By Jascha Wanger
|
|
|
- Reginald Jennings
- 8 years ago
- Views:
Transcription
1 Managing Data Center Functions with Open Source Tools By Jascha Wanger
2 Outline Firewalls IDS (Intrusion Detection) Monitoring/Administration Auditing Spam/Virus/Worm Scanning Proprietary Solution Cost Comparison Conclusion
3 Firewalls Netfilter/IPtables/Shorewall - Linux PF (Packet Filter) - OpenBSD IPFW - FreeBSD
4 Netfilter/IPtables Netfilter - a set of hooks inside the Linux 2.4.x kernel's network stack which allows kernel modules to register callback functions called every time a network packet traverses one of those hooks. IPtables - a generic table structure for the definition of rule sets Each rule within an IP table consists out of a number of classifiers (matches) and one connected action (target).
5 Netfilter/IPtables Features packet filtering (stateless or stateful) NAT (Network Address Translation) advanced packet processing packet mangling framework inside the Linux 2.4.x kernel additional features as patches
6 Shorewall Shorewall - high-level tool for configuring Netfilter/IPtables Router/firewall/gateway applications IP Masquerading Source Network Address Translation (SNAT) Blacklisting VPN support Traffic Control/Shaping MAC Verification Traffic accounting
7 PF (Packet Filter) on OpenBSD OpenBSD's system for filtering TCP/IP traffic NAT (Network Address Translation) Packet Scrubbing Queuing (Class Based, Priority, etc.) Traffic Redirection Part of the OpenBSD kernel Security hardened host Operating System OpenBSD security track record
8 IPFW on FreeBSD Packet filtering IP accounting NAT (Network Address Translation) Part of FreeBSD kernel FreeBSD rock solid stability/reliability
9 IDS (Intrusion Detection System) Snort Intrusion Detection System Prelude Hybrid Intrusion Detection System AIDE (Advanced Intrusion Detection Environment) Samhain File Integrity / Intrusion Detection System
10 Snort Snort - an open source network intrusion detection system. Real-time traffic analysis/alerts Packet logging Protocol analysis Content searching/matching Detect attacks/probes Flexible rules language Modular plug-in architecture Mature (current version 2.0.4) Released under GPL
11 Snort / A.C.I.D / Snort Center A.C.I.D. - Analysis Console for Intrusion Databases Snort Center - Snort IDS Rule and Sensor Management Centralized management of multiple Snort IDS nodes across a network from one console Centralized logging to SQL database Secured distribution of rule sets (via SSH)
12 Snort Center Senor Overview
13 Snort Center Rule Set Control
14 Snort Center ACID Plugin
15 Prelude Hybrid IDS Prelude - Hybrid Intrusion Detection system Five Main Parts: Sensors detect at strategic network points Managers centralized data processors (can be distributed) Counter Measure Agents perform action to stop/thwart anomaly reported by a Manager The Prelude Library API for modules
16 Prelude Overview Host and/or network based Modular design Distributed managers and sensors Countermeasure ability built in
17 AIDE (Advanced Intrusion Detection Environment) Host based Monitors file integrity Creates database of known good hashes Uses multiple algorithms (md5,sha1,rmd160,tiger,haval,etc) Intended as GPL replacement of TripWire
18 Samhain File Integrity / IDS Host based File checksums detect modifications Searches for rouge SUID executables Detects root kits (under Linux and FreeBSD) Able to log to SQL database 'Complete' integrity checking Released under GPL
19 Monitoring / Administration OpenNMS MRTG NeDi Nagios Webmin LogWatch / SWATCH SEC openmosix / openmosixview Etherape
20 OpenNMS Network Management System framework Easily customized to fit needs Modular design Supports plug-ins
21 OpenNMS Concurrent management tasks: Action daemon - automated action (work flow) Collection daemon - collects data Capability daemon - capability check on nodes DHCP daemon - DHCP client for OpenNMS Discovery daemon - initial and ongoing discovery Events manager daemon manages/stores events Notification daemon - external notification of users Outage manager daemon - consolidates events Poller daemon - polls managed nodes/services RTC manager daemon - real time availability information SNMP trap daemon handles SNMP traps Threshold daemon monitor for threshold values
22 OpenNMS Console
23 MRTG (Multi Router Traffic Grapher) A tool to monitor the traffic load on network Generates HTML with PNG reports Provides a LIVE visual representation of traffic Allows monitoring and analysis of many data center functions (router, server, latency, utilization, temperature, etc.) Countless ways to utilize for data visualization Released under GPL
24 MRTG Example Output
25 NeDi NeDi - a perl based network discovery & management system for Cisco components. Features Centralized management Manage device configurations Push out new configurations Intuitive console Accessed via web browser Graph devices Lists devices Supports IOS and CatOS
26 NeDi Example Screen shots Main Page
27 NeDi Example Screen shots NeDi Device Writer
28 NeDi Example Screen shots NeDi Device Report
29 Nagios Nagios a host and service monitor Accessed via web browser Services (POP, PING, HTTP, etc) Host resources Environmental factors Option of distributed monitoring Acknowledge issues via web interface Notification / event handlers Modular, allows for plug-ins Released under GPL
