Embedded Systems

Embedded Systems

1. An embedded system is a computer that has been built to solve only a few very specific problems and is not easily changed. In contrast, a general-purpose computer can do many different jobs, and can be changed at any time with new programs for new jobs.
   It is also a specialized computer system that is part of a larger system or machine. Typically, an embedded system is housed on a single microprocessor board with the programs stored in ROM. Virtually all appliances that have a digital interface watches, microwaves, VCRs, embedded systems.
   
   Some embedded systems include an operating system, but many are so specialized that the entire logic can be implemented as a single program.
   
   
   
   

Top Ten Password Cracking Techniques

1. Dictionary attack

This uses a simple file containing words that can, surprise surprise, be found in a dictionary. In other words, if you will excuse the pun, this attack uses exactly the kind of words that many people use as their password.

2. Brute force attack

This method is similar to the dictionary attack but with the added bonus, for the hacker, of being able to detect non-dictionary words by working through all possible alpha-numeric combinations from aaa1 to zzz10.

3. Rainbow table attack

A rainbow table is a list of pre-computed hashes - the numerical value of an encrypted password, used by most systems today - and that’s the hashes of all possible password combinations for any given hashing algorithm mind. The time it takes to crack a password using a rainbow table is reduced to the time it takes to look it up in the list.

4. Phishing

There's an easy way to hack: ask the user for his or her password. A phishing email leads the unsuspecting reader to a faked online banking, payment or other site in order to login and put right some terrible problem with their security.

5. Social engineering

Social engineering takes the whole ‘ask the user’ concept outside of the inbox that phishing tends to stick with and into the real world. A favourite of the social engineer is to telephone an office posing as an IT security tech guy and simply ask for the network access password.

6. Malware

A key logger or screen scraper can be installed by malware which records everything you type or takes screen shots during a login process, and then forwards a copy of this file to hacker central. Some malware will look for the existence of a web browser client password file and copy this which, unless properly encrypted, will contain easily accessible saved passwords from the user's browsing history.

7. Offline cracking

It’s easy to imagine that passwords are safe when the systems they protect lock out users after three or four wrong guesses, blocking automated guessing applications. Well, that would be true if it were not for the fact that most password hacking takes place offline, using a set of hashes in a password file that has been ‘obtained’ from a compromised system.

8. Social engineering

The most confident of hackers will take the guise of a parcel courier, aircon service technician or anything else that gets them access to an office building. It also provides an excellent opportunity to eyeball all those post-it notes stuck to the front of LCD screens with logins scribbled upon them.

9. Spidering

Savvy hackers have realised that many corporate passwords are made up of words that are connected to the business itself. Studying corporate literature, website sales material and even the websites of competitors and listed customers can provide the ammunition to build a custom word list to use in a brute force attack.

10. Guess

The password crackers best friend, of course, is the predictability of the user. Unless a truly random password has been created using software dedicated to the task, a user generated ‘random’ password is unlikely to be anything of the sort.

Password cracking

Password cracking 

What is Password Cracking?

Password cracking is the process of guessing or recovering a password from stored locations or from data transmission system. It is used to get a password for unauthorized access or to recover a forgotten password. In penetration testing, it is used to check the security of an application.

Most Popular Password Cracking Tools:

1. Brutus: is one of the most popular remote online password cracking tools. It claims to be the fastest and most flexible password cracking tool.
2. RainbowCrack: is a hash cracker tool that uses a large-scale time-memory trade off process for faster password cracking than traditional brute force tools.
3. Wfuzz: is web application password cracking tool that tries to crack passwords with brute forcing.
4. Cain and Abel: is a well-known password cracking tool that is capable of handling a variety of tasks. 
5. John the Ripper: is well-known free open source password cracking tool for Linux, Unix and Mac OS X. A Windows version is also available.

Hashing Algorithm

The key in public-key encryption is based on a hash value. This is a value that is computed from a base input number using a hashing algorithm. Essentially, the hash value is a summary of the original value. The important thing about a hash value is that it is nearly impossible to derive the original input number without knowing the data used to create the hash value. 

