Advanced Threat Detection in Cloud Environments Using Machine Learning Techniques

Jinu Jose

CISSP,CCSP, CISM

Technical Consultant, Cyber Security

Abstract

The rapid adoption of cloud computing has revolutionized modern IT infrastructures but has also introduced new challenges in cybersecurity. Traditional threat detection methods are often insufficient in dynamic and distributed cloud environments. This paper explores advanced threat detection techniques tailored for cloud systems, emphasizing the integration of machine learning (ML) models to identify and respond to potential threats. We examine the architecture of cloud environments, identify common threat vectors, and evaluate the efficacy of ML-based detection systems. The results indicate that machine learning significantly enhances the accuracy and speed of threat detection, reducing response time and mitigating potential damage.

Introduction

Cloud computing offers scalable and flexible services to individuals and organizations. However, the shared and virtualized nature of cloud infrastructure presents unique security risks, including data breaches, insider threats, and advanced persistent threats (APTs). Detecting such threats in real time is critical for maintaining cloud security. This paper investigates the potential of machine learning to improve threat detection capabilities in cloud environments

Literature Review

Background and Related Work

Previous research has explored intrusion detection systems (IDS) and signature-based methods for cloud security. However, these approaches struggle with zero-day attacks and large-scale data analysis. Machine learning provides adaptive models that can analyze vast amounts of data, recognize patterns, and detect anomalies. Related work includes anomaly-based intrusion detection using support vector machines (SVMs), clustering algorithms, and deep learning models such as autoencoders and recurrent neural networks (RNNs).

 

Threat Landscape in Cloud Environments

-Insider threats: Malicious actions by authorized users.

- External attacks: DDoS, phishing, malware injection.

- Data leakage: Unintentional or unauthorized data exposure.

- Misconfiguration: Poor security settings leading to vulnerabilities.

 

Machine Learning for Threat Detection

- Data Collection: Logs from cloud services, network traffic, user behavior.

- Feature Extraction: Transforming raw data into structured input for ML models.

- Model Selection: Algorithms such as Random Forest, SVM, K-Means, and Neural Networks.

- Training and Validation: Using labeled datasets to train models and evaluate accuracy.

- Real-time Monitoring: Deploying trained models for continuous threat detection.

Case Study and Experimental Setup

A case study was conducted using the UNSW-NB15 dataset, which includes normal and malicious traffic.

Multiple ML models were trained and tested to compare performance:

- Random Forest achieved 93.4% accuracy.

- SVM achieved 89.7% accuracy.

- Autoencoder-based model detected anomalies with a precision of 91.2%.

 

Discussion

The results demonstrate that machine learning significantly improves threat detection in cloud environments. However, challenges remain in terms of data privacy, model interpretability, and the risk of adversarial ML attacks. Integrating ML with traditional security frameworks and adopting explainable AI techniques are recommended for better adoption.

 

Conclusion

Machine learning offers a promising approach to enhancing threat detection in cloud environments. Future research should focus on hybrid models, real-time adaptive systems, and securing ML pipelines against adversarial threats. Cloud service providers should invest in intelligent security systems to proactively detect and mitigate cyber threats.

References

 

Sources Sited

1. Moustafa, N., & Slay, J. (2015). UNSW-NB15: A comprehensive data set for network intrusion detection

systems.

2. Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods for cyber

security intrusion detection.

3. Kim, G., Lee, S., & Kim, S. (2014). A novel hybrid intrusion detection method integrating anomaly detection

with misuse detection.

4. Sommer, R., & Paxson, V. (2010). Outside the closed world: On using machine learning for network

intrusion detection.

5. Sarker, I. H., et al. (2021). Cybersecurity data science: An overview from machine learning perspective.

 

 

 

 

 

 

 

How the AI tools can help in Threat Hunting

Jinu Jose

CISSP,CCSP, CISM

Technical Consultant, Cyber Security

Abstract

As cyber threats continue to evolve in complexity and frequency, traditional threat detection methods struggle to keep pace. Artificial Intelligence (AI) has emerged as a powerful ally in cybersecurity, particularly in the domain of threat hunting. This paper explores how AI tools can enhance threat hunting through automation, pattern recognition, anomaly detection, and predictive analysis. We examine current AI applications, their benefits, limitations, and potential future developments in proactive cybersecurity defense strategies.

