Open Source Security Tool Overview

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Open Source Security Tool Overview"

Transcription

1 Open Source Security Tool Overview Presented by Kitch Spicer & Douglas Couch Security Engineers for ITaP 1

2 Introduction Vulnerability Testing Network Security Passive Network Detection Firewalls Anti-virus/Anti-malware Host Intrusion Forensics Encryption Log File Analysis Miscellaneous All-In-One disks 2

3 Vulnerability Testing OpenVAS Network and host vulnerability scanner. Offshoot of Nessus NSAT Network Security Analysis Tool (similar to OpenVAS) Nikto Web application vulnerability scanner. W3AF Web Application Attack and Audit Pixy PHP Code scanner for XSS and SQLI 3

4 Network Security Wireshark (Windows, Linux, UNIX) Multi-platform network protocol analyzer with a lot of features and a variety of export format options. Snort (Windows, Linux, UNIX, Mac) IDS/IPS which combines signature, protocol and anomaly-based inspection. 4

5 Network Security NTop (Windows, Linux, UNIX, Mac) Network traffic probe providing insight to network usage. Analyzes IP traffic and sorts it based upon source and destination and has the ability to passively identify the host OS. 5

6 Network Security nfdump (Linux, UNIX) Set of command-line tools to collect and process netflow data. NfSen (Linux, UNIX) Web-based GUI for nfdump tools. Allows you to view flows, packets and bytes and easily navigate through netflow data. 6

7 Network Security Nmap (Windows, Linux, UNIX, Mac) Network discovery tool which uses raw IP packets to determine what hosts are on the network as well as any services the hosts are running, the OS, and more. 7

8 Network Security Netcat (Linux, UNIX, Mac) Network utility which provides data reading and writing capabilities using the TCP/IP protocol. Also has built-in port scanning, tunneling mode, and advanced usage options. 8

9 Network Security AFICK (Windows, Linux) File integrity tool - very simple interface that shows what files have changed on a system. 9

10 Network Security tcpdump (Linux, UNIX, Mac) Command-line packet sniffer/analyzer which allows the user to display packets that are being sent and received over the network which the system is attached. WinDump (Windows) Windows version of tcpdump 10

11 Passive Network Detection P0f (Windows, Linux, UNIX) Extremely versatile passive OS fingerprinting tool which can not only identify OS, but can detect the use of a firewall, NAT, load balancer, and even remote system ISP. 11

12 Passive Network Detection PADS Passive Asset Detection System Signature-based detection engine which passively detects network assets. Provides context to IDS alerts when used to supplement existing IDS/IPS systems. 12

13 Firewalls pfsense Customized FreeBSD distro to be used as a firewall and router. It includes features such as: VPN, NAT, Redundancy, Load Balancing, DHCP Server and Relay, etc. 13

14 Firewalls SmoothWall Firewall which includes its own hardened OS and provides a userfriendly web interface. Features include: proxies (Web, POP3 , IM), QoS, IDS via Snort, real-time traffic graphs, etc. 14

15 Firewalls AppArmor (Linux) Utilizes policy-based profiles for application access and protects the system from malware aimed at application vulnerabilities as well as unwanted programs. 15

16 Firewalls ModSecurity (OS Independent) Web Application firewall which can work embedded or as a reverse proxy. Protects against various web application attacks and has HTTP traffic logging, monitoring and real-time analysis capabilities. 16

17 Anti-Virus/Anti-Malware ClamAV (Windows, Linux) Anti-virus toolkit for UNIX with a focus on scanning at the mail gateway. Rootkit Hunter (Linux, UNIX) Tool used to check Linux/UNIX systems for the presence of rootkits as well as other unwanted tools. 17

18 Anti-Virus/Anti-Malware Nixory (OS independent) Program used with the Firefox web browser which protects users from malicious data mining. It is aimed at removing cookies which are used for tracking purposes in a malicious manner. 18

19 Host Intrusion Osiris Host integrity monitoring system. A tripwire replacement OSSEC Host intrusion detection including file integrity, log analysis, policy monitoring, and rootkit detect Samhain (Beltain) Similar to OSSEC. Beltain (non-free) offers a control panel. 19

20 Forensics AIR Automated Image and Restore is a GUI front-end to dd for creating forensic images. Autopsy A web front-end for the sleuth kit tools. ODESSA An open and extensible suite for acquisition, analysis and documentation of evidence. Live View Creates a Vmware image out of a raw DD image. Keeps a pristine image. 20

21 Encryption GnuPG (Windows, Linux, Mac) OpenPGP suite that allows users to encrypt and sign data and communication. Features a key management system as well as access modules for public key directories. gpg4win (Windows) Windows version of GnuPG. 21

