Incident Response and Early Warning Initiatives in Brazil
|
|
|
- Louisa Norman
- 10 years ago
- Views:
Transcription
1 Incident Response and Early Warning Initiatives in Brazil Marcelo H. P. C. Chaves Computer Emergency Response Team Brazil CERT.br Brazilian Internet Steering Committee Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.1/35
2 Overview CERT.br The CERT.br Sponsor Mission, constituency and services Initiatives Early Warning Motivation The honeypots network public and private statistics and use in incident response Advantages, disadvantages and future work Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.2/35
3 CGI.br / CERT.br Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.3/35
4 CGI.br The CERT.br Sponsor The Brazilian Internet Steering Committee (CGI.br) created by the Interministerial Ordinance Nº 147, of May 31st 1995 altered by the Presidential Decree Nº 4,829, of September 3rd 2003 It is a multistakeholder organization composed of: sector Federal Government Corporate sector representatives number Ministries of Science and Technology, Communications, Defense, Industry, etc, 9 and Telcos Regulatory Agency (ANATEL) Industry, Telcos, ISPs, users 4 NGO s Sci. and Tech. Community Non profit organizations, etc Academia Internet expert Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.4/35
5 CGI.br The CERT.br Sponsor (cont.) Brazilian Internet Steering Committe s main attributions: to propose policies and procedures related to the regulation of Internet activities; to recommend standards for technical and operational procedures for the Internet in Brazil; to establish strategic directives related to the use and development of Internet in Brazil; to promote studies and technical standards for the network and services security in the country; to coordinate the allocation of Internet addresses (IPs) and the registration of domain names using <.br>; to collect, organize and disseminate information on Internet services, including indicators and statistics. Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.5/35
6 CGI.br The CERT.br Sponsor (cont.) Brazilian Internet Steering Committee Network Information Center Computer Emergency Response Team Brazil Domain Registration Internet Exchange Points Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.6/35
7 CERT.br Mission: An organization that is responsible for receiving, reviewing, and responding to computer security incident reports and activity related to networks connected to the Brazilian Internet. Constituency: Brazil - Internet.br domain and IP addresses assigned to Brazil. Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.7/35
8 CERT.br (cont.) Services: provide a focal point for reporting incidents related to Brazilian networks; provide coordinated support in incident response; establish collaborative relationships (law enforcement, service providers, telephone companies, financial sector, etc); increase security awareness and help new CSIRTs to establish their activities; CERT.br is a member of FIRST Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.8/35
9 CERT.br Initiatives Produce technical documents in Portuguese Maintain statistics (incidents and spam) Anti-Phishing Working Group Research Partner detect malware enabled fraud notify hosting sites send samples to 20+ AV vendors Honeypots and Honeynets research Honeynet Research Alliance Member Brazilian Honeypots Alliance - Distributed Honeypots Project Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.9/35
10 CERT.br Initiatives (cont.) CSIRT Development: Training: SEI Partner for 4 CERT /CC courses * Creating a Computer Security Incident Response Team * Managing Computer Security Incident Response Teams * Fundamentals of Incident Handling * Advanced Incident Handling for Technical Staff 140+ people trained Help new teams creation Maintain a list of Brazilian CSIRTs Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.10/35
11 Brazilian CSIRTs Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.11/35
12 CGI.br Initiatives sponsors 2 meetings/conferences free of charge per year, to the security and network communities (GTS/GTER) inoc-dba BR project to stimulate Brazilian networks to join the inoc-dba global network 100 IP phones were provided to ASNs 20 IP phones were provided to CSIRTs recognized by CERT.br inoc-dba global hotline phone system which directly interconnects the Network Operations Centers and Security Incident Response Teams Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.12/35
13 CGI.br Initiatives (cont.) Task Force on Spam (CT-Spam) to propose a national strategy to fight spam to articulate the actions among the different actors documents created Technologies and Policies to Fight Spam technical analysis of international antispam laws and brazilian proposals of new laws Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.13/35
