1 / 38

PROTEXX Inc. - Information Security: A Managerial Overview

Learn about the dramatic issues facing our world and how PROTEXX Inc. offers secure solutions in information security. Discover our vision, approach, and partnerships.

jferry
Download Presentation

PROTEXX Inc. - Information Security: A Managerial Overview

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Corporate Overview PROTEXX Inc. - A Joint Venture of: Dynamic Encryption Inc, NXCONN Wireless LLC, and Horizon Wi-Fi.com LLC Our Network Operations Center [NOC] is located in Plainview New York with additional offices in Florida and Connecticut For information Call: 561 306 0605 Information Security...A Managerial Overview

  2. The Management Team Peter Letizia Director & Founder Dynamic Encryption Tunnel Inc Bill Tabor Director & CTO Dynamic Encryption Tunnel Inc Don Bonafazio Director & President NXCONN Wireless LLC Mark L Myers Director & Partner Horizon Wi-Fi Gene Feher Director & Partner Horizon Wi-Fi Ken McClenithan Director & Partner Horizon Wi-Fi Information Security...A Managerial Overview

  3. Problem Statement • Dramatic Issues Facing our World: Successful and Costly attacks upon life, property and information!! • These attacks include: • Terrorism • Theft of data • Identity theft • Denial of service • Transaction redirection • Misuse of data • Fraud • Theft of service Information Security...A Managerial Overview

  4. These issues resulted from • Absence of positive, persistent identification of an • individual due to: • Weak, poorly designed or absence of authentication (identification) systems • Inadequate local operating system/distributed server protection of user names, key files and password files • Inadequate application and data security due to: • Inadequate authorization controls (local and remote) protecting corporate assets • Local information sitting unprotected in text files and database records (tables) Information Security...A Managerial Overview

  5. Our Vision • Enable our customers to be absolutely sure of three things: • To whom they grant access (positive identification of the • requestor) • The services permitted once access is granted (exactly those • services required by the requestor to complete a task … no • more, no less) • Application, infrastructure and data security Information Security...A Managerial Overview

  6. Our Approach VMS For Outward Facing Systems VMS with DCE For Integration Connectivity Apache Pass-through Sign-in to DCE DCE Single Sign On DCE GUI Administration Terminal (Under Development) Information Security...A Managerial Overview

  7. Single Site Secure Access Information Security...A Managerial Overview

  8. Multiple Site Security Information Security...A Managerial Overview

  9. Secure System Provider • Biometric Secure Identification • Secure Instant Messaging and File Transfer • Public Key Infrastructure (PKI) Services • Custom Software Services • Consulting Services • Educational Services Information Security...A Managerial Overview

  10. Partner with Compaq • CSA Partner • Global Systems Reseller (PCs and Alpha) • Value Added Reseller • Technology Partner • Consulting Partner • OpenVMS Systems Integrator Information Security...A Managerial Overview

  11. Following Markets Focus • Medical/Pharmaceutical/Healthcare • Telecommunications Service Providers • Government (DOD) • Financial • Security • Legal Information Security...A Managerial Overview

  12. digitalrights prototype C code document Enterprise Security Perspective • Secure the Computing and Facilities Perimeters • Secure Information at Rest • Secure Information in Transit • Enable Digital Rights Management of Information Information Security...A Managerial Overview

  13. Value Add for Partners • Senior Staff Member Expertise • Secure Software Architecture, Design and Development • Network Configuration and Management • Biometric Engineering • Systems Integration and Consulting • SyntheSys Products Built on or Ported to Compaq Platforms • Exceptionally Strong OpenVMS Base • Exceptionally Strong Compaq Hardware Base • One of Twelve OpenVMS System Integrators • CSA Partner Information Security...A Managerial Overview

  14. Generate a 56-bit symmetric key PROTEXX Secure Products • Biometric Fingerprint Authentication Card • JabCast Secure Realtime Communications (SRC) Suite • JabCast Low Bandwidth Monitoring • PKI Trust Centers (idTRUST) Generate a Public/Private Key Pair Information Security...A Managerial Overview

