Intelligence Driven Intrusion Detection
|
|
|
- Jocelyn Malone
- 10 years ago
- Views:
Transcription
1 Intelligence Driven Intrusion Detection Matthias Wübbeling: Arnold Sykosch: Friedrich-Wilhelms-Universität Bonn: Working Group IT Security Fraunhofer Institute for Communication, Information Processing and Ergonomics FKIE: Cyber Security Department
2 OVERVIEW Threat Intelligence in a Nutshell Exchange of TI Utilization of TI STIX2Suricata STIX2GRR 2
3 Threat Intelligence in a Nutshell What do you need TI for? Identify emerging threats before being targeted by an attacker. Share intelligence information of ongoing or finished attacks. Common sense: To survive, a gazelle must run faster than the slowest gazelle. 3 (image from Common sense is not so common (unknown source). How about this quote in the field of Internet attacks / APT?
4 Threat Intelligence in a Nutshell How about the hunters and the hunted in the Internet age? To survive: You have to be faster than the fastest attacker! 4
5 Threat Intelligence in a Nutshell How about the hunters and the hunted in the Internet age? To survive: You have to be faster than the fastest attacker! Common goal: Being faster than 85%-99% of the attackers. 5
6 Exchange of Threat Intelligence Common data exchange format: XML Existing standards for TI data: OpenIOC STIX/CybOX OpenIOC OpenIOC is an extensible XML schema for the description of technical characteristics that identify a known threat, an attacker s methodology, or other evidence of compromise. OpenIOC was created by MANDIANT ( STIX/CybOX Developed by MITRE. At least as expressively as OpenIOC. Therefore: => we use STIX/CybOX. How to get Threat Intelligence? Become part of a TI sharing community Buy TI feeds or get the free ones (e.g. from hailataxii.com) 6
7 Utilization of Threat Intelligence How to use Threat Intelligence to protect your infrastructure? Have an employee consuming TI the whole day extracting the relevant information? 7
8 Utilization of Threat Intelligence How to use Threat Intelligence to protect your infrastructure? Have an employee consuming TI the whole day extracting the relevant information? Better not! 8
9 Utilization of Threat Intelligence How to use Threat Intelligence to protect your infrastructure? Have an employee consuming TI the whole day extracting the relevant information? Better not! Enable your security equipment to understand STIX/CybOX? 9
10 Utilization of Threat Intelligence How to use Threat Intelligence to protect your infrastructure? Have an employee consuming TI the whole day extracting the relevant information? Better not! Enable your security equipment to understand STIX/CybOX? Not possible if you use security appliances. 10
11 Utilization of Threat Intelligence How to use Threat Intelligence to protect your infrastructure? Have an employee consuming TI the whole day extracting the relevant information? Better not! Enable your security equipment to understand STIX/CybOX? Not possible if you use security appliances. Beg the vendor or your appliance to implement STIX/CybOX? 11
12 Utilization of Threat Intelligence How to use Threat Intelligence to protect your infrastructure? Have an employee consuming TI the whole day extracting the relevant information? Better not! Enable your security equipment to understand STIX/CybOX? Not possible if you use security appliances. Beg the vendor or your appliance to implement STIX/CybOX? Sure you do! Will take a while. 12
13 Utilization of Threat Intelligence How to use Threat Intelligence to protect your infrastructure? Have an employee consuming TI the whole day extracting the relevant information? Better not! Enable your security equipment to understand STIX/CybOX? Not possible if you use security appliances. Beg the vendor or your appliance to implement STIX/CybOX? Sure you do! Will take a while. Map STIX/CybOX information to the applications /appliances configuration! 13