14 Early Warning Initiative Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.14/35
15 Motivation Have a national early warning capability with the following characteristics: Widely distributed across the country in several ASNs and geographical locations Based on voluntary work of research partners High level of privacy for the members Useful for Incident Response Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.15/35
16 The Honeypots Network Brazilian Honeypots Alliance Distributed Honeypots Project Coordination: CERT.br Computer Emergency Response Team Brazil Brazilian Internet Steering Committee CenPRA Research Center Ministry of Science and Technology Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.16/35
17 The Honeypots Network (cont.) Technical requirements: secure configuration follow the project s standards (OS, configurations, updates, etc) no data pollution Privacy concerns (in a NDA): don t disclose IP/network information don t collect production network traffic don t exchange any information in clear text Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.17/35
18 The Honeypots Network (cont.) The architecture: low interaction honeypots OpenBSD + Honeyd using a netblock range emulating services (HTTP, SMTP, malwares backdoors, etc) a central server collects logs and uploaded malware performs a status check in all honeypots Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.18/35
19 The Honeypots Network (cont.) 31 research partner s institutions: Academia, Government, Industry, Military and Telcos networks They provide: hardware and network blocks (usually a /24) maintenance of their own honeypots Use the data for intrusion detection purposes less false positives than traditional IDSs Several have more than one honeypot Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.19/35
20 The Honeypots Network (cont.) # City Institutions 01 São José dos Campos INPE, ITA 02 Rio de Janeiro CBPF, Fiocruz, IME, PUC-RIO, RedeRio, UFRJ 03 São Paulo ANSP, CERT.br, Diveo, Durand, UNESP, USP 04 Campinas CenPRA, ITAL, HP Brazil, UNICAMP, UNICAMP FEEC 05 São José do Rio Preto UNESP 06 Piracicaba USP 07 Brasília Brasil Telecom, Ministry of Justice, TCU, UNB LabRedes 08 Natal UFRN 09 Petrópolis LNCC 10 Porto Alegre CERT-RS 11 Ribeirão Preto USP 12 São Carlos USP 13 Taubaté UNITAU 14 Florianópolis UFSC DAS 15 Americana VIVAX 16 Manaus VIVAX 17 Joinville UDESC 18 Lins FPTE 19 Uberlândia CTBC Telecom Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.20/35
21 The Honeypots Network (cont.) As of October, 2005 Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.21/35
22 Early Warning Private Statistics summaries including: specific information for each honeypot most active IPs, OSs, ports, protocols and Country Codes correlated activities (ports and IPs) Public Statistics: combined daily flows seen in the honeypots most active OSs, TCP/UDP ports and Country Codes (CC) * the top ports, OSs and CCs are calculated every day Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.22/35
23 Early Warning (cont.) Usefulness: observation of trends detect scans for potential new vulnerabilities partner institutions are detecting promptly: outbreaks of new worms/bots compromised servers network configuration errors collect new signatures and new malware Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.23/35
24 Public Statistics Generation convert the raw network data into flow data compute the amount of bytes/packets received by each port (or OS or CC) select the top 10 to plot the remaining will be displayed as others use RRDtool and ORCA to generate the flows graphics stack area graphics logarithmic scale Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.24/35
25 Public Statistics Generation (cont.) make pflog2flows.pl pflog files fprobe network flows flow capture flow files flow files flow print ascii flow files cidrgrep ascii flow files (filtered) ascii flow files (filtered) flow2ports.pl flow2cc.pl flow2srcos.pl TOP 10 tcp, TOP 10 udp, TOP 10 cc, TOP 10 srcos files Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.25/35
26 Public Statistics Generation (cont.) TOP 10 tcp TOP 10 udp TOP 10 cc TOP 10 srcos make honeyd stats.pl for each TOP 10 <type> file make orca stats.pl for each 4 hour data run ORCA feed RRDTool database PNG file PNG file store image for 4 hour period store daily image HTML files HTML file create HTML files store TOP 10 <type> files store daily file Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.26/35
27 Public Statistics Top UDP Ports September 17, 2005 Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.27/35
28 Public Statistics Top TCP Ports September 21, 2005 Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.28/35
