Mining Proxy Logs: Finding Needles In Haystacks
|
|
|
- Edwin Armstrong
- 8 years ago
- Views:
Transcription
1 Mining Proxy Logs: Finding Needles In Haystacks Matthew Myrick P. O. Box 808, Livermore, CA This work performed under the auspices of the U.S. Department of Energy by under Contract DE-AC52-07NA27344
2 Disclaimer Our security infrastructure is a work in progress This presentation is for educational purposes This discussion pertains to our Unclassified environment ONLY Hopefully we can make things better by learning from each other If you see problems please say something 2
3 Have Fun! 3
4 Overview Introduction Problems Landscape Solutions Future Conclusion 4
5 Introduction About LLNL/My Team/Me LLNL Livermore, CA (1 sq mile and 13 sq miles) ~7000 Employees (including contractors) ~20,000 computers My Team Me ~10,000 Access Internet Network Security Team (NST) - 8 people Incident Management Team (IMT) - 4 people IDS, IPS, Proxys, Firewalls, IR, Log Aggregation/Correlation, Pen Testing, Malware Analysis, Forensics, etc. B.S./M.S. in Computer Science from CSU, Chico Over 13 years w/ LLNL ~6 years full time Currently hold a CISSP, BCCPA, GCIH, GPEN 5
6 Problems What Are We Trying To Solve? How do we find bad guys on our networks??? There are a lot of users There are a lot of computers There is a lot of data There is no consistency and centralized governance is lacking What do the bad guys look like??? I ve never spoken to a bad guy I ve never met a bad guy in person Bad guys means something different to different people Most of us now have a web proxy now what??? It never works perfectly Somebody is always blaming me for breaking their app 6
7 Landscape - LLNL Proxy Deployment Blue Coat Proxy SG s Transparent forwarding deployment using WCCP We proxy ALL egress traffic (4 ports) Excluding mail, dns and things explicitly exempted Protocols or enforced on their respective ports Content filtering (BCWF) A/V scanning (McAfee) Internet authentication (ldaps) By and large most data flows through our proxy! 7
8 Landscape - Log Format Details Blue Coat uses a format called ELFF (WC3 Extended) Extend Log File Format ( date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filterresult cs-categories cs(referer) sc-status s-action cs-method rs(content-type) csuri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(user- Agent) s-ip sc-bytes cs-bytes x-virus-id 8
9 Landscape - Log Format Details prefix (header) Describes a header data field. The valid prefixes are: c = Client s = Server r = Remote cs = Client to Server sc = Server to Client upport/self-service/6/elff_format_descriptions.html 9
10 Landscape - Log Format Details continued LLNL format date time time-taken c-ip sc-status s-action scbytes cs-bytes cs-method cs-uri-scheme cshost cs-ip cs-uri-port cs-uri-path cs-uri-query cs(referer) cs-username cs-auth-group s- hierarchy s-supplier-name rs(content-type) cs(user-agent) sc-filter-result cs-category x- virus-id s-ip s-sitename Customize your log format to best suite your needs 10
11 Landscape - Log Format Example :00: XX XX 200 TCP_NC_MISS GET http 116vistadrive.greatluxuryestate.com /mlsmax/layout05/images/menu_div.gif - e.htm?mls=&vkey=&vid= linney1 - DIRECT 116vistadrive.greatluxuryestate.com image/gif "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv: ) Gecko/ Firefox/3.6.3" OBSERVED "Real Estate" 1XX XX SG-HTTP-Service 11
12 Solutions How can we solve our problems? Most of us now have a web proxy now what??? Centralize your logs Modify your log format to suite your needs What do the bad guys look like??? Different types of bad guys, overlap, difficult to tell apart Users Criminals / Entrepreneurs APT (Advanced Persistent Threat) How do we find bad guys on our networks??? Depends on which bad guys we re looking for Digest Analyze Scrutinize 12
13 Solutions Overview Parse your logs with whatever makes you happy My Proof of Concept codes are in Perl Need a code reference I ll share You can use grep, awk, sed, cut, PHP, C, etc. Practical tips Pay attention to http redirects 301, 302, 3XX Pay attention to referrer Could contain search terms Multi staged attacks are commonplace Looking at logs after 5pm can be detrimental! -Monzy 13
14 Solutions Overview Continued Getting comfortable with the data Machine learning algorithms are not mandatory get Our solutions will focus on the following Simple statistics summarization, mean, std. dev, etc. User agents Content Types Compound Searches Consult the oracle a.k.a. google 14