14 Utilization of Threat Intelligence How to use Threat Intelligence to protect your infrastructure? Have an employee consuming TI the whole day extracting the relevant information? Better not! Enable your security equipment to understand STIX/CybOX? Not possible if you use security appliances. Beg the vendor or your appliance to implement STIX/CybOX? Sure you do! Will take a while. Map STIX/CybOX information to the applications /appliances configuration! Might be a good chance to get it now! 14
15 Utilization of Threat Intelligence How to use Threat Intelligence to protect your infrastructure? Have an employee consuming TI the whole day extracting the relevant information? Better not! Enable your security equipment to understand STIX/CybOX? Not possible if you use security appliances. Beg the vendor or your appliance to implement STIX/CybOX? Sure you do! Will take a while. Map STIX/CybOX information to the applications /appliances configuration! Might be a good chance to get it now! We just started to map STIX to a Host and a Network IDS: Suricata (NIDS; same rule syntax as SNORT) GRR Rapid Response (HIDS; hunting for artifacts ) 15
16 STIX2Suricata Goal: Generate Suricata rules based on STIX/CybOX TI. 1 st Step: Identify relevant data fields in STIX/CybOX. 2 nd Step: Mapping identified fields to Suricata rule elements. 3 rd Step: Implement tool for automated rule generation. STIX/CybOX elements relevant for network intrustion detection systems: Address, NetworkConnection, Packet, Port, Socket ArchiveFile, DNSQuery, DNSRecord, DomainName, Message, File, Hostname, HTTPSession, Link, NetFlow, URI, X509Certificate 16
17 STIX2Suricata Suricata rule syntax: <Action> <Header> <Options> 17
18 STIX2Suricata Suricata rule syntax: <Action> <Header> <Options> <Action> Pass Drop Reject Alert 18
19 STIX2Suricata Suricata rule syntax: <Action> <Header> <Options> <Action> Pass Drop Reject Alert <Header> Protocol: (IP/UDP/TCP + some application layer protocols) Source IP-Address Source TCP/UDP-Port Direction of traffic Destination IP-Address Destination TCP/UDP-Port STIX2Suricata mapping for <Header> elements: Address, NetworkConnection, Packet, Port, Socket 19
20 STIX2Suricata <Header> mapping example: STIX/Cybox data: <indicator:observable id="example:observable-1c a4cd-434d-a d6980c459"> <cybox:object id="example:object-1980ce43-8e03-490b-863a-ea404d12242e"> <cybox:properties xsi:type="addressobject:addressobjecttype" category="ipv4-addr"> <AddressObject:Address_Value condition="equals" apply_condition="any"> ##comma## ##comma## </AddressObject:Address_Value> </cybox:properties> </cybox:object> </indicator:observable> 20 Resulting Suricata rule: alert ip [ , , ] any <> any any (<Options>)
21 STIX2Suricata Suricata rule syntax: <Action> <Header> <Options> <Options> msg sid rev gid classtype reference priority metadata content STIX2Suricata mapping for <Options> elements: ArchiveFile, DNSQuery, DNSRecord, DomainName, Message, File, Hostname, HTTPSession, Link, NetFlow, URI, X509Certificate 21
22 STIX2Suricata <Options> mapping example: STIX/Cybox data: < MessageObj:Header> < MessageObj:From category=" "> <AddressObj:Address_Value condition="startswith"> </AddressObj:Address_Value> </ MessageObj:From> </ MessageObj:Header> <cybox:related_objects> <cybox:related_object> <cybox:properties xsi:type="fileobj:fileobjecttype"> <FileObj:File_Extension>pdf</FileObj:File_Extension> <FileObj:Size_In_Bytes>87022</FileObj:Size_In_Bytes> </cybox:properties> </cybox:related_object> </cybox:related_objects> 22 Resulting Suricata rule: alert tcp any any <> any any (msg:"stix2suricata: Malicious "; flow:established; content:from: nocase; fileext:"pdf"; sid:513000; )
23 STIX2Suricata Current development status: Python prototype maps data relevant for NIDS to Suricata rules. Integration into [large company name here] Threat Intelligence tool. 23
24 STIX2GRR GRR Rapid Response (GRR) GRR is forensic framework focused on scalability enabling powerful analysis. ( A forensic framework is not a Host IDS!!!11? But: It is possible to use GRR to remotely get the state of host systems. Why GRR and not OSSEC or similar? GRR is state based as STIX/CybOX data is 24 GRR is hunt based Define artifact to look for. Select target hosts. Start hunt. Wait for rapid responses.
