Radia Perlman (M4) is a Distinguished Engineer at Sun Microsystems. She is known for her contributions to bridging (spanning tree algorithm) and routing (link state routing) as well as security (sabotage- proof networks). She is the author of Interconnections: Bridges, Routers, Switches, and Internetworking Protocols, and co-author of Network Security: Private Communication in a Public World, two of the top 10 Networking reference books, according to Network Magazine. She is one of the 25 people whose work has most influenced the networking industry, according to Data Communications Magazine. She has about 50 issued patents, an S.B. and S.M in mathematics and a Ph.D. in computer science from MIT and an honorary doctorate from KTH, the Royal Institute of Technology in Sweden.

Tuesday, August 6, 2002

T1 A Crash Course in SSL and TLS  NEW
Eric Rescorla, RTFM Inc.

Who should attend: Programmers, designers and architects who want to acquire an in-depth knowledge of SSL and TLS. Attendees should be familiar with TCP/IP. Familiarity with basic cryptography (encryption, public key, message digests, etc.) is desirable. We'll start with a brief primer on cryptography if a substantial portion of the class needs it.

This tutorial is an in-depth look at SSL and TLS. In this tutorial, we'll cram as much SSL/TLS knowledge into your head as possible in a single day. Topics covered will include:

Topics include:

• An in-depth look at the SSL handshake and its major variants
  • session resumption
  • client auth
  • export modes
• Data transfer and alerts
• Known attacks
• Performance
  • tuning
  • hardware acceleration
• Integrating SSL into protocols
  • generic philosophy
  • HTTPS
  • SMTP/TLS
• Programming with SSL
• The future of SSL/TLS

After completing this tutorial, you will know enough about SSL to be seriously dangerous to your friends, neighbors, and co-workers.

Eric Rescorla (T1) is Principal Engineer of RTFM, Inc., an independent security consulting firm. He has been working in Internet Security since 1993. He has been a member of the TLS working group from before the beginning and has written several commercial SSL implementations as well as the free Java toolkit PureTLS and the SSL protocol analyzer ssldump. He is the author of "SSL and TLS: Designing and Building Secure Systems" (Addison-Wesley 2000) as well as the RFCs defining Secure-HTTP and HTTP over TLS.

T2 Building Honey Pots for Intrusion Detection  NEW
Marcus Ranum, Consultant

Who should attend: System and network managers with administrative skills and a security background. The tutorial examples will be based on UNIX/Linux. While the materials may be of interest to a Windows/NT administrator, attendees will benefit most if they have at least basic UNIX system administration skills.

This class provides a technical introduction to the art of building honey pot systems for intrusion detection and burglar-alarming networks. Students completing this class will come away armed with the knowledge that will enable them to easily assemble their own honey pot, install it, maintain it, keep it secure, and analyze the data from it.

Topics include:

• Introduction
  • IDSes
  • Fundamentals of burglar alarms
  • Fundamentals of honey pots
  • Fundamentals of log-data analysis
  • Spoofing servers
• Overview of our honey pot's design
  • System initialization
  • Services
  • Spoofing server implementation walkthrough
  • Multiway address/traffic manipulation
  • Logging architecture: syslogs, XML logs, statistical processing
  • Simple tricks for information visualization
• Crunchy implementation details
  • How to write spoofing rules
  • How to write log filtering rules
• Management
  • How to get help in analyzing attacks
  • Keeping up to date

Auxiliary materials: Attendees will receive a bootable CD-ROM containing a mini UNIX kernel and preconfigured software, and will also have source-code access to the honey pot building toolkit. Attendees may also wish to review The Honeynet Project, eds., Know Your Enemy: Revealing the Security Tools, Tactics, and Motives of the Blackhat Community (Addison-Wesley, 2001).

Marcus Ranum (T2) founded and served as CTO of NFR Security, Inc. He is a consultant and has been working in the computer/network security field for over 14 years. Marcus is credited with designing and implementing the first commercial Internet firewall product. He also designed and implemented other significant security technologies, including the TIS firewall toolkit and the TIS Gauntlet firewall. As a researcher for ARPA, Marcus set up and managed the Whitehouse.gov email server. Widely known as a teacher and industry visionary, he has been the recipient of both the TISC Clue award and the ISSA lifetime achievement award. Marcus lives in Woodbine, Maryland, with his wife, Katrina, and a small herd of cats.

T3 Cisco's Security Features: What They Are, Where to Use Them, How to Configure Them  NEW
John Stewart, Digital Island, Inc.