22 Encryption AxCrypt (Windows) File encryption software which provides the ability to compress, encrypt, decrypt, store, send and work with files. Integrates with Windows Explorer. 22

23 Log File Analysis BASE (OS Independent) Basic Analysis and Security Engine - Web interface which performs analysis of Snort alerts and detections. Snare (Various OSes) Collects and analyzes security, application, system, DNS, file replication service, and AD logs. 23

24 Log File Analysis Splunk (Various OSes) Monitoring and reporting tool which utilizes logs, metrics, and various data from applications, servers and network devices. The information is then indexed into a searchable repository from which graphs, reports and alerts can be generated. 24

25 Miscellaneous OCS Inventory and package deployment system for Windows and *nix systems. DBAN Darik s Boot And Nuke: wipes drives effectively BleachBit Wipes free space Portable Apps Various SysInternals Windows tools 25

26 All-In-One SIFT Workstation Created by SANS for forensic analysis BackTrack Penetration testing and other hacker tools OSSIM Live CD with a network SIEM system preinstalled. Metasploit Ruby based framework for penetration tools and security tools 26

27 Conclusion Further questions? Where do you want to go from here? 27

Penetration Testing LAB Setup Guide

Penetration Testing LAB Setup Guide Penetration Testing LAB Setup Guide (External Attacker - Intermediate) By: magikh0e - magikh0e@ihtb.org Last Edit: July 06 2012 This guide assumes a few things... 1. You have read the basic guide of this

More information

ANTI-HACKER TOOL KIT. ourth Edition

ANTI-HACKER TOOL KIT. ourth Edition ANTI-HACKER TOOL KIT i ' Mm. i m Fm ourth Edition m CONTENTS Acknowledgments Introduction xvii xix The Best of the Basics 1 Managing Source Code and Working with Programming Languages 3 SCM Concepts 4

More information

Open Source Security Tools

Open Source Security Tools Open Source Security Tools Practical Applications for Security Tony Howlett Prentice Hall Professional Technical Reference PRENTICE Upper Saddle River, NJ 07458 www.phptr.com Preface xi Audience xii Contents

More information

INFORMATION SECURITY TRAINING CATALOG (2015)

INFORMATION SECURITY TRAINING CATALOG (2015) INFORMATICS AND INFORMATION SECURITY RESEARCH CENTER CYBER SECURITY INSTITUTE INFORMATION SECURITY TRAINING CATALOG (2015) Revision 3.0 2015 TÜBİTAK BİLGEM SGE Siber Güvenlik Enstitüsü P.K. 74, Gebze,

More information

By Jascha Wanger (jaschawanger@bse-inc.com) (jascha@localareasecurity.com)

By Jascha Wanger (jaschawanger@bse-inc.com) (jascha@localareasecurity.com) Managing Data Center Functions with Open Source Tools By Jascha Wanger (jaschawanger@bse-inc.com) (jascha@localareasecurity.com) Outline Firewalls IDS (Intrusion Detection) Monitoring/Administration Auditing

More information

Federated Network Security Administration Framework

Federated Network Security Administration Framework Available Online at www.ijcsmc.com International Journal of Computer Science and Mobile Computing A Monthly Journal of Computer Science and Information Technology IJCSMC, Vol. 2, Issue. 3, March 2013,

More information

Foreword Credits Preface Part I. Legal and Ethics 1. Legal and Ethics Issues 1.1 Core Issues 1.2 Computer Trespass Laws: No "Hacking" Allowed 1.

Foreword Credits Preface Part I. Legal and Ethics 1. Legal and Ethics Issues 1.1 Core Issues 1.2 Computer Trespass Laws: No Hacking Allowed 1. Foreword Credits Preface Part I. Legal and Ethics 1. Legal and Ethics Issues 1.1 Core Issues 1.2 Computer Trespass Laws: No "Hacking" Allowed 1.3 Reverse Engineering 1.4 Vulnerability Reporting 1.5 What

More information

Network/Internet Forensic and Intrusion Log Analysis

Network/Internet Forensic and Intrusion Log Analysis Course Introduction Enterprises all over the globe are compromised remotely by malicious hackers each day. Credit card numbers, proprietary information, account usernames and passwords, and a wealth of

More information

NETWORK SECURITY. Scott Hand. Melanie Rich-Wittrig. Enrique Jimenez

NETWORK SECURITY. Scott Hand. Melanie Rich-Wittrig. Enrique Jimenez NETWORK SECURITY Scott Hand Melanie Rich-Wittrig Enrique Jimenez Chapter 2 In Which Firewalls Are Erected, Packets Are Snorted, And Pwnage Denied TOPICS COVERED Host Software Firewalls iptables Network

More information

Automated Penetration Testing with the Metasploit Framework. NEO Information Security Forum March 19, 2008