30 Nagios Example Screen Shots Tactical Overview
31 Nagios Example Screen Shots 3D Overview
32 Webmin Webmin - a web-based interface for system administration for Unix - Administrate multiple servers via a web browser - Configure/monitor Shorewall firewalls - Manage http, DNS, Clusters, DHCP, POP, SMTP, etc. - Modular design using plug-ins - Released under GPL
33 Webmin Example Screen Shots
34 Webmin Example Screen Shots
35 Webmin Example Screen Shots
36 LogWatch LogWatch analyzes and reports on system logs - Customizable and pluggable log-monitoring - Reports on given parameters over given period
37 SWATCH Swatch (Simple WATCHer) of log files - Monitors virtually any log file - Reports on given parameters over given period - Easily customized
38 SEC Simple Event Correlation Fill the gap between commercial and homegrown solutions Event correlation engine for HP OpenView NNM Event correlation engine for HP OpenView ITO management server and agents Event management for CiscoWorks Event consolidation and correlation for Snort IDS Logfile monitoring and analysis (used in place of Swatch and Logwatch)
39 openmosix / openmosixview openmosix - a Linux kernel extension for single-image clustering openmosixview GUI for management of openmosix clusters Main Window
40 OpenMosixview Screen Shots History Remote Processes
41 Etherape Etherape - graphical network monitor for Unix modeled after etherman Network traffic is displayed graphically 'Top Talkers' represented most Select protocol stack of focus Network filters View internal traffic, end to end IP, or port to port TCP Can read saved tcpdump file Most protocols supported
42 Etherape Screen Shot
43 Auditing Nessus NMAP Inprotect Ethereal
44 Nessus Nessus - easy to use remote security scanner Software to remotely audit a given network Detects service on non-standard ports Will try to exploit remote service vulnerabilities Utilizes plug-ins Very up to date NASL (Nessus Attack Scripting Language) Client-server architecture Can test multiple host simultaneously Exportable reports in multiple formats Smart service recognition
45 Nmap Nmap - utility for network exploration or security auditing Can rapidly scan large networks Detects application name and version Detects OS version Detects firewalls etc. Easy to use
46 Nmap Screen Shots GUI Front End Terminal
47 Inprotect Inprotect - web interface for Nessus and Nmap security scanners Manual and scheduled security scans Easy to use web browser interface Administrate regular network scans easily
48 Ethereal Ethereal - network protocol analyzer (sniffer) Examine data from a live network Examine saved capture file Supports many capture formats Intuitive interface View reconstructed TCP sessions Easy to use filters
49 Ethereal Screen Shot
50 SPAM/Virus/Worm Filtering Spam Assassin ClamAV MailScanner
51 SPAM Assassin Spam Assassin rule based mail filter to identify Spam Header analysis Text analysis Blacklists Razor - (collaborative Spam-tracking database)
52 ClamAV ClamAV - anti-virus toolkit for UNIX Command-line scanner Fast, multi-threaded daemon Simple database updater Virus scanner C library On-access scanning (Linux) Detection of over viruses, worms and Trojans Built-in support for RAR (2.0), Zip, Gzip, etc. Up to date signature additions
53 *Source MailScanner website Mail Scanner Mail Scanner - scans all for viruses, Spam and attacks against security vulnerabilities Protects over 5 billion s every week* All in one solution for scanning any combination of 14 different virus scanners including ClamAV Scalable and robust Automatic updates Multiple Spam identification techniques Released under GPL
54 Open Source Solution Cost Comparison Example Network 50 servers 4000 users 450 VPN users
55 Proprietary Solution Cost Breakdown Checkpoint Suite - VPN-1, FireWall-1, FloodGate-1, Meta IP, Account Management Module, UserAuthority, ConnectControl, Reporting Module, Real-Time Monitor, SecureUpdate and Visual Policy Editor. Licensing by number of IP addresses = 4500 IPs - $200 per 10 IP addresses = $90,000* - $50 per VPN client software (450 users) = $22,500* - plus cost of hardware / OS to run it on - plus cost of newing license every year - plus deployment costs - plus support and updates - Licensing notes: Support and software updates are not included with CheckPoint products * Licensing Total = $112,500* *Source securehq.com
56 Open Source Solution Cost Breakdown Linux Firewall utilizing Shorewall and FreeS/WAN (for VPN) IP addresses = 4500 IPs - NO per IP licensing - NO VPN client software licensing - cost of hardware to run it on - NO cost of newing license every year - deployment costs - NO cost of support contracts and updates Licensing Total = $0.00
57 Conclusion Multiple options to choose from You get the source code Manage many data center functions from centralized console Easily create custom solutions to fit needs No licensing costs (per seat, IP, etc) Paid support available if needed Lower cost of ownership Better ROI than many proprietary offerings Sponsored by
Advanced Linux System Administration Knowledge GNU/LINUX Requirements
Advanced Linux System Administration Knowledge GNU/LINUX Requirements Duration: 112Hours / 28 Classes (4hrs each class Including Theory & Lab Session) (2 Classes/ Week) Class Topic Duration Class 1 History
Open Source Security: Opportunity or Oxymoron?