  15. Biometric Secure ID Protexx Biometric Card Features and Characteristics • Credit card sized “Smart Card” – with on-card crypto processor • Maintains protected storage for public/private keys, Digital Certificates and Digital Signatures to be used during authentication process • Executes Cryptographic Operations on Card (verifies fingerprint) • works in conjunction with Card • Operating System (COS) Information Security...A Managerial Overview

  16. VCC GND Reset Clock I/O Biometric Secure ID Card Biometric On-Card Components: 32-bit Microprocessor (Microcontroller) ISO 7816 Family of Smart/Crypto Card Standards, i.e., power, Clock & I/O Bus RAM 2K Bytes Crypto Accelerator (Processor) ROM 32K+ Bytes EEPROM 64K+ Bytes Information Security...A Managerial Overview

  17. Biometric Secure ID Card The Biometric Card Process • User enrolls in the Biometric process • Card maintains encrypted hash copy of user’s fingerprint in • EEPROM • To authenticate user places the correct finger on the optical reader • The fingerprint is scanned, hashed and encrypted • The crypto processor compares the fingerprint sample to the stored value • Card will return success or failure status to system Information Security...A Managerial Overview

  18. Biometric SmartCard Biometric Secure ID Card Immediate Uses for Biometric Smart Card Authenticate and Prove Absolute Identity of Card Holder Potential Future Biometric Smart Card Uses • Passports (via Distributed Information Databases) • Credit Card Verification & Approval • Storage of Loyalty Points (frequent flyer, etc.) • Pharmaceutical/Medical History • Credit or Debit Bankcard • Driver’s License Information Security...A Managerial Overview

  19. Biometric Secure Identity Card Example Control signal Open door/authorization failure Secured testing room door Authentication information door controller authorization database Information Security...A Managerial Overview

  20. Biometric Secure Identity Card Card Customization Capabilities: • Multiple processors (4, 6, 8, etc.) • Mix and match 8, 16 and 32 bit processors for focused tasks • Memory (Inter-processor and processor specific) • Multiple custom data structure (application and processor) • Potentially contact-based and contact-less cards Information Security...A Managerial Overview

  21. JabCast SRC Product Features • Secure realtime communications protocol – IP based • Secure realtime instant message delivery • Secure realtime file delivery • Senders address hidden from view – path hiding • Presence management (follow the user approach) • Architected on XML/Open Source Jabber protocol • Integration of JabCast protocol into application • infrastructures Information Security...A Managerial Overview

  22. JabCast SRC Product Features • Multi-platform support – Compaq servers • ProLiant • OpenVMS • TRU64 UNIX • Full range of client devices • Desktops  Laptops • Hand Helds • Cell Phones • Installation and technical support services • Training and documentation services Information Security...A Managerial Overview

  23. Foreign IM Server Cryptographic Algorithm Non-secure IM Client JabCast Client Non-secure IM Client OpenVMS JabCast Server Cryptographic Algorithm JabCast SRC Server Cryptographic Algorithm Cryptographic Algorithm Cryptographic Algorithm Cryptographic Algorithm JabCast Client JabCast Client JabCast Client JabCast SRC Implementation Example Information Security...A Managerial Overview

  24. Protexx PKI Product Suite • idTRUST (PKI) – suite of applications required to securely • manage business processes • idSEND – verifies receipt and successful delivery of • messages • idSIGN – XML based secure application ensuring • immutability of e-documents and forms through use of • digital signatures • idDOC – work flow management tool enabling creation, • access and tracking of e-documents Information Security...A Managerial Overview

  25. Protexx PKI Product Suite • idSAFE – platform to ensure transport and management • of data in transit (VPN) • idVOTE – a product enabling Internet voting via secure • voter authentication • idSEAL – smart encryption tool enabling the user to • encrypt and decrypt individual files Information Security...A Managerial Overview