Automated Penetration Testing with the Metasploit Framework. NEO Information Security Forum March 19, 2008 Automated Penetration Testing with the Metasploit Framework NEO Information Security Forum March 19, 2008 Topics What makes a good penetration testing framework? Frameworks available What is the Metasploit

More information

Introduction Open Source Security Tools for Information Technology Professionals

Introduction Open Source Security Tools for Information Technology Professionals Introduction Open Source Security Tools for Information Technology Professionals School of Professional Studies (SPS) The City University of New York (CUNY) Aron Trauring Adjunct Professor CEO, Zoteca

More information

OWASP Logging Project - Roadmap

OWASP Logging Project - Roadmap OWASP Logging Project - Roadmap SUMMARY Why log?... 2 What is commonly logged?... 2 What are security logs?... 2 What are the most common issues with logging?... 2 What are the common functions of a log

More information

Penetration Testing with Kali Linux

Penetration Testing with Kali Linux Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or

More information

Course Title: Penetration Testing: Security Analysis

Course Title: Penetration Testing: Security Analysis Course Title: Penetration Testing: Security Analysis Page 1 of 9 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics in advanced

More information

Some Tools for Computer Security Incident Response Team (CSIRT)

Some Tools for Computer Security Incident Response Team (CSIRT) Some Tools for Computer Security Incident Response Team (CSIRT) AfNOG 12 30 th May 2011 10 th June 2011 Tanzania By Marcus K. G. Adomey Overview Some Unix Commands Some Selected Tools Snort AirSnort hping

More information

2016 TÜBİTAK BİLGEM Cyber Security Institute

2016 TÜBİTAK BİLGEM Cyber Security Institute 2016 Revision 5.0 2016 TÜBİTAK BİLGEM Cyber Security Institute 1 ... 3 1. Information Security Awareness for End Users... 4 2. Information Security Awareness for Managers... 5 3. Social Engineering: Attack

More information

4. Exercise: Developing CERT Infrastructure 4.1 GENERAL DESCRIPTION 4.2 EXERCISE COURSE. 4.3 Introduction to the exercise. CERT Exercises Handbook

4. Exercise: Developing CERT Infrastructure 4.1 GENERAL DESCRIPTION 4.2 EXERCISE COURSE. 4.3 Introduction to the exercise. CERT Exercises Handbook 29 29 4. Exercise: Developing CERT Infrastructure Main Objective Targeted Audience Total Duration To learn what kind of software and hardware solutions could be used to provide a particular CERT service

More information

Linux and Open Source for (Almost) Zero Cost PCI Compliance. Rafeeq Rehman

Linux and Open Source for (Almost) Zero Cost PCI Compliance. Rafeeq Rehman Linux and Open Source for (Almost) Zero Cost PCI Compliance Rafeeq Rehman 2 Some Introductory Notes Payment Card Industry (PCI) standard is not a government regulacon. Who needs to comply with PCI? Twelve

More information

Open Source Security Tools for Information Technology Professionals

Open Source Security Tools for Information Technology Professionals Open Source Security Tools for Information Technology Professionals CUNY SPS Course Syllabus Aron Trauring May 23, 2005 (rev October 21, 2005) Course Description Information security is a top priority

More information

Host Hardening. OS Vulnerability test. CERT Report on systems vulnerabilities. (March 21, 2011)

Host Hardening. OS Vulnerability test. CERT Report on systems vulnerabilities. (March 21, 2011) Host Hardening (March 21, 2011) Abdou Illia Spring 2011 CERT Report on systems vulnerabilities Source: CERT Report @ http://www.kb.cert.org/vuls/bymetric 2 OS Vulnerability test Source: http://www.omninerd.com/articles/2006_operating_system_vulnerabilit

More information

Information Security Measures and Monitoring System at BARC. - R.S.Mundada Computer Division B.A.R.C., Mumbai-85

Information Security Measures and Monitoring System at BARC. - R.S.Mundada Computer Division B.A.R.C., Mumbai-85 Information Security Measures and Monitoring System at BARC - R.S.Mundada Computer Division B.A.R.C., Mumbai-85 Information Security Approach Secure Network Design, Layered approach, with SPF and Application

More information

INFORMATION SECURITY TRAINING CATALOG (2016)

INFORMATION SECURITY TRAINING CATALOG (2016) INFORMATICS AND INFORMATION SECURITY RESEARCH CENTER CYBER SECURITY INSTITUTE INFORMATION SECURITY TRAINING CATALOG (2016) Revision 4.0 2015 TÜBİTAK BİLGEM SGE Siber Güvenlik Enstitüsü P.K. 74, Gebze,

More information

INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION

INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION Prepared for the NRC Fuel Cycle Cyber Security Threat Conference Presented by: Jon Chugg, Ken Rohde Organization(s): INL Date: May 30, 2013 Disclaimer