Open Source Security: Opportunity or Oxymoron? by George Lawton Presented by Eduard Kuziner COMP 595 SEC CSUN May 2002 1 Outline 1. What is Open Source? 2. Open Source Pros and Cons 3. Current Projects
Intrusion Detection Systems (IDS)
Intrusion Detection Systems (IDS) What are They and How do They Work? By Wayne T Work Security Gauntlet Consulting 56 Applewood Lane Naugatuck, CT 06770 203.217.5004 Page 1 6/12/2003 1. Introduction Intrusion
Open Source Security Tool Overview
Open Source Security Tool Overview Presented by Kitch Spicer & Douglas Couch Security Engineers for ITaP 1 Introduction Vulnerability Testing Network Security Passive Network Detection Firewalls Anti-virus/Anti-malware
Introduction Open Source Security Tools for Information Technology Professionals
Introduction Open Source Security Tools for Information Technology Professionals School of Professional Studies (SPS) The City University of New York (CUNY) Aron Trauring Adjunct Professor CEO, Zoteca
INASP: Effective Network Management Workshops
INASP: Effective Network Management Workshops About these workshops Authors: Dick Elleray, AfriConnect Unit 7: Network Monitoring delleray@africonnect.com Chris Wilson, Aptivate Date: 2013-04-29 Objectives
A Brief. Introduction. of MG-SOFT s SNMP Network Management Products. Document Version 1.3, published in June, 2008
A Brief Introduction of MG-SOFT s SNMP Network Management Products Document Version 1.3, published in June, 2008 MG-SOFT s SNMP Products Overview SNMP Management Products MIB Browser Pro. for Windows and
Free Network Monitoring Software for Small Networks
Free Network Monitoring Software for Small Networks > WHITEPAPER Introduction Networks are becoming critical components of business success - irrespective of whether you are small or BIG. When network
PRTG NETWORK MONITOR. Installed in Seconds. Configured in Minutes. Masters Your Network for Years to Come.
PRTG NETWORK MONITOR Installed in Seconds. Configured in Minutes. Masters Your Network for Years to Come. PRTG Network Monitor is... NETWORK MONITORING Network monitoring continuously collects current
PANDORA FMS NETWORK DEVICES MONITORING
NETWORK DEVICES MONITORING pag. 2 INTRODUCTION This document aims to explain how Pandora FMS can monitor all the network devices available in the market, like Routers, Switches, Modems, Access points,
Federated Network Security Administration Framework
Available Online at www.ijcsmc.com International Journal of Computer Science and Mobile Computing A Monthly Journal of Computer Science and Information Technology IJCSMC, Vol. 2, Issue. 3, March 2013,
Open Source Security Tools
Open Source Security Tools Practical Applications for Security Tony Howlett Prentice Hall Professional Technical Reference PRENTICE Upper Saddle River, NJ 07458 www.phptr.com Preface xi Audience xii Contents
PRTG NETWORK MONITOR. Installed in Seconds. Configured in Minutes. Master Your Network for Years to Come.
