Monday, April 6, 2015

Infocom Security Conference 2015

Excited to present Uni Systems at Infocom Conference 2015. On the following links you can find my presentation and interview:

Presentation: https://dl.dropboxusercontent.com/u/75624475/2-athanasoulias-unisystems.pdf
Interview: https://www.youtube.com/watch?v=oyB4rq-gvJw

Friday, February 6, 2015

Partner Spotlight of Uni Systems S.A. at Hexis EMEA Exchange 2015

Here you can find my interview to Ms Katherine Russ-Hotfelter, Hexis Cyber Solutions Director of Channel Marketing which is published on this link:

By Katherine Russ-Hotfelter, Hexis Cyber Solutions Director of Channel Marketing
Cybersecurity threats are a global issue – just ask Andreas Athanasoulias, Information Security Officer for Athens, Greece-based, Uni Systems S.A. and a Hexis Cyber Solutions partner. Last week at our annual EMEA Exchange event in London, we sat down with Andreas to talk about what his company is seeing from a global threat perspective. What Andreas had to say wasn’t surprising – it’s just further evidence that this particular technology topic isn’t going away any time soon. Here’s what he had to say:
Hexis: What do you see as the biggest cybersecurity threat facing companies today?
Andreas Athanasoulias, Uni Systems:
Undoubtedly, the biggest cybersecurity threat is the advanced persistent threat that every organization is facing. Nowadays, cyber-attacks are becoming more and more targeted and sophisticated.  Cyber criminals target high-value organizations and spend tremendous amounts of time in order to create a “profiled attack”. That is to say, the attackers spend time profiling their targets, observing the organization structure, internal procedures and, of course, infrastructures. By assimilating this information, the cyber criminals prepare and launch their attacks, incorporating various techniques, such as viruses, Trojan horses, worms and social engineering.
Hexis: When you speak to security professionals at end user companies, what is their general security outlook? Why do they turn to channel partners?
A.A., Uni Systems:
Professionals at end user companies are worried that security threats may affect their organization. Advanced persistent threats, security incident and event management and trends like BYOD are just some of the many issues they need to deal with throughout their business day.
Moreover, end user companies face complexity on their infrastructure, internal processes and procedures. All of the aforementioned are the reasons why end user customers turn to channel partners. They need the unparalleled expertise of a channel partner to help them tackle the issues they don’t have time to themselves; as a result, end user organizations can spend more time continuing to build their business and less time worrying about IT security issues. For those organizations that currently lack security awareness inside their companies, channel partners act as trusted advisors and educators in this regard, eliminating employee bad habits and fostering a more secure IT environment.
Hexis: What are security teams at your customer sites doing right? Where have they made mistakes and how do you advise on alternative security strategies? 
A.A., Uni Systems:
In my opinion, more often than not, security teams are increasingly budget-driven than quality-driven. Due to the current state of economic affairs, we at Uni Systems have identified countless cases where cost-effective solutions are being chosen over solutions that, to put it simply, work better. This short-sighted decision provides a cheap, “quick-fix” solution, but ultimately creates bigger, long-term issues. These issues can impact the IT security market as whole, the environment of the customer, and most importantly – the vendors and their partners. My advice would be to evaluate the security solutions not only by economic and commercial terms (value, business vision of the vendor, etc.), but also on technical perspective, such as efficacy, efficiency, interoperability and ability to execute on what the vendor promises.
Interested in hearing more about how EMEA Exchange went? Check out Hexis’ conversation with keynote speaker and Bloor senior analyst, Fran Howarth. If you’re a Hexis partner that wasn’t able to make the trek to EMEA Exchange, consider registering for USA Exchange, happening in Las Vegas, NV, February 24-25.

Saturday, October 4, 2014

Surrendering our privacy to mobility

Last week of September 2014 I was honored to be invited by ISACA to present in EuroCACS in Barcelona a hot topic regarding privacy and mobility. You can find my presentation on this link.

Saturday, February 1, 2014

NGINX HTTP(S) Reverse Proxy with ModSecurity Protection

I would like to welcome you to my new project: building a reverse proxy powered by Nginx software, with a ModSecurity web application firewall enabled module.
There are many articles on how to do this configuration on the Internet, but I couldn't find any which had a holistic approach, from a to z, giving you all the steps on how to perform the above installation.

Nginx is an open-source HTTP and reverse proxy server. ModSecurity, an open-source web application firewall, has released packages in order to work together with nginx. Taking advantage of this architecture, you can redirect all the requests to nginx, let them get parsed and sanitised by ModSecurity and as a consequence, have your websites protected.