Introduction

Threat hunting is a proactive approach to cybersecurity that involves actively searching for threats that evade existing security solutions. As attack surfaces grow, manual threat hunting becomes increasingly insufficient. The integration of AI into threat hunting introduces capabilities for faster data processing, real-time analysis, and behavioral analytics, thus enabling organizations to identify threats earlier and respond more effectively.

Understanding Threat Hunting

Traditional threat detection is largely reactive, relying on known signatures and rules. In contrast, threat hunting is hypothesis-driven and looks for subtle indicators of compromise (IOCs) that traditional methods miss. It involves:

-  Hypothesis generation

-  Data collection

-  Investigation and analysis

-  Response and refinement

The effectiveness of threat hunting depends heavily on the analyst's skills and the quality of data - areas where AI can significantly contribute.

Literature Review

Role of AI in Threat Hunting

1.1  Data Processing and Analysis

AI tools can process massive datasets (logs, network traffic, endpoint data) at scale, which would be time-consuming for human analysts. Natural Language Processing (NLP) allows AI to interpret unstructured data such as threat reports and social media alerts.

1.2  Anomaly Detection

Machine Learning (ML) models can establish baselines for normal behavior and detect deviations that may signify threats. For example, a user's login from a new geographic location or accessing unusual files may trigger an alert.

1.3  Pattern Recognition

AI models can identify patterns associated with known attack vectors or previously unseen malware. Deep learning can be employed to classify malware types and detect advanced persistent threats (APTs).

1.4  Threat Intelligence Correlation

AI can correlate internal data with external threat intelligence feeds to enrich findings. This includes matching

IOCs with known malicious IPs, domains, and hashes.

1.5  Automation and Orchestration

AI enables security orchestration, automation, and response (SOAR) platforms to automate repetitive tasks, prioritize alerts, and assist in decision-making.

2.  Use Cases of AI in Threat Hunting

-  User and Entity Behavior Analytics (UEBA): Detects insider threats by monitoring behavior anomalies.

-  Endpoint Detection and Response (EDR): Uses AI to monitor and analyze endpoint activity in real-time.

-  Network Traffic Analysis (NTA): Identifies malicious behavior in network flow using AI algorithms.

-  Security Information and Event Management (SIEM): Enhances threat detection with AI-enhanced correlation rules.

3.  Challenges and Limitations

-  False Positives: Poorly trained AI models can generate false alerts, leading to alert fatigue.

-  Model Training and Bias: AI models require quality data and continuous updates to remain effective.

-  Adversarial Attacks: AI systems themselves can be targeted by attackers using evasion techniques.

-  Skill Gaps: Effective use of AI in threat hunting requires professionals who understand both AI and cybersecurity.

4.  Future Directions

-  Explainable AI (XAI): Developing models that provide transparency in decision-making.

-  Federated Learning: Sharing threat intelligence models across organizations without compromising data privacy.

-  AI-Augmented Analysts: Combining human intuition with AI speed and accuracy for more effective threat hunting.

Conclusion

AI tools represent a transformative shift in the cybersecurity landscape, particularly in threat hunting. By automating data analysis, detecting anomalies, and correlating diverse data sources, AI empowers cybersecurity professionals to identify and respond to threats with greater speed and precision. While challenges remain, ongoing advancements in AI technology promise to make threat hunting more intelligent, proactive, and resilient.

 

References

1.  S. Garcés-Erice et al., "AI for Cybersecurity: Threats and Opportunities," ACM Computing Surveys, 2023.

2.  MITRE Corporation, "Threat Hunting Techniques Using AI," 2022.

3.  IBM Security, "AI and Machine Learning in Cyber Threat Detection," White Paper, 2021.

4.  SANS Institute, "The Role of Automation in Cyber Threat Hunting," Research Report, 2022.

 

Why IPv6 adaption rate is slow in the co-operate network

Jinu Jose

CISSP,CCSP, CISM

Technical Consultant, Cyber Security

Abstract

IPv6 was founded officially in the year 1998. It's been more than 20 years now, but till now it has not replaced IPv4. Having many technological advantages over IPv4, IPv6 has not yet been able to completely replace it. There is no doubt in the statement that IPv6 adoption is slow. This study analyzes the major reasons and some of the most common misconceptions for the slow adoption of IPv6.