More information

An Open Source IPS. IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan

An Open Source IPS. IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan An Open Source IPS IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan Introduction IPS or Intrusion Prevention System Uses a NIDS or Network Intrusion Detection System Includes

More information

June 2014 WMLUG Meeting Kali Linux

June 2014 WMLUG Meeting Kali Linux June 2014 WMLUG Meeting Kali Linux "the quieter you become, the more you are able to hear" Patrick TenHoopen Kali Linux Kali Linux is a free and open source penetration testing Linux distribution designed

More information

Build Your Own Security Lab

Build Your Own Security Lab Build Your Own Security Lab A Field Guide for Network Testing Michael Gregg WILEY Wiley Publishing, Inc. Contents Acknowledgments Introduction XXI xxiii Chapter 1 Hardware and Gear Why Build a Lab? Hackers

More information

Penetration Testing Workshop

Penetration Testing Workshop Penetration Testing Workshop Who are we? Carter Poe Nathan Ritchey Mahdi Shapouri Fred Araujo Outline Ethical hacking What is penetration testing? Planning Reconnaissance Footprinting Network Endpoint

More information

NETWORK SECURITY HACKS *

NETWORK SECURITY HACKS * NETWORK SECURITY HACKS * Andrew %pckhart Ji O'REILLY* Beijing Cambridge Farnham Koln Paris Sebastopol Taipei Tokyo Contents Credits Preface ix xi Chapter 1. Unix Host Security 1 1. Secure Mount Points

More information

Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)

Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4) Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware

More information

IDS and Penetration Testing Lab ISA656 (Attacker)

IDS and Penetration Testing Lab ISA656 (Attacker) IDS and Penetration Testing Lab ISA656 (Attacker) Ethics Statement Network Security Student Certification and Agreement I,, hereby certify that I read the following: University Policy Number 1301: Responsible

More information

Reduce Security Compliance Costs Using Open Source

Reduce Security Compliance Costs Using Open Source BLUE KAIZEN CENTER OF IT SECURITY Cairo Security Camp 2010 Reduce Security Compliance Costs Using Open Source Subject : This document gives the user an introduction to Information Security Compliance,

More information

Network Forensics: Log Analysis

Network Forensics: Log Analysis Network Forensics: Analysis Richard Baskerville Agenda P Terms & -based Tracing P Application Layer Analysis P Lower Layer Analysis Georgia State University 1 2 Two Important Terms PPromiscuous Mode

More information

Virtual Learning Tools in Cyber Security Education

Virtual Learning Tools in Cyber Security Education Virtual Learning Tools in Cyber Security Education Dr. Sherly Abraham Faculty Program Director IT and Cybersecurity Dr. Lifang Shih Associate Dean School of Business & Technology, Excelsior College Overview

More information

Port Scanning. Objectives. Introduction: Port Scanning. 1. Introduce the techniques of port scanning. 2. Use port scanning audit tools such as Nmap.

Port Scanning. Objectives. Introduction: Port Scanning. 1. Introduce the techniques of port scanning. 2. Use port scanning audit tools such as Nmap. Port Scanning Objectives 1. Introduce the techniques of port scanning. 2. Use port scanning audit tools such as Nmap. Introduction: All machines connected to a LAN or connected to Internet via a modem

More information

information security and its Describe what drives the need for information security.

information security and its Describe what drives the need for information security. Computer Information Systems (Forensics Classes) Objectives for Course Challenges CIS 200 Intro to Info Security: Includes managerial and Describe information security and its critical role in business.

More information

Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding

Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding This chapter describes the configuration for the SSL VPN Tunnel Client and for Port Forwarding. When a remote user accesses the SSL VPN

More information

Move over, TMG! Replacing TMG with Sophos UTM

Move over, TMG! Replacing TMG with Sophos UTM Move over, TMG! Replacing TMG with Sophos UTM Christoph Litzbach, Pre-Sales Engineer NSG 39 Key Features of TMG HTTP Antivirus/spyware URL Filtering HTTPS forward inspection Web Caching Role based access

More information

Research, recommend, and assist in implementing identity automation solution.