Ingredients:

  • Debian Linux 7.3.0
  • ModSecurity source code
  • NGINX source code

First of all we need to fulfill some requirements before configuring ModSecurity to work with nginx.
  1. Install gcc:
    $> apt-get install gcc
  2. Install Apache apxs:
    $> apt-get install apache2-threaded-dev
  3. Install libxml2-dev:
    $> apt-get install libxml2-dev
  4. Install libcurl4-gnutls-dev:
    $> apt-get install libcurl4-gnutls-dev
  5. Install lua:
    $> apt-get install liblua5.1-dev

Then configure and build ModSecurity to be ready to get integrated in NGINX (following exactly the instructions as publish in ModSecurity website here):
Navigate to ModSecurity directory:
$> ./configure --enable-standalone-module
$> make
$> make install

Then we change to the directory where nginx source code is downloaded.
We configure NGINX to include ModSecurity and SSL support:
$> ./configure --add-module=../modsecurity-apache_2.7.7/nginx/modsecurity/ --with-http_ssl_module
$> make
$> make install

And the rest is pure configuration! Some references for your next steps are:
  • http://www.cyberciti.biz/tips/using-nginx-as-reverse-proxy.html
  • http://www.modsecurity.org/documentation/
  • http://eu.wiley.com/WileyCDA/WileyTitle/productCd-1118362187.html
  • https://www.feistyduck.com/books/modsecurity-handbook/gettingStarted.html
  • https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
Enjoy protecting your websites!

Monday, December 9, 2013

SYNTAX Application Security Report

I am very proud to annouce the publication of SYNTAX IT Group Application Security Report (ASR)!
The Application Security Report is an annual SYNTAX publication summarizing the vulnerabilities discovered on application security engagements and provides an insight on current web and mobile application vulnerabilities.
As the primary author of this publication, I would like to thank my team and my colleagues for their help and support.
You can download the report by following this link:

Sunday, December 8, 2013

Fine-tunning Spamassassin and Citadel

This is actually a follow-up article of the previous publication: RPi Home Mail Server Project.

Unfortunately there are not enough articles regarding the configuration needed in order to integrate the open source spam filter Spamassassin and Citadel mail server.

First of all you should install Spamassassin by issuing the following commands:
> apt-get update
> apt-get install spamassassin spampd

Spam daemon (spampd) works as an incoming MTA which scans the emails and then forwards them to the mail server. By default, spampd listens to port 10025 and connects to port 10026, after the relevant processing.

Following this architecture, your firewall should forward SMTP and SMTPS incoming connections to spampd at port 10025 (one simple scenario is by creating a port forwarding rule) and then forward them to Citadel mail server at port 25. 

In order to achieve this, you have to edit /etc/default/spampd and change value DESTPORT from 10026 to 25. 

And you are done! Enjoy!

Monday, August 26, 2013

RPi Home Mail Server Project

It has been a while since I last updated my blog. I am quite happy to write another article regarding my latest project: my own mail server based on my Raspberry Pi.

The reason is quite simple: since Google, Microsoft, or whatever provider, considers that it has the right to read my emails, the only way to "revoke" this right is by discontinuing the use of those providers' services. However, bear in mind that putting an email server into your internal network poses a great risk and you should be aware of the means how to mitigate those risks (implement DMZ, VLANs, buying firewalls, etc.). Those means cost money of course.

After a research regarding the most appropriate software for home -and RPi- use, I chose Citadel. I haven't tested it yet under extreme circumstances.

In order to configure Citadel you can use this very useful tutorial:
http://www.ducky-pond.com/posts/2012/Jul/installing-citadel-on-rpi/

Citadel offers integration with ClamAV, an open source antivirus and Spamassasin, an open source antispam software.

ClamAV

Unfortunately Citadel website offers only a high-level configuration guide for both ClamAV and SpamAssassin. As a consequence we have to dive a little bit deeper in order to make them work together.

We can install ClamAV by issuing the following commands:

> apt-get install clamav-daemon
> apt-get install clamav

Make sure you have included the following lines on /etc/clamav/clamd.conf:

TCPSocket 3310
TCPAddr 127.0.0.1


Make sure clamAV deamon is running:
/etc/init.d/clamav-daemon start

Then, add the localhost address on Citadel's administration page as mentioned on the guide.

SpamAssassin

Installing SpamAssassin by issuing the following commands:
> apt-get install spampd
> apt-get install spamassassin

Make sure you reconfigure the listening address and port for spamassassin (I have searched for a conf file but I didn't find it. So I include the following workaround.)

Edit /etc/init.d/spampd script and locate the following lines:

[ -n "${LISTENPORT}" ] && ARGS="${ARGS} --port=${LISTENPORT}"
[ -n "${LISTENHOST}" ] && ARGS="${ARGS} --host=${LISTENHOST}"


Alter them according to the following ones:

[ -n "${LISTENPORT}" ] && ARGS="${ARGS} --port=783"
[ -n "${LISTENHOST}" ] && ARGS="${ARGS} --host=127.0.0.1"

Spamassassin must listen on port 783 in order to cooperate with Citadel.

Now the only thing to do is to configure accordingly your domain name and MX records in order to send and receive emails.

Last but not least, consider implementing PGP keys in order to communicate safely. Bear in mind that the email service is plaintext, anyone suitably positioned on the Internet (ISPs, network administrators, etc.) can intercept and read your emails.

Enjoy your email service!