Introduction

IPv6 was designed with more extended features than IPv4. One of the main limitations of IPv4 was address space; IPv6 resolved that, which has opened a new door of technological transitions to the digital world. The Internet Society declared June 6, 2012, as IPv6 Launch Day. It took seventeen years to accept IPv6 or kick off the replacement of IPv4. The recent update provide by the Google regarding the proportion of IPv6 users, IPv6 adoption now is under 40% , more than ten years later. So, a lot of people think that adoption isn’t worth it. And many even support the statement that it may or may not resolve the many issues facing currently in the digital ecosystem. There are some unknown hurdles have commonly been suggested as justifications to slow the IPv6 transition. These include claims that IPv6 is more expensive to implement, slower, and less secure than IPv4.

What is IPv6

The next generation Internet Protocol (IP) address standard, known as IPv6, is meant to work in cooperation with IPv4. To communicate with other devices, a computer, smartphone, home automation component, Internet of Things sensor, or any other Internet-connected device needs a numerical IP address. Because so many connected devices are being used, the original IP address scheme, known as IPv4, is running out of addresses. This new IP address version is being deployed to fulfil the need for more Internet addresses. With 128-bit address space, it allows 340 undecillion unique address space. IPv6 support a theoretical maximum of 340, 282, 366, 920, 938, 463, 463, 374, 607, 431, 768, 211, 456.

Difference between IPv6 and IPv4

IPv4	IPv6
The Address space is 32 bits	The Space is 128 bits
The length of header is 20 bytes	The length of header is 40
4 bytes for each address in the header	16 bytes for each address in the header
The number of Header field 12	The number Header field 8
Checksum field, used to measure error in the header, required	Checksum field eliminated from header as error in the IP header are at very crucial
Internet Protocol Security (IPSec) with respect to network security is optional	Internet Protocol Security (IPSec) with respect to network security is mandatory
No identification to the packet flow (Lack of QoS handing)	The flow level field on the header portion identifies the packet flow and directs to router (Efficient QoS handing)
The fragmentation is done both by sending host and routers	The fragmentation is done both by sending host, there is no role for the routers
Clients have approach Dynamic Host Configuration server (DHCS) whenever they connect to an network	Clients do not have to approach any such server as they are given permanent address

Literature Review

Why IPv6
IPv4 addresses are facing space shortage. Because of that may people are switching from IPv4 to IPv6 without considering its challenges. With a range of 340 undecillion versus 4.3 billion, IPv6 addresses are significantly larger than IPv4 addresses The last blocks of IPv4 address space have already been distributed to regional Internet registries by the Internet Assigned Numbers Authority (IANA), underscoring the urgent need for broad IPv6 adoption. Network managers have challenges while switching from IPv4 to IPv6, which emphasizes how crucial it is to stay up to date on new standards and best practices.
Compared to IPv4, IPv6 offers a substantially greater number of unique IP addresses thanks to its 128-bit address structure. In the IPv4's address library is only sufficient for 4 billion devices, and its address format is 32-bit. In the coming years, anticipated more than 40 billions device's addresses cannot be fulfilled by IPv6. But IPv6 may be able to produce sufficient addresses which is more than enough to satisfy the expecting billion or trillion devices
Improvements and Advantages offered by IPv6
IPv6's advantages over IPv4 represent a fundamental shift in internet architecture, with increased address space, more efficient routing, improved security, and IoT interoperability. Its support for auto-configuration, multicast, anycast, and future-proofing make it an obvious choice for internet expansion. As organizations transition to IPv6, the internet ecosystem becomes more resilient and adaptive, indicating a purposeful investment in future connectivity.
Furthermore, IPv6 includes built-in security capabilities such as IPsec for encrypted and authenticated communications. It also supports improved Quality of Service (QoS), which boosts performance for real-time applications such as video streaming and gaming. As the pool of IPv4 addresses runs out, IPv6 ensures that the internet may continue to scale by resolving IPv4's restrictions.

Streamlined network management

IPv6 supports stateless address autoconfiguration (SLAAC), allowing devices to self-configure their IP addresses without manual setup or external services like DHCP. This benefits industries like smart cities, agriculture, and finance by reducing administrative overhead and simplifying network management.

