General security

• General security information at CERT and JANET-CERT
• CIAC
• Computer crime pointers.
• Wietse Venema distributes several security products (note that these have been moved from the old location at <ftp://ftp.win.tue.nl/pub/security/>), including TCP wrappers, S/Key implementations, portmap/rpcbind replacements, and more. They seem quite highly regarded.
• CERT Security Improvement Modules
• Secure Deletion of Data from Magnetic and Solid-State Memory
• SSH - secure shell. the SSH web pages have been repeatedly buggered about with. The company that sells F-Secure is DataFellows. I have, however, found a separate ssh FAQ.
• List of ssh software. Mac clients:
  • NiftyTelnet: version 1.1-ssh-r3 is very nice, has scp and RSA authentication, but doesn't have port forwarding.
  • F-Secure: commercial. Version 1, supporting ssh-1, was a bit clunky, but was the only ssh client I managed to get to do port forwarding.
  • BetterTelnet is a descendant of NCSA Telnet. It doesn't have ssh support, but reportedly will have `soon' (as at November 2000).
  • MacSSH supposedly has ssh port forwarding, but I couldn't get it to work.
  • Java-SSH applet. Or see the Java Telnet Application (jta). Both need fairly up-to-date Java runtimes.
• Computer security pointers from NIH, with a useful collection of FAQs
• Zedz Consultants is a big archive of security and cryptographic software (it used to be replay.com).
• The Global Trust Register is a paper book containing about 1000 `important' keys.
• EuroCERT
• Fortify `provides world-wide, unconditional, full strength 128-bit cryptography to users of Netscape'. You can check your browser's encryption strength by looking at <https://www.fortify.net/sslcheck.html>.
• CERT Advisory CA-94.05 discusses MD5 checksums in general, includes checksums for various SunOS system files, and includes a pointer to MD5 software.
• Peter Gutmann's godzilla crypto tutorial
• JTAP working papers: Secure Internet issues for the HE Community, and The Use of Firewalls in an Academic Environment.
• Social engineering for hacking: Part I: Hacker Tactics, Part II: Combat Strategies, and NLP-powered Social Engineering

Other links: The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments.

Ross Anderson has made available his lecture notes on computer security: at second and third year.

RFC 2196 Site Security Handbook

Norman 1 January 2001