IT Data Visualization
|
|
|
- Christian Stevens
- 10 years ago
- Views:
Transcription
1 IT Data Visualization Raffael Marty, GCIA, CISSP Chief Security Splunk> SUMIT, Michigan - October 08
2 Raffael Marty Chief Security Splunk> Looked at logs/it data for over 10 years - IBM Research - Conference boards / committees Presenting around the world on SecViz Passion for Visualization Applied Security Visualization Paperback: 552 pages Publisher: Addison Wesley (August, 2008) ISBN:
3 Agenda IT Data Visualization - Security Visualization Dichotomy - Research Dichotomy IT Data Management - A shifted crime landscape Perimeter Threat Visualization is a more effective way of IT data management and analysis. Insider Threat Security Visualization Community 3
4 Visualization Questions Who analyzes logs? Who uses visualization for log analysis? Who has used DAVIX? Have you heard of SecViz.org? What tools are you using for log analysis? 4
5 IT Data Visualization Applied Security Visualization, Chapter 3
6 What is Visualization? Generate a picture from IT data A picture is worth a thousand log records. Explore and Discover Inspire Answer a Pose a New Increase Communicate Support Question Question Efficiency Information Decisions 6
7 Information Visualization Process Capture Process Visualize 7
8 The 1st Dichotomy Security security data types of data networking protocols two domains perception routing protocols (the Internet) optics security impact color theory depth cue theory security policy jargon use-cases are the end-users Visualization Security & Visualization interaction theory types of graphs human computer interaction 8
9 9 The Failure - New Graphs
10 10 The Right Thing - Reuse Graphs
11 11 The Failure - The Wrong Graph
12 12 The Right Thing - Adequate Graphs
13 The Failure - The Wrong Integration Using proprietary data format Provide parsers for various data formats does not scale is probably buggy / incomplete Use wrong data access paradigm complex configuration e.g., needs an SSH connection /usr/share/man/man5/launchd.plist.5 <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" " <plist version="1.0"> <dict> <key>_name</key> <dict> <key>_iscolumn</key> <string>yes</string> <key>_isoutlinecolumn</key> <string>yes</string> <key>_order</key> <string>0</string> </dict> <key>bsd_name</key> <dict> <key>_order</key> <string>62</string> </dict> <key>detachable_drive</key> <dict> <key>_order</key> <string>59</string> </dict> <key>device_manufacturer</key> <dict> <key>_order</key> <string>41</string> </dict> <key>device_model</key> <dict> <key>_order</key> <string>42</string> </dict> <key>device_revision</key> 13
14 The Right Thing - KISS Keep It Simple Stupid Use CSV input Use files as input Offload to other tools parsers data conversions /usr/share/man/man5/launchd.plist.5 <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" " <plist version="1.0"> <dict> <key>_name</key> <dict> <key>_iscolumn</key> <string>yes</string> <key>_isoutlinecolumn</key> <string>yes</string> <key>_order</key> <string>0</string> </dict> <key>bsd_name</key> <dict> <key>_order</key> <string>62</string> </dict> <key>detachable_drive</key> <dict> <key>_order</key> <string>59</string> </dict> <key>device_manufacturer</key> <dict> <key>_order</key> <string>41</string> </dict> <key>device_model</key> <dict> <key>_order</key> <string>42</string> </dict> <key>device_revision</key> # Using node sizes: size.source=1; size.target=200 maxnodesize=0.2 14
15 15 The Failure - Unnecessary Ink
16 The Right Thing - Apply Good Visualization Practices Don't use graphics to decorate a few numbers Reduce data ink ratio Visualization principles 16
17 Industry don t understand the real impact get the 70% solution don t think big no time/money for real research can t scale work based off of a few customer s input The 2nd Dichotomy Academia Some comments are based on paper reviews from RAID 2007/08, VizSec 2007/08 don t know what s been done in industry don t understand the use-cases two worlds Industry & Academia don t understand the environments / data / domain work on simulated data construct their own problems use overly complicated, impractical solutions use graphs / visualization where it is not needed 17