Efficient routing and packet processing

IPv6's simple header structure, hierarchical addressing, and prefix aggregation improve routing efficiency by reducing packet processing costs, routing table size, and the number of IP prefixes.

 

Support for new technologies

IPv6 is designed for emerging technologies like 5G and IoT, offering advanced QoS features such as traffic shaping, packet classification, and queueing. These capabilities enhance network efficiency and ensure compatibility with future technological advancements.

Enhanced security measures 

IPv6 comes with built-in security features like IPsec, which protects data integrity, authentication, and encryption for internet traffic. This fundamental security mechanism strengthens internet communication by protecting against malicious assaults including eavesdropping, manipulation, and impersonation.

Expansive addressing capacity

IPv6 provides a significantly larger address space than IPv4, satisfying the growing demand for internet-connected devices and consumers. IPv6, which uses 128-bit addresses rather than 32-bit addresses, gives a huge pool of about 3.41038 unique addresses. This represents a significant increase over IPv4 capability, which is restricted to 4.3 billion unique addresses.

Automatic Configuration

Essentially, IPv6 provides two techniques for devices to automatically configure IP addresses: SLAAC and DHCPv6, making network setup easier and decreasing the workload of network administrators.

 

Why Is IPv6 Adoption Slow?

Despite being available for more than 20 years and having a number of technological advantages over IPv4, IPv6 has not yet been able to completely replace it. Let's examine the main causes of IPv6's sluggish adoption.

Flexibility and Difficulty.

Unfortunately, IPv6 is not backward compatible with the majority of current systems (computers, networks, and routers), which were built to function with IPv4. This implies that in order to handle IPv6, enterprises may need to change their entire network infrastructure, which can be a challenging task.

The price of change

As previously stated, system updates are necessary to make the switch to IPv6 because of compatibility issues. This can entail investing in and setting up new, frequently costly network equipment, like switches and routers. Additionally, most firms' IT staff are only conversant with IPv4 addresses and infrastructure. IPv6 adoption will necessitate software migration and IT staff training investments, which can be expensive, particularly for organizations with complex network infrastructures.

 

Conclusion

IPv6's broad address capability supports the IoT's sustainable growth as the need for IP addresses keeps increasing. As a result, companies are urged to embrace it quickly, showcasing their flexibility and leadership in technical developments and setting themselves up for future success. But both smooth transitions and quick uptake depend on governments and major internet companies working together.

 

References

 

Sources Sited

https://www.catchpoint.com/benefits-of-ipv6/ipv6-adoption

https://thenewstack.io/why-is-ipv6-adoption-slow/

https://www.apnic.net/

https://www.worldipv6launch.org/

CAS Server Installation in Ubuntu

         CAS server installation in ubuntu and integration with Drupal & OTRS

Contents

•  Introduction
•  How CAS works
•  CAS installation

             Installing Dependencies(apache-tomcat)
             Generating and installing Certificate
             Configuring CAS server
             Integrating CAS with LDAP authentication
             Integrating CAS with DRUPAL (CAS client)
             Integrating CAS with OTRS (CAS client

Introduction

The Central Authentication Service (CAS) is a single sign-on protocol for the web. Its purpose is to permit a user to access multiple applications while providing their credentials (such as userid and password) only once. It also allows web applications to authenticate users without gaining access to a user's security credentials, such as a password. The name CAS also refers to a software package that implements this protocol.
Our goal is to integrate CAS sever with Drupal and OTRS and provide single sign on solution for our customer.

How CAS works

When an application would like to authenticate users with CAS, it will use a CAS client along with a small amount of code to interact with this client. Many clients are available including a client for uPortal, AuthCAS for Apache along with clients written in Java, Perl, PHP, Ruby, etc.
To insure that the web application does not require access the user's credentials, authentication with CAS is a two step process.

When a new user initially logs into an application they won't have established a session with the application. Instead of displaying a login form asking for the username and password, the application (via the CAS Client) will redirect the browser to the CAS login page.

CAS then authenticates the user. If the authentication fails, the CAS login page is displayed again with an error message. So until authentication succeeds, the user will not be returned to the application. If the user is not sure how to proceed at that point, there are help desk links on the CAS login page. Once the user authenticates successfully, CAS will redirect the browser back to your application. CAS knows where to redirect to via a {service} parameter that you append to the CAS login url.