PRTG NETWORK MONITOR Installed in Seconds. Configured in Minutes. Master Your Network for Years to Come. PRTG Network Monitor is... NETWORK MONITORING Network monitoring continuously collects current status
PANDORA FMS NETWORK DEVICE MONITORING
NETWORK DEVICE MONITORING pag. 2 INTRODUCTION This document aims to explain how Pandora FMS is able to monitor all network devices available on the marke such as Routers, Switches, Modems, Access points,
PRTG NETWORK MONITOR. Installed in Seconds. Configured in Minutes. Masters Your Network for Years to Come.
PRTG NETWORK MONITOR Installed in Seconds. Configured in Minutes. Masters Your Network for Years to Come. PRTG Network Monitor is... NETWORK MONITORING Network monitoring continuously collects current
Security Mgt. Tools and Subsystems
Security Mgt. Tools and Subsystems some attack and defense security tools at work Reconaissance Passive Active Penetration Classes of tools (network-bound) Passive Reconaissance Passively listen and analyze
Cisco PIX vs. Checkpoint Firewall
Cisco PIX vs. Checkpoint Firewall Introduction Firewall technology ranges from packet filtering to application-layer proxies, to Stateful inspection; each technique gleaning the benefits from its predecessor.
NetCrunch 6. AdRem. Network Monitoring Server. Document. Monitor. Manage
AdRem NetCrunch 6 Network Monitoring Server With NetCrunch, you always know exactly what is happening with your critical applications, servers, and devices. Document Explore physical and logical network
CSE331: Introduction to Networks and Security. Lecture 17 Fall 2006
CSE331: Introduction to Networks and Security Lecture 17 Fall 2006 Announcements Project 2 is due next Weds. Homework 2 has been assigned: It's due on Monday, November 6th. CSE331 Fall 2004 2 Summary:
Network Monitoring. Easy, failsafe, and complete visibility of your network. Our customers have the same view as our NOC technicians.
One software solution to monitor your entire network, including devices, applications, traffic, and availability. Network monitoring is the constant evaluation fo your systems performance within the IT
Network monitoring systems & tools
Network monitoring systems & tools Network & Service Monitoring tools Nagios server and service monitor Can monitor pretty much anything HTTP, SMTP, DNS, Disk space, CPU usage,... Easy to write new plugins
NETWORK SECURITY HACKS *
NETWORK SECURITY HACKS * Andrew %pckhart Ji O'REILLY* Beijing Cambridge Farnham Koln Paris Sebastopol Taipei Tokyo Contents Credits Preface ix xi Chapter 1. Unix Host Security 1 1. Secure Mount Points
Linux Network Security
Linux Network Security Course ID SEC220 Course Description This extremely popular class focuses on network security, and makes an excellent companion class to the GL550: Host Security course. Protocols
Introduction to Network Monitoring and Management
Introduction to Network Monitoring and Management Jonathan Brewer Network Startup Resource Center jon@nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International
Network Monitoring and Management Introduction to Networking Monitoring and Management
Network Monitoring and Management Introduction to Networking Monitoring and Management These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
One software solution to monitor your entire network, including devices, applications traffic and availability.
One software solution to monitor your entire network, including devices, applications traffic and availability. About Britannic Expert Integrators We are award winning specialists in IP communications,
An Open Source IPS. IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan
An Open Source IPS IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan Introduction IPS or Intrusion Prevention System Uses a NIDS or Network Intrusion Detection System Includes
Mauro Andreolini University of Modena andreolini@unimore.it. Michele Colajanni. colajanni@unimore.it. bulgarelli.alessandro@ unimore.
HoneySpam: Honeypots fighting SPAM at the source Mauro Andreolini University of Modena andreolini@unimore.it Alessandro Bulgarelli University of Modena bulgarelli.alessandro@ unimore.it Michele Colajanni
Open Source Security Tools for Information Technology Professionals
Open Source Security Tools for Information Technology Professionals CUNY SPS Course Syllabus Aron Trauring May 23, 2005 (rev October 21, 2005) Course Description Information security is a top priority
Course Title: Penetration Testing: Security Analysis
Course Title: Penetration Testing: Security Analysis Page 1 of 9 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics in advanced
Tk20 Network Infrastructure
Tk20 Network Infrastructure Tk20 Network Infrastructure Table of Contents Overview... 4 Physical Layout... 4 Air Conditioning:... 4 Backup Power:... 4 Personnel Security:... 4 Fire Prevention and Suppression:...
