The University of Arizona
Home

Tools and Resources for IT Professionals

For IT Support Staff

For Application Developers

For IT Support Staff

Tools 

  • Vulnerability Scanning Tool - Automated vulnerability scanning software for identifying devices on your network that are open to known vulnerabilities
  • CIS Benchmarks and Scoring Tools - Security configuration benchmarks that detail how to secure an array of workstations, servers, network devices and software applications in terms of technology-specific controls; scoring tools that analyze and report system compliance with the technical control settings in the benchmarks
  • Web Application Security Assessment Tool - Automated security and compliance assessment software for checking web applications for common vulnerabilities.  It can be used in test, development and production instances to find all linked pages and to check sites for such vulnerabilities as SQL injection, cross-site scripting and buffer overflows.
  • DHCP Information
  • Check Current List of Blocked Hosts
  • Net Manager Database - Owner Information and IP Ranges

Training Materials 

Firewalls at UA (Requires UA NetID and Apple QuickTime Player)
   

Part 1 (Modules 1-4):  Basic network and firewall terminology and concepts; UA network architecture.  Recommended for anyone wanting to gain or refresh a basic understanding of networking and firewalls. 

 

 

   

Part 2 (Module 5):  How to create rule sets and request a new firewall implementation, with interactive examples.  Recommended for all who complete the first session and others with a basic understanding of networking and firewalls.

 

 

 

  • Firewall Handout
    		  

     

    UA Presentations

    Other Helpful Resources & Information

    For Application Developers

    Tools

    • Web Application Security Assessment Tool - Automated security and compliance assessment software for checking web applications for common vulnerabilities.  It can be used in test, development and production instances to find all linked pages and to check sites for such vulnerabilities as SQL injection, cross-site scripting and buffer overflows. 

    • Vulnerability Scanning Tool - Automated vulnerability scanning software for identifying known vulnerabilities on your web server

    Training Materials

    The biggest threat to UA's network security comes from its public websites and the web-based applications found there.  A public website is generally accessible to anyone who wants to view it, making application security an issue.  Vulnerabilities in web applications have inevitably attracted the attention of recreational and criminal attackers, who have devised techniques to exploit the vulnerabilities.  Attacks on the web application layer now exceed attacks on the network.

    Developers can mitigate these risks by becoming educated on the threats to application security and designing applications with security in mind.  The following free resources provide both general and platform-specific information.

    • AzIT Security Training - Language-agnostic security training developed by senior IBM software engineers 
    • Microsoft Security Guidance Training for Developers - This clinic presents topics related to the essentials of application security (the importance of application security, security development practices, security technologies and secure development guidelines), threat defense (the need for secure code; defending against memory issues, arithmetic errors, cross-site scripting, SQL injection, canonicalization issues, cryptography weaknesses, Unicode issues, and denial of services attacks) and best practices for writing secure code (secure development process, threat modeling, risk mitigation and security best practices).  The emphasis is on generally applicable material, but includes some demonstrations for Microsoft Visual Basic, Microsoft Visual C++, C#.  Requires online registration.
    • Dept. of Home Security Approved Secure Software Course - This course covers secure programming practices necessary to secure applications against attacks and exploits.  Topics covered include fundamental concepts of secure software development, defensive programming techniques, secure design and testing, and secure development methodologies.  Requires online registration.

    UA Presentations

    CWE/SANS

    OWASP

    MSDN Library

    Other Resources