18 The Way Forward Building a secviz discipline Bridging the gap Learning the other discipline More academia / industry collaboration Security Visualization SecViz 18
19 My Focus Areas Use-case oriented visualization IT data management Perimeter Threat Governance Risk Compliance (GRC) Insider Threat IT data visualization SecViz.Org DAVIX 19
20 IT Data Management
21 A Shifted Crime Landscape Crimes are moving up the stack Insider crime Large-scale spread of many small attacks Application Layer Transport Layer Are you prepared? Are you monitoring enough? Questions are not known in advance! Have the data when you need it! Network Layer Link Layer Physical Layer 21
22 What Is IT Data? Logs /var/log/messags /opt/log/* multi-line files Configurations Traps & Alerts Scripts & Code Change Events /etc/syslog.conf /etc/hosts iso. org. dod. internet. mgmt. mib-2. host. hrdevice. hrprocessortable. hrprocessorentry. hrprocessorload ps netstat File system changes Windows Registry entire files multi-line structures multi-line table format hooks into the OS The IT Search Company
23 Perimeter Threat Applied Security Visualization, Chapter 6
24 Sparklines "Data-intense, design-simple, word-sized graphics". Edward Tufte (2006). Beautiful Evidence. Graphics Press. Average } Standard Deviation Examples: - stock price over a day - access to port 80 over the last week Java Script Implementation: 24
25 Sparklines Port Source IP Destination IP 25
26 Insider Threat Applied Security Visualization, Chapter 8
27 Three Types of Insider Threats Fraud Information Leak Sabotage 27
28 Example - Insider Threat Visualization More and other data sources than for the traditional security use-cases Insiders often have legitimate access to machines and data. You need to log more than the exceptions Insider crimes are often executed on the application layer. You need transaction data and chatty application logs The questions are not known in advance! Visualization provokes questions and helps find answers Dynamic nature of fraud Problem for static algorithms Bandits quickly adapt to fixed thresholdbased detection systems Looking for any unusual patterns 28
29 User Activity Color indicates failed logins High ratio of failed logins 29
30 30
31 Security Visualization Community
32 SecViz - Security Visualization This is a place to share, discuss, challenge, and learn about security visualization.
33 V D X Data Analysis and Visualization Linux davix.secviz.org
34 Tools Capture - Network tools Argus Snort Wireshark - Logging syslog-ng - Fetching data wget ftp scp Processing - Shell tools awk, grep, sed - Graphic preprocessing Afterglow LGL - Date enrichment geoiplookup whois/gwhois Visualization - Network Traffic EtherApe InetVis tnv - Generic Afterglow Treemap Mondrian R Project * Non-concluding list of tools
35 Thank You! splunk. com
DAVIX Visualization. Workshop
V DAVIX Visualization D X Workshop V DAVIX Visualization D X Workshop Jan. Monsch at iplosion. com Raffael. Marty at secviz. org Chief Security Strategist @ Splunk> Passion for Visualization http://secviz.org
Cloud-based Log Analysis and Visualization
Cloud-based Log Analysis and Visualization DeepSec 2010, Vienna, Austria mobile-166 My syslog Raffael Marty - @zrlram Raffael (Raffy) Marty Founder @ Chief Security Strategist and Product Manager @ Splunk
DAVIX Visualization Bootcamp 25C3
DAVIX Visualization Bootcamp 25C3 Visualize Your Network! Jan P. Monsch Marius Ciepluch About Your Hosts Jan P. Monsch DAVIX Project Initiator & Lead Engineer Marius Ciepluch DAVIX User & Workshop Assistant
Aqua Connect Load Balancer User Manual (Linux)
Aqua Connect Load Balancer User Manual (Linux) Table of Contents About Aqua Connect Load Balancer... 3 System Requirements... 4 Mac OS X ACRDS Server Computer Node Setup... 5 Managing Inactive Sessions...
