SlideShare a Scribd company logo
©




               Elgg Email Integration
                           Michael Jett <mjett@mitre.org>




                                                      Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©




                           Handshake
                                       Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                           What is Handshake?

                           business net working prototype built on
                           top of the elgg platform
                           created to support relationships
                           bet ween current employees, industry,
                           vendors, academia, sponsors, former
                           employees, and other FFRDCs

                                                        Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                            Email Integration?


                           A feature which allows users to
                           communicate directly with the elgg
                           platform from their email client



                                                       Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                                         Why?

                           Increased accessibility (mobile, box-top)
                           Familiar ground for veteran users
                           List-ser v transition
                           Convenience


                                                          Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                            Not a new concept

                           facebook
                           moodle
                           WordPress
                           Blogger


                                          Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                           Basic Flow
          System issues a user a        my.special.email@domain.com
           special email address


                                   User sends an email to
                                    this special address


     System receives email
    and performs an action                        Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                                      Concerns

                           Security
                           Server resource consumption
                           Maintenance
                           Storage


                                                         Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                             Security Threats

                           Email address spoofing
                           Unintentional for warding of email
                           secrets
                           Maliciously flooding ser ver with email
                           traffic


                                                         Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                           Security Specifics?
                                          Where do we
                                       Embed, Issue, or Store
                                              them?

                                         Do they expire?

              Tokens, Keys, Specials

                                               Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©




                   Security Approaches


                                 Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                                  User Expired
                           User is issued a special email address to
                           perform an action
                           User may regenerate a new email
                           address if they feel it has been
                           compromised
                           eg (my.silly.email@elggbook.com)

                                                          Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                                User Expired
                   Advantages                 Disadvantages

                       Manageable            Requires IP Monitoring

                       Usable                Requires Extensive
                                             logging



                           silly.email.address@elggbook.com

                                                      Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                               System Expired


                           System automatically expires email
                           address within a specific time frame.

                            valid.for.30.days@elggbook.com

                                                        Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                               System Expired
                   Advantages             Disadvantages


                       Security is more   Requires extra system
                       centralized        resources to validate
                                          expired emails




                                                   Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©




                           Our Approach


                                      Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                                Our Approach

                           System Expired
                           Signature embedding to thwart
                           spoofing attempts
                           Action embedding


                                                      Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©




                Huh? Example Please!?
                           create.comment.123+8vFBxhiU@elggbook.com


                       Do?                Where?

                                                           Security!
                                What?                     Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©

                                  Acquisition
                                                            How does a user obtain one
                                                            of these “special” email
                                                            addresses?

                           Automatically embedded in
                           notifications
    To: billy@bob.com
    From: no.reply@elggbook.com

    Someone commented on your discussion topic

    Email a reply                           href=”mailto:create...
                                                       Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012
©




                           Conclusion


                                        Approved	
  for	
  Public	
  Release:	
  12-­‐1298


Thursday, April 12, 2012

More Related Content

Viewers also liked

ElggCamp Santiago> For Developers!
ElggCamp Santiago> For Developers!ElggCamp Santiago> For Developers!
ElggCamp Santiago> For Developers!
Condiminds
 
'State of Elgg' Brett Profitt #ECSF
'State of Elgg' Brett Profitt #ECSF'State of Elgg' Brett Profitt #ECSF
'State of Elgg' Brett Profitt #ECSFCondiminds
 
'Finding Baby Bear's Bed: a tale of two spaces' Jon Dron #ECSF
'Finding Baby Bear's Bed: a tale of two spaces' Jon Dron #ECSF'Finding Baby Bear's Bed: a tale of two spaces' Jon Dron #ECSF
'Finding Baby Bear's Bed: a tale of two spaces' Jon Dron #ECSFCondiminds
 
'Not a developer? not a problem!' Brett Profitt #ECSF
'Not a developer? not a problem!' Brett Profitt #ECSF'Not a developer? not a problem!' Brett Profitt #ECSF
'Not a developer? not a problem!' Brett Profitt #ECSFCondiminds
 
'Best Practices for Elgg Plugin Developers' Cash Costello #ECSF
'Best Practices for Elgg Plugin Developers' Cash Costello #ECSF'Best Practices for Elgg Plugin Developers' Cash Costello #ECSF
'Best Practices for Elgg Plugin Developers' Cash Costello #ECSFCondiminds
 