15 Solution - Summarization :00: XX XX 200 TCP_NC_MISS GET http 116vistadrive.greatluxuryestate.com /mlsmax/layout05/images/menu_div.gif - e.htm?mls=&vkey=&vid= linney1 - DIRECT 116vistadrive.greatluxuryestate.com image/gif "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv: ) Gecko/ Firefox/3.6.3" OBSERVED "Real Estate" 1XX XX SG-HTTP-Service 15
16 Solution - Summarize logs Daily summary Total HTTP users, Total FTP users, Top Sources, Top Destinations, Top Categories, Top Denied Sources, Top Spyware/Malware Sources, Top Spyware Effects, Top User Agents, Top IP getting images, Top IP performing POST s Top 15 Spyware/Malware Sources: 1xx xx : 48 1xx xxx : 47 1xx xx : 14 1xx xx : 12 1xx.9.93.xx : 8 1xx xxx : 5 1xx xxx : 5 1xx xx : 2 1xx xx : 2 1xx xxx : 2 1xx xx : 1 PoC bcsummary.pl Daily summary of most of the above 16
17 Solution - Summarize all requests by TLD Top Level Domain (TLD) I need to jump through hoops to travel physically Virtually users are all over the map! Summary of daily TLD's: com : net : org : gov : edu : uk : us : de : it : tv : fr : ca : ru : 7621 PoC tldsummary.pl summary by Top Level Domain Maybe you should block entire TLD s? 17
18 Solution User Agents :00: XX XX 200 TCP_NC_MISS GET http 116vistadrive.greatluxuryestate.com /mlsmax/layout05/images/menu_div.gif - &vkey=&vid= linney1 - DIRECT 116vistadrive.greatluxuryestate.com image/gif "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv: ) Gecko/ Firefox/3.6.3" OBSERVED "Real Estate" 1XX XX SG-HTTP-Service Most things identify themselves Or at least try to mimic common agents Even malware or unwanted software 18
19 Solution - User Agents Recent interesting user agents Possible trojan QI.exe TwcToolbarIe7 weather2004 Possible piracy/mpaa issues AnyDVD (DVD cloning software) Possible PII issues TurboTax2009.r VFNetwork/ Darwin/9.8.0 (i386) (MacBook5%2C1) Possible Data Loss Prevention dotmacsyncclient259 CFNetwork/ Darwin/9.8.0 (i386) (MacBook3%2C1) Possible malware or IT issue Immunet Updater MSDW //Thank you Monzy,Danny Quist, Kevin Hall Microsoft Dr. Watson (sqm.microsoft.com, sqm.msn.com, watson.microsoft.com) 19
20 Solution - User Agents Continued Possible Waste Fraud and Abuse (WFA) BattlefieldBadCompany2Updater Solitaire III Build 33 AppleTV/1.1 Possible attack victims honeyd/1.5b Winamp/5.551 //Integer overflow exploit Integer overflow ( WordPress/2.7; Possibly anything ie8ish blah Handy lookup tool (user-agents.org) PoC uasummary.pl Summarizes user agents and list in descending order by number of occurrences 20
21 Solution Content Types :00: XX XX 200 TCP_NC_MISS GET http 116vistadrive.greatluxuryestate.com /mlsmax/layout05/images/menu_div.gif - e.htm?mls=&vkey=&vid= linney1 - DIRECT 116vistadrive.greatluxuryestate.com image/gif "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv: ) Gecko/ Firefox/3.6.3" OBSERVED "Real Estate" 1XX XX SG-HTTP-Service 21
22 Solution - Content-Type (a.k.a. MIME) HTTP Protocol (originally designed for SMTP) Used to identify the type of information that a file contains. Specified by web server using Content-type: header Common examples text/html.html Web Page image/png.png PNG-format image image/jpeg.jpeg JPEG-format image audio/mpeg.mp3 MPEG Audio File application.exe Executable content 22
23 Content-Type continued Focus on executable content "application/octet-stream Beware of.ico (i.e. favicon.ico) "application/x-msdownload application/x-msdos-program Or Ends in.exe.msi.pif.scr etc. 23
24 Content-Type continued PoC executables.pl Look for everything that ends in.exe Exempt items from trusted domains Less than 100 domains for my enterprise Interesting examples download.uniblue.com/aff/rb/fdm/registrybooster.exe koti.mbnet.fi/vaultec/files/miscellaneous/mingwstudiosetup- 2.05r2.exe The possibilities are endless 24
25 Solution Compound Searches Mix and match all of the tools previous tools This where scripting languages come in handy! Pay close attention to some TLDs, specifically.ca! If the destination ends in.ca If the mime type is "application/octet-stream" Print the log line Check out executables coming from category of none If content type is "application/octet-stream or "application/xmsdownload If category is none If the file doesn t end in.ico» Print the log line 25