DAVIX Visualization Workshop
DAVIX Visualization Workshop Jan P. Monsch [email protected] About Jan P. Monsch Currently Senior Security Analyst Technical Reviewer @ Pearson Education DAVIX Project Initiator & Lead Engineer On
Network visualization
Whether you are a security analyst, system administrator or technical manager, chances are you are confronted with an overwhelming sea of security related data. Typically, we analyze this data with textual
ΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized Internet users
Insider Threat The Visual Conviction
Copyright Copyright (c) 2007 (c) 2007 by by Raffael Marty Insider Threat The Visual Conviction Raffael Marty, GCIA, CISSP Manager Solutions @ ArcSight, Inc. FIRST June 2007 Seville Copyright (c) 2007 by
Subnetting and Network Management Omer F. Rana. Networks and Data Communications 1
Subnetting and Network Management Omer F. Rana Networks and Data Communications 1 Subnetting Subnetting is an important concept in establishing TCP/IP based networks important in integrating small Local
Chapter 11 Cloud Application Development
Chapter 11 Cloud Application Development Contents Motivation. Connecting clients to instances through firewalls. Chapter 10 2 Motivation Some of the questions of interest to application developers: How
What IT Auditors Need to Know About Secure Shell. SSH Communications Security
What IT Auditors Need to Know About Secure Shell SSH Communications Security Agenda Secure Shell Basics Security Risks Compliance Requirements Methods, Tools, Resources What is Secure Shell? A cryptographic
Network Monitoring. By: Delbert Thompson Network & Network Security Supervisor Basin Electric Power Cooperative
Network Monitoring By: Delbert Thompson Network & Network Security Supervisor Basin Electric Power Cooperative Overview of network Logical network view Goals of Network Monitoring Determine overall health
CS2107 Introduction to Information and System Security (Slid. (Slide set 8)
Networks, the Internet Tool support CS2107 Introduction to Information and System Security (Slide set 8) National University of Singapore School of Computing July, 2015 CS2107 Introduction to Information
Pandora FMS 3.0 Quick User's Guide: Network Monitoring. Pandora FMS 3.0 Quick User's Guide
Pandora FMS 3.0 Quick User's Guide April 27th, 2009 1 Contents How to monitor a network computer/device?...3 Concepts...3 What's an agent?...3 What's a module?...3 Data transfer modes...3 What is an alert?...3
Hillstone T-Series Intelligent Next-Generation Firewall Whitepaper: Abnormal Behavior Analysis
Hillstone T-Series Intelligent Next-Generation Firewall Whitepaper: Abnormal Behavior Analysis Keywords: Intelligent Next-Generation Firewall (ingfw), Unknown Threat, Abnormal Parameter, Abnormal Behavior,
CS 665: Computer System Security. Network Security. Usage environment. Sources of vulnerabilities. Information Assurance Module
CS 665: Computer System Security Network Security Bojan Cukic Lane Department of Computer Science and Electrical Engineering West Virginia University 1 Usage environment Anonymity Automation, minimal human
Network & Agent Based Intrusion Detection Systems
Network & Agent Based Intrusion Detection Systems Hakan Albag TU Munich, Dep. of Computer Science Exchange Student Istanbul Tech. Uni., Dep. Of Comp. Engineering Abstract. The following document is focused
SOLUTION BRIEF. TIBCO LogLogic A Splunk Management Solution
SOLUTION BRIEF TIBCO LogLogic A Splunk Management Solution Table of Contents 3 State of Affairs 3 The Challenges 5 The Solution 6 How it Works 7 Solution Benefits TIBCO LogLogic A Splunk Management Solution
CMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
Network Forensics Network Traffic Analysis
Copyright: The development of this document is funded by Higher Education of Academy. Permission is granted to copy, distribute and /or modify this document under a license compliant with the Creative
Unit 3 Research Project. Eddie S. Jackson. Kaplan University. IT540: Management of Information Security. Kenneth L. Flick, Ph.D.