Using Nessus to Detect Wireless Access Points. March 6, 2015 (Revision 4)
Using Nessus to Detect Wireless Access Points March 6, 2015 (Revision 4) Table of Contents Introduction... 3 Why Detect Wireless Access Points?... 3 Wireless Scanning for WAPs... 4 Detecting WAPs using
State of Oregon Open Source Application Use in the Enterprise
State of Oregon Open Source Application Use in the Enterprise Case Study: Asterisk used to create powerful audio conferencing service For large Agency user. Background: Data and Video Services (DVS), a
Host Hardening. OS Vulnerability test. CERT Report on systems vulnerabilities. (March 21, 2011)
Host Hardening (March 21, 2011) Abdou Illia Spring 2011 CERT Report on systems vulnerabilities Source: CERT Report @ http://www.kb.cert.org/vuls/bymetric 2 OS Vulnerability test Source: http://www.omninerd.com/articles/2006_operating_system_vulnerabilit
CiscoWorks Resource Manager Essentials 4.3
. Data Sheet CiscoWorks Resource Manager Essentials 4.3 Product Overview CiscoWorks Resource Manager Essentials (RME) 4.3 is the cornerstone application of CiscoWorks LAN Management Solution (LMS). CiscoWorks
funkwerk packetalarm NG IDS/IPS Systems
funkwerk packetalarm NG IDS/IPS Systems First Class Security. Intrusion Detection and Intrusion Prevention Funkwerk IP-Appliances Corporate and Authorities networks: A Popular Target of Attacks Nowadays,
IDS / IPS. James E. Thiel S.W.A.T.
IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods
Information Security Measures and Monitoring System at BARC. - R.S.Mundada Computer Division B.A.R.C., Mumbai-85
Information Security Measures and Monitoring System at BARC - R.S.Mundada Computer Division B.A.R.C., Mumbai-85 Information Security Approach Secure Network Design, Layered approach, with SPF and Application
Blended Security Assessments
Blended Security Assessments Combining Active, Passive and Host Assessment Techniques October 12, 2009 (Revision 9) Renaud Deraison Director of Research Ron Gula Chief Technology Officer Table of Contents
NETWORK SECURITY HACKS
SECOND EDITION NETWORK SECURITY HACKS 2008 AGI-Information Management Consultants May be used for personal purporses only or by libraries associated to dandelon.com network. Andrew Lockhart O'REILLY Beijing
EventSentry Overview. Part I About This Guide 1. Part II Overview 2. Part III Installation & Deployment 4. Part IV Monitoring Architecture 13
Contents I Part I About This Guide 1 Part II Overview 2 Part III Installation & Deployment 4 1 Installation... with Setup 5 2 Management... Console 6 3 Configuration... 7 4 Remote... Update 10 Part IV
ForeScout CounterACT. Device Host and Detection Methods. Technology Brief
ForeScout CounterACT Device Host and Detection Methods Technology Brief Contents Introduction... 3 The ForeScout Approach... 3 Discovery Methodologies... 4 Passive Monitoring... 4 Passive Authentication...
How To Protect A Network From Attack From A Hacker (Hbss)
Leveraging Network Vulnerability Assessment with Incident Response Processes and Procedures DAVID COLE, DIRECTOR IS AUDITS, U.S. HOUSE OF REPRESENTATIVES Assessment Planning Assessment Execution Assessment
WÜRTHPHOENIX NetEye Version 3
WÜRTHPHOENIX NetEye Release Note WÜRTHPHOENIX NetEye Version 3 Release date: March 2009 Overview of the updates and newly introduced functionalities in VS 3 In the following summaries, you can obtain a
ANNEXURE-1 TO THE TENDER ENQUIRY NO.: DPS/AMPU/MIC/1896. Network Security Software Nessus- Technical Details
Sub: Supply, Installation, setup and testing of Tenable Network Security Nessus vulnerability scanner professional version 6 or latest for scanning the LAN, VLAN, VPN and IPs with 3 years License/Subscription
Foreword Credits Preface Part I. Legal and Ethics 1. Legal and Ethics Issues 1.1 Core Issues 1.2 Computer Trespass Laws: No "Hacking" Allowed 1.