Demilitarized zone (DMZ)

Demilitarized zone (DMZ)

DMZ (demilitarized zone) is a computer host or small network inserted as a "neutral zone" between a company's private network and the outside public network. It prevents outside users from getting direct access to a server that has company data.  A DMZ is an optional and more secure approach to a firewall and effectively acts as a proxy server as well. A DMZ sits between the Internet and the internal network and is sometimes referred to as a “perimeter network.” 

A DMZ protecting an internal network

Network Address Translation (NAT)

Network Address Translation (NAT)

The most basic security feature of a firewall is Network Address Translation (NAT).

Network Address Translation is the process where a network device, usually a firewall, assigns a public address to a computer (or group of computers) inside a private network.

The main use of NAT is to limit the number of public IP addresses an organization or company must use, for both economy and security purposes.

The War Machines

The War Machines is the ninth and final serial of the third season in the British science fiction television series Doctor Who, which was first broadcast in 4 weekly parts from 25 June to 16 July 1966. This serial marks the departure of Jackie Lane as Dodo Chaplet and also the first appearance of Michael Craze and Anneke Wills as new pending companions Ben Jacksonand Polly. It is also the only complete serial to actually feature Anneke Wills and Michael Craze, and the final complete serial from the William Hartnell era.

Honeypots

Honeypots

A honeypot is a computer system on the Internet that is expressly set up to attract and "trap" people who attempt to penetrate other people's computer systems. (This includes the hacker, cracker, and script kiddy.) To set up a honey pot, it is recommended that you:

• Install the operating system without patches installed and using typical defaults and options 
• Make sure that there is no data on the system that cannot safely be destroyed 
• Add the application that is designed to record the activities of the invader

Maintaining a honey pot is said to require a considerable amount of attention and may offer as its highest value nothing more than a learning experience (that is, you may not catch any hackers).

History of cryptography

Cryptography, the use of codes and ciphers to protect secrets, began thousands of years ago. Until recent decades, it has been the story of what might be called classic cryptography — that is, of methods of encryption that use pen and paper, or perhaps simple mechanical aids. In the early 20th century, the invention of complex mechanical and electromechanical machines, such as the Enigma rotor machine, provided more sophisticated and efficient means of encryption; and the subsequent introduction of electronics and computing has allowed elaborate schemes of still greater complexity, most of which are entirely unsuited to pen and paper.

The development of cryptography has been paralleled by the development of cryptanalysis — the "breaking" of codes and ciphers. The discovery and application, early on, of frequency analysis to the reading of encrypted communications has, on occasion, altered the course of history. Thus the Zimmermann Telegram triggered the United States' entry into World War I; and Allied reading of Nazi Germany's ciphers shortened World War II, in some evaluations by as much as two years.

Until the 1970s, secure cryptography was largely the preserve of governments. Two events have since brought it squarely into the public domain: the creation of a public encryption standard (DES), and the invention of public-key cryptography.

Application Layer Firewal

Application layer firewalls function in one of two modes: passive or active. Active application firewalls actively inspect all incoming requests -- including the actual message being exchanged -- against known vulnerabilities such as SQL injection, parameter and cookie tampering, and cross-site scripting. Only requests that are deemed "clean" are passed to the application. Passive application layer firewalls act in a manner similar to an IDS (Intrusion Detection System) in that they also inspect all incoming requests against known vulnerabilities, but they do not actively reject or deny those requests if a potential attack is discovered.

Application layer firewalls improve the overall security of the application infrastructure by preventing attacks that are likely to cause a service outage or cause structural damage to data sources. Application layer firewalls are generally remotely updateable, which allows them to prevent newly discovered vulnerabilities. These firewalls are often more up to date than specific security-focused code included in applications, due to the longer development and testing cycles required to include such code within applications.

F5 products that provide an application layer firewall:

• BIG-IP Application Security Manager

Additional resources about application layer firewalls:

• Application firewalls white paper
• Vulnerability Assessment Plus Web Application Firewall
• Web Application Firewalls - Application Protection and Much More
• WhiteHat Security and F5 Team to Battle Attacks Against Enterprise and eCommerce Websites

Packet Filtering

Definition - What does Packet Filtering mean?

Packet filtering is a firewall technique used to control network access by monitoring outgoing and incoming packets and allowing them to pass or halt based on the source and destination Internet Protocol (IP) addresses, protocols and ports.