Running head: UNIT 3 RESEARCH PROJECT 1 Unit 3 Research Project Eddie S. Jackson Kaplan University IT540: Management of Information Security Kenneth L. Flick, Ph.D. 10/07/2014 UNIT 3 RESEARCH PROJECT 2
Implementation of a Department Local Area Network Management System
Implementation of a Department Local Area Network Management System I-Ping Hsieh Lai-Ming Shiue Shang-Juh Kao Department of Computer Science Department of Applied Mathematics Department of Computer Science
CSSIA CompTIA Security+ Domain. Network Security. Network Security. Network Security. Network Security. Network Security
Security+ Supported Labs - V1 Lab 1 Network Devices and Technologies - Capturing Network Using tcpdump to Capture Network with Wireshark with Network Miner 2 Secure Network Administration Principles -
Intrusion Detection System Visualization of Network Alerts
Intrusion Detection System Visualization of Network Alerts Dolores M. Zage and Wayne M. Zage Ball State University Final Report July 2010 Sponsor: U.S. Army Research Laboratory 20101115030 DEFENSE TECHNICAL
Intrusion Detection & SNORT. Fakrul Alam [email protected]
Intrusion Detection & SNORT Fakrul Alam [email protected] Sometimes, Defenses Fail Our defenses aren t perfect Patches weren t applied promptly enough Antivirus signatures not up to date 0- days get through
Presented by: Aaron Bossert, Cray Inc. Network Security Analytics, HPC Platforms, Hadoop, and Graphs Oh, My
Presented by: Aaron Bossert, Cray Inc. Network Security Analytics, HPC Platforms, Hadoop, and Graphs Oh, My The Proverbial Needle In A Haystack Problem The Nuclear Option Problem Statement and Proposed
D. Grzetich 6/26/2013. The Problem We Face Today
Ideas on Using Asset Criticality Inference (ACI) Through Gathering and Processing of Asset Contextual Utilizing Analytical Models and Processing Rules D. Grzetich 6/26/2013 The Problem We Face Today Security
A Survey on Cloud Security Issues and Techniques
A Survey on Cloud Security Issues and Techniques Garima Gupta 1, P.R.Laxmi 2 and Shubhanjali Sharma 3 1 Department of Computer Engineering, Government Engineering College, Ajmer [email protected]
Reverse Shells Enable Attackers To Operate From Your Network. Richard Hammer August 2006
Reverse Shells Enable Attackers To Operate From Your Network Richard Hammer August 2006 Reverse Shells? Why should you care about reverse shells? How do reverse shells work? How do reverse shells get installed
Security Correlation Server Quick Installation Guide
orrelogtm Security Correlation Server Quick Installation Guide This guide provides brief information on how to install the CorreLog Server system on a Microsoft Windows platform. This information can also
Savvius Insight Initial Configuration
The configuration utility on Savvius Insight lets you configure device, network, and time settings. Additionally, if you are forwarding your data from Savvius Insight to a Splunk server, You can configure
Glossary of Technical Terms Related to IPv6
AAAA Record An AAAA record stores a 128-bit Internet Protocol version 6 (IPv6) address, which does not fit the standard A record format. For example, 2007:0db6:85a3:0000:0000:6a2e:0371:7234 is a valid
Avaya TM G700 Media Gateway Security. White Paper
Avaya TM G700 Media Gateway Security White Paper March 2002 G700 Media Gateway Security Summary With the Avaya G700 Media Gateway controlled by the Avaya S8300 or S8700 Media Servers, many of the traditional
Avaya G700 Media Gateway Security - Issue 1.0
Avaya G700 Media Gateway Security - Issue 1.0 Avaya G700 Media Gateway Security With the Avaya G700 Media Gateway controlled by the Avaya S8300 or S8700 Media Servers, many of the traditional Enterprise
IBM Tivoli Monitoring for Network Performance
Optimize networks to increase application performance and availability IBM Tivoli Monitoring for Network Performance Highlights Performance management for today s networks Today s networks are a combination
Detecting rogue systems
Product Guide Revision A McAfee Rogue System Detection 4.7.1 For use with epolicy Orchestrator 4.6.3-5.0.0 Software Detecting rogue systems Unprotected systems, referred to as rogue systems, are often
Certificates and Application Resigning
Certificates and Application Resigning Introduction In the following chapters we will be reviewing how to resign an application along with how to get the needed resources for the process. To successfully
Make a folder named Lab3. We will be using Unix redirection commands to create several output files in that folder.