Research, recommend, and assist in implementing identity automation solution. Stephen Hargrove PO Box 592241 San Antonio, TX 78259 210-239-9763 stephen@stephenhargrove.com EXPERIENCE Information Security Officer Manager, Information Security Administration, UTHSCSA; San Antonio,

More information

Critical Considerations in Choosing a Network Firewall. Version 5.4.3 July 2014

Critical Considerations in Choosing a Network Firewall. Version 5.4.3 July 2014 Critical Considerations in Choosing a Network Firewall Version 5.4.3 July 2014 Why today s Firewalls are broken Visibility No visibility into user behavior No control over applications Manageability No

More information

Chapter 9 Firewalls and Intrusion Prevention Systems

Chapter 9 Firewalls and Intrusion Prevention Systems Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish

More information

Security Mgt. Tools and Subsystems

Security Mgt. Tools and Subsystems Security Mgt. Tools and Subsystems some attack and defense security tools at work Reconaissance Passive Active Penetration Classes of tools (network-bound) Passive Reconaissance Passively listen and analyze

More information

Networks & Security Course. Web of Trust and Network Forensics

Networks & Security Course. Web of Trust and Network Forensics Networks & Security Course Web of Trust and Network Forensics Virtual Machine Virtual Machine Internet connection You need to connect the VM to the Internet for some of the Web of Trust exercises. Make

More information

CS2107 Introduction to Information and System Security (Slid. (Slide set 8)

CS2107 Introduction to Information and System Security (Slid. (Slide set 8) Networks, the Internet Tool support CS2107 Introduction to Information and System Security (Slide set 8) National University of Singapore School of Computing July, 2015 CS2107 Introduction to Information

More information

Open Source Security: Opportunity or Oxymoron?

Open Source Security: Opportunity or Oxymoron? Open Source Security: Opportunity or Oxymoron? by George Lawton Presented by Eduard Kuziner COMP 595 SEC CSUN May 2002 1 Outline 1. What is Open Source? 2. Open Source Pros and Cons 3. Current Projects

More information

Vulnerability Assessment and Penetration Testing

Vulnerability Assessment and Penetration Testing Vulnerability Assessment and Penetration Testing Module 1: Vulnerability Assessment & Penetration Testing: Introduction 1.1 Brief Introduction of Linux 1.2 About Vulnerability Assessment and Penetration

More information

Security of IPv6 and DNSSEC for penetration testers

Security of IPv6 and DNSSEC for penetration testers Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions

More information

Sourcefire Defense Center TM

Sourcefire Defense Center TM Sourcefire TM Sourcefire Capabilities Store up to 100,000,000 security & host events, including packet data Centralized policy & sensor management Centralized audit logging of configuration & security

More information

NETASQ & PCI DSS. Is NETASQ compatible with PCI DSS? NG Firewall version 9

NETASQ & PCI DSS. Is NETASQ compatible with PCI DSS? NG Firewall version 9 NETASQ & PCI DSS Is NETASQ compatible with PCI DSS? We have often been asked this question. Unfortunately, even the best firewall is but an element in the process of PCI DSS certification. This document

More information

Passive Vulnerability Detection

Passive Vulnerability Detection Page 1 of 5 Passive Vulnerability Detection "Techniques to passively find network security vulnerabilities" Ron Gula rgula@securitywizards.com September 9, 1999 Copyright 1999 Network Security Wizards

More information

Decryption. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks

Decryption. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks Decryption Palo Alto Networks PAN-OS Administrator s Guide Version 6.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us

More information

Clavister InSight TM. Protecting Values

Clavister InSight TM. Protecting Values Clavister InSight TM Clavister SSP Security Services Platform firewall VPN termination intrusion prevention anti-virus anti-spam content filtering traffic shaping authentication Protecting Values & Enterprise-wide

More information

P Principles of Network Forensics P Terms & Log-based Tracing P Application Layer Log Analysis P Lower Layer Log Analysis

P Principles of Network Forensics P Terms & Log-based Tracing P Application Layer Log Analysis P Lower Layer Log Analysis Agenda Richard Baskerville P Principles of P Terms & -based Tracing P Application Layer Analysis P Lower Layer Analysis Georgia State University 1 2 Principles Kim, et al (2004) A fuzzy expert system for

More information

JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA

JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA To purchase Full version of Practice exam click below; http://www.certshome.com/jk0-022-practice-test.html FOR CompTIA JK0-022 Exam Candidates

More information

Network Monitoring. Sebastian Büttrich, sebastian@less.dk NSRC / IT University of Copenhagen Last edit: February 2012, ICTP Trieste

Network Monitoring. Sebastian Büttrich, sebastian@less.dk NSRC / IT University of Copenhagen Last edit: February 2012, ICTP Trieste Network Monitoring Sebastian Büttrich, sebastian@less.dk NSRC / IT University of Copenhagen Last edit: February 2012, ICTP Trieste http://creativecommons.org/licenses/by-nc-sa/3.0/ Agenda What is network

More information

BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports

BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports Building a Security Operation Center Agenda: Auditing Your Network Environment Selecting Effective Security

More information

Linux Server Support by Applied Technology Research Center. Proxy Server Configuration

Linux Server Support by Applied Technology Research Center. Proxy Server Configuration Linux Server Support by Applied Technology Research Center Proxy Server Configuration We configure squid for your LAN. Including transparent for HTTP and proxy for HTTPS. We also provide basic training