26 Solution Compound Searches Examine requests to IP s categorized as none If the destination host is the same as the destination IP If the category is none If this isn t FTP Print the log line PoC quickie.pl (does this + more) Simple canned compound queries of interest Useful for looking for things quickly Great for APT indicators 26
27 Solution - Google Safe Browsing API API that enables client applications to check URLs against Google's constantly updated blacklists of suspected phishing and malware pages. Isolates machine from Internet ~300,227 domains ( ) Built into Firefox FREE Reactive Checks nightly PoC safebrows-canonical.pl Monzy Merza & Adam Sealey 27
28 Future Continue automation/scripting Proxy Log IDS (P.L.I.D.S.) Share indicators/ideas that work! Other Antivirus Scanners Experimenting with Avira/Kaspersky Add to current ICAP group Other Content filters Procuring McAfee Smartfilter Do More with HTTPS Deny (Category=NONE && Untrusted issuer) Intercept everything Archive HTTPS files 28
29 Conclusion Further Reading Dr Anton Chuvakin (chuvakin.blogspot.com) Joe Griffin ( malware_theres_gold_in_them_thar_proxy_logs_32959) Any Questions??? My Contact Information (Entrust/PGP) Office: Thank you for your time 29
Exploitation of Server Log Files of User Behavior in Order to Inform Administrator
Exploitation of Server Log Files of User Behavior in Order to Inform Administrator Hamed Jelodar Computer Department, Islamic Azad University, Science and Research Branch, Bushehr, Iran ABSTRACT All requests
LogLogic Blue Coat ProxySG Log Configuration Guide
LogLogic Blue Coat ProxySG Log Configuration Guide Document Release: September 2011 Part Number: LL600012-00ELS100001 This manual supports LogLogic Blue Coat ProxySG Release 1.0 and later, and LogLogic
Microsoft Internet Information Services (IIS)
McAfee Enterprise Security Manager Data Source Configuration Guide Data Source: Microsoft Internet Information Services (IIS) September 30, 2014 Microsoft IIS Page 1 of 11 Important Note: The information
Pre-Processing: Procedure on Web Log File for Web Usage Mining
Pre-Processing: Procedure on Web Log File for Web Usage Mining Shaily Langhnoja 1, Mehul Barot 2, Darshak Mehta 3 1 Student M.E.(C.E.), L.D.R.P. ITR, Gandhinagar, India 2 Asst.Professor, C.E. Dept., L.D.R.P.
Survey on web log data in teams of Web Usage Mining
Survey on web log data in teams of Web Usage Mining *Mrudang D. Pandya, **Prof. Kiran R Amin *(U.V.PATEL COLLAGE OF ENGINEERING,GANPAT UNIVERSITY, Ganpat Vidyanagar,Mehsana-Gozaria HighwayMehsana - 384012,
Networks and the Internet A Primer for Prosecutors and Investigators
Computer Crime & Intellectual Property Section Networks and the Internet A Primer for Prosecutors and Investigators Michael J. Stawasz Senior Counsel Computer Crime and Intellectual Property Section ()
STABLE & SECURE BANK lab writeup. Page 1 of 21
STABLE & SECURE BANK lab writeup 1 of 21 Penetrating an imaginary bank through real present-date security vulnerabilities PENTESTIT, a Russian Information Security company has launched its new, eighth
Symantec Event Collector 3.6 for Blue Coat Proxy Quick Reference
Symantec Event Collector 3.6 for Blue Coat Proxy Quick Reference Symantec Event Collector for Blue Coat Proxy Quick Reference The software described in this book is furnished under a license agreement
Networking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
Proxies. Chapter 4. Network & Security Gildas Avoine
Proxies Chapter 4 Network & Security Gildas Avoine SUMMARY OF CHAPTER 4 Generalities Forward Proxies Reverse Proxies Open Proxies Conclusion GENERALITIES Generalities Forward Proxies Reverse Proxies Open
Analyzing the Different Attributes of Web Log Files To Have An Effective Web Mining
Analyzing the Different Attributes of Web Log Files To Have An Effective Web Mining Jaswinder Kaur #1, Dr. Kanwal Garg #2 #1 Ph.D. Scholar, Department of Computer Science & Applications Kurukshetra University,
LogLogic Blue Coat ProxySG Syslog Log Configuration Guide
LogLogic Blue Coat ProxySG Syslog Log Configuration Guide Document Release: September 2011 Part Number: LL600070-00ELS100000 This manual supports LogLogic Blue Coat ProxySG Release 1.0 and later, and LogLogic
Malware Prevention with Blue Coat Proxies
Malware Prevention with Blue Coat Proxies Malware is software designed to infiltrate or damage a computer system without the owner's informed consent. It is a portmanteau of the words "malicious" and "software".
