Advance Program--Twelfth Annual Computer Security Applications Conference

Tutorial Program

Monday Tutorials:

Analysis and Implementation of Current Firewall Architectures
Fundamentals of Encryption
CORBA Secure Interoperability
Security Modeling for the Generalist

Tuesday Tutorials:

Security Protocols for the Internet
Assembling a UNIX Security Toolkit
Introduction to the Common Criteria

Free Tuesday Workshop:

Intrusion Detection Issues

Analysis and Implementation of Current Firewall Architectures
A Full Day Tutorial, Monday, December 9, 1996, Registration Code: M1
Course Director: Mr. Norm Laudermilch, Uunet Technologies, Inc.

Course Objective:
This tutorial will teach how to design, implement, and manage firewall architectures. Beginning with the need for perimeter security, the tutorial explores the specifics of firewall design and how different designs can be used to enforce different types of security. A methodical approach to defining security requirements, choosing a firewall architecture to enforce those requirements, and building the pieces step-by-step is then introduced. The effectiveness and differences of several firewall products is then examined. This relates the technologies to current products, and helps those looking for a commercial rather than a custom designed solution. The tutorial concludes with a discussion of tools, conclusions, and references. At the end of the tutorial, the attendee will be able to accurately identify security and communications requirements, build an appropriate security architecture to meet those requirements, and have knowledge of the tools to help manage and maintain their firewall. This tutorial assumes a moderate level of UNIX and networking knowledge.

Course Outline:

1. The need for perimeter security 4. Current Firewall Products

2. Firewall Design 5. Useful Tools

3. Firewall Implementation 6. Conclusions and References

Fundamentals of Encryption
A Full Day Tutorial, Monday, December 9, 1996, Registration Code: M2
Course Director: Dr. Ronald Gove, SAIC

Course Objective:
The widespread use of the internet for electronic commerce and the exchange of information of a personal nature has greatly increased both the need and the community interest in cryptogrpahy. To be able to develop systems that use cryptographic engines requires some knowledge of cryptographic principles. Reports of the recent attacks on Netscape's cryptography in the nations newspapers were somewhat misleading because of this lack of understanding of the relationship between key lengths, algorithms, and faulty implementation. This tutorial will provide a foundation of basic knowledge that will be of significant benefit to all who intend to use or apply cryptography.

Course Outline:

1. Introduction & Overview 5. Key management

2. Historical Introduction 6. Public Key Cryptography

3. Modern Cryptography 7. Digital Signatures & Hash Functions

4. Cryptanalysis 8. DES & Other Systems

CORBA Secure Interoperability
A Full Day Tutorial, Monday, December 9, 1996, Registration Code: M3
Course Director: Mr. Bret Hartman, BlackWatch Technology, Inc.

Course Objective:
Object technology (OT) is a paradigm supporting distributed computing. The Common Object Request Broker Architecture (CORBA) as promoted by the Object Management Group (OMG) is a standard set of interface specifications that supports interoperable distributed object-based computing. However, the current CORBA security specification does not include mechanisms for interoperability. The proposed Common Secure Interoperability (CSI) specification addresses this topic, defining common security mechanisms. ORBs built to this specification will enable object-based applications to interoperate securely across a wide variety of hardware and operating system platforms. The tutorial will describe the security reference model, architecture, and assurance guidelines. The tutorial will then present an in-depth view of how the CSI specification supports interoperation among ORBs for a range of security policies and mechanisms. The tutorial will conclude with a comparison of CORBA secure interoperability with other security mechanisms.

Course Outline:

1. Introduction to CORBA Security 5. Common Secure Interoperability

2. Security Reference Model 6. Closed Environment Interoperability

3. Security Architecture 7. Open Environment Interoperability

4. Trust Model 8. Interoperability Mechanisms

Security Modeling for the Generalist
A Full Day Tutorial, Monday, December 9, 1996, Registration Code: M4
Course Director: Dr. David Bell, Mitretek Systems

Course Objective:
This tutorial is for the computer security professional that needs familiarity with security modeling but does not need to become an expert. The emphasis will be on the benefits of modeling in conjunction with system design or system analysis, with attention to the pitfalls of viewing modeling as just a hurdle to clear. Topics that covered will be the early developments in computer security that led to "security models"; the earliest types of models (information-flow and access models); the development and initial use of models; the use of models through the Computer Security Initiative to the most recent additions to the Evaluated Products List (EPL); a survey of recent modeling trends, developments and controversies; and a description of how modeling has been used in trusted product evaluation and formal system assessment in operational systems. Group problems and exercises will be included

Course Outline:

1. Introduction 4. Security Models Used in System and Product Evaluations

2. Early Modeling

3. Using Security Models 5. Modeling Trends and Developments

Security Protocols for the Internet
A Full Day Tutorial, Tuesday, December 10, 1996, Registration Code: T1
Course Director: Dr. Rolf Opplinger, Swiss Federal Office of Information Technology and Systems (BFI)

Course Objective:
In spite of the wide deployment of firewalls within the current Internet, most network security practitioners agree that more and better security can only be achieved by using cryptographic techniques and corresponding security protocols. However, there is neither a general consensus on how these protocols should look like, nor on what layer they should be deployed. Today, there is a wide proliferation of security protocols being proposed for the Internet, transport, and/or application layer. The aim of this tutorial is to give a comparative overview and to discuss the security protocols that are available today.