29 Public Statistics Top Country Codes September 21, 2005 Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.29/35
30 Public Statistics Top Source OS September 13, 2005 Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.30/35
31 Incident Response Identify signatures of well known malicious/abusive activities worms, bots, scans, spam and other malware Notify the responsible networks of the Brazilian IPs with recovery tips Donate sanitized data of non-brazilian IPs to other CSIRTs (e.g. Team Cymru) Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.31/35
32 Architecture advantages Few false positives Ability to collect malware samples specific listeners: mydoom, kuang, subseven, etc. Ability to implement spam traps Permits the members expertise s improvement in several areas: honeypots, intrusion detection, PGP, firewalls, OS hardening Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.32/35
33 Architecture disadvantages It s more difficult to maintain Usually don t catch attacks targeted to production networks Need the partners cooperation to maintain and update the honeypots Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.33/35
34 Future Work Continuously expand the network 4 new partners in installation phase 17 partner candidates Have more frequent private summaries Provide monthy, weekly, and hourly public statistics Increase data donation to trusted parties Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.34/35
35 Related Links This presentation Computer Emergency Response Team Brazil CERT.br Brazilian Internet Steering Comittee CGI.br Brazilian Honeypots Alliance Distributed Honeypots Project Brazilian Honeypots Alliance Statistics The Honeynet Research Alliance Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.35/35
CERT.br: Mission and Services
CERT.br: Mission and Services Marcelo H. P. C. Chaves [email protected] Computer Emergency Response Team Brazil CERT.br http://www.cert.br/ Brazilian Internet Steering Committee http://www.cgi.br/ Conferencia
Cybersecurity and Incident Response Initiatives: Brazil and Americas
Cybersecurity and Incident Response Initiatives: Brazil and Americas Cristine Hoepers [email protected] Computer Emergency Response Team Brazil CERT.br http://www.cert.br/ Brazilian Internet Steering Committee
honeytarg Chapter Activities
honeytarg Chapter Activities Marcelo Chaves [email protected]! Computer Emergency Response Team Brazil - CERT.br Network Information Center Brazil - NIC.br Brazilian Internet Steering Committee - CGI.br Agenda
SpamPots Project: Using Honeypots to Measure the Abuse of End-User Machines to Send Spam
SpamPots Project: Using Honeypots to Measure the Abuse of End-User Machines to Send Spam Marcelo H. P. C. Chaves [email protected] CERT.br Computer Emergency Response Team Brazil NIC.br Network Information Center
Development of an IPv6 Honeypot
Development of an IPv6 Honeypot Klaus Steding-Jessen [email protected] CERT.br Computer Emergency Response Team Brazil NIC.br Network Information Center Brazil CGI.br Brazilian Internet Steering Committee
Preventing your Network from Being Abused by Spammers
Preventing your Network from Being Abused by Spammers Marcelo H. P. C. Chaves [email protected] CERT.br Computer Emergency Response Team Brazil NIC.br - Network Information Center Brazil CGI.br - Brazilian Internet
Phishing and Banking Trojan Cases Affecting Brazil
Phishing and Banking Trojan Cases Affecting Brazil Cristine Hoepers [email protected]! Centro de Estudos, Resposta e Tratamento de Incidentes de Segurança no Brasil Núcleo de Informação e Coordenação do
Fraud and Phishing Scam Response Arrangements in Brazil
Fraud and Phishing Scam Response Arrangements in Brazil Marcelo H. P. C. Chaves [email protected] Computer Emergency Response Team Brazil CERT.br http://www.cert.br/ Brazilian Internet Steering Committee http://www.cgi.br/
The Importance of a Multistakeholder Approach to Cybersecurity Effectiveness
The Importance of a Multistakeholder Approach to Cybersecurity Effectiveness Abstract Area: ROADMAP FOR THE FURTHER EVOLUTION OF THE INTERNET GOVERNANCE ECOSYSTEM Entitled by: Cristine Hoepers, Klaus Steding-Jessen,
DNS Amplification Attacks as a DDoS Tool and Mitigation Techniques
DNS Amplification Attacks as a DDoS Tool and Mitigation Techniques Klaus Steding-Jessen [email protected]! Computer Emergency Response Team Brazil - CERT.br Network Information Center Brazil - NIC.br Brazilian
LACNIC 25 CSIRTs Meeting Havana, Cuba May 4 th, 2016
LACNIC 25 CSIRTs Meeting Havana, Cuba May 4 th, 2016 DDoS Atacks: Detection, Analysis and Mitigation Lucimara Desiderá [email protected] Klaus Steding-Jessen [email protected] Internet Governance in Brazil:
IX.br - Brasil Internet Exchange - Participants Diversity - 27th Euro-IX - 27 Oct 2015 - Berlin, Germany IX.br Engineering Team <eng@ix.
