50 Essential Open Source Security Tools

http://www.linuxplanet.com/linuxplanet/roundups/6579/1
Anti-Everything, Encryption, Secure Delete, Forensics

• November 11, 2008
• By Cynthia Harvey

The area of open source security software is growing rapidly, with a cornucopia of apps for every use: anti-spam, firewalls, forensics, encryption, log monitoring, passwords – the list is growing even as you read this. In many cases, these open source security tools – many of which are free – are available for the Windows, Linux and Mac operating systems.
Let the downloading begin…
1. SpamAssassin
Winner of multiple Datamation Product of the Year awards, SpamAssassin uses header and text analysis, Bayesian filtering, DNS blocklists, and collaborative filtering databases to block unwanted e-mail at the server level. It works with most mail systems and is available under the Apache license. Operating System: OS Independent.
Anti-Virus/Anti-Malware
2. ClamAV
This anti-virus toolkit is designed especially for protecting mail gateways and features a command line scanner, automatic updates, and more. Although the original ClamAV engine works only with Unix-like systems, numerous other projects (both open-source and commercial) have incorporated ClamAV. Operating System: Linux, Unix, BSD.
3. ClamWin
ClamWin provides a Windows front-end for the ClamAV antivirus toolkit. It features automatic updates, a scanning schedule, Outlook integration, and more. Operating System: Windows.
Application Firewall
4. SELinux
Developed by the NSA, Security Enhanced Linux adds mandatory access control features to the Linux OS. It enforces complete separation of information to make it more difficult to bypass application security mechanisms. Operating System: Linux, Unix.
5. AppArmor
Novell's application firewall uses policy-based profiles to control who can access various applications. It's included with openSUSE and SUSE Linux Enterprise, but is also available for download for any Linux system. Operating System: Linux.
Data Destruction
6. Darik's Boot And Nuke
Just slip a disk containing Darik's Boot and Nuke into your system, and it will automatically destroy all the data on any hard drive it can detect. It's ideal for cleaning up old computers before they are donated or recycled. Operating System: OS Independent.
7. Eraser
Eraser completely eliminates a file so that it cannot be read with digital forensic tools. It overwrites data several times with random patterns erasing all traces of sensitive information. Operating System: Windows.
Encryption
8. TrueCrypt
TruCrypt can create a virtual encrypted disk within a file or encrypt a partition or drive on a Windows system. It can also be used to encrypt a portable hard drive or USB flash drive. Operating System: Windows, Mac, Linux.
9. AxCrypt
Simply right-click any file on Windows Explorer to encrypt it with AxCrypt. AxCrypt aims to make it as easy to work with encrypted files as it is to work with unencrypted files—just a lot more secure. Operating System: Windows.
File Transfer
10. WinSCP
WinSCP is a easy-to-use, basic SFTP and FTP client for Windows only. It also supports SCP. Operating System: Windows.
Forensics
11. The Sleuth Kit
Need to recover a deleted file? The Sleuth Kit lets you read deleted data from NTFS, FAT, FFS, and EXT2FS file systems. Operating System: Windows, Mac, Linux, Unix, BSD, Solaris.
Gateway Security Appliance
12. Untangle
A great alternative to expensive commercial security appliances, Untangle combines the best of open-source Web filtering, anti-spam, anti-spyware, anti-virus, intrusion prevention, firewall, VPN, and more into one download that can be used to turn any PC into a security appliance. Commercial support and other add-ons are available for a fee. Operating System: Linux.
13. Endian Firewall Community
Similar to Untangle, Endian Firewall Community can turn an old PC into a unified threat management (UTM) appliance that provides a firewall, anti-virus, anti-spam, content filtering, and a VPN. Pre-configured appliances and support are also available for a fee. Operating System: Linux.

• 2. Anti-Everything, Encryption, Secure Delete, Forensics
• 3. Anti-Everything, Encryption, Secure Delete, Forensics
• 4. Anti-Everything, Encryption, Secure Delete, Forensics

Unified Threat Management

Unified Threat Management (UTM) is a comprehensive solution that has recently emerged in the network security industry, and since 2004 it has gained widespread currency as a primary network gateway defense solution for organizations.^[1] In theory, UTM is the evolution of the traditional firewall into an all-inclusive security product able to perform multiple security functions within one single appliance: network firewalling, network intrusion prevention and gateway antivirus (AV), gateway anti-spam, VPN, content filtering, load balancing, data leak prevention and on-appliance reporting.