25 STIX2GRR GRR Rapid Response (GRR) GRR is highly extensible and written in python. 25 Image from:
26 STIX2GRR Mapable STIX/CybOX data fields: WindowsDriver, ArchiveFile, File, ImageFile, PDFFile, UnixFile, WindowsExecutableFile, WindowsFile, Mutex, Address, DomainName, DNSQuery, Message, HTTPSession, NetworkConnection, SocketAddress, URI, Process, UnixProcess, WindowsProcess, WindowsRegistryKey Goal: Generate hunts for given STIX/CybOX TI data: 1 st Step: Identify relevant data fields in STIX/CybOX. 2 nd Step: Mapping identified fields to artifacts. 3 rd Step: Implement tool for automated hunt generation (+ artifact support). 26
27 STIX2GRR Current development status: Python prototype maps data relevant for HIDS and creates hunts directly in GRR server system. Integration into [large company name here] Threat Intelligence tool. 27
28 Conclusion Identified relevant Objects in STIX/CybOX. Created mapping for STIX/CybOX => (N H)IDS. Implemented prototype as proof-of-concept. Integrated it into a TI management framework. 28
29 Questions? Thank you very much for your attention 29 Credits: Image Lion and Gazelle from quoteinvestigator.com. Image GRR hunt from github.com/google/grr Other images from pixabay.com (CC License)
Passive Logging. Intrusion Detection System (IDS): Software that automates this process
Passive Logging Intrusion Detection: Monitor events, analyze for signs of incidents Look for violations or imminent violations of security policies accepted use policies standard security practices Intrusion
Network Security Monitoring
Network Security Monitoring Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
IDS Categories. Sensor Types Host-based (HIDS) sensors collect data from hosts for
Intrusion Detection Intrusion Detection Security Intrusion: a security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts
Lesson 5: Network perimeter security
Lesson 5: Network perimeter security Alejandro Ramos Fraile [email protected] Tiger Team Manager (SIA company) Security Consulting (CISSP, CISA) Perimeter Security The architecture and elements that provide
Snort Installation - Ubuntu FEUP. SSI - ProDEI-2010. Paulo Neto and Rui Chilro. December 7, 2010
December 7, 2010 Work Proposal The purpose of this work is: Explain a basic IDS Architecture and Topology Explain a more advanced IDS solution Install SNORT on the FEUP Ubuntu distribution and test some
EZ Snort Rules Find the Truffles, Leave the Dirt. David J. Bianco Vorant Network Security, Inc. [email protected]. 2006, Vorant Network Security, Inc.