Network layer firewalls define packet filtering rule sets, which provide highly efficient security mechanisms. 

Packet filtering is also known as static filtering.

Techopedia explains Packet Filtering

During network communication, a node transmits a packet that is filtered and matched with predefined rules and policies. Once matched, a packet is either accepted or denied. 

Packet filtering checks source and destination IP addresses. If both IP addresses match, the packet is considered secure and verified. Because the sender may use different applications and programs, packet filtering also checks source and destination protocols, such as User Datagram Protocol (UDP) and Transmission Control Protocol (TCP). Packet filters also verify source and destination port addresses.

Some packet filters are not intelligent and unable to memorize used packets. However, other packet filters can memorize previously used packet items, such as source and destination IP addresses.

Packet filtering is usually an effective defense against attacks from computers outside a local area network (LAN). As most routing devices have integrated filtering capabilities, packet filtering is considered a standard and cost-effective means of security.

What is Penetration Testing?

Think of a penetration testing methodology—or “pentesting” for short—as a controlled cyber attack during which your best defenses are put to the test and exploited to determine the extent of vulnerabilities in your web applications.

Essentially, designing and implementing a penetration testing methodology allows you to:

• Hack your own system in a proactive, authorized environment, focusing on elements such as IT infrastructure, OS vulnerabilities, application issues and user and configuration errors;
• Analyze and validate both system defenses and user adherence to system protocols; and
• Assess potential attack vectors such as web applications, wireless networks and devices and servers.

Unfortunately, no data is safe 100 percent of the time. But an effective penetration testing methodology can do wonders for eliminating unnecessary vulnerabilities.

Replay Attack

Sometimes known as a man in the middle attack, a replay attack is a type of security issue in which a third party intercepts data transmissions with the purpose of making use of that data in some manner. Typically, this type of attack involves copying and possibly altering the data in some manner before releasing it for delivery to the intended recipient. This method can be used to collect login credentials or other information that is intended to be proprietary, and use that information to gain unauthorized access to additional data.

Embedded Operating System

An embedded system is a computer that is part of a different kind of machine. Examples include computers in cars, traffic lights, digital televisions, ATMs, airplane controls, point of sale (POS) terminals, digital cameras, GPS navigation systems, elevators, digital media receivers and smart meters, among many other possibilities.

Password Cracking

In cryptanalysis and computer security, password cracking is the process of recovering passwords from data that have been stored in or transmitted by a computer system. A common approach (brute-force attack) is to repeatedly try guesses for the password

The purpose of password cracking might be to help a user recover a forgotten password (installing an entirely new password is less of a security risk, but it involves System Administration privileges), to gain unauthorized access to a system, or as a preventive measure by System Administrators to check for easily crackable passwords. On a file-by-file basis, password cracking is utilized to gain access to digital evidence for which a judge has allowed access but the particular file's access is restricted.

Dictionary Attack

A method used to break security systems, specifically password-based security systems, in which the attacker systematically tests all possible passwords beginning with words that have a higher possibility of being used, such as names and places. The word "dictionary" refers to the attacker exhausting all of the words in a dictionary in an attempt to discover the password. Dictionary attacks are typically done with software instead of an individual manually trying each password.

Cryptography Attacks

Birthday attack

A birthday attack is a type of cryptographic attack that exploits the mathematics behind the birthday problem in probability theory. This attack can be used to abuse communication between two or more parties. The attack depends on the higher likelihood of collisions found between random attack attempts and a fixed degree of permutations (pigeonholes).

Mathematical attack

A mathematical attack refers to breaking the encryption by intercepting large quantities of encrypted information and using mathematical and statistical analysis to find the common factor or a hole in the encryption algorithm (a backdoor).

There are five main categories for this attack:

1- Ciphertext-only attack

2- Known plaintext attack

3- Chosen-plaintext attack

4- Chosen-ciphertext attack

5- Side-channel attack

Brute-Force Attack

In cryptography, a brute-force attack, or exhaustive key search, is a cryptanalytic attack that can, in theory, be used against any encrypted data (except for data encrypted in an information-theoretically secure manner).

Cryptography Basic Principles

Introduction to Cryptography Basic Principles

Whenever we come across the term cryptography, the first thing and probably the only thing that comes to our mind is private communication through encryption. There is more to cryptography than just encryption. In this article, we will try to learn the basics of cryptography.