The worldwide UTM market was approximately worth $1.2 billion in 2007, with a forecast of 35-40% compounded annual growth rate through 2011. The primary market of UTM providers is the SMB and Enterprise segment, although a few providers are now providing UTM solutions for small offices/remote offices.^[2]

The term UTM was originally coined by market research firm IDC. The advantages of unified security lie in the fact that rather than administering multiple systems that individually handle anti virus, content filtering, intrusion prevention and spam filtering functions, organizations now have the flexibility to deploy a single UTM appliance that takes over all their functionality into a single rack mountable network appliance.

Contents   [hide]  1 Brief history 2 Transition from point to integrated security solutions 3 How UTM secures the network 3.1 Key advantages[8] 3.2 Key Disadvantages 4 Role of user identity 4.1 Regulatory compliance 5 See also 6 References 7 External links

[edit]Brief history

UTM solutions emerged of the need to stem the increasing number of attacks on corporate information systems via hacking/cracking, viruses, worms - mostly an outcome of blended threats and insider threats. Also, newer attack techniques target the user as the weakest link in an enterprise, the repercussions of which are far more serious than imagined.

Data security and unauthorized employee access have become major business concerns for enterprises today. This is because malicious intent and the resultant loss of confidential data can lead to huge financial losses as well as corresponding legal liabilities. It needs to be mentioned that enterprises have only now begun to recognize the fact that user ignorance can lead to vital security being compromised out of their internal networks.^[3]

The main advantages of UTM solutions are simplicity, streamlined installation and use, and the ability to update all the security functions concurrently.^[4] So, not only are they a cost-effective purchase, but day-to-day network running costs are also considerably lower than other solutions.

The ultimate goal of a UTM is to provide a comprehensive set of security features in a single product managed through a single console. Integrated security solutions evolved as a logical way to tackle the increasingly complex blended internet threats impacting organizations.^[5]

The UTM market has shown dramatic growth recently with a 20.1% increase in 2009 following up a 32.2% increase in 2008, according to Frost and Sullivan.^[6]

[edit]Transition from point to integrated security solutions

Traditional point solutions, which were installed to solve major threat and productivity issues, are difficult to deploy, manage and update, which increases operational complexities and overhead costs.^[7] Instead, organizations of today demand an integrated approach to network security and productivity that combines the management of traditionally disparate point technologies.

All these disadvantages can lead to situations where organizations deploy reduced security and inferior policies at remote locations. UTMs can help overcome these problems. In summary, the fast-paced transition from point to integrated security appliances is largely due to the cost-effectiveness and ease of manageability of UTM devices.

[edit]How UTM secures the network

A single UTM appliance simplifies management of a company's security strategy, with just one device taking the place of multiple layers of hardware and software. Also from one single centralized console, all the security solutions can be monitored and configured.

In this context, UTMs represent all-in-one security appliances that carry a variety of security capabilities including firewall, VPN, gateway anti-virus, gateway anti-spam, intrusion prevention, content filtering, bandwidth management, application control and centralized reporting as basic features. The UTM has a customized OS holding all the security features at one place, which can lead to better integration and throughput than a collection of disparate devices.

For enterprises with remote networks or distantly located offices, UTMs are a means to provide centralized security with complete control over their globally distributed networks.