CMSC 355 Lab 3 : Penetration Testing Tools Due: September 31, 2010 In the previous lab, we used some basic system administration tools to figure out which programs where running on a system and which files
Directory and File Transfer Services. Chapter 7
Directory and File Transfer Services Chapter 7 Learning Objectives Explain benefits offered by centralized enterprise directory services such as LDAP over traditional authentication systems Identify major
RSA Authentication Manager
McAfee Enterprise Security Manager Data Source Configuration Guide Data Source: RSA Authentication Manager February 26, 2015 RSA Authentication Manager Page 1 of 9 Important Note: The information contained
Log Analysis: Overall Issues p. 1 Introduction p. 2 IT Budgets and Results: Leveraging OSS Solutions at Little Cost p. 2 Reporting Security
Foreword p. xvii Log Analysis: Overall Issues p. 1 Introduction p. 2 IT Budgets and Results: Leveraging OSS Solutions at Little Cost p. 2 Reporting Security Information to Management p. 5 Example of an
Study of Network Security along with Network Security Tools and Network Simulators
Study of Network Security along with Network Security Tools and Network Simulators Amanpreet Kaur, Monika Saluja CSE Department. SBSCET,Fzr (Pb,India) Abstract -With the increase of hacking, different
Backup & Disaster Recovery Appliance User Guide
Built on the Intel Hybrid Cloud Platform Backup & Disaster Recovery Appliance User Guide Order Number: G68664-001 Rev 1.0 June 22, 2012 Contents Registering the BDR Appliance... 4 Step 1: Register the
Report of Independent Auditors
Ernst & Young LLP Suite 3300 370 17th Street Denver, Colorado 80202-5663 Tel: +1 720 931 4000 Fax: +1 720 931 4444 www.ey.com Report of Independent Auditors To the Management of NTT America, Inc.: We have
A SURVEY OF CLOUD COMPUTING: NETWORK BASED ISSUES PERFORMANCE AND ANALYSIS
A SURVEY OF CLOUD COMPUTING: NETWORK BASED ISSUES PERFORMANCE AND ANALYSIS *Dr Umesh Sehgal, #Shalini Guleria *Associate Professor,ARNI School of Computer Science,Arni University,[email protected]
Network Management. Jaakko Kotimäki. Department of Computer Science Aalto University, School of Science. 21. maaliskuuta 2016
Jaakko Kotimäki Department of Computer Science Aalto University, School of Science Outline Introduction SNMP architecture Management Information Base SNMP protocol Network management in practice Niksula
How To Use Mindarray For Business
Minder Network Performance Monitoring Monitor everything about your Network performance Discover, visualize and monitor your complete IT Infrastructure in less than an hour. Mindarray s Minder is a powerful
Internet infrastructure. Prof. dr. ir. André Mariën
Internet infrastructure Prof. dr. ir. André Mariën (c) A. Mariën 31/01/2006 Topic Firewalls (c) A. Mariën 31/01/2006 Firewalls Only a short introduction See for instance: Building Internet Firewalls, second
A Model Design of Network Security for Private and Public Data Transmission
2011, TextRoad Publication ISSN 2090-424X Journal of Basic and Applied Scientific Research www.textroad.com A Model Design of Network Security for Private and Public Data Transmission Farhan Pervez, Ali
CS197U: A Hands on Introduction to Unix
CS197U: A Hands on Introduction to Unix Lecture 10: Security Issues and Traffic Monitoring Tian Guo University of Massachusetts Amherst CICS 1 Reminders Assignment 5 is due Thursday (Oct. 22) Part 1 (tracking
Second-generation (GenII) honeypots
Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. [email protected] Abstract Honeypots are security resources which trap malicious activities, so they
Using VDOMs to host two FortiOS instances on a single FortiGate unit
Using VDOMs to host two FortiOS instances on a single FortiGate unit Virtual Domains (VDOMs) can be used to divide a single FortiGate unit into two or more virtual instances of FortiOS that function as
Kevin Hayes, CISSP, CISM MULTIPLY SECURITY EFFECTIVENESS WITH SIEM