Exercicio inorganica
Exercicio inorganicaExercicio inorganica
Exercicio inorganicaKelly Candido
 
жизненный путь
жизненный путьжизненный путь
жизненный путь
tiskovich
 
Presentacion razas de perros
Presentacion razas de perrosPresentacion razas de perros
Presentacion razas de perros
lorenaricardoecci
 
81-47148-1466487088-certificate
81-47148-1466487088-certificate81-47148-1466487088-certificate
81-47148-1466487088-certificateCarlos F Muniz
 
преобразующее мышление
преобразующее мышлениепреобразующее мышление
преобразующее мышление
tiskovich
 
основатели финансового менеджмента
основатели финансового менеджментаоснователи финансового менеджмента
основатели финансового менеджмента
tiskovich
 
CEO Forum 2015 Stefanos Komninos
CEO Forum 2015 Stefanos KomninosCEO Forum 2015 Stefanos Komninos
CEO Forum 2015 Stefanos KomninosStefanos Komninos
 
4.3.2 balanceo ecuaciones ii resulta
4.3.2 balanceo ecuaciones ii  resulta4.3.2 balanceo ecuaciones ii  resulta
4.3.2 balanceo ecuaciones ii resulta
Jorge Arizpe Dodero
 
IoT Demo
IoT Demo IoT Demo

Viewers also liked (20)

ElggCamp Santiago> For Developers!
ElggCamp Santiago> For Developers!ElggCamp Santiago> For Developers!
ElggCamp Santiago> For Developers!
 
'State of Elgg' Brett Profitt #ECSF
'State of Elgg' Brett Profitt #ECSF'State of Elgg' Brett Profitt #ECSF
'State of Elgg' Brett Profitt #ECSF
 
'Finding Baby Bear's Bed: a tale of two spaces' Jon Dron #ECSF
'Finding Baby Bear's Bed: a tale of two spaces' Jon Dron #ECSF'Finding Baby Bear's Bed: a tale of two spaces' Jon Dron #ECSF
'Finding Baby Bear's Bed: a tale of two spaces' Jon Dron #ECSF
 
'Not a developer? not a problem!' Brett Profitt #ECSF
'Not a developer? not a problem!' Brett Profitt #ECSF'Not a developer? not a problem!' Brett Profitt #ECSF
'Not a developer? not a problem!' Brett Profitt #ECSF
 
'Best Practices for Elgg Plugin Developers' Cash Costello #ECSF
'Best Practices for Elgg Plugin Developers' Cash Costello #ECSF'Best Practices for Elgg Plugin Developers' Cash Costello #ECSF
'Best Practices for Elgg Plugin Developers' Cash Costello #ECSF
 
Manual zanussi encimera zav6040 xba
Manual zanussi   encimera zav6040 xbaManual zanussi   encimera zav6040 xba
Manual zanussi encimera zav6040 xba
 
Tarea marelly
Tarea marellyTarea marelly
Tarea marelly
 
Manual zanussi encimera zei6632 fba
Manual zanussi   encimera zei6632 fbaManual zanussi   encimera zei6632 fba
Manual zanussi encimera zei6632 fba
 
Manual zanussi encimera zei6640 fbv
Manual zanussi   encimera zei6640 fbvManual zanussi   encimera zei6640 fbv
Manual zanussi encimera zei6640 fbv
 
Exercicio inorganica
Exercicio inorganicaExercicio inorganica
Exercicio inorganica
 
жизненный путь
жизненный путьжизненный путь
жизненный путь
 
Presentacion razas de perros
Presentacion razas de perrosPresentacion razas de perros
Presentacion razas de perros
 
Arqmanpc unidad 1
Arqmanpc unidad 1Arqmanpc unidad 1
Arqmanpc unidad 1
 
81-47148-1466487088-certificate
81-47148-1466487088-certificate81-47148-1466487088-certificate
81-47148-1466487088-certificate
 
преобразующее мышление
преобразующее мышлениепреобразующее мышление
преобразующее мышление
 