IX.br Engineering Team - 1 IX.br Brasil Internet Exchange Participants Diversity 27th Euro-IX 27 Oct 2015 - Berlin, Germany Eduardo Ascenço Reis Julimar Mendes
PTTMetro - PTT.br The Brazilian Metropolitan IXP Project http://ptt.br/
PTTMetro - PTT.br The Brazilian Metropolitan IXP Project http://ptt.br/ LINX 78 21st August 2012 Eduardo Ascenço Reis Antonio Galvao de Rezende Filho PTT.br Engineering
HoneyBOT User Guide A Windows based honeypot solution
HoneyBOT User Guide A Windows based honeypot solution Visit our website at http://www.atomicsoftwaresolutions.com/ Table of Contents What is a Honeypot?...2 How HoneyBOT Works...2 Secure the HoneyBOT Computer...3
The Brazilian Internet Steering Committee CGI.br Internet Governance Model in Brazil
ian Internet Steering Committee CGI.br Internet Governance Model in rev. July 2014 CGI.br - ian Internet Steering Committee NIC.br ian Network Information Center CETIC.br Center of Studies on Information
Peering in Brazil - Americas Interconnection Summit - April 7-10, 2015 in San Diego, CA - PTT.br <[email protected]> - 1
Peering in Brazil - Americas Interconnection Summit - April 7-10, 2015 in San Diego, CA - PTT.br - 1 Peering in Brazil - Americas Interconnection Summit - April 7-10, 2015 in San Diego, CA
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology. Project Proposal 1
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology Project Proposal 1 Project Proposal 2 Abstract Honeypot systems are readily used by organizations large and
CLARA: Security in Latin American Academic Networks
Jornadas sobre Seguridad Informática Buenos Aires, 1-7 Octubre, 2005 Liliana Velásquez Solha CAIS/RNP - Brazil Juan Carlos López Guel UNAM-CERT Mexico (on behalf of CLARA Latin American Cooperation of
Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia
Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia Helmi Rais CERT-TCC Team Manager National Agency for Computer Security, Tunisia [email protected] [email protected] Framework
Cyber security Country Experience: Establishment of Information Security Projects.