Course Outline:

1. Introduction 4. Security for the Transport Layer

2. Cryptography 5. Security for the Application Layer

3. Security for the Internet Layer 6. Conclusions

Assembling a UNIX Security Toolkit
A Full Day Tutorial, Tuesday, December 10, 1996, Registration Code: T2
Course Director: Mr. Daniel Vukelich, The MITRE Corporation

Course Objective:
This tutorial will discuss how to assemble a security toolkit for a UNIX system. The tutorial will discuss categories of tools required by system and security administrators to effectively do their jobs, identify which security tools typically come bundled with a UNIX system, identify useful public domain security tools, and provide guidance on balancing the tradeoffs between public domain tools and COTS tools. The bulk of the tutorial will concentrate on individual public domain tools such as SATAN, COPS, SPI, tripwire, etc. The tutorial will discuss each tool's function, recommended frequency of execution, and report interpretation. Sample reports and instructions for obtaining the tools will be provided.

Course Outline:

1. Introduction 6. Applying Short-Term Countermeasures

2. Building a UNIX Security Toolbox

3. Types of Things a UNIX Security Tools Should Check For 7. Building A UNIX Security Toolbox at Your Site

4. Types of UNIX Security Tools 8. Internet Sources

5. Interpreting the Results

Introduction to the Common Criteria
A Full Day Tutorial, Tuesday, December 10, 1996, Registration Code: T3
Course Director: Mr. Aaron Cohen Computer Sciences Canada

Course Objective:
Version 1.0 of the CCITSE is a large and complex document containing inconsistencies and a radical approach to evaluating trusted computer systems and products. This tutorial will explain how to tackle the seemingly insurmountable CC document. The structure of the CC has been improved significantly since version 0.9; however, knowing which parts to read is key to understanding the document. This course will address these points and will introduce the students to the CC by explaining the structure and content of the criteria in an easy to understand way. The students will learn how to orient themselves to the criteria in a quick and efficient manner and also what parts of the criteria to read to address specific goals. The new terminology (classes, families, components protection profile, security target, etc.) will be explained and contrasted to the terms found in the TCSEC, ITSEC, and CTCPEC to help students make the transition to the CC. The hierarchical nature of the functional and assurance criteria will be explained along with subtleties found throughout the criteria. Real examples of a security target and final evaluation report from the Milky Way evaluation against CC ver. 0.9 (or a more recent CC evaluation, if available) will be examined along with the protection profiles (PP) found in Part 4 of the CC. The course will end with a review of current events tied to the CC effort.

Course Outline:

1. Introduction 6. New concepts and terminology

2. The Structure of the CC 7. Current CC Effort Activities

3. The Parts of the CC 8. Protection Profiles included in Part 4

4. The new approach to functionality and assurance 9. Review of an Evaluated Product against the CC

5. The assurance hierarchy and alternate assurance methods.

[ FORWARD TO WEDNESDAY TECHNICAL PROGRAM ]

[ACSAC HOME PAGE] [ GENERAL INFORMATION] [ PROGRAM OVERVIEW]
[ TECHNICAL PROGRAM] [ TUTORIALS] [ REGISTRATION/LOGISTICS] [MAIL ACSAC WEBMASTER]

1.	The need for perimeter security	4.	Current Firewall Products
2.	Firewall Design	5.	Useful Tools
3.	Firewall Implementation	6.	Conclusions and References

1.	Introduction & Overview	5.	Key management
2.	Historical Introduction	6.	Public Key Cryptography
3.	Modern Cryptography	7.	Digital Signatures & Hash Functions
4.	Cryptanalysis	8.	DES & Other Systems

1.	Introduction to CORBA Security	5.	Common Secure Interoperability
2.	Security Reference Model	6.	Closed Environment Interoperability
3.	Security Architecture	7.	Open Environment Interoperability
4.	Trust Model	8.	Interoperability Mechanisms

1.	Introduction	4.	Security Models Used in System and Product Evaluations
2.	Early Modeling
3.	Using Security Models	5.	Modeling Trends and Developments

1.	Introduction	4.	Security for the Transport Layer
2.	Cryptography	5.	Security for the Application Layer
3.	Security for the Internet Layer	6.	Conclusions

1.	Introduction	6.	Applying Short-Term Countermeasures
2.	Building a UNIX Security Toolbox
3.	Types of Things a UNIX Security Tools Should Check For	7.	Building A UNIX Security Toolbox at Your Site
4.	Types of UNIX Security Tools	8.	Internet Sources
5.	Interpreting the Results

1.	Introduction	6.	New concepts and terminology
2.	The Structure of the CC	7.	Current CC Effort Activities
3.	The Parts of the CC	8.	Protection Profiles included in Part 4
4.	The new approach to functionality and assurance	9.	Review of an Evaluated Product against the CC
5.	The assurance hierarchy and alternate assurance methods.