Foreword Credits Preface Part I. Legal and Ethics 1. Legal and Ethics Issues 1.1 Core Issues 1.2 Computer Trespass Laws: No "Hacking" Allowed 1.3 Reverse Engineering 1.4 Vulnerability Reporting 1.5 What
Network Management & Monitoring Overview
Network Management & Monitoring Overview PacNOG 6 November 17, 2009 Nadi, Fiji hervey@nsrc.org Introduction This is a big topic... There are a lot of tools to choose from: - Open Source - Commercial -
CARENET-SE. NOC Tools Review. Communication System Design Summer 2010. Project team. Champion Björn Pehrson Coach Hans Eriksson
NOC Tools Review CARENET-SE Communication System Design Summer 2010 Project team IK2207 Alin Pastrama pastrama@kth.se Champion Björn Pehrson Coach Hans Eriksson IK2207 Annika Holmgren annika.holmgren@gmail.com
Security Information Management
Security Information Management b-i branding. technology. integration. www.b-i.com Acronyms Main acronyms used in this talk : - IDS : Intrusion Detection System, commonly divided in > NIDS : Network Intrusion
Firewalls. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49. Firewall Design Principles
Firewalls Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49 1 Firewall Design Principles Firewall Characteristics Types of Firewalls Firewall Configurations
Network Defense Tools
Network Defense Tools Prepared by Vanjara Ravikant Thakkarbhai Engineering College, Godhra-Tuwa +91-94291-77234 www.cebirds.in, www.facebook.com/cebirds ravikantvanjara@gmail.com What is Firewall? A firewall
SNMP and OpenNMS. Part 2 OpenNMS
SNMP and OpenNMS Part 2 OpenNMS Parts of this presentation were shamelessly copied from a presentation by the project's maintainer, Tarus Balog with the author's permission. Zeev Halevi NMS - ISO Definition:
PROFESSIONAL SECURITY SYSTEMS
PROFESSIONAL SECURITY SYSTEMS Security policy, active protection against network attacks and management of IDP Introduction Intrusion Detection and Prevention (IDP ) is a new generation of network security
Stateful Inspection Technology
Stateful Inspection Technology Security Requirements TECH NOTE In order to provide robust security, a firewall must track and control the flow of communication passing through it. To reach control decisions
FEATURE OVERVIEW. FGX Series firewall. Last updated February 2012
FEATURE OVERVIEW FGX Series firewall Last updated February 2012 Celestix FGX Features Deep Packet Firewall VPN Virtual system DoD/DDoS attach defense Intrusion protection Anti-virus Anti-spam URL filtering
mbits Network Operations Centrec
mbits Network Operations Centrec The mbits Network Operations Centre (NOC) is co-located and fully operationally integrated with the mbits Service Desk. The NOC is staffed by fulltime mbits employees,
CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013
CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
INFORMATION SECURITY TRAINING CATALOG (2015)
INFORMATICS AND INFORMATION SECURITY RESEARCH CENTER CYBER SECURITY INSTITUTE INFORMATION SECURITY TRAINING CATALOG (2015) Revision 3.0 2015 TÜBİTAK BİLGEM SGE Siber Güvenlik Enstitüsü P.K. 74, Gebze,
Ovation Security Center Data Sheet
Features Scans for vulnerabilities Discovers assets Deploys security patches transparently Allows only white-listed applications to run in workstations Provides virus protection for Ovation Windows workstations
MALAYSIAN PUBLIC SECTOR OPEN SOURCE SOFTWARE (OSS) PROGRAMME. COMPARISON REPORT ON NETWORK MONITORING SYSTEMS (Nagios and Zabbix)
MALAYSIAN PUBLIC SECTOR OPEN SOURCE SOFTWARE (OSS) PROGRAMME COMPARISON REPORT ON NETWORK MONITORING SYSTEMS (Nagios and Zabbix) JANUARY 2010 Phase II -Network Monitoring System- Copyright The government
CiscoWorks Resource Manager Essentials 4.1
CiscoWorks Resource Manager Essentials 4.1 Product Overview CiscoWorks Resource Manager Essentials (RME) 4.1 is the cornerstone application of CiscoWorks LAN Management Solution (LMS). CiscoWorks RME provides
Definition of firewall
Internet Firewalls Definitions: firewall, policy, router, gateway, proxy NAT: Network Address Translation Source NAT, Destination NAT, Port forwarding NAT firewall compromise via UPnP/IGD Packet filtering
CSE331: Introduction to Networks and Security. Lecture 18 Fall 2006
CSE331: Introduction to Networks and Security Lecture 18 Fall 2006 Announcements Project 2 is due next Weds. Homework 2 has been assigned: It's due on Monday, November 6th. CSE331 Fall 2004 2 Attacker
VPNSCAN: Extending the Audit and Compliance Perimeter. Rob VandenBrink rvandenbrink@metafore.ca
VPNSCAN: Extending the Audit and Compliance Perimeter Rob VandenBrink rvandenbrink@metafore.ca Business Issue Most clients have a remote access or other governing policy that has one or more common restrictions