EZ Snort Rules Find the Truffles, Leave the Dirt David J. Bianco Vorant Network Security, Inc. [email protected] 2006, Vorant Network Security, Inc. Table of Contents Intro to Snort Configuration Anatomy
Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA
Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline
Intrusion Detection in AlienVault
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
APPLICATION PROGRAMMING INTERFACE
DATA SHEET Advanced Threat Protection INTRODUCTION Customers can use Seculert s Application Programming Interface (API) to integrate their existing security devices and applications with Seculert. With
Introduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
Network Security Monitoring
CEENET/GEANT Security Workshop Sofia, 2014 Network Security Monitoring An Introduction to the world of Intrusion Detection Systems Irvin Homem [email protected] Stockholm University Who am I? Of Indian and
SHARING THREAT INTELLIGENCE ANALYTICS FOR COLLABORATIVE ATTACK ANALYSIS
SHARING THREAT INTELLIGENCE ANALYTICS FOR COLLABORATIVE ATTACK ANALYSIS Samir Saklikar RSA, The Security Division of EMC Session ID: CLE T05 Session Classification: Intermediate Agenda Advanced Targeted
International Journal of Enterprise Computing and Business Systems ISSN (Online) : 2230-8849
WINDOWS-BASED APPLICATION AWARE NETWORK INTERCEPTOR Ms. Shalvi Dave [1], Mr. Jimit Mahadevia [2], Prof. Bhushan Trivedi [3] [1] Asst.Prof., MCA Department, IITE, Ahmedabad, INDIA [2] Chief Architect, Elitecore
Dynamic Rule Based Traffic Analysis in NIDS
International Journal of Information & Computation Technology. ISSN 0974-2239 Volume 4, Number 14 (2014), pp. 1429-1436 International Research Publications House http://www. irphouse.com Dynamic Rule Based
Network Security Monitoring: Looking Beyond the Network
1 Network Security Monitoring: Looking Beyond the Network Ian R. J. Burke: GCIH, GCFA, EC/SA, CEH, LPT [email protected] [email protected] February 8, 2011 2 Abstract Network security monitoring
Attackers are reusing attacks (because they work)
The Problem Attackers are reusing attacks (because they work) Defenders are collecting and/or sharing information, but Often a manual process (copy-paste from a PDF) Different sources provide different
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
How To Protect Your Network From Intrusions From A Malicious Computer (Malware) With A Microsoft Network Security Platform)
McAfee Security: Intrusion Prevention System REV: 0.1.1 (July 2011) 1 Contents 1. McAfee Network Security Platform...3 2. McAfee Host Intrusion Prevention for Server...4 2.1 Network IPS...4 2.2 Workload
Fighting Advanced Persistent Threats (APT) with Open Source Tools
Fighting Advanced Persistent Threats (APT) with Open Source Tools What is APT? The US Air Force invented the term in 2006 APT refers to advanced techniques used to gain access to an intelligence objective
Introduction to Intrusion Detection and Snort p. 1 What is Intrusion Detection? p. 5 Some Definitions p. 6 Where IDS Should be Placed in Network
Introduction to Intrusion Detection and Snort p. 1 What is Intrusion Detection? p. 5 Some Definitions p. 6 Where IDS Should be Placed in Network Topology p. 8 Honey Pots p. 9 Security Zones and Levels
Intro to Firewalls. Summary
Topic 3: Lesson 2 Intro to Firewalls Summary Basic questions What is a firewall? What can a firewall do? What is packet filtering? What is proxying? What is stateful packet filtering? Compare network layer
Overview. Firewall Security. Perimeter Security Devices. Routers
Overview Firewall Security Chapter 8 Perimeter Security Devices H/W vs. S/W Packet Filtering vs. Stateful Inspection Firewall Topologies Firewall Rulebases Lecturer: Pei-yih Ting 1 2 Perimeter Security
Flow Analysis Versus Packet Analysis. What Should You Choose?