Blue Coat Security First Steps Solution for Deploying an Explicit Proxy
Blue Coat Security First Steps Solution for Deploying an Explicit Proxy SGOS 6.5 Third Party Copyright Notices 2014 Blue Coat Systems, Inc. All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER, CACHEFLOW,
Research on Application of Web Log Analysis Method in Agriculture Website Improvement
Research on Application of Web Log Analysis Method in Agriculture Website Improvement Jian Wang 1 ( 1 Agricultural information institute of CAAS, Beijing 100081, China) wangjian@caas.net.cn Abstract :
Copyright 2006-2011 Winfrasoft Corporation. All rights reserved.
Installation and Configuration Guide Installation and configuration guide Adding X-Forwarded-For logging support to Microsoft Internet Information Server 6.0 & 7.0 Published: January 2013 Applies to: Winfrasoft
APPLICATION PROGRAMMING INTERFACE
DATA SHEET Advanced Threat Protection INTRODUCTION Customers can use Seculert s Application Programming Interface (API) to integrate their existing security devices and applications with Seculert. With
DEPLOYMENT GUIDE Version 1.1. Deploying the BIG-IP LTM v10 with Citrix Presentation Server 4.5
DEPLOYMENT GUIDE Version 1.1 Deploying the BIG-IP LTM v10 with Citrix Presentation Server 4.5 Table of Contents Table of Contents Deploying the BIG-IP system v10 with Citrix Presentation Server Prerequisites
Controlling Risk, Conserving Bandwidth, and Monitoring Productivity with Websense Web Security and Websense Content Gateway
Controlling Risk, Conserving Bandwidth, and Monitoring Productivity with Websense Web Security and Websense Content Gateway Websense Support Webinar January 2010 web security data security email security
The web server administrator needs to set certain properties to insure that logging is activated.
Access Logs As before, we are going to use the Microsoft Virtual Labs for this exercise. Go to http://technet.microsoft.com/en-us/bb467605.aspx, then under Server Technologies click on Internet Information
Sophos UTM Web Application Firewall for Microsoft Exchange connectivity
How to configure Sophos UTM Web Application Firewall for Microsoft Exchange connectivity This article explains how to configure your Sophos UTM 9.2 to allow access to the relevant Microsoft Exchange services
Common Event Format Configuration Guide
Common Event Format Configuration Guide F5 Networks BIG-IP Application Security Manager (ASM) Date: Friday, May 27, 2011 CEF Connector Configuration Guide This document is provided for informational purposes
Centralized Cloud Firewall. Ivan Ivanovic BUCC/AMRES Tbilisi, December 2013.
Centralized Cloud Firewall Ivan Ivanovic BUCC/AMRES Tbilisi, December 2013. AMRES NREN 172 institutions ~2200 km dark fiber links 22 cities 3 cross border optical links Redundant Geant internet links 1
HTTP. Internet Engineering. Fall 2015. Bahador Bakhshi CE & IT Department, Amirkabir University of Technology
HTTP Internet Engineering Fall 2015 Bahador Bakhshi CE & IT Department, Amirkabir University of Technology Questions Q1) How do web server and client browser talk to each other? Q1.1) What is the common
Whose IP Is It Anyways: Tales of IP Reputation Failures
Whose IP Is It Anyways: Tales of IP Reputation Failures SESSION ID: SPO-T07 Michael Hamelin Lead X-Force Security Architect IBM Security Systems @HackerJoe What is reputation? 2 House banners tell a story
Barracuda Web Filter Demo Guide Version 3.3 GETTING STARTED
Version 3.3 GETTING STARTED What is the Web Filter? Integrated content filtering and application blocking Best-of-breed spyware protection Integrated gateway antivirus Desktop spyware protection Firmware
Web Application Security. Radovan Gibala Senior Field Systems Engineer F5 Networks r.gibala@f5.com
Web Application Security Radovan Gibala Senior Field Systems Engineer F5 Networks r.gibala@f5.com Security s Gaping Hole 64% of the 10 million security incidents tracked targeted port 80. Information Week
UNMASKCONTENT: THE CASE STUDY
DIGITONTO LLC. UNMASKCONTENT: THE CASE STUDY The mystery UnmaskContent.com v1.0 Contents I. CASE 1: Malware Alert... 2 a. Scenario... 2 b. Data Collection... 2 c. Data Aggregation... 3 d. Data Enumeration...
