Author Archives: SANS Internet Storm Center, InfoCON: green

Why and How You Should be Using an Internal Certificate Authority, (Thu, Apr 15th)

Posted on by

Yesterday, Google released Chrome 90, and with that “HTTPS” is becoming the default protocol if you enter just a hostname into the URL bar without specifying the protocol [1]. This is the latest indication that the EFF&#39&#x3b;s “HTTPS Everywhere” initiative is succeeding [2][3]. Browsers are more and more likely to push users to encrypted content. While I applaud this trend, it does have a downside for small internal sites that often make it difficult to configure proper certificates. In addition, browsers are becoming pickier as to what certificates they accept. For example, in the “good old days”, I could set up internal certificates that were valid for 10 years, not having to worry about the expiring. Currently, browsers will reject certificates valid for more than 13 months (398 days) [4].

Continue reading Why and How You Should be Using an Internal Certificate Authority, (Thu, Apr 15th)→

Posted in Uncategorized


Building an IDS Sensor with Suricata & Zeek with Logs to ELK, (Sat, Apr 10th)

Posted on by

Over the past several years I have used multiple pre-built sensors using readily available ISO images (rockNSM, SO, OPNSense, etc) but what I was really looking for was just a sensor to parse traffic (i.e Zeek) and IDS alerts (Suricata) to ELK. To speed up the deployment of each sensors, I created a basic CentOS7 server VM where I copied all the scripts and files, I need to get Suricata & Zeek up and running. Since my ELK cluster is the recipient of these logs, it includes Elastic filebeat. I saved all the important scripts and changes into two tarballs (installation and sensor). The sensor tarball has a copy of the softflowd (netflow binary) that can be use to capture netflow data.

Continue reading 
Building an IDS Sensor with Suricata & Zeek with Logs to ELK, (Sat, Apr 10th)→

Posted in Uncategorized