More information

Introduction to Network Security Lab 2 - NMap

Introduction to Network Security Lab 2 - NMap Introduction to Network Security Lab 2 - NMap 1 Introduction: Nmap as an Offensive Network Security Tool Nmap, short for Network Mapper, is a very versatile security tool that should be included in every

More information

FortKnox Personal Firewall

FortKnox Personal Firewall FortKnox Personal Firewall User Manual Document version 1.4 EN ( 15. 9. 2009 ) Copyright (c) 2007-2009 NETGATE Technologies s.r.o. All rights reserved. This product uses compression library zlib Copyright

More information

Lab 8.4.2 Configuring Access Policies and DMZ Settings

Lab 8.4.2 Configuring Access Policies and DMZ Settings Lab 8.4.2 Configuring Access Policies and DMZ Settings Objectives Log in to a multi-function device and view security settings. Set up Internet access policies based on IP address and application. Set

More information

CRYPTUS DIPLOMA IN IT SECURITY

CRYPTUS DIPLOMA IN IT SECURITY CRYPTUS DIPLOMA IN IT SECURITY 6 MONTHS OF TRAINING ON ETHICAL HACKING & INFORMATION SECURITY COURSE NAME: CRYPTUS 6 MONTHS DIPLOMA IN IT SECURITY Course Description This is the Ethical hacking & Information

More information

BEGINNER S GUIDE to. Open Source Intrusion Detection Tools. www.alienvault.com

BEGINNER S GUIDE to. Open Source Intrusion Detection Tools. www.alienvault.com BEGINNER S GUIDE to Open Source Intrusion Detection Tools www.alienvault.com IDS Basics If you aren t already running network IDS, you should be. There are two types of Network IDS: Signature Detection

More information

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks

More information

Tk20 Network Infrastructure

Tk20 Network Infrastructure Tk20 Network Infrastructure Tk20 Network Infrastructure Table of Contents Overview... 4 Physical Layout... 4 Air Conditioning:... 4 Backup Power:... 4 Personnel Security:... 4 Fire Prevention and Suppression:...

More information

Fighting Advanced Persistent Threats (APT) with Open Source Tools

Fighting Advanced Persistent Threats (APT) with Open Source Tools Fighting Advanced Persistent Threats (APT) with Open Source Tools What is APT? The US Air Force invented the term in 2006 APT refers to advanced techniques used to gain access to an intelligence objective

More information

Network Defense Tools

Network Defense Tools Network Defense Tools Prepared by Vanjara Ravikant Thakkarbhai Engineering College, Godhra-Tuwa +91-94291-77234 www.cebirds.in, www.facebook.com/cebirds ravikantvanjara@gmail.com What is Firewall? A firewall

More information

MCSA Objectives. Exam 70-236: TS:Exchange Server 2007, Configuring

MCSA Objectives. Exam 70-236: TS:Exchange Server 2007, Configuring MCSA Objectives Exam 70-236: TS:Exchange Server 2007, Configuring Installing and Configuring Microsoft Exchange Servers Prepare the infrastructure for Exchange installation. Prepare the servers for Exchange

More information

Environment. Attacks against physical integrity that can modify or destroy the information, Unauthorized use of information.

Environment. Attacks against physical integrity that can modify or destroy the information, Unauthorized use of information. Cyber Security. Environment, Solutions and Case study. Special Telecommunications Service David Gabriel, Buciu Adrian Contact: gdavid13@sts.ro adibuciu@sts.ro Environment Network/services can be damaged

More information

74% 96 Action Items. Compliance

74% 96 Action Items. Compliance Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated

More information

Endian Unified Threat Management

Endian Unified Threat Management Endian Unified Threat Management Introduction/Demo to Endian UTM lmarzke Lee Marzke (4AERO.com) Infrastructure Consultant: Software Development organizations Specialize in SCM, Process, PM, Tools Just

More information

Advanced Open-Source /Free Solutions for Home and Small Business Owners. Robert Baldi, CISSP- ISSEP

Advanced Open-Source /Free Solutions for Home and Small Business Owners. Robert Baldi, CISSP- ISSEP Advanced Open-Source /Free Solutions for Home and Small Business Owners Robert Baldi, CISSP- ISSEP TOPICS Encryption Backups Audits Wireless Security Network Security Open Source Goodness ENCRYPTION Encryption

More information

Network Intrusion Analysis (Hands-on)

Network Intrusion Analysis (Hands-on) Network Intrusion Analysis (Hands-on) TCP/IP protocol suite is the core of the Internet and it is vital to understand how it works together, its strengths and weaknesses and how it can be used to detect

More information

Security Incident Management Essentials Compiled as a service to the community by Internet2, EDUCAUSE, and REN-ISAC