When CAS redirects the authenticated user back to your application, it will append a {ticket} parameter to your url.

The ticket returned to your application is opaque, meaning that it includes no useful information to anyone other than the CAS Server. The only thing that your application can do is send this ticket back to CAS for validation.

CAS will then either respond that this ticket does not represent a valid user for this service, or will acknowledge that this ticket proves authentication. In the later case, CAS will also supply the user's NetID so that you know the identity of the user.

The application must provide its own session management. Once the user is authenticated, your application should keep track of this fact within a session so that you don't have to reauthenticate them with the CAS Server. Typically this would be the same as if you authenticated the user directly from your application.

Through the myRutgers portal, CAS offers a single sign-on facility. Once the user has logged into myRutgers, the user does not need to supply their password to login to other applications using CAS. This is accomplished with a Ticket Granting Ticket cookie that CAS sends back to the browser when they initially login to the myRutgers portal.

For applications that deal with especially sensitive data, the application can opt out of the single sign-on facility by providing the {renew=true} parameter to the CAS login page.

Each application should provide their own logout facility which will invalidate the session and require the user to re-authenticate into the application. Note that if they are using SSO through the myRutgers portal, they will not have to re-enter their NetID and password.

CAS Installation

Prerequisites

•  Apache Tomcat
•  Sun java JDK

Sun java JDK installation

#sudo add-apt-repository ppa:sun-java-community-team/sun-java6

#sudo apt-get update

#sudo apt-get install sun-java6-jdk

Apache Tomcat installation

Download the Latest version of apache-tomcat from http://tomcat.apache.org/

Extract the downloaded file

To start the tomcat run this command in teminal

# /path to apache tomcat/bin/startup.sh

To stop apache-toamcat

#/path to apache tomcat/bin/startup.sh

To check the working of tomcat open this URL in web browser http:/localhost:8080/

If the apache-tomcat home page is opening means you have successfully installed tomcat

Generating and installing certificate

In any directory (I use my root) enter the command:

keytool -genkey -alias tomcat -keypass changeit -keyalg RSA

Note: Be sure to use the keytool that comes with the Java VM (%JAVA_HOME%/jre/bin/keytool), as on some systems the default points to the GNU version of keytool, where the two seem incompatible.

Answer the questions: (note that your firstname and lastname MUST be hostname of your server and cannot be a IP address; this is very important as an IP address will fail client hostname verification even if it is correct)

Enter keystore password: changeit

What is your first and last name?

[Unknown]: localhost

What is the name of your organizational unit?

[Unknown]:

What is the name of your organization?

[Unknown]:

What is the name of your City or Locality?

[Unknown]:

What is the name of your State or Province?

[Unknown]:

What is the two-letter country code for this unit?

[Unknown]:

Is CN=localhost, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct?

[no]: yes

Then enter the command:

keytool -export -alias tomcat -keypass changeit -file %FILE_NAME%

Finally import the cert into Java's keystore with this command. Tomcat uses the keystore in your JRE (%JAVA_HOME%/jre/lib/security/cacerts)

keytool -import -alias tomcat -file %FILE_NAME% -keypass changeit -keystore %JAVA_HOME%/jre/lib/security/cacerts

Open the HTTPS port in tomcat server

Edit “server.xml“ file located at /apache-tomcat-7.0.26/conf/server.xml and uncomment the below

<!-- Define a SSL HTTP/1.1 Connector on port 8443 -->

<Connector port="8443" maxHttpHeaderSize="8192"

maxThreads="150" minSpareThreads="25" maxSpareThreads="75"

enableLookups="false" disableUploadTimeout="true"

acceptCount="100" scheme="https" secure="true"

clientAuth="false" sslProtocol="TLS" />

check your https connection using URL https://localhost:8443/

Configuring CAS server

Download the latest Version of CAS server from jasig web site or

Run this command in the terminal

#wget http://downloads.jasig.org/cas/cas-server-3.4.11-release.tar.gz

#tar –xvzf cas-server-3.4.11-release.tar.gz

Moving CAS WAR file into apache-tomcat server

Move /path to cas-server/cas-server-x.y.z /modules/cascas-server-webapp-x.y.z to /path to apache tomcat/apache-tomcat-7.0.29/webapps/