Next Level. Elevated to the. 22 nd Chaos Communication Congress. Alien8 - Matthias Petermann
Intrusion Detection Systems Elevated to the Next Level Alien8 - Matthias Petermann 22 nd Chaos Communication Congress Agenda Attacks and Intrusion Methods Why Intrusion Detection? IDS Technologies Basic
Network Monitoring. Sebastian Büttrich, sebastian@less.dk NSRC / IT University of Copenhagen Last edit: February 2012, ICTP Trieste
Network Monitoring Sebastian Büttrich, sebastian@less.dk NSRC / IT University of Copenhagen Last edit: February 2012, ICTP Trieste http://creativecommons.org/licenses/by-nc-sa/3.0/ Agenda What is network
About Network Data Collector
CHAPTER 2 About Network Data Collector The Network Data Collector is a telnet and SNMP-based data collector for Cisco devices which is used by customers to collect data for Net Audits. It provides a robust
SCP - Strategic Infrastructure Security
SCP - Strategic Infrastructure Security Lesson 1 - Cryptogaphy and Data Security Cryptogaphy and Data Security History of Cryptography The number lock analogy Cryptography Terminology Caesar and Character
Network Security and Firewall 1
Department/program: Networking Course Code: CPT 224 Contact Hours: 96 Subject/Course WEB Access & Network Security: Theoretical: 2 Hours/week Year Two Semester: Two Prerequisite: NET304 Practical: 4 Hours/week
Details. Some details on the core concepts:
Details Some details on the core concepts: Network documentation Diagnostic tools Monitoring tools Performance tools Active and passive tools SNMP Ticket systems Configuration and change management Documentation
Firewalls. Chien-Chung Shen cshen@cis.udel.edu
Firewalls Chien-Chung Shen cshen@cis.udel.edu The Need for Firewalls Internet connectivity is essential however it creates a threat vs. host-based security services (e.g., intrusion detection), not cost-effective
Firewalls, NAT and Intrusion Detection and Prevention Systems (IDS)
Firewalls, NAT and Intrusion Detection and Prevention Systems (IDS) Internet (In)Security Exposed Prof. Dr. Bernhard Plattner With some contributions by Stephan Neuhaus Thanks to Thomas Dübendorfer, Stefan
AfNOG 2010 Network Monitoring and Management Tutorial. Introduction to Networking Monitoring and Management
AfNOG 2010 Network Monitoring and Management Tutorial Introduction to Networking Monitoring and Management Part I: Overview Core concepts presented: What is network monitoring What is network management
Cisco Security Agent (CSA) Network Admission Control (NAC)
Cisco Security Agent (CSA) Network Admission Control (NAC) Pascal Delprat Security Consultant Cisco France Vincent Bieri Marketing Manager, Security EMEA Technology Marketing Organisation 1 Agenda CSA
The new services in nagios: network bandwidth utility, email notification and sms alert in improving the network performance
The new services in nagios: network bandwidth utility, email notification and sms alert in improving the network performance Mohammad Ali Arsyad bin Mohd Shuhaimi Hang Tuah Jaya, 76100 Durian Tunggal,
Firewalls. Pehr Söderman KTH-CSC Pehrs@kth.se
Firewalls Pehr Söderman KTH-CSC Pehrs@kth.se 1 Definition A firewall is a network device that separates two parts of a network, enforcing a policy for all traversing traffic. 2 Fundamental requirements
ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy
ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy OVERVIEW The global communication and the continuous growth of services provided through the Internet or local infrastructure require to
IBM. Vulnerability scanning and best practices
IBM Vulnerability scanning and best practices ii Vulnerability scanning and best practices Contents Vulnerability scanning strategy and best practices.............. 1 Scan types............... 2 Scan duration
Chapter 11 Cloud Application Development
Chapter 11 Cloud Application Development Contents Motivation. Connecting clients to instances through firewalls. Chapter 10 2 Motivation Some of the questions of interest to application developers: How
SECURE YOUR NETWORK WITH FIREWALL BUILDER
SECURE YOUR NETWORK WITH FIREWALL BUILDER firewall isolates a trusted, secure internal network from another network like the Internet, which is not regarded as either trusted or secure. Firewall Builder
Network Management & Monitoring Overview
Network Management & Monitoring Overview Advanced cctld Workshop September, 2008, Holland What is network management? System & Service monitoring Reachability, availability Resource measurement/monitoring
From Network Security To Content Filtering