Cyber security Country Experience: Establishment of Information Security Projects. Mr. Vincent Museminali [email protected] Internet and New media regulations Rwanda Utilities Regulatory Authority
Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA
Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline
CALNET 3 Category 7 Network Based Management Security. Table of Contents
State of California IFB STPD 12-001-B CALNET 3 Category 7 Network Based Security Table of Contents 7.2.1.4.a DDoS Detection and Mitigation Features... 1 7.2.2.3 Email Monitoring Service Features... 2 7.2.3.2
How To Protect A Network From Attack From A Hacker (Hbss)
Leveraging Network Vulnerability Assessment with Incident Response Processes and Procedures DAVID COLE, DIRECTOR IS AUDITS, U.S. HOUSE OF REPRESENTATIVES Assessment Planning Assessment Execution Assessment
RNP Experiences and Expectations in Future Internet R&D
RNP Experiences and Expectations in Future Internet R&D CPqD, Campinas 23 September 2009 Michael Stanton [email protected] Director of Innovation Rede Nacional de Ensino e Pesquisa - RNP 2009 RNP Introduction
Security Management. Keeping the IT Security Administrator Busy
Security Management Keeping the IT Security Administrator Busy Dr. Jane LeClair Chief Operating Officer National Cybersecurity Institute, Excelsior College James L. Antonakos SUNY Distinguished Teaching
Dynamic Honeypot Construction
Dynamic Honeypot Construction 2nd Annual Alaska Information Assurance Workshop Christopher Hecker U. of Alaska, Fairbanks 9-5-2006 Presentation l Brief Introduction l Project Overview l Future Work l References
Traffic Monitoring : Experience
Traffic Monitoring : Experience Objectives Lebah Net To understand who and/or what the threats are To understand attacker operation Originating Host Motives (purpose of access) Tools and Techniques Who
Second-generation (GenII) honeypots
Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. [email protected] Abstract Honeypots are security resources which trap malicious activities, so they
Honeypot as the Intruder Detection System
Honeypot as the Intruder Detection System DAVID MALANIK, LUKAS KOURIL Department of Informatics and Artificial Intelligence Faculty of Applied Informatics, Tomas Bata University in Zlin nam. T. G. Masaryka
THE ROLE OF IDS & ADS IN NETWORK SECURITY
THE ROLE OF IDS & ADS IN NETWORK SECURITY The Role of IDS & ADS in Network Security When it comes to security, most networks today are like an egg: hard on the outside, gooey in the middle. Once a hacker
How to build and use a Honeypot. Ralph Edward Sutton, Jr. DTEC 6873 Section 01
How to build and use a Honeypot By Ralph Edward Sutton, Jr DTEC 6873 Section 01 Abstract Everybody has gotten hacked one way or another when dealing with computers. When I ran across the idea of a honeypot
PROFESSIONAL SECURITY SYSTEMS
PROFESSIONAL SECURITY SYSTEMS Security policy, active protection against network attacks and management of IDP Introduction Intrusion Detection and Prevention (IDP ) is a new generation of network security
IDS / IPS. James E. Thiel S.W.A.T.
IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods
Course: Information Security Management in e-governance. Day 1. Session 5: Securing Data and Operating systems
Course: Information Security Management in e-governance Day 1 Session 5: Securing Data and Operating systems Agenda Introduction to information, data and database systems Information security risks surrounding
INTRUSION DETECTION SYSTEMS and Network Security
INTRUSION DETECTION SYSTEMS and Network Security Intrusion Detection System IDS A layered network security approach starts with : A well secured system which starts with: Up-to-date application and OS
HONEYPOT SECURITY. February 2008. The Government of the Hong Kong Special Administrative Region
HONEYPOT SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without
Securing the system using honeypot in cloud computing environment
Volume: 2, Issue: 4, 172-176 April 2015 www.allsubjectjournal.com e-issn: 2349-4182 p-issn: 2349-5979 Impact Factor: 3.762 M. Phil Research Scholar, Department of Computer Science Vivekanandha College
Securing Web Applications...at the Network Layer
Securing Web Applications......at the Network Layer OWASP Spain Chapter Meeting 16 th June, 2006 Barcelona (ES) Carlos Fragoso Mariscal Chief Technical Director [email protected] Securing Web Applications
Palo Alto Networks. October 6
Palo Alto Networks October 6 Agenda Malware Trends by the numbers Protect Locally Share Globally Delivery methods 21.5% ~14% OF MALWARE HAS BEEN DELIVERED OVER APPS OTHER THAN WEB AND EMAIL IN 2015 8.2%
Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak CR V4.1
Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak CR V4.1 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents Table of Contents
Tunisia s experience in building an ISAC. Haythem EL MIR Technical Manager NACS Head of the Incident Response Team cert-tcc
Tunisia s experience in building an ISAC Haythem EL MIR Technical Manager NACS Head of the Incident Response Team cert-tcc 1 Agenda Introduction ISAC objectives and benefits Tunisian approach SAHER system
Networking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka
Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques
Firewalls & Intrusion Detection
Firewalls & Intrusion Detection CS 594 Special Topics/Kent Law School: Computer and Network Privacy and Security: Ethical, Legal, and Technical Consideration 2007, 2008 Robert H. Sloan Security Intrusion
Εmerging Ways to Protect your Network
Εmerging Ways to Protect your Network From Vulnerability Scanning to Real-time Monitoring and Detection of Cyber-attacks Konstantinos Xinidis Software Engineer [email protected] Development Dept.,
Security Toolsets for ISP Defense
Security Toolsets for ISP Defense Backbone Practices Authored by Timothy A Battles (AT&T IP Network Security) What s our goal? To provide protection against anomalous traffic for our network and it s customers.