Flow Analysis Versus Packet Analysis. What Should You Choose? www.netfort.com Flow analysis can help to determine traffic statistics overall, but it falls short when you need to analyse a specific conversation
Intrusion Detection & SNORT. Fakrul Alam [email protected]
Intrusion Detection & SNORT Fakrul Alam [email protected] Sometimes, Defenses Fail Our defenses aren t perfect Patches weren t applied promptly enough Antivirus signatures not up to date 0- days get through
A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
Advancement in Virtualization Based Intrusion Detection System in Cloud Environment
Advancement in Virtualization Based Intrusion Detection System in Cloud Environment Jaimin K. Khatri IT Systems and Network Security GTU PG School, Ahmedabad, Gujarat, India Mr. Girish Khilari Senior Consultant,
Automate the Hunt. Rapid IOC Detection and Remediation WHITE PAPER WP-ATH-032015
Rapid IOC Detection and Remediation WP-ATH-032015 EXECUTIVE SUMMARY In the escalating war that is cyber crime, attackers keep upping their game. Their tools and techniques are both faster and stealthier
Sophisticated Indicators for the Modern Threat Landscape: An Introduction to OpenIOC
WHITE PAPER Sophisticated Indicators for the Modern Threat Landscape: An Introduction to OpenIOC www.openioc.org OpenIOC 1 Table of Contents Introduction... 3 IOCs & OpenIOC... 4 IOC Functionality... 5
Fighting Advanced Persistent Threats (APT) with Open Source Tools
Fighting Advanced Persistent Threats (APT) with Open Source Tools What is APT? The US Air Force invented the term in 2006 APT refers to advanced techniques used to gain access to an intelligence objective
Suricata IDS. What is it and how to enable it
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
Intrusion Detection System in Campus Network: SNORT the most powerful Open Source Network Security Tool
Intrusion Detection System in Campus Network: SNORT the most powerful Open Source Network Security Tool Mukta Garg Assistant Professor, Advanced Educational Institutions, Palwal Abstract Today s society
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
Analysis of Network Beaconing Activity for Incident Response
Analysis of Network Beaconing Activity for Incident Response FloCon2008 Peter Balland, P. O. Box 808, Livermore, CA 94551 This work performed under the auspices of the U.S. Department of Energy by under
An Open Source IPS. IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan
An Open Source IPS IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan Introduction IPS or Intrusion Prevention System Uses a NIDS or Network Intrusion Detection System Includes
Security Advisory. Some IPS systems can be easily fingerprinted using simple techniques.
Some IPS systems can be easily fingered using simple techniques. The unintentional disclosure of which security devices are deployed within your defences could put your network at significant risk. Security
S N O R T I D S B L A S T C O U R S E
S N O R T I D S B L A S T C O U R S E General Description In this course, we will use the Security Onion operating system. Security Onion is based on Ubuntu Linux distro. It contains the Snort IDS, Suricata,
F-SECURE MESSAGING SECURITY GATEWAY
F-SECURE MESSAGING SECURITY GATEWAY DEFAULT SETUP GUIDE This guide describes how to set up and configure the F-Secure Messaging Security Gateway appliance in a basic e-mail server environment. AN EXAMPLE
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access
The MANTIS Framework Cyber-Threat Intelligence Mgmt. for CERTs Siemens AG 2014. All rights reserved
B. Grobauer, S.Berger, J. Göbel, T. Schreck, J. Wallinger Siemens CERT The MANTIS Framework Cyber-Threat Intelligence Mgmt. for CERTs Note MANTIS is available as Open Source under GPL v2+ from https://github.com/siemens/django-mantis
Bridging the gap between COTS tool alerting and raw data analysis
Article Bridging the gap between COTS tool alerting and raw data analysis An article on how the use of metadata in cybersecurity solutions raises the situational awareness of network activity, leading
WHEN THE HUNTER BECOMES THE HUNTED HUNTING DOWN BOTNETS USING NETWORK TRAFFIC ANALYSIS
WHEN THE HUNTER BECOMES THE HUNTED HUNTING DOWN BOTNETS USING NETWORK TRAFFIC ANALYSIS /ABOUT/ME Thomas Chopitea - Incident handler @CertSG Digital forensics & incident response (#DFIR), malware analysis,
Who am I? BlackHat RSA
Intrusion Detection Who am I? Informal Security Education CS - Colby College Honors work in Static Analysis Fortify Software Engineer Architect Product Management HP AlienVault Products BlackHat RSA What
IBM SECURITY QRADAR INCIDENT FORENSICS
IBM SECURITY QRADAR INCIDENT FORENSICS DELIVERING CLARITY TO CYBER SECURITY INVESTIGATIONS Gyenese Péter Channel Sales Leader, CEE IBM Security Systems 12014 IBM Corporation Harsh realities for many enterprise
You Don t Know What You Can t See: Network Security Monitoring in ICS Rob Caldwell
You Don t Know What You Can t See: Network Security Monitoring in ICS Rob Caldwell Mandiant, a FireEye company [2014 SANS European ICS Summit] About me Currently: Principal Consultant on Mandiant s Industrial
ΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
How To Protect A Network From Attack From A Hacker (Hbss)
Leveraging Network Vulnerability Assessment with Incident Response Processes and Procedures DAVID COLE, DIRECTOR IS AUDITS, U.S. HOUSE OF REPRESENTATIVES Assessment Planning Assessment Execution Assessment
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT Rashmi Knowles RSA, The Security Division of EMC Session ID: Session Classification: SPO-W07 Intermediate APT1 maintained access to
Using Network Based Security Systems to Search for STIX and TAXII Based Indicators of Compromise
Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Using
Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA
Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..
