer lines of html.

Server 2003 FTP to SSH

I recently found myself needing to setup an FTP server on my MS Server 2003 back home. No big deal right!

I knew FTP required 2 ports, 21 and 20. I am using RRAS (Routing and Remote Access Server[Service]), and had opened up ports before, no big deal.

So I opened the ports and was able to open a connection, SUCCESS! Then i entered ls to list out the contents of the directory, and FAILURE!. After too long (way too long) on google. I learned that their are two modes passive and active. In active, the server tries to open then data connection with the client. (http://slacksite.com/other/ftp.html) Of course NAT is going to frown on that so passive dominates. In passive the client chooses a server port >1023 and initiates with the server. This got me really confused, cause I thought it was going to be port 20. I really don't want to open up a big range of ports (>1023) for ftp.

In the end, I decided FTP's model of 2 ports doesn't work for me and went with SSH, minutes later I was up and running.

So I installed http://www.freesshd.com/ on my server. Using the GUI I was able to start the service, add a user, and choose my directory. In RRAS I closed my ftp ports and opened 22 for SSH. And voila!

For a client I was using FileZilla for FTP and "knew" it wouldn't work with SSH, but tried it anyway. It worked!

Curious, I even found a web shell http://www.anyclient.com which will allow me to SSH into my files without having to install a client (java based). Keep in mind that using a web shell like this defeats the security part of SSH. Your password is transmitted to anyclient.com in clear text before it even touches SSH.

In the end, I am very disappointed with FTP and very impressed with SSH. I was even more impressed by the FTP clients that allow me to use SSH as if it were FTP.

I hope that this helps someone.