[edit]Key advantages^[8]

1. Reduced complexity: Single security solution. Single Vendor. Single AMC
2. Simplicity: Avoidance of multiple software installation and maintenance
3. Easy Management: Plug & Play Architecture, Web-based GUI for easy management
4. Reduced technical training requirements, one product to learn.
5. Regulatory compliance

[edit]Key Disadvantages

1. Single point of failure for network traffic
2. Single point of compromise if the UTM has vulnerabilities
3. Potential impact on latency and bandwidth when the UTM cannot keep up with the traffic

[edit]Role of user identity

Identity-based UTM appliances are the next-generation security solutions offering comprehensive protection against emerging blended threats. While simple UTMs identify only IP addresses in the network, identity-based UTMs provide discrete identity information of each user in the network along with network log data. They allow creation of identity-based network access policies for individual users, delivering complete visibility and control on the network activities. The identity-based feature of such UTMs runs across the entire feature set, enabling enterprises to identify patterns of behavior by specific users or groups that can signify misuse, unauthorized intrusions, or malicious attacks from inside or outside the enterprise.^[3]

The strength of UTM technology is that it is designed to offer comprehensive security while keeping security an easy-to-manage affair. Enterprises get complete network information in hand to take proactive action against network threats in case of inappropriate or suspicious user behavior in the network. As identity-based UTMs do not depend onIP addresses, they provide comprehensive protection even in dynamic IP environments such as DHCP and WI-Fi and especially in a scenario where multiple users share the same computer.^[3]

[edit]Regulatory compliance

One salient feature of UTM appliances is that they provide best-of-the-breed security technology that can handle the increasingly regulatory environment across the world. Regulatory compliances like HIPAA, GLBA, PCI-DSS, FISMA, CIPA, SOX, NERC, FFIEC require access controls and auditing that meet control data leakage. UTMs that provide identity-based security give visibility into user activity while enabling policy creation based on the user identity, meeting the requirements of regulatory compliances.

Identity-based UTMs deliver identity-based reports on individual users in the network. This offers short audit and reporting cycles and facilitate the meeting of regulatory compliance requirements in enterprises.

[edit]See also

Computer security portal

• Identity driven networking
• Role-based access control
• Content-control software
• Quality of service
• Single sign-on
• Extensible Threat Management (XTM)

[edit]References

1. ^ IDC. September 2007. Unified Threat Management Appliances and Identity-based Security: The Next Level in Network Security. IDC Go-to Market Services.
2. ^ Firstbrook, Peter, Orans, Lawrence & Hallawell, Arabella. 4 June 2007. Magic Quadrant for Secure Web Gateway, 2007. Gartner Inc. 1-28
3. ^ ^a b c Mittal, Richa. Dec 19, 2008. Unified Threat Management and Identity-based Security. Knol Articles. http://knol.google.com/k/richa-mittal/unified-threat-management-and-identity/1jdphe4wksldn/5#. Accessed May 7, 2009
4. ^ Author Unknown. 2009. Definitions –Unified Threat Management. Search Security (Tech Target). http://searchsecurity.techtarget.com/dictionary/definition/what-is-unified-threat-management.html. (accessed May 7, 2009)
5. ^ Biztech. 2008. SMBs Driving the Indian UTM Market. Biztech India. http://tech2.in.com/biz/india/features/security/smbs-driving-the-indian-utm-market/19851/0 (accessed May 7, 2009)
6. ^ UTM market to reach $7bn by 2016
7. ^ Jacob, John, 2009. The Rise of Integrated Security Appliances. Channel Business. http://www.channelbusiness.in/index.php?Itemid=83&id=252&option=com_content&task=view. (Accessed May 6, 2009)http://www.channelbusiness.in/index.php?Itemid=83&id=252&option=com_content&task=view
8. ^ http://searchnetworking.techtarget.com/tip/0,289483,sid7_gci1275947,00.html

[edit]External links

• List of UTM Software and Vendors, Mosaic Security Research

IT Security DOs and DON'Ts

http://www.sophos.com/en-us/security-news-trends/it-security-dos-and-donts.aspx
Train your employees to steer clear of trouble with our free toolkit.

Download the toolkit

A customizable security training program

IT security awareness training is made easy with this toolkit. Whether you’re starting a program from scratch, or just need some refresher materials, we’ve got you covered.
See all the tools in all the formats and pick the ones to download. View them as HTML, download ready-to-use PDFs, or Word files you can customize yourself.