Kevin Hayes, CISSP, CISM MULTIPLY SECURITY EFFECTIVENESS WITH SIEM TODAY S AGENDA Describe the need for SIEM Explore different options available for SIEM Demonstrate a few Use Cases Cover some caveats
Safe network analysis
Safe network analysis Generating network traffic captures within a virtual network. Presented by Andrew Martin 1 Introduction What is a sniffer How does sniffing work Usages Scenarios Building safe repositories
W H I T E P A P E R. Best Practices for Building Virtual Appliances
W H I T E P A P E R Best Practices for Building Virtual Appliances Table of Contents Objectives.................................................................................. 3 Design Principles...........................................................................
Using Monitoring, Logging, and Alerting to Improve ICS Security ICSJWG 2015 Fall Meeting October 27, 2015
www.encari.com Using Monitoring, Logging, and Alerting to Improve ICS Security ICSJWG 2015 Fall Meeting October 27, 2015 www.encari.com 2 The Problem Cyber attacks are not just a risk, they are a reality.
The Internet, Intranets, and Extranets. What is the Internet. What is the Internet cont d.
C H A P T E R 7 The Internet, Intranets, and Extranets What is the Internet Millions of computers, all linked together on a computer network. A home computer usually links to the Internet using a phone
Maintaining Non-Stop Services with Multi Layer Monitoring
Maintaining Non-Stop Services with Multi Layer Monitoring Lahav Savir System Architect and CEO of Emind Systems [email protected] www.emindsys.com The approach Non-stop applications can t leave on their
Protecting and controlling Virtual LANs by Linux router-firewall
Protecting and controlling Virtual LANs by Linux router-firewall Tihomir Katić Mile Šikić Krešimir Šikić Faculty of Electrical Engineering and Computing University of Zagreb Unska 3, HR 10000 Zagreb, Croatia
MANAGING NETWORK COMPONENTS USING SNMP
MANAGING NETWORK COMPONENTS USING SNMP Abubucker Samsudeen Shaffi 1 Mohanned Al-Obaidy 2 Gulf College 1, 2 Sultanate of Oman. Email: [email protected] [email protected] Abstract:
Edge Configuration Series Reporting Overview
Reporting Edge Configuration Series Reporting Overview The Reporting portion of the Edge appliance provides a number of enhanced network monitoring and reporting capabilities. WAN Reporting Provides detailed
Question Name C 1.1 Do all users and administrators have a unique ID and password? Yes
Category Question Name Question Text C 1.1 Do all users and administrators have a unique ID and password? C 1.1.1 Passwords are required to have ( # of ) characters: 5 or less 6-7 8-9 Answer 10 or more
INTERNET SECURITY: THE ROLE OF FIREWALL SYSTEM
INTERNET SECURITY: THE ROLE OF FIREWALL SYSTEM Okumoku-Evroro Oniovosa Lecturer, Department of Computer Science Delta State University, Abraka, Nigeria Email: [email protected] ABSTRACT Internet security
CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security
CTS2134 Introduction to Networking Module 8.4 8.7 Network Security Switch Security: VLANs A virtual LAN (VLAN) is a logical grouping of computers based on a switch port. VLAN membership is configured by
Nixu SNS Security White Paper May 2007 Version 1.2
1 Nixu SNS Security White Paper May 2007 Version 1.2 Nixu Software Limited Nixu Group 2 Contents 1 Security Design Principles... 3 1.1 Defense in Depth... 4 1.2 Principle of Least Privilege... 4 1.3 Principle
Network Management and Monitoring Software
Page 1 of 7 Network Management and Monitoring Software Many products on the market today provide analytical information to those who are responsible for the management of networked systems or what the
CDS and Clearing Limited Thapathali, Kathmandu 7 th Level (Technical) Syllabus
CDS and Clearing Limited Thapathali, Kathmandu 7 th Level (Technical) Syllabus Modality of Examination: The examination comprises of two papers, each carrying 100 marks. The first paper is General Overview
Bridging the gap between COTS tool alerting and raw data analysis