Manual zanussi encimera zei6632 xba
Manual zanussi   encimera zei6632 xbaManual zanussi   encimera zei6632 xba
Manual zanussi encimera zei6632 xba
 
основатели финансового менеджмента
основатели финансового менеджментаоснователи финансового менеджмента
основатели финансового менеджмента
 
CEO Forum 2015 Stefanos Komninos
CEO Forum 2015 Stefanos KomninosCEO Forum 2015 Stefanos Komninos
CEO Forum 2015 Stefanos Komninos
 
4.3.2 balanceo ecuaciones ii resulta
4.3.2 balanceo ecuaciones ii  resulta4.3.2 balanceo ecuaciones ii  resulta
4.3.2 balanceo ecuaciones ii resulta
 
IoT Demo
IoT Demo IoT Demo
IoT Demo
 

More from Condiminds

Introducción a las Metodologías Ágiles
Introducción a las Metodologías ÁgilesIntroducción a las Metodologías Ágiles
Introducción a las Metodologías Ágiles
Condiminds
 
Querés hacer tu Caralibro? | Emilio Gonzalez | Condiminds
Querés hacer tu Caralibro? | Emilio Gonzalez | Condiminds Querés hacer tu Caralibro? | Emilio Gonzalez | Condiminds
Querés hacer tu Caralibro? | Emilio Gonzalez | Condiminds
Condiminds
 
10 Tips para una Red de Nicho | Condiminds
10 Tips para una Red de Nicho | Condiminds10 Tips para una Red de Nicho | Condiminds
10 Tips para una Red de Nicho | Condiminds
Condiminds
 
Bienvenida ElggCampBA 2010
Bienvenida ElggCampBA 2010Bienvenida ElggCampBA 2010
Bienvenida ElggCampBA 2010
Condiminds
 
Social Enterprise Guru Device
Social Enterprise Guru DeviceSocial Enterprise Guru Device
Social Enterprise Guru Device
Condiminds
 
Desarrollo de Redes Sociales para Social Enterprise, Powered by Elgg
Desarrollo de Redes Sociales para Social Enterprise, Powered by ElggDesarrollo de Redes Sociales para Social Enterprise, Powered by Elgg
Desarrollo de Redes Sociales para Social Enterprise, Powered by Elgg
Condiminds
 
Elgg para Mkt online en el #barcampba
Elgg para Mkt online en el #barcampbaElgg para Mkt online en el #barcampba
Elgg para Mkt online en el #barcampba
Condiminds
 
Elgg Camp Buenos Aires - Español
Elgg Camp Buenos Aires - EspañolElgg Camp Buenos Aires - Español
Elgg Camp Buenos Aires - Español
Condiminds
 

More from Condiminds (8)

Introducción a las Metodologías Ágiles
Introducción a las Metodologías ÁgilesIntroducción a las Metodologías Ágiles
Introducción a las Metodologías Ágiles
 
Querés hacer tu Caralibro? | Emilio Gonzalez | Condiminds
Querés hacer tu Caralibro? | Emilio Gonzalez | Condiminds Querés hacer tu Caralibro? | Emilio Gonzalez | Condiminds
Querés hacer tu Caralibro? | Emilio Gonzalez | Condiminds
 
10 Tips para una Red de Nicho | Condiminds
10 Tips para una Red de Nicho | Condiminds10 Tips para una Red de Nicho | Condiminds
10 Tips para una Red de Nicho | Condiminds
 
Bienvenida ElggCampBA 2010
Bienvenida ElggCampBA 2010Bienvenida ElggCampBA 2010
Bienvenida ElggCampBA 2010
 
Social Enterprise Guru Device
Social Enterprise Guru DeviceSocial Enterprise Guru Device
Social Enterprise Guru Device
 
Desarrollo de Redes Sociales para Social Enterprise, Powered by Elgg
Desarrollo de Redes Sociales para Social Enterprise, Powered by ElggDesarrollo de Redes Sociales para Social Enterprise, Powered by Elgg
Desarrollo de Redes Sociales para Social Enterprise, Powered by Elgg
 
Elgg para Mkt online en el #barcampba
Elgg para Mkt online en el #barcampbaElgg para Mkt online en el #barcampba
Elgg para Mkt online en el #barcampba
 