Network Intrusion Analysis (Hands-on)
Network Intrusion Analysis (Hands-on) TCP/IP protocol suite is the core of the Internet and it is vital to understand how it works together, its strengths and weaknesses and how it can be used to detect
_Firewall. Palo Alto. How Logtrust works with Palo Alto Networks
_Firewall Palo Alto Networks is the next-generation firewalls that enhance your network security and enable any enterprises to look beyond IP addresses and packets. These innovative firewalls let you see
Cesario Di Sarno. Security Information and Event Management in Critical Infrastructures
Cesario Di Sarno Ph.D. Student in Information Engineering University of Naples «Parthenope» Security Information and Event Management in Critical Infrastructures Fai della Paganella 11 Febbraio 2014 Critical
Internet Security Firewalls
Overview Internet Security Firewalls Ozalp Babaoglu! Exo-structures " Firewalls " Virtual Private Networks! Cryptography-based technologies " IPSec " Secure Socket Layer ALMA MATER STUDIORUM UNIVERSITA
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
Performing Advanced Incident Response Interactive Exercise
Performing Advanced Incident Response Interactive Exercise Post-Conference Summary Merlin Namuth Robert Huber SCENARIO 1 - PHISHING EMAILS... 3... 3 Mitigations... 3 SCENARIO 2 - IDS ALERT FOR PSEXEC...
COUNTERSNIPE WWW.COUNTERSNIPE.COM
COUNTERSNIPE WWW.COUNTERSNIPE.COM COUNTERSNIPE SYSTEMS LLC RELEASE 7.0 CounterSnipe s version 7.0 is their next major release and includes a completely new IDS/IPS leveraging high performance scalability
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3
Intrusion Detections Systems
Intrusion Detections Systems 2009-03-04 Secure Computer Systems Poia Samoudi Asli Davor Sutic Contents Intrusion Detections Systems... 1 Contents... 2 Abstract... 2 Introduction... 3 IDS importance...
Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA
Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA What is ReporterAnalyzer? ReporterAnalyzer gives network professionals insight into how application traffic is impacting network performance.
All Information is derived from Mandiant consulting in a non-classified environment.
Disclaimer: All Information is derived from Mandiant consulting in a non-classified environment. Case Studies are representative of industry trends and have been derived from multiple client engagements.
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized Internet users
Cisco Application Networking for IBM WebSphere
Cisco Application Networking for IBM WebSphere Faster Downloads and Site Navigation, Less Bandwidth and Server Processing, and Greater Availability for Global Deployments What You Will Learn To address
JOOMLA REFLECTION DDOS-FOR-HIRE
1 TLP: GREEN GSI ID: 1085 JOOMLA REFLECTION DDOS-FOR-HIRE RISK FACTOR - HIGH 1.1 / OVERVIEW / Following a series of vulnerability disclosures throughout 2014, the popular content management framework Joomla
Network Layers. CSC358 - Introduction to Computer Networks
Network Layers Goal Understand how application processes set up a connection and exchange messages. Understand how addresses are determined Data Exchange Between Application Processes TCP Connection-Setup
Unified Security, ATP and more
SYMANTEC Unified Security, ATP and more TAKE THE NEXT STEP Martin Werner PreSales Consultant, Symantec Switzerland AG MEET SWISS INFOSEC! 27.01.2016 Unified Security 2 Symantec Enterprise Security Users
SECURITY ADVISORY FROM PATTON ELECTRONICS
SECURITY ADVISORY FROM PATTON ELECTRONICS Potential Security Vulnerabilities Identified in Simple Network Management Protocol (SNMP) Revision 1.0 For Public Release March 7, 2002 Last Updated March 7,
On-Premises DDoS Mitigation for the Enterprise
On-Premises DDoS Mitigation for the Enterprise FIRST LINE OF DEFENSE Pocket Guide The Challenge There is no doubt that cyber-attacks are growing in complexity and sophistication. As a result, a need has
SECURITY ANALYTICS MOVES TO REAL-TIME PROTECTION
SECURITY ANALYTICS MOVES TO REAL-TIME PROTECTION How ThreatBLADES add real-time threat scanning and alerting to the Analytics Platform INTRODUCTION: analytics solutions have become an essential weapon
Effective Threat Management. Building a complete lifecycle to manage enterprise threats.
