Who am I? BlackHat RSA
|
|
|
- Marilynn Todd
- 10 years ago
- Views:
Transcription
1 Intrusion Detection
2 Who am I? Informal Security Education CS - Colby College Honors work in Static Analysis Fortify Software Engineer Architect Product Management HP AlienVault Products BlackHat RSA
3 What is it?
4 What are you looking for? Pattern known sequences of behaviors that indicate malicious activity Statistical deviations from normal (anomalous) behavior that could indicate malicious activity
5 Where are you looking for it? User Activity Application Activity Operating System Activity Network Activity SIEM SIEM / Host-based IDS Host-based IDS Network-based IDS
6 Where are you looking for it? User Activity Application Activity Operating System Activity Network Activity SIEM SIEM / Host-based IDS Host-based IDS Network-based IDS Why so many products??
7 Different Data SIEM Host-based IDS Network-based IDS Event logs Operating system events Raw network data
8 Host-based IDS
9 Host-based IDS Monitors operating system activity File changes Registry Application / Processes Deployment: Agent Remote Products OSSEC (free) McAfee EPO Symantec HIDS Tripwire
10 Host-based IDS <var name="sys_users">^apache$ ^mysql$ ^www$ ^nobody$ ^nogroup$ ^portmap$ ^named$ ^rpc$ ^mail$ ^ftp$ ^shutdown$ ^halt$ ^daemon$ ^bin$ ^postfix$ ^shell $ ^info$ ^guest$ ^psql$ ^user$ ^users$ ^console$ ^uucp$ ^lp$ ^sync$ ^sshd$ ^cdrom$ ^ossec$</var>!!! <rule id="40101" level="12">! <if_group>authentication_success</if_group>! <user>$sys_users</user>! <description>system user successfully logged to the system.</description>! <group>invalid_login,</group>! </rule>!
11 Host-based IDS Pro Process level inspection Acute behavioral detection User attribution Cons Easy to disable High Administrative Costs
12 Network IDS
13 Network IDS Monitors network activity Protocol Usage Deep Packet Inspection File Identification Deployment: Inline Products Suricata (free) McAfee IntruShield Cisco Juniper
14 Network IDS alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"et ATTACK_RESPONSE Metasploit Meterpreter Sysinfo Command Detected"; flow:to_client,established; content:"stdapi_sys_config_sysinfo"; depth:60; reference:url, meterpreter.pdf; reference:url,doc.emergingthreats.net/ ; classtype:successful-user; sid: ; rev: 2;)!
15 Network IDS Pro Difficult to disable Early identification of threats Broad rulesets available Cons Difficult to derive context
16 SIEM
17 SIEM Monitors anything you can feed it VPN, Firewall, Application, server, door readers, etc Deployment: Central Products ArcSight (HP) IBM (Q1) OSSIM (Free)
18 Data Normalization Example Juniper SRX Session Denied Raw Log Event! #Sep 25 06:26: T06:26: SRX2-NY RT_FLOW - RT_FLOW_SESSION_DENY [junos@ source-address=" " source-port="1234" destination-address=" " destination-port="80" service-name="junos-http" protocol-id="6" icmp-type="0" policy-name="deny" source-zone-name="trust" destination-zone-name="untrust"]!
19 Data Normalization Example Juniper SRX Session Denied Raw Log Event! #Sep 25 06:26: T06:26: SRX2-NY RT_FLOW - RT_FLOW_SESSION_DENY [junos@ source-address=" " source-port="1234" destination-address=" " destination-port="80" service-name="junos-http" protocol-id="6" icmp-type="0" policy-name="deny" source-zone-name="trust" destination-zone-name="untrust"]! NORMALIZED!! Event ID=SESSION_DENY! Date=September 25, :26:09! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=80! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny!