Understanding Syslog Messages for the Barracuda Web Filter
Understanding Syslog Messages for the Barracuda Web Filter Overview This document describes each element of a syslog message so you can better analyze why your Barracuda Web Filter performs a particular
The PA-4000 Series can add visibility and control into your network for webmail applications to stop incoming threats and limit uploaded data.
Controlling Webmail Tech Note Overview Webmail interfaces are widespread and available from search providers (Yahoo, Google), software vendors (Microsoft s Hotmail), social networking sites (Myspace, Facebook),
Cyan Networks Secure Web vs. Websense Security Gateway Battle card
URL Filtering CYAN Secure Web Database - over 30 million web sites organized into 31 categories updated daily, periodically refreshing the data and removing expired domains Updates of the URL database
CSE331: Introduction to Networks and Security. Lecture 12 Fall 2006
CSE331: Introduction to Networks and Security Lecture 12 Fall 2006 Announcements Midterm I will be held Friday, Oct. 6th. True/False Multiple Choice Calculation Short answer Short essay Project 2 is on
Executive Summary. What is Authentication, Authorization, and Accounting? Why should I perform Authentication, Authorization, and Accounting?
Executive Summary As the leader in Wide Area Application Delivery, Blue Coat products accelerate and secure applications within your WAN and across the Internet. Blue Coat provides a robust and flexible
On and off premises technologies Which is best for you?
On and off premises technologies Which is best for you? We don t mind what you buy, as long as it is YELLOW! Warren Sealey and Paul-Christian Garpe On Premises or in the cloud? 1 Agenda Why Symantec? Email
A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
Websense Web Security Gateway: Integrating the Content Gateway component with Third Party Data Loss Prevention Applications
Websense Web Security Gateway: Integrating the Content Gateway component with Third Party Data Loss Prevention Applications November, 2010 2010 Websense, Inc. All rights reserved. Websense is a registered
Barracuda Networks Web Application Firewall
McAfee Enterprise Security Manager Data Source Configuration Guide Data Source: Barracuda Networks Web Application Firewall January 30, 2015 Barracuda Networks Web Application Firewall Page 1 of 10 Important
Stopping secure Web traffic from bypassing your content filter. BLACK BOX
Stopping secure Web traffic from bypassing your content filter. BLACK BOX 724-746-5500 blackbox.com Table of Contents Introduction... 3 Implications... 4 Approaches... 4 SSL CGI Proxy... 5 SSL Full Proxy...
How To Set Up An Ip Firewall On Linux With Iptables (For Ubuntu) And Iptable (For Windows)
Security principles Firewalls and NAT These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/) Host vs Network
Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme. Firewall
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application Layer Chapter 5: Security Concepts for Networks Firewalls Intrusion Detection
Guidelines for Web applications protection with dedicated Web Application Firewall
Guidelines for Web applications protection with dedicated Web Application Firewall Prepared by: dr inŝ. Mariusz Stawowski, CISSP Bartosz Kryński, Imperva Certified Security Engineer INTRODUCTION Security
Blue Coat Systems SG Appliance
Blue Coat Systems SG Appliance Configuration and Management Guide Volume 9: Access Logging Version SGOS 5.1.x Volume 9: Access Logging Contact Information Blue Coat Systems Inc. 420 North Mary Ave Sunnyvale,
Using TestLogServer for Web Security Troubleshooting
Using TestLogServer for Web Security Troubleshooting Topic 50330 TestLogServer Web Security Solutions Version 7.7, Updated 19-Sept- 2013 A command-line utility called TestLogServer is included as part
Installing AWStats on IIS 6.0 (Including IIS 5.1) - Revision 3.0
AWStats is such a great statistical tracking program to use, but there seems to be a lack of easy-tofollow documentation available for installing AWStats on IIS. This document covers the basic setup process
Architecture. The DMZ is a portion of a network that separates a purely internal network from an external network.