Article Bridging the gap between COTS tool alerting and raw data analysis An article on how the use of metadata in cybersecurity solutions raises the situational awareness of network activity, leading
IndusGuard Web Application Firewall Test Drive User Registration
IndusGuard Web Application Firewall Test Drive User Registration Document Version 1.0 24/06/2015 Confidentiality INDUSFACE HAS PREPARED THIS DOCUMENT FOR INTERNAL PURPOSE. NEITHER THIS DOCUMENT NOR ITS
Lab Objectives & Turn In
Firewall Lab This lab will apply several theories discussed throughout the networking series. The routing, installing/configuring DHCP, and setting up the services is already done. All that is left for
SOLUTION BRIEF. An ArcSight Management Solution
SOLUTION BRIEF TIBCO LogLogic An Management Solution Table of Contents 3 State of Affairs 3 The Challenges 5 The Solution 6 How it Works 7 Solution Benefits TIBCO LogLogic An Management Solution State
Firewalls. Basic Firewall Concept. Why firewalls? Firewall goals. Two Separable Topics. Firewall Design & Architecture Issues
CS 155 May 20, 2004 Firewalls Basic Firewall Concept Separate local area net from internet Firewall John Mitchell Credit: some text, illustrations from Simon Cooper Router All packets between LAN and internet
Security visualisation
Security visualisation This thesis provides a guideline of how to generate a visual representation of a given dataset and use visualisation in the evaluation of known security vulnerabilities by Marco
Security Correlation Server Quick Installation Guide
orrelog Security Correlation Server Quick Installation Guide This guide provides brief information on how to install the CorreLog Server system on a Microsoft Windows platform. This information can also
ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy
ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy OVERVIEW The global communication and the continuous growth of services provided through the Internet or local infrastructure require to
When Recognition Matters THE COMPARISON OF PROGRAMS FOR NETWORK MONITORING. www.pecb.com
When Recognition Matters THE COMPARISON OF PROGRAMS FOR NETWORK MONITORING www.pecb.com Imagine a working environment comprised of a number of switches, routers, some terminals and file servers. Network
Department of Veterans Affairs VistA Integration Adapter Release 1.0.5.0 Enhancement Manual
Department of Veterans Affairs VistA Integration Adapter Release 1.0.5.0 Enhancement Manual Version 1.1 September 2014 Revision History Date Version Description Author 09/28/2014 1.0 Updates associated
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
0DQDJLQJ#0XOWLVHUYLFH#1HWZRUNV
Best Connections in the Business ProSphere NMS 0DQDJLQJ#0XOWLVHUYLFH#1HWZRUNV Figure 1: Xedge Switches managed by ProSphere NMS 7KH#0XOWLVHUYLFH#&KDOOHQJH Managing diverse protocols, applications and topologies
CONNECTING TO DEPARTMENT OF COMPUTER SCIENCE SERVERS BOTH FROM ON AND OFF CAMPUS USING TUNNELING, PuTTY, AND VNC Client Utilities
CONNECTING TO DEPARTMENT OF COMPUTER SCIENCE SERVERS BOTH FROM ON AND OFF CAMPUS USING TUNNELING, PuTTY, AND VNC Client Utilities DNS name: turing.cs.montclair.edu -This server is the Departmental Server
CERT/CSIRT Operation Operation. ADLI WAHID [email protected]
CERT/CSIRT Operation Operation ADLI WAHID [email protected] What This Course Is About Welcome as we gather together to improve the future of security and share our ideas, projects, and successes! During the
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
Volume SYSLOG JUNCTION. User s Guide. User s Guide
Volume 1 SYSLOG JUNCTION User s Guide User s Guide SYSLOG JUNCTION USER S GUIDE Introduction I n simple terms, Syslog junction is a log viewer with graphing capabilities. It can receive syslog messages
Network Monitoring and Forensics
Available Online at www.ijcsmc.com International Journal of Computer Science and Mobile Computing A Monthly Journal of Computer Science and Information Technology ISSN 2320 088X IJCSMC, Vol. 2, Issue.