20 Data Normalization Example Juniper SRX Session Denied Log Event! #Sep 25 06:26: T06:26: SRX2-NY RT_FLOW - RT_FLOW_SESSION_DENY [junos@ source-address=" " source-port="1234" destination-address=" " destination-port="80" service-name="junos-http" protocol-id="6" icmp-type="0" policy-name="deny" source-zone-name="trust" destination-zone-name="untrust"]! NORMALIZED!! Event ID=SESSION_DENY! Date=September 25, :26:09! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=80! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny! Necessary for cross-data source correlation Identify similar data from different data sources (User Name, IP Address, etc.) Each data source requires some custom logic Each log has a unique format
21 Correlation Example Probing! Deny! Deny! Allow! Correlation can be thought of as a state machine
22 Correlation Example Probing! Deny! DENY! Deny! Allow! Event 1!! Event ID=SESSION_DENY! Date=September 25, :26:09! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=80! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny! Each event can match and progress the state
23 Correlation Example Probing! Deny! DENY! Deny! Allow!! Event ID=SESSION_DENY! Date=September 25, :26:09! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=80! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny! Event 2!! Event ID=SESSION_DENY! Date=September 25, :26:10! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=443! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny! Subsequent events need to match within time window
24 Correlation Example Probing! Deny! DENY! DENY! Deny! Allow!! Event ID=SESSION_DENY! Date=September 25, :26:09! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=80! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny!! Event ID=SESSION_DENY! Date=September 25, :26:10! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=80! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny! Event 3!! Event ID=SESSION_CREATE! Date=September 25, :26:11! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=22! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny! Subsequent events need to match within time window
25 Correlation Example Probing! Deny! DENY! DENY! Deny! ALLOW! Deny!! Event ID=SESSION_DENY! Date=September 25, :26:09! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=80! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny!! Event ID=SESSION_DENY! Date=September 25, :26:10! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=443! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny!! Event ID=SESSION_CREATE! Date=September 25, :26:11! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=22! Destination Zone=untrust! Service Name=Junos HTTP! Protocol=TCP! ICMP Type=Echo! Policy=Deny! ALARM Probing! Source IP= ! Source Port=1234! Source Zone=trust! Destination IP= ! Destination Port=80,443,22! Protocol=TCP! Fully loaded state machine generates an alarm
26 SIEM Pro Flexible and complete Cons Expensive to deploy
27 Example
28 Example <Unknown> < Unknown> 9:53 AM 9:56 AM 9:59 AM 10:03 AM 10:05 AM 10:16 AM M. Cochran Disconnects from network Infection M. Cochran Reconnects to network Snort detect Mariposa / Paveo CnC Host Identified as Infected M. Cochran Disconnects from network Potential Detection Point: Snort Identify Malicious Binary Potential Detection Point: Symantec Identify Infection Potential Detection Point: OSSEC Reports Infection
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
IDS Categories. Sensor Types Host-based (HIDS) sensors collect data from hosts for
Intrusion Detection Intrusion Detection Security Intrusion: a security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts
Introduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
Deploying HIDS Client to Windows Hosts
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
AlienVault Unified Security Management (USM) 4.x-5.x. Deploying HIDS Agents to Linux Hosts
AlienVault Unified Security Management (USM) 4.x-5.x Deploying HIDS Agents to Linux Hosts USM 4.x-5.x Deploying HIDS Agents to Linux Hosts, rev. 2 Copyright 2015 AlienVault, Inc. All rights reserved. AlienVault,
Lesson 5: Network perimeter security
Lesson 5: Network perimeter security Alejandro Ramos Fraile [email protected] Tiger Team Manager (SIA company) Security Consulting (CISSP, CISA) Perimeter Security The architecture and elements that provide
Intrusion Detection in AlienVault
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
Fighting Advanced Persistent Threats (APT) with Open Source Tools
Fighting Advanced Persistent Threats (APT) with Open Source Tools What is APT? The US Air Force invented the term in 2006 APT refers to advanced techniques used to gain access to an intelligence objective
Intrusion Detection Systems and Supporting Tools. Ian Welch NWEN 405 Week 12
Intrusion Detection Systems and Supporting Tools Ian Welch NWEN 405 Week 12 IDS CONCEPTS Firewalls. Intrusion detection systems. Anderson publishes paper outlining security problems 1972 DNS created 1984
Passive Logging. Intrusion Detection System (IDS): Software that automates this process
Passive Logging Intrusion Detection: Monitor events, analyze for signs of incidents Look for violations or imminent violations of security policies accepted use policies standard security practices Intrusion
Symantec Enterprise Firewalls. From the Internet Thomas Jerry Scott
Symantec Enterprise Firewalls From the Internet Thomas Symantec Firewalls Symantec offers a whole line of firewalls The Symantec Enterprise Firewall, which emerged from the older RAPTOR product We are
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute
AlienVault Unified Security Management Solution Complete. Simple. Affordable Life Cycle of a log
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
1Juniper. 2How Logtrust. works with Juniper? a security network solution for enterprises and service providers.
Juniper 1Juniper I t s a security network solution for enterprises and service providers. These are prevention and protection products that provide a full on-line security firewall network against iworm,
IDS / IPS. James E. Thiel S.W.A.T.
IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods
Fighting Advanced Persistent Threats (APT) with Open Source Tools
Fighting Advanced Persistent Threats (APT) with Open Source Tools What is APT? The US Air Force invented the term in 2006 APT refers to advanced techniques used to gain access to an intelligence objective
From Network Security To Content Filtering
Computer Fraud & Security, May 2007 page 1/10 From Network Security To Content Filtering Network security has evolved dramatically in the last few years not only for what concerns the tools at our disposals
Know your security in mission critical environments Petr Hněvkovský, Senior Security Consultant, HP Enterprise Security Products
Know your security in mission critical environments Petr Hněvkovský, Senior Security Consultant, HP Enterprise Security Products Threat landscape Riskier Enterprises + Advanced Attackers = More Attacks
Websense Web Security Gateway: Integrating the Content Gateway component with Third Party Data Loss Prevention Applications
Websense Web Security Gateway: Integrating the Content Gateway component with Third Party Data Loss Prevention Applications November, 2010 2010 Websense, Inc. All rights reserved. Websense is a registered
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access
Intrusion Detection System in Campus Network: SNORT the most powerful Open Source Network Security Tool
Intrusion Detection System in Campus Network: SNORT the most powerful Open Source Network Security Tool Mukta Garg Assistant Professor, Advanced Educational Institutions, Palwal Abstract Today s society
Introducing IBM s Advanced Threat Protection Platform
Introducing IBM s Advanced Threat Protection Platform Introducing IBM s Extensible Approach to Threat Prevention Paul Kaspian Senior Product Marketing Manager IBM Security Systems 1 IBM NDA 2012 Only IBM
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP Aakanksha Vijay M.tech, Department of Computer Science Suresh Gyan Vihar University Jaipur, India Mrs Savita Shiwani Head Of
CS2107 Introduction to Information and System Security (Slid. (Slide set 8)
Networks, the Internet Tool support CS2107 Introduction to Information and System Security (Slide set 8) National University of Singapore School of Computing July, 2015 CS2107 Introduction to Information
INTRUSION DETECTION SYSTEMS and Network Security
INTRUSION DETECTION SYSTEMS and Network Security Intrusion Detection System IDS A layered network security approach starts with : A well secured system which starts with: Up-to-date application and OS
Biznet GIO Cloud Connecting VM via Windows Remote Desktop
Biznet GIO Cloud Connecting VM via Windows Remote Desktop Introduction Connecting to your newly created Windows Virtual Machine (VM) via the Windows Remote Desktop client is easy but you will need to make
Lab exercise: Working with Wireshark and Snort for Intrusion Detection
CS 491S: Computer and Network Security Fall 2008 Lab exercise: Working with Wireshark and Snort for Intrusion Detection Abstract: This lab is intended to give you experience with two key tools used by
Suricata IDS. What is it and how to enable it
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
Intrusion Detection. Tianen Liu. May 22, 2003. paper will look at different kinds of intrusion detection systems, different ways of
Intrusion Detection Tianen Liu May 22, 2003 I. Abstract Computers are vulnerable to many threats. Hackers and unauthorized users can compromise systems. Viruses, worms, and other kinds of harmful code
Network Security Monitoring
Network Security Monitoring Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
Chapter 15. Firewalls, IDS and IPS
Chapter 15 Firewalls, IDS and IPS Basic Firewall Operation The firewall is a border firewall. It sits at the boundary between the corporate site and the external Internet. A firewall examines each packet
Adding an Extended Access List
CHAPTER 11 This chapter describes how to configure extended access lists (also known as access control lists), and it includes the following topics: Information About Extended Access Lists, page 11-1 Licensing
International Journal of Enterprise Computing and Business Systems ISSN (Online) : 2230-8849
WINDOWS-BASED APPLICATION AWARE NETWORK INTERCEPTOR Ms. Shalvi Dave [1], Mr. Jimit Mahadevia [2], Prof. Bhushan Trivedi [3] [1] Asst.Prof., MCA Department, IITE, Ahmedabad, INDIA [2] Chief Architect, Elitecore
Blended Security Assessments
Blended Security Assessments Combining Active, Passive and Host Assessment Techniques October 12, 2009 (Revision 9) Renaud Deraison Director of Research Ron Gula Chief Technology Officer Table of Contents
AlienVault. Unified Security Management (USM) 5.x Policy Management Fundamentals