Choose your tools
It's up to you

Here’s what you get:

Program launch guide  Employee handbook Email series of 10 tips Poster series of 10 tips

Online videos Password quick tips Launch announcement Buy-in documents

PCI SSC Data Security Standards Overview

The Payment Card Industry Security Standards Council offers robust and comprehensive standards and supporting materials to enhance payment card data security. These materials include a framework of specifications, tools, measurements and support resources to help organizations ensure the safe handling of cardholder information at every step. The keystone is the PCI Data Security Standard (PCI DSS), which provides an actionable framework for developing a robust payment card data security process -- including prevention, detection and appropriate reaction to security incidents.

Tools to assist organizations validate their PCI DSS compliance include Self Assessment Questionnaires. The chart linked here shows some of the tools available to help organizations become PCI DSS-compliant.

For device vendors and manufacturers, the Council provides the PIN Transaction Security (PTS) requirements, which contains a single set of requirements for all personal identification number (PIN) terminals, including POS devices, encrypting PIN pads and unattended payment terminals. A list of approved PIN transaction devices can be accessed here. 

https://www.pcisecuritystandards.org/security_standards/glossary.php

To help software vendors and others develop secure payment applications, the Council maintains the Payment Application Data Security Standard (PA-DSS) and a list of Validated Payment Applications.

The Council also provides training to professional firms and individuals so that they can assist organizations with their compliance efforts. The Council maintains public resources such as lists of Qualified Security Assessors (QSAs), Payment Application Qualified Security Assessors (PA-QSAs), and Approved Scanning Vendors (ASVs). Large firms seeking to educate their employees can take advantage of the Internal Security Assessor (ISA) education program. 

Security standards glossary

Information Security

Information Security Components: or qualities, i.e., Confidentiality, Integrity and Availability (CIA). Information Systems are decomposed in three main portions, hardware, software and communications with the purpose to identify and apply information security industry standards, as mechanisms of protection and prevention, at three levels or layers: Physical, personal and organizational. Essentially, procedures or policies are implemented to tell people (administrators, users and operators)how to use products to ensure information security within the organizations.

Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction.^[1]

The terms information security, computer security and information assurance are frequently incorrectly used interchangeably. These fields are interrelated often and share the common goals of protecting the confidentiality, integrity and availability of information; however, there are some subtle differences between them.

These differences lie primarily in the approach to the subject, the methodologies used, and the areas of concentration. Information security is concerned with the confidentiality, integrity and availability of data regardless of the form the data may take: electronic, print, or other forms.

Computer security can focus on ensuring the availability and correct operation of a computer system without concern for the information stored or processed by the computer.

Governments, military, corporations, financial institutions, hospitals, and private businesses amass a great deal of confidential information about their employees, customers, products, research, and financial status. Most of this information is now collected, processed and stored on electronic computers and transmitted across networks to other computers.

Should confidential information about a business' customers or finances or new product line fall into the hands of a competitor, such a breach of security could lead to lost business, law suits or even bankruptcy of the business. Protecting confidential information is a business requirement, and in many cases also an ethical and legal requirement.

For the individual, information security has a significant effect on privacy, which is viewed very differently in different cultures.

The field of information security has grown and evolved significantly in recent years. As a career choice there are many ways of gaining entry into the field. It offers many areas for specialization including: securing network(s) and allied infrastructure, securing applications and databases, security testing, information systems auditing, business continuity planning and digital forensics science, to name a few.

This article presents a general overview of information security and its core concept.

Contents

1 History 2 Basic principles 2.1 Key concepts 2.1.1 Confidentiality 2.1.2 Integrity 2.1.3 Availability 2.2 Authenticity 2.3 Non-repudiation 2.4 Risk management 2.5 Controls 2.5.1 Administrative 2.5.2 Logical 2.5.3 Physical 2.6 Security classification for information 2.7 Access control 2.8 Cryptography 2.9 Defense in depth 3 Process 3.1 Security governance 3.2 Incident response plans 3.3 Change management 4 Business continuity 4.1 Disaster recovery planning 5 Laws and regulations 6 Sources of standards 7 Professionalism 8 Conclusion 9 See also 10 Scholars working in the field 11 Further reading 12 Notes and references 12.1 External links 12.2 Bibliography