Itet2 its counter recon
0 likes212 views
This document discusses the importance of counter reconnaissance and log analysis to detect and prevent security threats. It recommends logging large amounts of system and network activity daily, centralizing logs for easier analysis, and using log analyzers and intrusion detection software to mine logs for anomalies or attacks. Examples provided demonstrate analyzing Linux and firewall logs, as well as using security information and event management tools to correlate events across systems.
1 of 9
Downloaded 12 times
More Related Content
Viewers also liked (13)
Ad
Similar to Itet2 its counter recon (20)
Ad
More from Morten Nielsen (9)
Recently uploaded (20)
Itet2 its counter recon
- 2. Basic profile Reconnaissance Open sources
- 3. “Internal” and other privileged sources Attack DoS
- 4. Intrusion
- 5. Counter reconnaissance Purpose Know that they are looking, before they break in. Result of good counter reconnaissance Determine methodology
- 7. Prevention
- 9. Log, logs, logs, logs Huge amounts of information. Use it! (Daily?)
- 10. Use log analysers to data mine
- 11. Decentralized log are difficult, centralized are easier to analyse.
- 12. Log example Linux examples: see /var/log Ex. on the ipcop firewall
- 13. Log software Cloud based logs Loggly Log-based intrusion detection OSSSEC Web log analysis Analog example
- 14. AWstats example
- 15. Intrusion detection Sectools top 5 Bonus question: What happens when an IDS detects an intrusion?
- 16. SIEM Security information and event management
- 17. What is that? Light reading on the topic may be found here .
- 18. Exercise What is found in the logs? As an alternative: your windows or linux machine
- 19. Any interesting events? Try the different nmap detection schemes
- 20. Are they detected? Install snort and try again.