Collaborate Disseminate
The other day I was talking with a service provider (MSSP) who has experience with operating SOC (security operations centre) 24×7. Their price was rather steep (in the millions range). I don’t understand why it would be so steep. My impre… Continue reading Setting up own enterprise SOC
I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
Continue reading What are the difference between IPS and WAF in terms of DDoS?
I am using pfsense as a firewall, and I would like to know how I can stop network scans from enumerating open services and ports.
The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS:
Passive IDS: the IDS only reports that there was an intrusion.
Active IDS: the IDS also takes actions against th… Continue reading Difference between IDS and IPS and Firewall
The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS:
Passive IDS: the IDS only reports that there was an intrusion.
Active IDS: the IDS also takes actions against th… Continue reading Difference between IDS and IPS and Firewall
Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the radar and would typically go … Continue reading How could malware like Stuxnet be detected?
I have recently installed the Security Onion distro for Ubuntu.
This distro does a great job of combining multiple tools like snort/Suricata, Sguil, Snorby, Elsa, bro ids, Squert, etc. Within my Security Onion the installati… Continue reading Security Onion: Snorby alerts show all local network source IP (public and private)
I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started reading the research paper “D… Continue reading Symbiote Counter-Attack Detection
I realize there is already a question similar to this one, but this is somewhat of a follow-up.
I understand that a reverse proxy server by itself is hardly useful as a web app security measure because it just kind of “hides” the server b… Continue reading Open source or common implementations for reverse proxy web application security
What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work?
alert ip any any -> any any ( msg: “ICMP packet detected!”; sid: 1; )
That is, using its… Continue reading Testing Snort IDS installation