AlienVault Unified Security Management (USM) 5.x Policy Management Fundamentals USM 5.x Policy Management Fundamentals Copyright 2015 AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,
Analysis of Network Packets. C DAC Bangalore Electronics City
Analysis of Network Packets C DAC Bangalore Electronics City Agenda TCP/IP Protocol Security concerns related to Protocols Packet Analysis Signature based Analysis Anomaly based Analysis Traffic Analysis
How To Connect Log Files To A Log File On A Network With A Network Device (Network) On A Computer Or Network (Network Or Network) On Your Network (For A Network)
SIEM FOR BEGINNERS EVERYTHING YOU WANTED TO KNOW ABOUT LOG MANAGEMENT BUT WERE AFRAID TO ASK www.alienvault.com A Rose By Any Other Name SLM/LMS, SIM, SEM, SEC, SIEM Although the industry has settled on
CSCI 4250/6250 Fall 2015 Computer and Networks Security
CSCI 4250/6250 Fall 2015 Computer and Networks Security Network Security Goodrich, Chapter 5-6 Tunnels } The contents of TCP packets are not normally encrypted, so if someone is eavesdropping on a TCP
Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA
Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline
Role of Anomaly IDS in Network
Role of Anomaly IDS in Network SumathyMurugan 1, Dr.M.Sundara Rajan 2 1 Asst. Prof, Department of Computer Science, Thiruthangal Nadar College, Chennai -51. 2 Asst. Prof, Department of Computer Science,
Security Monitoring and Architectures for Security Logging
Security Monitoring and Architectures for Security Logging Christer Andersson 15 December 2009 1 December 2008 Introduction to myself Christer Andersson Information Security Consultant at Combitech Karlstad
Symantec Security Information Manager Version 4.7
Version 4.7 Agenda What are the challenges? What is Security Information Manager? How does Security Information Manager work? Why? 2 Security Management Challenges 3 Managing IT Security PREVENT INFORM
How To Protect A Network From Attack From A Hacker (Hbss)
Leveraging Network Vulnerability Assessment with Incident Response Processes and Procedures DAVID COLE, DIRECTOR IS AUDITS, U.S. HOUSE OF REPRESENTATIVES Assessment Planning Assessment Execution Assessment
Open Source Security Tool Overview
Open Source Security Tool Overview Presented by Kitch Spicer & Douglas Couch Security Engineers for ITaP 1 Introduction Vulnerability Testing Network Security Passive Network Detection Firewalls Anti-virus/Anti-malware
Architecture Overview
Architecture Overview Design Fundamentals The networks discussed in this paper have some common design fundamentals, including segmentation into modules, which enables network traffic to be isolated and
An Open Source IPS. IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan
An Open Source IPS IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan Introduction IPS or Intrusion Prevention System Uses a NIDS or Network Intrusion Detection System Includes
FIREWALL AND NAT Lecture 7a
FIREWALL AND NAT Lecture 7a COMPSCI 726 Network Defence and Countermeasures Muhammad Rizwan Asghar August 3, 2015 Source of most of slides: University of Twente FIREWALL An integrated collection of security
Peeling Back the Layers of the Network Security with Security Onion Gary Smith, Pacific Northwest National Laboratory
Peeling Back the Layers of the Network Security with Security Onion Gary Smith, Pacific Northwest National Laboratory A Little Context! The Five Golden Principles of Security! Know your system! Principle
Networking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
Security Correlation Server Quick Installation Guide
orrelogtm Security Correlation Server Quick Installation Guide This guide provides brief information on how to install the CorreLog Server system on a Microsoft Windows platform. This information can also
Network Security Management
Network Security Management TWNIC 2003 Objective Have an overview concept on network security management. Learn how to use NIDS and firewall technologies to secure our networks. 1 Outline Network Security
Configuring Snort as a Firewall on Windows 7 Environment
Configuring Snort as a Firewall on Windo Environment Moath Hashim Alsafasfeh a, Abdel Ilah Noor Alshbatat b a National university of Malaysia UKM, Selengor, Malaysia. b Tafila Technical University, Electrical
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 9 Firewalls and Intrusion Prevention Systems First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Firewalls and Intrusion
Kevin Hayes, CISSP, CISM MULTIPLY SECURITY EFFECTIVENESS WITH SIEM
Kevin Hayes, CISSP, CISM MULTIPLY SECURITY EFFECTIVENESS WITH SIEM TODAY S AGENDA Describe the need for SIEM Explore different options available for SIEM Demonstrate a few Use Cases Cover some caveats