Internet Security Firewalls
Overview Internet Security Firewalls Ozalp Babaoglu! Exo-structures " Firewalls " Virtual Private Networks! Cryptography-based technologies " IPSec " Secure Socket Layer ALMA MATER STUDIORUM UNIVERSITA
How To Stop A Ddos Attack On A Network From Tracing To Source From A Network To A Source Address
Inter-provider Coordination for Real-Time Tracebacks Kathleen M. Moriarty 2 June 2003 This work was sponsored by the Air Force Contract number F19628-00-C-002. Opinions, interpretations, conclusions, and
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
Intrusion Detection Systems (IDS)
Intrusion Detection Systems (IDS) What are They and How do They Work? By Wayne T Work Security Gauntlet Consulting 56 Applewood Lane Naugatuck, CT 06770 203.217.5004 Page 1 6/12/2003 1. Introduction Intrusion
Configuring Security for SMTP Traffic
4 Configuring Security for SMTP Traffic Securing SMTP traffic Creating a security profile for SMTP traffic Configuring a local traffic SMTP profile Assigning an SMTP security profile to a local traffic
Network Service, Systems and Data Communications Monitoring Policy
Network Service, Systems and Data Communications Monitoring Policy Purpose This Policy defines the environment and circumstances under which Network Service, Systems and Data Communications Monitoring
Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak DR V2.0
Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak DR V2.0 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents Table of Contents
Network reconnaissance and IDS
Network reconnaissance and IDS CS642: Computer Security Professor Ristenpart h9p://www.cs.wisc.edu/~rist/ rist at cs dot wisc dot edu University of Wisconsin CS 642 Let s play over the network Target
Application Firewalls
Application Moving Up the Stack Advantages Disadvantages Example: Protecting Email Email Threats Inbound Email Different Sublayers Combining Firewall Types Firewalling Email Enforcement Application Distributed
HONEYD (OPEN SOURCE HONEYPOT SOFTWARE)
HONEYD (OPEN SOURCE HONEYPOT SOFTWARE) Author: Avinash Singh Avinash Singh is a Technical Evangelist currently worksing at Appin Technology Lab, Noida. Educational Qualification: B.Tech from Punjab Technical
8. Firewall Design & Implementation
DMZ Networks The most common firewall environment implementation is known as a DMZ, or DeMilitarized Zone network. A DMZ network is created out of a network connecting two firewalls; i.e., when two or
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router
Erasmus Mundus External Cooperation Windows. EU-BRAZIL STARTUP Call for applications outcome 08/02/2010
L15a0900007 L15a0900027 L15a0900041 L15a0900051 L15a0900057 L15a0900080 L15a0900081 L15a0900084 L15a0900088 L15a0900090 L15a0900093 L15a0900095 L15a0900096 L15a0900099 L15a0900106 L15a0900107 L15a0900115
Glasnost or Tyranny? You Can Have Secure and Open Networks!