Who should attend: Network and system administrators running Cisco networks, and security professionals.

It's common knowledge that over 85% of all Internet traffic crosses a Cisco product at one time or another. Given this fact, it is obvious that improving security on Cisco products can improve the overall security of your site as well as the overall security of the Internet. However, the security features available in Cisco products can be a discipline in themselves. This class takes a nuts-and-bolts approach to deciding which Cisco security features to use, and when and where to use them. A sample network is used as the basis for the class. For each area, sample uses and actual configuration techniques are discussed.

Topics include:

• Perimeter Security
  • Cisco Access Control Lists (ACLs)
  • Lock and key
  • TCP intercept
  • Context-Based Access Control (CBAC)
  • Firewalling technologies compared and contrasted
  • PIX
  • IOS
• Access Lists revealed
  • Basic vs. extended
  • Where and how to use ACLs
  • Event logging
  • Per-user ACLs on dial-up ports
• Router-to-router security
  • Shared symmetrical application keys
  • Distributed Director
  • Remote access
  • Route authentication
• User security
  • Authentication, Authorization, Accounting (AAA)
  • TACACS
  • Fixed, OTP, SecureCard
  • RADIUS
  • Kerberos
• IPSec
  • Current standards update
  • Deploying IPSec with other technologies
  • ISAKMP/Oakley
  • Availability
  • Configuring and using IPSec
• Network Address Translation (NAT)
  • Hiding your company
  • Hiding your Web servers
  • Using NAT over dial-up
• VPN
  • VPDNs
  • GRE tunnels
  • Layer 2 Forwarding (L2F)
  • L2TP tunnels

John Stewart (T3) is responsible for investigating emerging technologies and helping to set future direction for Exodus, a Cable & Wireless Service. Previous to this position, Mr. Stewart was Digital Island's Chief Security Office. He also managed the core team and company-wide Security Council for auditing and adherence. As part of his involvement with the Center for Information Security (CIS), Mr. Stewart co-developed the Cisco Router Auditing Tool, an industry security analysis tool to help network administrators protect their Cisco routers, switches, and PIX firewalls. He serves on advisory boards for CloudShield, Tripwire Security, and hotU, Inc. Mr. Stewart holds a Master of Science degree in Computer and Information Science from Syracuse University, Syracuse, New York.

T4 IPSec  NEW
John Ioannidis, AT&T Labs;
Angelos Keromytis, Columbia University

Who should attend: Who should attend: Network administrators, system managers, developers of network applications, and anyone interested in network security. Some familiarity with networking principles is required, but cryptography is not.

The IPSec protocol suite provides network-layer security for the Internet and is an IETF standard. It is already widely used to implement Virtual Private Networks (VPNs), and is beginning to make its way into commercial implementations of desktop operating systems. This tutorial covers every feature of IPSec and its key management protocol, IKE, gives many real-life examples drawn from a variety of environments and operating systems, and aims to clear a lot of myths and misunderstandings about IPSsec.

Topics include:

• Justification of network-layer security
• Encapsulation, tunneling, and overlay networks
• The IPSec transforms (ESP and AH)
• Transport and tunnel modes
• Key management
• IKE, the Internet Key Exchange protocol
• Interaction between IPSec/IKE and firewall/NAT boxes
• Examples
• Performance considerations (software and hardware)
• Comparison with TLS/SSL
• About PKIs
• Miscellaneous topics
• Future developments
  • Policy
  • Additional Key Management protocols

John Ioannidis (T4) is a researcher at AT&T Labs — Research. He has been contributing in the IETF for over 10 years, and has been with the IPsec effort since the very beginning, and wrote the first SunOS, BSD and Linux implementations. He has also worked on policy mechanisms for IPsec, and more recently on JFK, a proposed successor to the Internet Key Exchange protocol. His many research interests include security of large distributed systems, wireless and mobile networking, micropayment systems, and high-speed network monitoring.

Angelos Keromytis (T4) is an Assistant Professor of Computer Science at Columbia University. He has been working on IPsec since 1995, both in defining and refining the standards in the IETF, and in implementing and measuring its performance. He developed the OpenBSD IPsec stack, and wrote the first free implementations of the Photuris and IKE key management protocols for IPsec. More recently, he has been working on a proposed successor to IKE, named JFK, and has designed and implemented a cryptographic acceleration framework for IPsec (and other cryptography-heavy applications). His other research interests include scalable access control mechanisms, security policy composition and enforcement, and distributed system virtualization.