#mv /path to cas-server/cas-server-x.y.z /modules/cas-server-webapp-x.y.z.war /path_to_apache tomcat/apache-tomcat-7.0.29/webapps/

Restart the tomcat server

To restart the tomcat use the start and stop command for tomcat that mentioned above

Check that your cas server is working or not using this url
https://localhost:8443/cas-server-webapp-x.y.z/ and you will get a login screen like this

The Default login will be username=password

Integrating CAS with LDAP

• Stop the tomcat server, e.g. $TOMCAT_HOME/bin/shutdown.sh
• Add the following to the pom.xml file in the META-INF folder, $TOMCAT_HOME\webapps\cas-
  
  

  server-webapp-$VERSION\META-INF\maven\org.jasig.cas\cas-server-webapp:

<dependency>

<groupId>${project.groupId}</groupId>

<artifactId>cas-server-support-ldap</artifactId>

<version>${project.version}</version>

</dependency>

• Edit $TOMCAT_HOME\webapps\cas-server-webapp-$VERSION\WEBINF\
• deployerConfigContext.xmlas follows

<bean id="contextSource"

class="org.springframework.ldap.core.support.LdapContextSource">

<property name="anonymousReadOnly" value="false" />

<property name="userDn" value="CN=sso,DC=pitsm,DC=com" />

<property name="password" value="SGS^cas" />

<property name="pooled" value="true" />

<property name="urls">

<list>

<value>ldap://172.20.1.28:389/</value>

</list>

</property>

<property name="baseEnvironmentProperties">

<map>

<entry>

<key><value>java.naming.security.authentication</value></key>

<value>simple</value>

</entry>

</map>

</property>

</bean>

• Remove the demo authentication handler,
  org.jasig.cas.authentication.handler.support.SimpleTestUsernamePassword 
  AuthenticationHandler, from the authenticationHandlers property of the 
  org.jasig.cas.authentication.AuthenticationManagerImpl bean.
• Add the LDAP fast bind authentication handler to the authenticationHandlers property of the authenticationHandler bean:

<bean

class="org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler" >

<property name="filter" value="uid=%u,ou=system" />

<property name="contextSource" ref="contextSource" />

</bean>

• Add the cas-server-support-ldap-$VERSION.jar from the CAS installation to $TOMCAT_HOME\webapps\cas-server-webapp-$VERSION\WEB-INF\lib.
• Add the spring-ldap-X.Y.Z.RELEASE-all.jar to $TOMCAT_HOME\webapps\casserver-
• webapp-$VERSION\WEB-INF\lib. It can be downloaded from http://www.springsource.org/ldap. X.Y.Z should correspond to latest version.
• Start tomcat and confirm there are no errors in the $TOMCAT_HOME\logs\catalina.out log
• Open a browser to the URL http://localhost:8080/cas-server-webapp-$VERSION/ and authenticate with the following credentials, sso/SGS^cas

Give the credintials

Successful login to the cas server

Integrating CAS server With Drupal

Edit the CAS settings in user management-->CAS settings-->CAS

Modify the fields in CAS settings as given below

Now the Drupal will redirect to the CAS login page

Integrating CAS with OTRS

          1)    Install perl library authcas

                 http://search.cpan.org/~osalaun/AuthCAS-1.5/lib/AuthCAS.pm

          2)    Add this to /opt/otrs/Kernel/ Config.pm

                 $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::CAS';

                 $Self->{'Customer::AuthModule::CAS::Gateway'} = 0;

                 $Self->{'Customer::AuthModule::CAS::ServiceUrl'} =

                 'http://172.20.1.21/customer.pl';

                 $Self->{'Customer::AuthModule::CAS::CASUrl'} = 'https://172.20.1.25:8443/';

         3)  Create CAS.pm in Kernel/System/CustomerAuth

              

                  (download from http://bugs.otrs.org/attachment.cgi?id=1673)

• Restart the apache server

             /etc/init.d/apache restart

             Once you enter the http://172.20.1.21/customer.pl it will redirect to CAS login page

Reference

https://wiki.jasig.org/display/CASUM/CAS+on+Windows+Quick+Setup+Guide

http://bugs.otrs.org/show_bug.cgi?id=7467

http://osdir.com/ml/otrs.devel/2007-05/msg00014.html

https://wiki.jasig.org/display/CASUM/LDAP