Security Incident Management Essentials Compiled as a service to the community by Internet2, EDUCAUSE, and REN-ISAC Compiled as a service to the community by Internet2, EDUCAUSE, and REN-ISAC Background and Overview The Computer Security Incidents Internet2 (CSI2) working group organizes activities to better identify

More information

Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík

Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík {celeda velan jirsik}@ics.muni.cz Part I Introduction P. Čeleda et al. Network Security Monitoring and Behavior

More information

SANS Top 20 Critical Controls for Effective Cyber Defense

SANS Top 20 Critical Controls for Effective Cyber Defense WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a

More information

Getting Started. Symantec Client Security. About Symantec Client Security. How to get started

Getting Started. Symantec Client Security. About Symantec Client Security. How to get started Getting Started Symantec Client Security About Security Security provides scalable, cross-platform firewall, intrusion prevention, and antivirus protection for workstations and antivirus protection for

More information

NETASQ MIGRATING FROM V8 TO V9

NETASQ MIGRATING FROM V8 TO V9 UTM Firewall version 9 NETASQ MIGRATING FROM V8 TO V9 Document version: 1.1 Reference: naentno_migration-v8-to-v9 INTRODUCTION 3 Upgrading on a production site... 3 Compatibility... 3 Requirements... 4

More information

Lab 8.4.2 Configuring Access Policies and DMZ Settings

Lab 8.4.2 Configuring Access Policies and DMZ Settings Lab 8.4.2 Configuring Access Policies and DMZ Settings Objectives Log in to a multi-function device and view security settings. Set up Internet access policies based on IP address and application. Set

More information

Contents. vii. Preface. P ART I THE HONEYNET 1 Chapter 1 The Beginning 3. Chapter 2 Honeypots 17. xix

Contents. vii. Preface. P ART I THE HONEYNET 1 Chapter 1 The Beginning 3. Chapter 2 Honeypots 17. xix Honeynet2_bookTOC.fm Page vii Monday, May 3, 2004 12:00 PM Contents Preface Foreword xix xxvii P ART I THE HONEYNET 1 Chapter 1 The Beginning 3 The Honeynet Project 3 The Information Security Environment

More information

EFFECTIVE IMPLEMENTATION OF DYNAMIC CLASSIFICATION FOR NETWORK FORENSIC AND TRAFFIC ANALYSIS

EFFECTIVE IMPLEMENTATION OF DYNAMIC CLASSIFICATION FOR NETWORK FORENSIC AND TRAFFIC ANALYSIS EFFECTIVE IMPLEMENTATION OF DYNAMIC CLASSIFICATION FOR NETWORK FORENSIC AND TRAFFIC ANALYSIS Manu Bansal Assistant Professor Department of IT University Institute of Engineering & Technology Panjab University,

More information

To read more Linux Journal or start your subscription, please visit http://www.linuxjournal.com.

To read more Linux Journal or start your subscription, please visit http://www.linuxjournal.com. AlienVault the Future of Security Information Management Meet AlienVault OSSIM, a complex security system designed to make your life simpler. JERAMIAH BOWLING Security Information Management (SIM) systems

More information

Description: Objective: Attending students will learn:

Description: Objective: Attending students will learn: Course: Introduction to Cyber Security Duration: 5 Day Hands-On Lab & Lecture Course Price: $ 3,495.00 Description: In 2014 the world has continued to watch as breach after breach results in millions of

More information

Best of Breed of an ITIL based IT Monitoring. The System Management strategy of NetEye

Best of Breed of an ITIL based IT Monitoring. The System Management strategy of NetEye Best of Breed of an ITIL based IT Monitoring The System Management strategy of NetEye by Georg Kostner 5/11/2012 1 IT Services and IT Service Management IT Services means provisioning of added value for

More information

המרכז ללימודי חוץ המכללה האקדמית ספיר. ד.נ חוף אשקלון 79165 טל'- 08-6801535 פקס- 08-6801543 בשיתוף עם מכללת הנגב ע"ש ספיר

המרכז ללימודי חוץ המכללה האקדמית ספיר. ד.נ חוף אשקלון 79165 טל'- 08-6801535 פקס- 08-6801543 בשיתוף עם מכללת הנגב עש ספיר מודולות הלימוד של מייקרוסופט הקורס מחולק ל 4 מודולות כמפורט:.1Configuring Microsoft Windows Vista Client 70-620 Installing and upgrading Windows Vista Identify hardware requirements. Perform a clean installation.