Effective Threat Management Building a complete lifecycle to manage enterprise threats. Threat Management Lifecycle Assimilation of Operational Security Disciplines into an Interdependent System of Proactive
Scalable Extraction, Aggregation, and Response to Network Intelligence
Scalable Extraction, Aggregation, and Response to Network Intelligence Agenda Explain the two major limitations of using Netflow for Network Monitoring Scalability and Visibility How to resolve these issues
Network Security Management
Network Security Management TWNIC 2003 Objective Have an overview concept on network security management. Learn how to use NIDS and firewall technologies to secure our networks. 1 Outline Network Security
Technical Note. ForeScout CounterACT: Virtual Firewall
ForeScout CounterACT: Contents Introduction... 3 What is the vfw?.... 3 Technically, How Does vfw Work?.... 4 How Does vfw Compare to a Real Firewall?.... 4 How Does vfw Compare to other Blocking Methods?...
Security Onion. Peel Back the Layers of Your Network in Minutes. Doug Burks
Security Onion Peel Back the Layers of Your Network in Minutes Doug Burks tcpdump -nnai eth1 -s0 grep -A5 "Doug Burks" About Doug Burks: Christian, husband, father Corporate Incident Handler for Mandiant
Using Jquery with Snort to Visualize Intrusion
www.ijcsi.org 486 Using Jquery with Snort to Visualize Intrusion Alaa El - Din Riad 1, Ibrahim Elhenawy 2, Ahmed Hassan 3 and Nancy Awadallah 4 1 Vice Dean for Students Affairs, Faculty of Computer Science
First Line of Defense
First Line of Defense SecureWatch ANALYTICS FIRST LINE OF DEFENSE OVERVIEW KEY BENEFITS Comprehensive Visibility Gain comprehensive visibility into DDoS attacks and cyber-threats with easily accessible
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP Aakanksha Vijay M.tech, Department of Computer Science Suresh Gyan Vihar University Jaipur, India Mrs Savita Shiwani Head Of
Network Metrics Content Pack for VMware vrealize Log Insight
Network Metrics Content Pack for VMware vrealize Log Insight User Manual Version 2.1 June, 2015 Copyright 2012-2015 NetFlow Logic Corporation. All rights reserved. Patents Pending. Contents Introduction...
IDS / IPS. James E. Thiel S.W.A.T.
IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods
you us MSSP are a Managed Security Service Provider looking to offer Advanced Malware Protection Services
MSSP you us are a Managed Security Service Provider looking to offer Advanced Malware Protection Services Lastline is the only company with 10+ years of academic research focused on detecting advanced
Palo Alto Networks. October 6
Palo Alto Networks October 6 Agenda Malware Trends by the numbers Protect Locally Share Globally Delivery methods 21.5% ~14% OF MALWARE HAS BEEN DELIVERED OVER APPS OTHER THAN WEB AND EMAIL IN 2015 8.2%
Securing Local Area Network with OpenFlow
Securing Local Area Network with OpenFlow Master s Thesis Presentation Fahad B. H. Chowdhury Supervisor: Professor Jukka Manner Advisor: Timo Kiravuo Department of Communications and Networking Aalto University
For more information on SQL injection, please refer to the Visa Data Security Alert, SQL Injection Attacks, available at www.visa.