Architecture The policy discussed suggests that the network be partitioned into several parts with guards between the various parts to prevent information from leaking from one part to another. One part
User Identification and Authentication
User Identification and Authentication Vital Security 9.2 Copyright Copyright 1996-2008. Finjan Software Inc.and its affiliates and subsidiaries ( Finjan ). All rights reserved. All text and figures included
Name Services (DNS): This is Quick rule will enable the Domain Name Services on the firewall.
How to configure quick set up rules You can configure rules/policies using Quick setup to get the Firewall up and running in no time. To do this log in to the Firewall, browse to Firewall > Policies >
Blue Coat Security First Steps Transparent Proxy Deployments
Transparent Proxy Deployments SGOS 6.5 Third Party Copyright Notices 2014 Blue Coat Systems, Inc. All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER, CACHEFLOW, INTELLIGENCECENTER, CACHEOS, CACHEPULSE,
Introduction to Computer Security Benoit Donnet Academic Year 2015-2016
Introduction to Computer Security Benoit Donnet Academic Year 2015-2016 1 Agenda Networking Chapter 1: Firewalls Chapter 2: Proxy Chapter 3: Intrusion Detection System Chapter 4: Network Attacks Chapter
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA
Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline
Centre for the Protection of National Infrastructure Effective Log Management
Centre for the Protection of National Infrastructure Effective Log Management Tom Goldsmith, 2nd April 2014 response@contextis.com Effective Log Management / Contents Contents 1 Executive Summary 5 2 About
UNCLASSIFIED. http://www.govcertuk.gov.uk. General Enquiries. Incidents incidents@govcertuk.gov.uk Incidents incidents@govcertuk.gsi.gov.uk.
Version 1.2 19-June-2013 GUIDELINES Incident Response Guidelines Executive Summary Government Departments have a responsibility to report computer incidents under the terms laid out in the SPF, issued
www.apacheviewer.com Apache Logs Viewer Manual
Apache Logs Viewer Manual Table of Contents 1. Introduction... 3 2. Installation... 3 3. Using Apache Logs Viewer... 4 3.1 Log Files... 4 3.1.1 Open Access Log File... 5 3.1.2 Open Remote Access Log File
Direct or Transparent Proxy?
Direct or Transparent Proxy? Choose the right configuration for your gateway. Table of Contents Direct Proxy...3 Transparent Proxy...4 Other Considerations: Managing authentication made easier.....4 SSL
Cisco AnyConnect Secure Mobility Solution Guide
Cisco AnyConnect Secure Mobility Solution Guide This document contains the following information: Cisco AnyConnect Secure Mobility Overview, page 1 Understanding How AnyConnect Secure Mobility Works, page
Comparison table for an idea on features and differences between most famous statistics tools (AWStats, Analog, Webalizer,...).
What is AWStats AWStats is a free powerful and featureful tool that generates advanced web, streaming, ftp or mail server statistics, graphically. This log analyzer works as a CGI or from command line
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework ajin25@gmail.com keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.