Computer Fraud & Security, May 2007 page 1/10 From Network Security To Content Filtering Network security has evolved dramatically in the last few years not only for what concerns the tools at our disposals
How To Build A Network Security Firewall
Ethical Hacking and Countermeasures Version 6 Module LX Firewall Technologies News Source: http://www.internetnews.com/ Module Objective This module will familiarize i you with: Firewalls Hardware Firewalls
INTRUSION DETECTION SYSTEMS and Network Security
INTRUSION DETECTION SYSTEMS and Network Security Intrusion Detection System IDS A layered network security approach starts with : A well secured system which starts with: Up-to-date application and OS
Network Security. 1 Pass the course => Pass Written exam week 11 Pass Labs
Network Security Ola Lundh ola.lundh@hh.se Schedule/ time-table: landris.hh.se/ (NetwoSec) Course home-page: hh.se/english/ide/education/student/coursewebp ages/networksecurity cisco.netacad.net Packet
Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion
Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann
Installing and Configuring Nessus by Nitesh Dhanjani
Unless you've been living under a rock for the past few years, it is quite evident that software vulnerabilities are being found and announced quicker than ever before. Every time a security advisory goes
A SURVEY ON AUTOMATED SERVER MONITORING
A SURVEY ON AUTOMATED SERVER MONITORING S.Priscilla Florence Persis B.Tech IT III year SNS College of Engineering,Coimbatore. priscillapersis@gmail.com Abstract This paper covers the automatic way of server
Network Monitoring and Management Introduction to Networking Monitoring and Management
Network Monitoring and Management Introduction to Networking Monitoring and Management These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
Vulnerability Testing of Industrial Network Devices
Vulnerability Testing of Industrial Network Devices Matthew Franz (mfranz@cisco.com) Critical Infrastructure Assurance Group (CIAG) http://www.cisco.com/go/ciag 2003, Cisco Systems, Inc. All rights reserved.
Chapter 7. Firewalls http://www.redhat.com/docs/manuals/enterprise/rhel-4-manual/security-guide/ch-fw.html
Red Hat Docs > Manuals > Red Hat Enterprise Linux Manuals > Red Hat Enterprise Linux 4: Security Guide Chapter 7. Firewalls http://www.redhat.com/docs/manuals/enterprise/rhel-4-manual/security-guide/ch-fw.html
Make a folder named Lab3. We will be using Unix redirection commands to create several output files in that folder.
CMSC 355 Lab 3 : Penetration Testing Tools Due: September 31, 2010 In the previous lab, we used some basic system administration tools to figure out which programs where running on a system and which files
Monitoring Anything and Everything with Nagios. Chris Burgess chris@chrisburgess.com.au http://www.chrisburgess.com.au
Monitoring Anything and Everything with Nagios Chris Burgess chris@chrisburgess.com.au http://www.chrisburgess.com.au What We Will Cover What is Nagios? The variety of things Nagios can monitor Why monitoring
Firewalls. Ingress Filtering. Ingress Filtering. Network Security. Firewalls. Access lists Ingress filtering. Egress filtering NAT
Network Security s Access lists Ingress filtering s Egress filtering NAT 2 Drivers of Performance RequirementsTraffic Volume and Complexity of Static IP Packet Filter Corporate Network The Complexity of
Linux Firewalls (Ubuntu IPTables) II
Linux Firewalls (Ubuntu IPTables) II Here we will complete the previous firewall lab by making a bridge on the Ubuntu machine, to make the Ubuntu machine completely control the Internet connection on the
74% 96 Action Items. Compliance
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated
F5 Configuring BIG-IP Local Traffic Manager (LTM) - V11. Description
F5 Configuring BIG-IP Local Traffic Manager (LTM) - V11 Description This four-day course gives networking professionals a functional understanding of the BIG-IP LTM v11 system as it is commonly used, as
Track 2 Workshop PacNOG 7 American Samoa. Firewalling and NAT
Track 2 Workshop PacNOG 7 American Samoa Firewalling and NAT Core Concepts Host security vs Network security What is a firewall? What does it do? Where does one use it? At what level does it function?
Optimisacion del ancho de banda (Introduccion al Firewall de Linux)
Optimisacion del ancho de banda (Introduccion al Firewall de Linux) Christian Benvenuti christian.benvenuti@libero.it Managua, Nicaragua, 31/8/9-11/9/9 UNAN-Managua Before we start... Are you familiar
May 11, 2011. (Revision 10)
Blended Security Assessments Combining Active, Passive and Host Assessment Techniques May 11, 2011 (Revision 10) Renaud Deraison Director of Research Ron Gula Chief Technology Officer Copyright 2011. Tenable