Elgg Camp Buenos Aires - Español
Elgg Camp Buenos Aires - EspañolElgg Camp Buenos Aires - Español
Elgg Camp Buenos Aires - Español
 

Recently uploaded

The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 daysPushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
Adtran
 
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
Neo4j
 
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
Neo4j
 
A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...
sonjaschweigert1
 
Video Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the FutureVideo Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the Future
Alpen-Adria-Universität
 
UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5
DianaGray10
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
Guy Korland
 
Free Complete Python - A step towards Data Science
Free Complete Python - A step towards Data ScienceFree Complete Python - A step towards Data Science
Free Complete Python - A step towards Data Science
RinaMondal9
 
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdfUni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems S.M.S.A.
 
National Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practicesNational Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practices
Quotidiano Piemontese
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
KatiaHIMEUR1
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdfObservability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Paige Cruz
 
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
Neo4j
 
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
SOFTTECHHUB
 
20240605 QFM017 Machine Intelligence Reading List May 2024
20240605 QFM017 Machine Intelligence Reading List May 202420240605 QFM017 Machine Intelligence Reading List May 2024
20240605 QFM017 Machine Intelligence Reading List May 2024
Matthew Sinclair
 
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
James Anderson
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Ana-Maria Mihalceanu
 

Recently uploaded (20)

The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 daysPushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
 
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
 
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
 
A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...
 
Video Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the FutureVideo Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the Future
 
UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
 
Free Complete Python - A step towards Data Science
Free Complete Python - A step towards Data ScienceFree Complete Python - A step towards Data Science
Free Complete Python - A step towards Data Science
 
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdfUni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdf
 
National Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practicesNational Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practices
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdfObservability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
 
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
 
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
 
20240605 QFM017 Machine Intelligence Reading List May 2024
20240605 QFM017 Machine Intelligence Reading List May 202420240605 QFM017 Machine Intelligence Reading List May 2024
20240605 QFM017 Machine Intelligence Reading List May 2024
 
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
 

'Elgg email integration' Mike Jett #ECSF

  • 1. © Elgg Email Integration Michael Jett <mjett@mitre.org> Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 2. © Handshake Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 3. © What is Handshake? business net working prototype built on top of the elgg platform created to support relationships bet ween current employees, industry, vendors, academia, sponsors, former employees, and other FFRDCs Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 4. © Email Integration? A feature which allows users to communicate directly with the elgg platform from their email client Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 5. © Why? Increased accessibility (mobile, box-top) Familiar ground for veteran users List-ser v transition Convenience Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 6. © Not a new concept facebook moodle WordPress Blogger Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 7. © Basic Flow System issues a user a my.special.email@domain.com special email address User sends an email to this special address System receives email and performs an action Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 8. © Concerns Security Server resource consumption Maintenance Storage Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 9. © Security Threats Email address spoofing Unintentional for warding of email secrets Maliciously flooding ser ver with email traffic Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 10. © Security Specifics? Where do we Embed, Issue, or Store them? Do they expire? Tokens, Keys, Specials Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 11. © Security Approaches Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 12. © User Expired User is issued a special email address to perform an action User may regenerate a new email address if they feel it has been compromised eg (my.silly.email@elggbook.com) Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 13. © User Expired Advantages Disadvantages Manageable Requires IP Monitoring Usable Requires Extensive logging silly.email.address@elggbook.com Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 14. © System Expired System automatically expires email address within a specific time frame. valid.for.30.days@elggbook.com Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 15. © System Expired Advantages Disadvantages Security is more Requires extra system centralized resources to validate expired emails Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 16. © Our Approach Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 17. © Our Approach System Expired Signature embedding to thwart spoofing attempts Action embedding Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 18. © Huh? Example Please!? create.comment.123+8vFBxhiU@elggbook.com Do? Where? Security! What? Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 19. © Acquisition How does a user obtain one of these “special” email addresses? Automatically embedded in notifications To: billy@bob.com From: no.reply@elggbook.com Someone commented on your discussion topic Email a reply href=”mailto:create... Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012
  • 20. © Conclusion Approved  for  Public  Release:  12-­‐1298 Thursday, April 12, 2012