Security Correlation Server Quick Installation Guide
orrelog Security Correlation Server Quick Installation Guide This guide provides brief information on how to install the CorreLog Server system on a Microsoft Windows platform. This information can also
Overview. Firewall Security. Perimeter Security Devices. Routers
Overview Firewall Security Chapter 8 Perimeter Security Devices H/W vs. S/W Packet Filtering vs. Stateful Inspection Firewall Topologies Firewall Rulebases Lecturer: Pei-yih Ting 1 2 Perimeter Security
ΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
Configuring Snort as a Firewall on Windows 7 Environment
Journal of Ubiquitous Systems & Pervasive Networks Volume 3, No. 2 (2011) pp. 3- Configuring Snort as a Firewall on Windo Environment Moath Hashim Alsafasfeh a, Abdel Ilah Noor Alshbatat b a National University
NETWORK SECURITY (W/LAB) Course Syllabus
6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 NETWORK SECURITY (W/LAB) Course Syllabus Course Number: NTWK-0008 OHLAP Credit: Yes OCAS Code: 8131 Course Length: 130 Hours Career Cluster: Information
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh10/
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh10/ Fall 2010 Sonja Buchegger [email protected] Lecture 6, Nov. 10, 2010 Firewalls, Intrusion Prevention, Intrusion Detection
Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)
s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware
UMHLABUYALINGANA MUNICIPALITY FIREWALL MANAGEMENT POLICY
UMHLABUYALINGANA MUNICIPALITY FIREWALL MANAGEMENT POLICY Firewall Management Policy Approval and Version Control Approval Process: Position or Meeting Number: Date: Originator: Recommended by Director
Guideline on Firewall
CMSGu2014-02 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Firewall National Computer Board Mauritius Version 1.0 June
Firewalls & Intrusion Detection
Firewalls & Intrusion Detection CS 594 Special Topics/Kent Law School: Computer and Network Privacy and Security: Ethical, Legal, and Technical Consideration 2007, 2008 Robert H. Sloan Security Intrusion
Intrusion Detection & SNORT. Fakrul Alam [email protected]
Intrusion Detection & SNORT Fakrul Alam [email protected] Sometimes, Defenses Fail Our defenses aren t perfect Patches weren t applied promptly enough Antivirus signatures not up to date 0- days get through
Second-generation (GenII) honeypots
Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. [email protected] Abstract Honeypots are security resources which trap malicious activities, so they
Our Security. History of IDS Cont d In 1983, Dr. Dorothy Denning and SRI International began working on a government project.
Our Security Ways we protect our valuables: By Edith Butler Fall 2008 Locks Security Alarm Video Surveillance, etc. History about IDS It began in 1980, with James Anderson's paper: History of IDS Cont
FISMA / NIST 800-53 REVISION 3 COMPLIANCE
Mandated by the Federal Information Security Management Act (FISMA) of 2002, the National Institute of Standards and Technology (NIST) created special publication 800-53 to provide guidelines on security
Module II. Internet Security. Chapter 7. Intrusion Detection. Web Security: Theory & Applications. School of Software, Sun Yat-sen University
Module II. Internet Security Chapter 7 Intrusion Detection Web Security: Theory & Applications School of Software, Sun Yat-sen University Outline 7.1 Threats to Computer System 7.2 Process of Intrusions
Intrusion Detection Systems
Intrusion Detection Systems Intrusion Detection Systems Intrusion Detection Systems: Overview IDS Acronyms & Definition Components Recognition & Response Security Interoperability & Cooperation HIDS NIDS
How To Protect Your Firewall From Attack From A Malicious Computer Or Network Device
Ch.9 Firewalls and Intrusion Prevention Systems Firewalls: effective means of protecting LANs Internet connectivity is essential for every organization and individuals introduces threats from the Internet
Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme. Firewall
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application Layer Chapter 5: Security Concepts for Networks Firewalls Intrusion Detection
A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
Course Title: Penetration Testing: Security Analysis
Course Title: Penetration Testing: Security Analysis Page 1 of 9 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics in advanced
ArcSight Supports a Wide Range of Security Relevant Products
ArcSight Supports a Wide Range of Security Relevant Products ArcSight s data collection capabilities are the most versatile in the industry and run the gamut from a centralized collection point on the