The Basic Principles

1. Encryption

In a simplest form, encryption is to convert the data in some unreadable form. This helps in protecting the privacy while sending the data from sender to receiver. On the receiver side, the data can be decrypted and can be brought back to its original form. The reverse of encryption is called as decryption. The concept of encryption and decryption requires some extra information for encrypting and decrypting the data. This information is known as key. There may be cases when same key can be used for both encryption and decryption while in certain cases, encryption and decryption may require different keys.

2. Authentication

This is another important principle of cryptography. In a layman’s term, authentication ensures that the message was originated from the originator claimed in the message. Now, one may think how to make it possible? Suppose, Alice sends a message to Bob and now Bob wants proof that the message has been indeed sent by Alice. This can be made possible if Alice performs some action on message that Bob knows only Alice can do. Well, this forms the basic fundamental of Authentication.

3. Integrity

Now, one problem that a communication system can face is the loss of integrity of messages being sent from sender to receiver. This means that Cryptography should ensure that the messages that are received by the receiver are not altered anywhere on the communication path. This can be achieved by using the concept of cryptographic hash.

4. Non Repudiation

What happens if Alice sends a message to Bob but denies that she has actually sent the message? Cases like these may happen and cryptography should prevent the originator or sender to act this way. One popular way to achieve this is through the use of digital signatures.

Types of Cryptography

There are three types of cryptography techniques :

• Secret key Cryptography
• Public key cryptography
• Hash Functions

1. Secret Key Cryptography

This type of cryptography technique uses just a single key. The sender applies a key to encrypt a message while the receiver applies the same key to decrypt the message. Since only single key is used so we say that this is a symmetric encryption.

The biggest problem with this technique is the distribution of key as this algorithm makes use of single key for encryption or decryption.

2. Public Key Cryptography

This type of cryptography technique involves two key crypto system in which a secure communication can take place between receiver and sender over insecure communication channel. Since a pair of keys is applied here so this technique is also known as asymmetric encryption.

In this method, each party has a private key and a public key. The private is secret and is not revealed while the public key is shared with all those whom you want to communicate with. If Alice wants to send a message to bob, then Alice will encrypt it with Bob’s public key and Bob can decrypt the message with its private key.

This is what we use when we setup public key authentication in openssh to login from one server to another server in the backend without having to enter the password.

3. Hash Functions

This technique does not involve any key. Rather it uses a fixed length hash value that is computed on the basis of the plain text message. Hash functions are used to check the integrity of the message to ensure that the message has not be altered,compromised or affected by virus.

So we see that how different types of cryptography techniques (described above) are used to implement the basic principles that we discussed earlier. In the future article of this series, we’ll cover more advanced topics on Cryptography.

Resource: http://www.thegeekstuff.com/2012/07/cryptography-basics/

Port scanning

A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their network and by attackers to identify running services on a host with the view to compromise it.

A port scan or portscan can be defined as a process that sends client requests to a range of server port addresses on a host, with the goal of finding an active port. While not a nefarious process in and of itself, it is one used by hackers to probe target machine services with the aim of exploiting a known vulnerability of that service. However the majority of uses of a port scan are not attacks and are simple probes to determine services available on a remote machine.

To portsweep is to scan multiple hosts for a specific listening port. The latter is typically used to search for a specific service, for example, an SQL-based computer worm may portsweep looking for hosts listening on TCP port. 

Types of port scanning:- 

- TCP scanning 

-SYN scanning 

-UDP scanning

-ACK scanning

-Window scanning

Virtualization

Virtualization, in computing, refers to the act of creating a virtual (rather than actual) version of something, including but not limited to a virtual computer hardware platform,operating system  (OS), storage device , or computer network  resources.

Virtualization began in 1960s mainframe computers as a method of logically dividing the system resources provided by mainframes between different applications. Since then, the meaning of the term has broadened.

Different types of hardware virtualization include:

• Full virtualization – almost complete simulation of the actual hardware to allow software, which typically consists of a guest operating system, to run unmodified.
• Partial virtualization – some but not all of the target environment is simulated. Some guest programs, therefore, may need modifications to run in this virtual environment.
• Paravirtualization – a hardware environment is not simulated; however, the guest programs are executed in their own isolated domains, as if they are running on a separate system. Guest programs need to be specifically modified to run in this environment.

