Microsoft's Active Directory Security Features

Overview
Microsoft's Active Directory is a system that keeps information about network components, as well as allowing clients to find objects within its namespace (a location where a network component can be found).

Security Features


As Active Directory plays a critical role in future networking for Windows, it is imperative that administrators must be able to guard their directory from attackers and users, while being able to still assign tasks to other admins when required. The Active Directory Security Model aims to do just that. Below are a few of its methods.

Delegation of Control Wizard




The above is what the Delegation of Control Wizard looks like. It permits a high level of control to the administrator. This allows him to grant both individual and groups of users different levels of permissions for objects and their attributes. Using this Wizard, an Administrator can add or hide attributes to various groups and/or users. Another function is delegated administration, where an administrator is administrates certain areas, instead of a single person having access to all permissions.

Auditing


another feature of the Active Directory is its ability to be audited. This is a very useful way to determine if permissions are set correctly and to monitor for any unauthorized access attempts, and more importantly, check for success or failure to access.

References
http://technet.microsoft.com/en-us/library/bb742424.aspx

LDAP Security Features

Overview


LDAP, or Lightweight Directory Access Protocol, was originally a simplification and alternative to the X.500 protocols. LDAP allowed clients to use the TCP/IP networks when connecting. The LDAP replaces the DAP (Directory Access Protocol)  protocol in X.500. LDAP was later expanded as well to replace the DSP (Directory System Protocol) protocol as well.

Security Features


The LDAP protocol utilises few forms a security to protect its data. Some are listed below

• Simple Authentication and Security Layer (SASL)
• The Simple Authentication and Security Layer, or SASL, is a framework that permits authentication as well as data security services  in connection-oriented protocols, such as the above-mentioned LDAP. It states a challenge-response protocol where data is exchanged between the client and the server for authenticating and building a security layer for further communication.
• Secure Sockets Layer (SSL)
• The Secure Socket Layer is used for management for message transmission over the Internet. It uses a uses a program layer found between the Hypertext Transfer Protocol (HTTP) and Transport Control Protocol (TCP) layers. It uses a public-and-private-key encryption system which also utilises digital certificates. It uses the sockets method in which data is passed between a client and and server program in a network or between the program layers in the same computer.

References

http://tldp.org/HOWTO/LDAP-HOWTO/authentication.html

http://tools.ietf.org/html/rfc4422

http://www.collectionscanada.gc.ca/iso/ill/document/ill_directory/X_500andLDAP.pdf

http://searchsecurity.techtarget.com/definition/Secure-Sockets-Layer-SSL

X.500 Security Features

 Overview

The X.500 protocol, which was first approved in 1988 and then enhanced in 1993 with the support of the International Telecommunications Union (ITU). The goal of this protocol was to provide a global standard for directory systems. It consists of a client-server model design, and uses two other protocols, namely Directory Access Protocol (DAP), and Directory System Protocol (DSP), to communicate between the systems.

Security features

The X.500 protocol utilises the X.509 PKI (Public Key Infrastructure) specification as part of its security design.

X.509 is a standard when defining digital certificates. It functions as follows:

1. The client sends a message to the service which include his or her credentials signed with the private key that is paired with the public key in the client's X.509 certificate. The client then attaches a certificate identifier to the request which allows the service to withdraw the certificate from the  certificate repository and verify the message signature.
2. The service validates the certificate, by conducting checks such as verifying that the certificate is still valid. If not, it would not be approved and verifying the internal consistency of the certificate. The service also checks that the data in the certificate has not been tampered with by verifying the certificate contents against the signature of the issuing CA.
3. The service utilizes the public key in the client's X.509 certificate to verify the client's signature. This allows the service to authenticate the client and ensure the authenticity of the signed data even after the message was signed.
4. The service may  subsequently send a response back to the client.

references
http://msdn.microsoft.com/en-us/library/ff649801.aspx
http://www.collectionscanada.gc.ca/iso/ill/document/ill_directory/X_500andLDAP.pdf

GPRS Security Features, Threats and Solutions

GPRS, or General Packet Radio Service is form of mobile data service that is Packet oriented, which is used in 2G and 3G networks. It was originally standardised by the  European Telecommunications Standards Institute (ETSI). However, it is now being managed by the 3rd Generation Partnership Project (3GPP).
GPRS utilises similar security as to those offered by GSM. Some of the features are described below:

• Identity Confidentiality
• This provides a level of confidentiality to the user, thus making it difficult to identify the user from the traffic sent and received. A temporary identity, known as TLLI (Temporary Logical Link Identifier), is used. To avoid ambiguities, a Routing Area Identity (RAI) is used.
• User and signaling data confidentiality
• The key used for data and signaling, GPRS-Kc, is derived by utilising the function A3/8, from which a 64-bit key is derived.

The GPRS service is also susceptible to threats, such as:

• Denial of Service attacks (DoS attacks)
• Attackers might flood a particular IP address of a Mobile Station, making it unable to use the GPRS network.

However, there are some solutions in place to help combat this threat.

• Traffic rate limiting
• On Internet connections, IPSec traffic from important networks would be prioritised over other traffic, thus ensuring the intranet services are protected from attacks.

References

http://www.it.iitb.ac.in/~kavita/GSM_Security_Papers/GPRS_Security_Threats_and_Solutions.pdf

http://www.brookson.com/gsm/gprs.pdf

GSM Security Features, Threats and Solutions

GSM (Global System for Mobile Communications, formally known as Groupe Spécial Mobile) is a set of standards which was developed by the European Telecommunications Standards Institute (ETSI) and describes  the technologies used in second generation (2G) digital cellular networks. It provides some features, such as:

• Total Mobility
• The user is able to utilize the Pan-European system which permits him to communicate from everywhere and to contacted in any location that is covered by the  GSM cellular network utilizing the same assigned telephone number, including when the user is not at home. The calling party is not required to be aware of the location of who they are calling, because the GSM networks will handle these tasks. With own chipcard he or she can make a call anywhere, not only from his or her home.
• Security
• The security methods for the GSM System makes one of the safest form of cellular telecommunications standard currently available. Despite the fact that the confidentiality of a call and anonymity of the GSM subscriber is only guaranteed on the radio channel, it is still a big shift in achieving end-to-end protection. Temporary identification numbers are used to protect the subscriber’s identity . The confidentiality of the communication itself on the radio link is performed by the use of encryption algorithms and frequency hopping via digital systems and signaling.

However, there are still some threats faced by GSM users. Some of them includes:

• Theft of service
• Due to the mobile nature of the technology, it makes it more susceptible to physical theft. The thief could then utilize the SIM card to make calls without the owner's approval, and as well as access the owner's account.
• A simple solution to this problem could be that users should be careful and ensure that their items do not get stolen, which would nullify this threat.
• Another solution is for the subscriber to immediately alert the service provider upon theft, and the service provider would terminate service to that account.
• Privacy
• GSM relies on encryption algorithms to protect the data traffic. Should this be compromised, any data transmitted can be read. Furthermore, due to its widespread nature, it is a prime target for hackers.

References:
http://www.hackcanada.com/blackcrawl/cell/gsm/gsm-secur/gsm-secur.html
http://www.ehow.com/list_7453174_problems-facing-gsm.html