IntruPro TM IPS. Inline Intrusion Prevention. White Paper
IntruPro TM IPS Inline Intrusion Prevention White Paper White Paper Inline Intrusion Prevention Introduction Enterprises are increasingly looking at tools that detect network security breaches and alert
AlienVault Unified Security Management (USM) 4.x-5.x. Deployment Planning Guide
AlienVault Unified Security Management (USM) 4.x-5.x Deployment Planning Guide USM 4.x-5.x Deployment Planning Guide, rev. 1 Copyright AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,
Advancement in Virtualization Based Intrusion Detection System in Cloud Environment
Advancement in Virtualization Based Intrusion Detection System in Cloud Environment Jaimin K. Khatri IT Systems and Network Security GTU PG School, Ahmedabad, Gujarat, India Mr. Girish Khilari Senior Consultant,
The SIEM Evaluator s Guide
Using SIEM for Compliance, Threat Management, & Incident Response Security information and event management (SIEM) tools are designed to collect, store, analyze, and report on log data for threat detection,
642 523 Securing Networks with PIX and ASA
642 523 Securing Networks with PIX and ASA Course Number: 642 523 Length: 1 Day(s) Course Overview This course is part of the training for the Cisco Certified Security Professional and the Cisco Firewall
Application Note: Junos NAT Configuration Examples
: Junos NAT Configuration Examples January 2010 Juniper Networks, Inc. 1 Table of Contents Junos NAT Configuration Examples...1 Introduction...3 Requirements...3 Configuration Examples...3 Source NAT...3
Intrusion Detection Systems
Intrusion Detection Systems Advanced Computer Networks 2007 Reinhard Wallner [email protected] Outline Introduction Types of IDS How works an IDS Attacks to IDS Intrusion Prevention Systems
SonicWALL Unified Threat Management. Alvin Mann April 2009
SonicWALL Unified Threat Management Alvin Mann April 2009 Agenda Who is SonicWALL? Networking Drivers & Trends SonicWALL Unified Threat Management (UTM) Next Generation Protection SonicWALL CONFIDENTIAL
Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN
Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology. Project Proposal 1
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology Project Proposal 1 Project Proposal 2 Abstract Honeypot systems are readily used by organizations large and
Firewall. IPTables and its use in a realistic scenario. José Bateira ei10133 Pedro Cunha ei05064 Pedro Grilo ei09137 FEUP MIEIC SSIN
Firewall IPTables and its use in a realistic scenario FEUP MIEIC SSIN José Bateira ei10133 Pedro Cunha ei05064 Pedro Grilo ei09137 Topics 1- Firewall 1.1 - How they work? 1.2 - Why use them? 1.3 - NAT
Testing Network Security Using OPNET
Testing Network Security Using OPNET Agustin Zaballos, Guiomar Corral, Isard Serra, Jaume Abella Enginyeria i Arquitectura La Salle, Universitat Ramon Llull, Spain Paseo Bonanova, 8, 08022 Barcelona Tlf:
Securely Yours LLC Top Security Topics for 2013. Sajay Rai, CPA, CISSP, CISM [email protected]
Securely Yours LLC Top Security Topics for 2013 Sajay Rai, CPA, CISSP, CISM [email protected] Contents Background Top Security Topics What auditors must know? What auditors must do? Next Steps
Dynamic Rule Based Traffic Analysis in NIDS
International Journal of Information & Computation Technology. ISSN 0974-2239 Volume 4, Number 14 (2014), pp. 1429-1436 International Research Publications House http://www. irphouse.com Dynamic Rule Based
Intruders and viruses. 8: Network Security 8-1
Intruders and viruses 8: Network Security 8-1 Intrusion Detection Systems Firewalls allow traffic only to legitimate hosts and services Traffic to the legitimate hosts/services can have attacks CodeReds
Security Information Management
Security Information Management b-i branding. technology. integration. www.b-i.com Acronyms Main acronyms used in this talk : - IDS : Intrusion Detection System, commonly divided in > NIDS : Network Intrusion
Intrusion Detection Systems
Intrusion Detection Systems Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-07/
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized Internet users
Chapter 11 Phase 5: Covering Tracks and Hiding
Chapter 11 Phase 5: Covering Tracks and Hiding Attrition Web Site Contains an archive of Web vandalism attacks http://www.attrition.org/mirror/attrition Most attackers, however, wish to keep low profile
BEGINNER S GUIDE to. Open Source Intrusion Detection Tools. www.alienvault.com
BEGINNER S GUIDE to Open Source Intrusion Detection Tools www.alienvault.com IDS Basics If you aren t already running network IDS, you should be. There are two types of Network IDS: Signature Detection