Detection of illegal gateways in protected networks
Detection of illegal gateways in protected networks Risto Vaarandi and Kārlis Podiņš Cooperative Cyber Defence Centre of Excellence Tallinn, Estonia [email protected] 1. Introduction In this
Approach to Information Security Architecture. Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera
Approach to Information Security Architecture Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera About TeliaSonera TeliaSonera provides network access and telecommunication services that help
The syslog-ng Store Box 3 F2
The syslog-ng Store Box 3 F2 PRODUCT DESCRIPTION Copyright 2000-2014 BalaBit IT Security All rights reserved. www.balabit.com Introduction The syslog-ng Store Box (SSB) is a high-reliability and high-performance
Centralized Logging in a Decentralized World
Centralized Logging in a Decentralized World JAMES DONN AND TIM HARTMANN James Donn has been working as a Senior Network Management Systems Engineer (NMSE) for the past four years and is responsible for
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
Data Center Virtualization and Cloud QA Expertise
Data Center Virtualization and Cloud QA Expertise Highlights Broad Functional QA Experience Deep understanding of Switching and Routing Protocols Strong hands on experience in multiple hyper-visors like
finger, ftp, host, hostname, mesg, rcp, rlogin, rsh, scp, sftp, slogin, ssh, talk, telnet, users, w, walla, who, write,...
Read Chapter 9 Linux network utilities finger, ftp, host, hostname, mesg, rcp, rlogin, rsh, scp, sftp, slogin, ssh, talk, telnet, users, w, walla, who, write,... 1 Important to know common network terminology
A43. Modern Hacking Techniques and IP Security. By Shawn Mullen. Las Vegas, NV IBM TRAINING. IBM Corporation 2006
IBM TRAINING A43 Modern Hacking Techniques and IP Security By Shawn Mullen Las Vegas, NV 2005 CSI/FBI US Computer Crime and Computer Security Survey 9 out of 10 experienced computer security incident in
Last Updated: July 2011. STATISTICA Enterprise Server Security
Last Updated: July 2011 STATISTICA Enterprise Server Security STATISTICA Enterprise Server Security Page 2 of 10 Table of Contents Executive Summary... 3 Introduction to STATISTICA Enterprise Server...
1 Attack Top Attackers Report, Top Targets Report, Top Protocol Used by Attack Report, Top Attacks Report, Top Internal Attackers Report, Top External Attackers Report, Top Internal Targets Report, Top
Windows PowerShell Cookbook
Windows PowerShell Cookbook Lee Holmes O'REILLY' Beijing Cambridge Farnham Koln Paris Sebastopol Taipei Tokyo Table of Contents Foreword Preface xvii xxi Part I. Tour A Guided Tour of Windows PowerShell
Suricata IDS. What is it and how to enable it
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
Linux VPS with cpanel. Getting Started Guide
Linux VPS with cpanel Getting Started Guide First Edition October 2010 Table of Contents Introduction...1 cpanel Documentation...1 Accessing your Server...2 cpanel Users...2 WHM Interface...3 cpanel Interface...3