Password Cracking

In cryptanalysis and computer security, password cracking is the process of recovering passwords from data that have been stored in or transmitted by a computer system. A common approach (brute-force attack) is to repeatedly try guesses for the password.

The purpose of password cracking might be to help a user recover a forgotten password (installing an entirely new password is less of a security risk, but it involves System Administration privileges), to gain unauthorized access to a system, or as a preventive measure by System Administrators to check for easily crackable passwords. On a file-by-file basis, password cracking is utilized to gain access to digital evidence for which a judge has allowed access but the particular file's access is restricted.

The best method of preventing a password from being cracked is to ensure that attackers cannot get access even to the hashed password. For example, on the Unixoperating system, hashed passwords were originally stored in a publicly accessible file /etc/passwd. On modern Unix (and similar) systems, on the other hand, they are stored in the file /etc/shadow, which is accessible only to programs running with enhanced privileges (i.e., "system" privileges). This makes it harder for a malicious user to obtain the hashed passwords in the first instance. Unfortunately, many common Network Protocols transmit passwords in cleartext or use weak challenge/response schemes.

There are many password cracking software tools, but the most popular are Cain and Abel, John the Ripper, Hashcat, Hydra, DaveGrohl and ElcomSoft. Many litigation support software packages also include password cracking functionality. Most of these packages employ a mixture of cracking strategies, with brute force and dictionary attacks proving to be the most productive.

Firewalls.

                Introduction to firewalls

A firewall is a hardware or software system that prevents unauthorized access to or from a network. It can be implemented in both hardware and software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet. All data entering or leaving the intranet pass through the firewall, which examines each packet and blocks those that do not meet the specified security criteria.

Generally, firewalls are configured to protect against unauthenticated interactive logins from the outside world. This helps prevent hackers from logging into machines on your network. More sophisticated firewalls block traffic from the outside to the inside, but permit users on the inside to communicate a little more freely with the outside.

Firewalls are essential since they provide a single block point, where security and auditing can be imposed. Firewalls provide an important logging and auditing function; often, they provide summaries to the administrator about what type/volume of traffic has been processed through it. This is an important benefit: Providing this block point can serve the same purpose on your network as an armed guard does for your physical premises. 

Network_with_Firewall_NIST.jpg

Encryption

Encryption is the conversion of electronic data into another form, called ciphertext, which cannot be easily understood by anyone except authorized parties

History of encryption

The word encryption comes from the Greek word kryptos, meaning hidden or secret. The use of encryption is nearly as old as the art of communication itself. As early as 1900 BC, an Egyptian scribe used non-standard hieroglyphs to hide the meaning of an inscription. In a time when most people couldn't read, simply writing a message was often enough, but encryption schemes soon developed to convert messages into unreadable groups of figures to protect the message's secrecy while it was carried from one place to another. The contents of a message were reordered (transposition) or replaced (substitution) with other characters, symbols, numbers or pictures in order to conceal its meaning.

HoneyPot

In computer terminology, a honeypot is a trap set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. This is similar to the police baiting a criminal and then conducting undercover surveillance.

Public Key Infrastructure (PKI)

 Public Key Infrastructure (PKI)

A public key infrastructure (PKI) supports the distribution and identification of public encryption keys, enabling users and computers to both securely exchange data over networks such as the Internet and verify the identity of the other party.

Without PKI, sensitive information can still be encrypted (ensuring confidentiality) and exchanged, but there would be no assurance of the identity (authentication) of the other party. Any form of sensitive data exchanged over the Internet is reliant on PKI for security.

A typical PKI includes the following key elements:

• A trusted party, called a certificate authority (CA), acts as the root of trust and provides services that authenticate the identity of individuals, computers and other entities.
• A registration authority, often called a subordinate CA, certified by a root CA to issue certificates for specific uses permitted by the root.
• A certificate database, which stores certificate requests and issues and revokes certificates.
• A certificate store, which resides on a local computer as a place to store issued certificates and private keys.

Cryptography

Cryptography is a method of storing and transmitting data in a particular form so that only those for whom it is intended can read and process it.