  26. Why Use Cryptography? • Cryptographycan be applied to the following informationcategories: • Information at Rest • Information in Transit • Cryptographyis used to enable information: • Privacy – information cannot be read • Integrity – information cannot be modified • Authentication – information proof of ownership • Non-repudiation – cannot deny involvement in transaction Information Security...A Managerial Overview

  27. Ciphertext Cleartext Public Key Cipher Public Key Cipher information Ciphertext Cleartext Asymmetric key “public key” Asymmetric key “private key” information Encryption Process Decryption Process J9%B 8^cBt J9%B 8^cBt Asymmetric Key Cryptography Different keys (secrets) are used for both the encryption and decryption processes: Asymmetric key cryptography is characterized by the use of two independent but mathematically related keys Information Security...A Managerial Overview

  28. Generate a Public/Private Key Pair Public/Private Key Generation Local Application Browser Remote Server Information Security...A Managerial Overview

  29. idTRUST – PKI Infrastructure Why is a PKI Infrastructure Necessary? • Optional key generation • Validate initial identities • Issuance, renewal and termination of certificates • Certificate validation • Distribution of certificates • Secure archival and key recovery • Generation of signatures and timestamps • Establish and manage trust relationships Information Security...A Managerial Overview

  30. idTRUST – PKI Infrastructure What has blocked PKI from global use? • Cost • PKI Integration with vertical application base • CA portability and interoperability Information Security...A Managerial Overview

  31. Certificate interoperability Master Trust Centers SyntheSys Master Trust Center Third Party Master Trust Center (depends on level of trust) (Security Level 1, 2, 3) Organizations Healthcare Level 1, 2, 3 Finance TrustCenter Trust Center Level 1, 2, 3 Departments, Groups, Regional Centers Trust Center Trust Center Trust Center Trust Center Trust Center Trust Center Trust Center Trust Center Level 3 Level 1 Level 1, 3 Level 1 Level 1, 2 Level 1, 2 Level 1, 2 Geographic (regional) Trust Center Geographic (regional) Trust Center Geographic (regional) Trust Center Level 1 Level 1, 2 Medical records database small business small business small business small business small business small business small business small business small business Trust Center Hierarchy Information Security...A Managerial Overview

  32. idTRUST Customer Options • On-Site Purchase • On-Site Lease • Service Agreement (Application Service Provider Model) Information Security...A Managerial Overview

  33. Protexx Professional Services: • Biometric Smart Card, Trust Center and PKI Integration • Secure Application Design, Development and Implementation • Enterprise Security Services • Custom Software and Consulting Services • Technical Support (Hotline and On-site) • Project Management • Training and Education Information Security...A Managerial Overview

  34. Security Services • Security Inventory Service • Security Policies and Procedures Guide Development • Security Audit/Assessment Service • Security Vulnerability Service • Security Implementation Service • Disaster Recovery Services Information Security...A Managerial Overview

  35. Security Audit Service Task: Review existing corporate security practices pertaining to: • Day-to-day enterprise computing: • Perimeter security (authentication, identity and authorization) • Information at rest • Information in transit (distributed computing, file transfer, etc.) • Business applications software and email usage • mobile computing • Management security directives • Corporate security policy and procedure guidelines • Compliance with appropriate legislation Information Security...A Managerial Overview

  36. Security Audit Service Deliverables: Deliver documents declaring existing security preparedness • An inventory document defining the current sate of • enterprise security methods, techniques, corporate • compliance and usage • A document defining next steps in the overall process of • defining a current corporate security strategy and • implementation plan: • Requirements Analysis document • Security Architecture document • Security Products and Implementation plan Information Security...A Managerial Overview

  37. Educational Services [Tech Training] • Modern Security Practices • Authentication/Perimeter Security • Trust Center and PKI Integration • Secure Distributed Architectures • Secure Middleware Integration • CORBA • DCE • Programming Languages • C • Java/JavaScript • Perl Information Security...A Managerial Overview

  38. Protexx Inc. Concerned ! Dedicated ! Confident ! Thank You! www.ProtexxInc.com 203 559 9860 Information Security...A Managerial Overview

More Related