Global Partner Management Notice Subject: Visa Data Security Alert Malicious Software and Internet Protocol Addresses Dated: April 10, 2009 Announcement: The protection of account information is a responsibility
Missing the Obvious: Network Security Monitoring for ICS
Missing the Obvious: Network Security Monitoring for ICS If ICS are so vulnerable, why haven t we seen more attacks? We aren t looking! Two Key Reasons Intent Visibility Intent Why are targeted attacks
Peeling Back the Layers of the Network Security with Security Onion Gary Smith, Pacific Northwest National Laboratory
Peeling Back the Layers of the Network Security with Security Onion Gary Smith, Pacific Northwest National Laboratory A Little Context! The Five Golden Principles of Security! Know your system! Principle
Network Monitoring for Cyber Security
Network Monitoring for Cyber Security Paul Krystosek, PhD CERT Network Situational Awareness 2006 Carnegie Mellon University What s Coming Up The scope of network monitoring Cast of characters Descriptions
A NOVEL APPROACH FOR PROTECTING EXPOSED INTRANET FROM INTRUSIONS
A NOVEL APPROACH FOR PROTECTING EXPOSED INTRANET FROM INTRUSIONS K.B.Chandradeep Department of Centre for Educational Technology, IIT Kharagpur, Kharagpur, India [email protected] ABSTRACT This paper
Customized Data Exchange Gateway (DEG) for Automated File Exchange across Networks
Customized Data Exchange Gateway (DEG) for Automated File Exchange across Networks *Abhishek Vora B. Lakshmi C.V. Srinivas National Remote Sensing Center (NRSC), Indian Space Research Organization (ISRO),
DNS FLOODER V1.1. akamai s [state of the internet] / Threat Advisory
![DNS FLOODER V1.1. akamai s [state of the internet] / Threat Advisory](/thumbs/40/21253849.jpg "DNS FLOODER V1.1. akamai s [state of the internet] / Threat Advisory")
GSI ID: 1065 DNS FLOODER V1.1 RISK FACTOR - HIGH 1.1 OVERVIEW / PLXSert has observed the release and rapid deployment of a new DNS reflection toolkit for distributed denial of service (DDoS) attacks. The
Snort ids. Alert (file) Fig. 1 Working of Snort
Volume 4, Issue 3, March 2014 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com Developing rules
Memory Forensics & Security Analytics: Detecting Unknown Malware
Memory Forensics & Security Analytics: Detecting Unknown Malware SESSION ID: SEC-T09 Fahad Ehsan Associate Director Security Research and Analytics UBS AG Where it all started. ------------------------------------------------------------------------------------------
UNIVERSITY OF BOLTON CREATIVE TECHNOLOGIES COMPUTING AND NETWORK SECURITY SEMESTER TWO EXAMINATIONS 2014/2015 NETWORK SECURITY MODULE NO: CPU6004
[CRT14] UNIVERSITY OF BOLTON CREATIVE TECHNOLOGIES COMPUTING AND NETWORK SECURITY SEMESTER TWO EXAMINATIONS 2014/2015 NETWORK SECURITY MODULE NO: CPU6004 Date: Wednesday 27 th May 2015 Time: 14:00 16:00
Concierge SIEM Reporting Overview
Concierge SIEM Reporting Overview Table of Contents Introduction... 2 Inventory View... 3 Internal Traffic View (IP Flow Data)... 4 External Traffic View (HTTP, SSL and DNS)... 5 Risk View (IPS Alerts
Basics of Internet Security
Basics of Internet Security Premraj Jeyaprakash About Technowave, Inc. Technowave is a strategic and technical consulting group focused on bringing processes and technology into line with organizational
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border