More information

CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013

CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013 CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access

More information

FRONT RUNNER DIPLOMA PROGRAM INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months

FRONT RUNNER DIPLOMA PROGRAM INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months FRONT RUNNER DIPLOMA PROGRAM INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months MODULE: INTRODUCTION TO INFORMATION SECURITY INFORMATION SECURITY ESSENTIAL TERMINOLOGIES SECURITY

More information

Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort

Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort License Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons

More information

60467 Project 1. Net Vulnerabilities scans and attacks. Chun Li

60467 Project 1. Net Vulnerabilities scans and attacks. Chun Li 60467 Project 1 Net Vulnerabilities scans and attacks Chun Li Hardware used: Desktop PC: Windows Vista service pack Service Pack 2 v113 Intel Core 2 Duo 3GHz CPU, 4GB Ram, D-Link DWA-552 XtremeN Desktop

More information

Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA

Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline

More information

Kerio Control. Step-by-Step Guide. Kerio Technologies

Kerio Control. Step-by-Step Guide. Kerio Technologies Kerio Control Step-by-Step Guide Kerio Technologies 2011 Kerio Technologies s.r.o. All rights reserved. This guide provides detailed description on configuration of the local network which uses the Kerio

More information

Intrusion Detection Systems (IDS)

Intrusion Detection Systems (IDS) Intrusion Detection Systems (IDS) What are They and How do They Work? By Wayne T Work Security Gauntlet Consulting 56 Applewood Lane Naugatuck, CT 06770 203.217.5004 Page 1 6/12/2003 1. Introduction Intrusion

More information

Network Security Administrator

Network Security Administrator Network Security Administrator Course ID ECC600 Course Description This course looks at the network security in defensive view. The ENSA program is designed to provide fundamental skills needed to analyze

More information

One-Man Shop. How to build a functional security program with limited resources DEF CON 22

One-Man Shop. How to build a functional security program with limited resources DEF CON 22 One-Man Shop How to build a functional security program with limited resources DEF CON 22 One-Man Shop Agenda Caveats & Considerations People and Processes Network Architecture System Design Continuous

More information

Unit 3 Research Project. Eddie S. Jackson. Kaplan University. IT540: Management of Information Security. Kenneth L. Flick, Ph.D.

Unit 3 Research Project. Eddie S. Jackson. Kaplan University. IT540: Management of Information Security. Kenneth L. Flick, Ph.D. Running head: UNIT 3 RESEARCH PROJECT 1 Unit 3 Research Project Eddie S. Jackson Kaplan University IT540: Management of Information Security Kenneth L. Flick, Ph.D. 10/07/2014 UNIT 3 RESEARCH PROJECT 2

More information

Semantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual. Document Version 1.0

Semantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual. Document Version 1.0 Semantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual Document Version 1.0 Table of Contents 1 SWAF... 4 1.1 SWAF Features... 4 2 Operations and User Manual... 7 2.1 SWAF Administrator

More information

WatchGuard Training. Introduction to WatchGuard Dimension

WatchGuard Training. Introduction to WatchGuard Dimension WatchGuard Training Introduction to WatchGuard Dimension Introduction to WatchGuard Dimension What is WatchGuard Dimension? Deploy WatchGuard Dimension Configure WatchGuard Dimension Use WatchGuard Dimension

More information

April 11, 2011. (Revision 2)

April 11, 2011. (Revision 2) Passive Vulnerability Scanning Overview April 11, 2011 (Revision 2) Copyright 2011. Tenable Network Security, Inc. All rights reserved. Tenable Network Security and Nessus are registered trademarks of

More information

CIT 380: Securing Computer Systems

CIT 380: Securing Computer Systems CIT 380: Securing Computer Systems Scanning CIT 380: Securing Computer Systems Slide #1 Topics 1. Port Scanning 2. Stealth Scanning 3. Version Identification 4. OS Fingerprinting 5. Vulnerability Scanning

More information

Leveraging Network Vulnerability Assessment with Incident Response Processes and Procedures

Leveraging Network Vulnerability Assessment with Incident Response Processes and Procedures Leveraging Network Vulnerability Assessment with Incident Response Processes and Procedures DAVID COLE, DIRECTOR IS AUDITS, U.S. HOUSE OF REPRESENTATIVES Assessment Planning Assessment Execution Assessment

More information

Make a folder named Lab3. We will be using Unix redirection commands to create several output files in that folder.

Make a folder named Lab3. We will be using Unix redirection commands to create several output files in that folder. CMSC 355 Lab 3 : Penetration Testing Tools Due: September 31, 2010 In the previous lab, we used some basic system administration tools to figure out which programs where running on a system and which files

More information

PND at a glance: The World s Premier Online Practical Network Defense course. Self-paced, online, flexible access

PND at a glance: The World s Premier Online Practical Network Defense course. Self-paced, online, flexible access The World s Premier Online Practical Network Defense course PND at a glance: Self-paced, online, flexible access 1500+ interactive slides (PDF, HTML5 and Flash) 7+ hours of video material 10 virtual labs

More information