Modern cryptography concerns itself with the following four objectives:

1) Confidentiality (the information cannot be understood by anyone for whom it was unintended)

2) Integrity (the information cannot be altered in storage or transit between sender and intended receiver without the alteration being detected)

3) Non-repudiation (the creator/sender of the information cannot deny at a later stage his or her intentions in the creation or transmission of the information)

4) Authentication (the sender and receiver can confirm each other?s identity and the origin/destination of the information)

What is cryptography?

What is cryptography?

The art of protecting information by transforming it (encrypting it) into an unreadable format, called cipher text. Only those who possess a secret key can decipher (or decrypt) the message intoplain text. Encrypted messages can sometimes be broken by cryptanalysis, also called codebreaking, although modern cryptography techniques are virtually unbreakable.

As the Internet and other forms of electronic communication become more prevalent, electronic security is becoming increasingly important. Cryptography is used to protect e-mailmessages, credit card information, and corporate data. One of the most popular cryptography systems used on the Internet is Pretty Good Privacy because it's effective and free.

Cryptography systems can be broadly classified into symmetric-key systems that use a single key that both the sender and recipient have, and public-key systems that use two keys, a public key known to everyone and a private key that only the recipient of messages uses.

KFSensor (Honeypot)

KFSensor

Advanced Windows Honeypot System

KFSensor is a Windows based honeypot Intrusion Detection System (IDS).

It acts as a honeypot to attract and detect hackers and worms by simulating vulnerable system services and trojans.
By acting as a decoy server it can divert attacks from critical systems and provide a higher level of information than can be achieved by using firewalls and NIDS alone.

KFSensor is designed for use in a Windows based corporate environment and contains many innovative and unique features such as remote management, a Snort compatible signature engine and emulations of Windows networking protocols.

With its GUI based management console, extensive documentation and low maintenance, 

.KFSensor provides a cost effective way of improving an organization's network security

KFSensor Benefits

Signature attack identification KFSensor's rule base signature engine can identify known attack patterns, which greatly helps in analyzing the nature of a event. Rules can be imported from external sources in Snort format giving access to a huge amount of security knowledge. Detects Windows networking attacks KFSensor contains the world's only Windows networking/ NetBIOS / SMB / CIFS emulation honeypot. This unique feature enables it to detect the nature of attacks on file shares and Windows administrative services, currently the most prevalent and damaging on the Internet. Firewalls can detect port scans, but not the nature of an attack. NIDS can identify certain attacks but not without the risk of compromising security. Only KFSensor can provide the maximum information on an attack, without risk of compromise. Extendable architecture The already comprehensive emulation and reporting features of KFSensor can be further extended by writing your own scripts and database queries. No false positives Firewalls and network based IDS are often overwhelmed by the amount of network traffic and often generate false alarms by misinterpreting legitimate network traffic. KFSensor's honeypot model has no legitimate uses, so all connections to them are suspect. Low overheads KFSensor lies dormant until attacked, consuming very little processor time or network resources. Sensors can be installed on users’ machines without affecting their normal use, eliminating the need for additional hardware. Full converage All TCP, UDP and ICMP traffic is monitored for all ports.		Remote Administration Protect different locations in the corporate network with multiple KFSensor installations and manage the process from one location. KFSensor Enterprise Edition provides remote configuration and real time concatenation of events from a single administrator machine using top of the range encryption and authentication. Simplicity The concepts behind KFSensor are easy to understand. Its configuration and operation is straightforward, requiring minimal training and maintenance. Advanced server simulation KFSensor emulates real servers, such as FTP, SMB, POP3, HTTP, Telnet, SMTP and SOCKS to improve deception and gain more valuable information on a hacker's motives. Real time detection Attacks are detected, analyzed and reported immediately allowing response to an attack while still in progress. Detects unknown threats Unlike other products KFSensor does not rely on signatures of known attacks and can therefore detect new or 0 day threats, such as new worms, viruses and elite hackers. KFSensor is just as effective at detecting internal threats. Security in-depth KFSensor complements other types of security products, such as firewalls, anti-virus and network based IDS systems, to provide an additional layer of protection. Designed for a corporate environment KFSensor's secure design and its ability to work both inside a LAN and in front of a firewall make it suitable for organizations that demand the highest security requirements.