AT&T is a proud sponsor of StaySafe Online Glasnost or Tyranny? You Can Have Secure and Open Networks! Steven Hurst CISSP Director - AT&T Security Services and Technology AT&T Chief Security Office 2009
How to build and run a Security Operations Center
How to build and run a Security Operations Center v1.1 Nicolas FISCHBACH Senior Manager, Network Engineering Security, COLT Telecom [email protected] - http://www.securite.org/nico/ About Nicolas Fischbach
Xerox Multifunction Devices. Network Configuration. Domain 2. Domino Server 2. Notes. MIME to Notes. Port. Domino. Server 1.
Xerox Multifunction Devices Customer Tips September 17, 2003 NOTE: Information in this document applies to the following multifunction device software levels: WorkCentre Pros - all software levels DC 555/545/535
Taxonomy of Intrusion Detection System
Taxonomy of Intrusion Detection System Monika Sharma, Sumit Sharma Abstract During the past years, security of computer networks has become main stream in most of everyone's lives. Nowadays as the use
Managed Intrusion, Detection, & Prevention Services (MIDPS) Why E-mail Sorting Solutions? Why ProtectPoint?
Managed Intrusion, Detection, & Prevention Services (MIDPS) Why E-mail Sorting Solutions? Why ProtectPoint? Why? Focused on Managed Intrusion Security Superior-Architected Hardened Technology Security
AlienVault. Unified Security Management (USM) 5.x Policy Management Fundamentals
AlienVault Unified Security Management (USM) 5.x Policy Management Fundamentals USM 5.x Policy Management Fundamentals Copyright 2015 AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,
ΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
Server Protection Policy 1 1. Rationale 1.1. Compliance with this policy will help protect the privacy and integrity of data created by and relating
Server Protection Policy 1 1. Rationale 1.1. Compliance with this policy will help protect the privacy and integrity of data created by and relating to all users of UNH IT resources, and improve the availability
Cisco Security Intelligence Operations
Operations Operations of 1 Operations Operations of Today s organizations require security solutions that accurately detect threats, provide holistic protection, and continually adapt to a rapidly evolving,
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access
IBM Security QRadar SIEM & Fortinet FortiGate / FortiAnalyzer
IBM Security QRadar SIEM & Fortinet / FortiAnalyzer Introducing new functionality for IBM QRadar Security Intelligence Platform: integration with Fortinet s firewalls and logs forwarded by FortiAnalyzer.
SESA Securing Email with Cisco Email Security Appliance Parts 1 and 2
Course Overview Securing Email with Cisco Email Security Appliance (SESA) combines Parts 1 and 2 (SESA1, SESA2) into a single three day course. Students learn to use Cisco Email Security Appliances (ESA's)
DDoS Protection on the Security Gateway
DDoS Protection on the Security Gateway Best Practices 24 August 2014 Protected 2014 Check Point Software Technologies Ltd. All rights reserved. This product and related documentation are protected by
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak Capture Link Server V1.00
Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak Capture Link Server V1.00 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents
VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION
VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION Kleissner & Associates Botconf 14, 3-5 Dec 2014, Nancy/France Worlds largest botnet monitoring system Since September 2012 Originally
Firewalls and Intrusion Detection
Firewalls and Intrusion Detection What is a Firewall? A computer system between the internal network and the rest of the Internet A single computer or a set of computers that cooperate to perform the firewall
The Information Security Problem
Chapter 10 Objectives Describe the major concepts and terminology of EC security. Understand phishing and its relationship to financial crimes. Describe the information assurance security principles. Identify
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports Building a Security Operation Center Agenda: Auditing Your Network Environment Selecting Effective Security
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
Many network and firewall administrators consider the network firewall at the network edge as their primary defense against all network woes.
RimApp RoadBLOCK goes beyond simple filtering! Many network and firewall administrators consider the network firewall at the network edge as their primary defense against all network woes. However, traditional
CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013
CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Configuration Example
Configuration Example Set Up a Public Web Server Behind a Firebox Example configuration files created with WSM v11.10.1 Revised 7/21/2015 Use Case In this configuration example, an organization wants to