Phishing Activity Trends Report for the Month of December, 2007
Phishing Activity Trends Report for the Month of December, 2007 Summarization of December Report Findings The total number of unique phishing reports submitted to APWG in December 2007 was 25,683, a decrease
Using the Microsoft IIS SMTP Service for LISTSERV Deliveries
Whitepaper Using the Microsoft IIS SMTP Service for LISTSERV Deliveries May 10, 2011 Copyright 2010 L-Soft international, Inc. Information in this document is subject to change without notice. Companies,
LogLogic Microsoft Internet Information Services (IIS) Log Configuration Guide
LogLogic Microsoft Internet Information Services (IIS) Log Configuration Guide Document Release: September 2011 Part Number: LL60001-00ELS090000 This manual supports LogLogic Microsoft IIS Release 1.0
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
Inside-Out Attacks. ivan.buetler@csnc.ch. Security Event April 28, 2004 Page 1. Responses to the following questions
Inside-Out Attacks ivan.buetler@csnc.ch Security Event April 28, 2004 Page 1 Goals of this presentation Responses to the following questions What are inside-out attacks Who will use this technique? How
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
Release Notes for Websense Email Security v7.2
Release Notes for Websense Email Security v7.2 Websense Email Security version 7.2 is a feature release that includes support for Windows Server 2008 as well as support for Microsoft SQL Server 2008. Version
Contact Information. Document Number: 231-02909 Document Revision: SSL Proxy Deployment Guide SGOS 5.1.4
Contact Information Blue Coat Systems Inc. 420 North Mary Ave Sunnyvale, CA 94085-4121 http://www.bluecoat.com/support/contact.html bcs.info@bluecoat.com http://www.bluecoat.com For concerns or feedback
Firewalls, IDS and IPS
Session 9 Firewalls, IDS and IPS Prepared By: Dr. Mohamed Abd-Eldayem Ref.: Corporate Computer and Network Security By: Raymond Panko Basic Firewall Operation 2. Internet Border Firewall 1. Internet (Not
Firewall Firewall August, 2003
Firewall August, 2003 1 Firewall and Access Control This product also serves as an Internet firewall, not only does it provide a natural firewall function (Network Address Translation, NAT), but it also
Blue Coat Systems. Reference Guide. SSL Proxy. For SGOS 5.3.1
Blue Coat Systems Reference Guide SSL Proxy For SGOS 5.3.1 Contact Information Blue Coat Systems Inc. 420 North Mary Ave Sunnyvale, CA 94085-4121 http://www.bluecoat.com/support/contactsupport http://www.bluecoat.com
Secure Web Service - Hybrid. Policy Server Setup. Release 9.2.5 Manual Version 1.01
Secure Web Service - Hybrid Policy Server Setup Release 9.2.5 Manual Version 1.01 M86 SECURITY WEB SERVICE HYBRID QUICK START USER GUIDE 2010 M86 Security All rights reserved. 828 W. Taft Ave., Orange,
Comparison of Firewall, Intrusion Prevention and Antivirus Technologies
White Paper Comparison of Firewall, Intrusion Prevention and Antivirus Technologies How each protects the network Juan Pablo Pereira Technical Marketing Manager Juniper Networks, Inc. 1194 North Mathilda
Domain Name System (DNS)
Application Layer Domain Name System Domain Name System (DNS) Problem Want to go to www.google.com, but don t know the IP address Solution DNS queries Name Servers to get correct IP address Essentially
Web Application Firewall
Web Application Firewall Getting Started Guide August 3, 2015 Copyright 2014-2015 by Qualys, Inc. All Rights Reserved. Qualys and the Qualys logo are registered trademarks of Qualys, Inc. All other trademarks
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training The McAfee Web Gateway Administration course from Education Services provides an in-depth introduction
Proxy Blocking: Preventing Tunnels Around Your Web Filter. Information Paper August 2009
Proxy Blocking: Preventing Tunnels Around Your Web Filter Information Paper August 2009 Table of Contents Introduction... 3 What Are Proxies?... 3 Web Proxies... 3 CGI Proxies... 4 The Lightspeed Proxy
Ram Dantu. VOIP: Are We Secured?
Ram Dantu Professor, Computer Science and Engineering Director, Center for Information and Computer Security University of North Texas rdantu@unt.edu www.cse.unt.edu/~rdantu VOIP: Are We Secured? 04/09/2012
WebMarshal User Guide
WebMarshal User Guide Legal Notice Copyright 2014 Trustwave Holdings, Inc. All rights reserved. This document is protected by copyright and any distribution, reproduction, copying, or decompilation is
Application Detection
The following topics describe Firepower System application detection : Overview:, page 1 Custom Application Detectors, page 7 Viewing or Downloading Detector Details, page 15 Sorting the Detector List,
How to Configure Captive Portal
How to Configure Captive Portal Captive portal is one of the user identification methods available on the Palo Alto Networks firewall. Unknown users sending HTTP or HTTPS 1 traffic will be authenticated,
provides several new features and enhancements, and resolves several issues reported by WatchGuard customers.
WatchGuard XCS v10.0 Update 1 Release Notes WatchGuard XCS Build 140312 Revision Date 11 November, 2014 Introduction WatchGuard is pleased to announce the release of WatchGuard XCS v10.0 Update 1. This
Inside-Out Attacks. ivan.buetler@csnc.ch. Covert Channel Attacks Inside-out Attacks Seite 1 GLÄRNISCHSTRASSE 7 POSTFACH 1671 CH-8640 RAPPERSWIL
Inside-Out Attacks ivan.buetler@csnc.ch Covert Channel Attacks Inside-out Attacks Seite 1 Goals of this presentation! Responses to the following questions! What are inside-out attacks! Who will use this
Third Party Integration
APPENDIXG This appendix contains the following sections: Overview, page G-1 BlackBerry Enterprise Server, page G-1 Blue Coat, page G-2 Check Point, page G-3 Firebox, page G-4 ISA Server/Forefront TMG,
How To Understand The History Of The Web (Web)
(World Wide) Web WWW A way to connect computers that provide information (servers) with computers that ask for it (clients like you and me) uses the Internet, but it's not the same as the Internet URL
How To Connect Log Files To A Log File On A Network With A Network Device (Network) On A Computer Or Network (Network Or Network) On Your Network (For A Network)
SIEM FOR BEGINNERS EVERYTHING YOU WANTED TO KNOW ABOUT LOG MANAGEMENT BUT WERE AFRAID TO ASK www.alienvault.com A Rose By Any Other Name SLM/LMS, SIM, SEM, SEC, SIEM Although the industry has settled on
thriller INTERNET SECURITY
+ thriller INTERNET SECURITY Saturday, October 31, 2009 1:30 PM 3:00 PM Matthew 28:18-20 Website Ministry + Agenda 2 Scripture (Col 3:12-15) Prayer Internet Security Security Threats Security Protection
74% 96 Action Items. Compliance
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated
Load balancing Microsoft IAG
Load balancing Microsoft IAG Using ZXTM with Microsoft IAG (Intelligent Application Gateway) Server Zeus Technology Limited Zeus Technology UK: +44 (0)1223 525000 The Jeffreys Building 1955 Landings Drive
Intro to Firewalls. Summary
Topic 3: Lesson 2 Intro to Firewalls Summary Basic questions What is a firewall? What can a firewall do? What is packet filtering? What is proxying? What is stateful packet filtering? Compare network layer
Security workshop Protection against botnets. Belnet Aris Adamantiadis Brussels 18 th April 2013
Security workshop Belnet Aris Adamantiadis Brussels 18 th April 2013 Agenda What is a botnet? Symptoms How does it work? Life cycle How to fight against botnets? Proactive and reactive NIDS 2 What is a
Gateway Security at Stateful Inspection/Application Proxy
Gateway Security at Stateful Inspection/Application Proxy Michael Lai Sales Engineer - Secure Computing Corporation MBA, MSc, BEng(Hons), CISSP, CISA, BS7799 Lead Auditor (BSI) Agenda Who is Secure Computing
CS 665: Computer System Security. Network Security. Usage environment. Sources of vulnerabilities. Information Assurance Module
CS 665: Computer System Security Network Security Bojan Cukic Lane Department of Computer Science and Electrical Engineering West Virginia University 1 Usage environment Anonymity Automation, minimal human
Integrated SSL Scanning
Software Version 9.0 Copyright Copyright 1996-2008. Finjan Software Inc. and its affiliates and subsidiaries ( Finjan ). All rights reserved. All text and figures included in this publication are the exclusive
Deploying the SSL Proxy
Blue Coat Systems Deployment Guide Deploying the SSL Proxy For SGOS 5.1.4 Contact Information Blue Coat Systems Inc. 420 North Mary Ave Sunnyvale, CA 94085-4121 http://www.bluecoat.com/support/contact.html
Email Migration Project Plan for Cisco Cloud Email Security
Sales Tool Email Migration Project Plan for Cisco Cloud Email Security 2014 Cisco and/or its affiliates. All rights reserv ed. This document is Cisco Conf idential. For Channel Partner use only. Not f
Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping
Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control
Today's security needs in networking
Today's security needs in networking Besoins actuels de la sécurité réseau European partner summit Thursday, October 13, 2005 Hervé Schauer Hervé Schauer Agenda Firewalls Liability
How To Control Your Network With A Firewall On A Network With An Internet Security Policy On A Pc Or Ipad (For A Web Browser)
1110 Cool Things Your Firewall Should Do Extend beyond blocking network threats to protect, manage and control application traffic Table of Contents The Firewall Grows Up 1 What does SonicWALL Application
An Approach to Convert Unprocessed Weblogs to Database Table
An Approach to Convert Unprocessed Weblogs to Database Table Kiruthika M, Dipa Dixit, Pranay Suresh, Rishi M Department of Computer Engineering, Fr. CRIT, Vashi, Navi Mumbai Abstract With the explosive