0
votes
1answer
46 views

Industry standards for threat names

One of the security appliances we own reports a so-called "Industry Name" for the threats it detects on the network. I wanted to know if there is really such a standard and where I can find ...
0
votes
1answer
121 views

Cryptic threat names

I have logs from a security appliance from Damballa which has cryptic names for threats observed in a network which I am trying to make sense of. Some examples of these threats are "RedTreeBruisers" , ...
3
votes
7answers
296 views

How does an IDS identify a computer ?

How does an IDS identify a computer on the network. I mean do IDS' actually check whether a device is actually what it claims to be ? If so what factors does it check (MAC etc) ? For e.g. if a ...
4
votes
2answers
504 views

Event monitoring for a home network

I'd like to utilise some of the free SIEM type products out there to increase the chances that I will detect attacks and compromises of any of the devices on my home network. Most of my home devices ...
-1
votes
1answer
72 views

What steps are performed when a serious event reaches an Intrusion Detection System? [closed]

For example, you are using Snort and you just got a serious event, which states that a certain service is attacked. What do you do with the threat source IP? What are the steps that network event ...
2
votes
1answer
2k views

Snort/IDS detect and alert on possible DoS/DDoS attack?

As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack. Looking at the rulesets, which are primarily signature based rules, I can't see a ...
0
votes
1answer
64 views

How to specify a Snort rule connection duration?

Is it even possible to specify into a snort rule the duration of a connection? For example: in this format Hour, Minute, Second H, M, S = 0, 2, 1 If a connection that has the duration of 2 minutes ...
2
votes
1answer
442 views

How to add wildcards to snort rule ip address?

Is it possible to add wildcards or something that would function like them to a snort rule IP address? For example: If I'd like to detect source-ip of: 192.168.*.9 Where the third octet can be ...
1
vote
2answers
235 views

Intrusion Prevention Systems: NIPS vs NBA

I was going through the wikipedia article on Intrusion Prevention Systems. It states two of the four types of IPS as follows: Network-based intrusion prevention system (NIPS): monitors the entire ...
3
votes
2answers
388 views

Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?

I understand that there are many applications such as Snort that do the job for network layer 3 IDS. From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
3
votes
1answer
774 views

Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?

I'm trying to develop an IDS/IPS system project to include these elements: A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client) ...
5
votes
2answers
279 views

How did Evernote detect the security breach?

http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/ Evernote's official message says little about technical details of the attack and how it was detected. ...
1
vote
2answers
363 views

What type of data does Snort log?

This is new to me, but what types of data does Snort log for Network Intrusion Detection? I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
5
votes
1answer
119 views

Symbiote Counter-Attack Detection

I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started ...
2
votes
2answers
280 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
1
vote
1answer
368 views

Examples for (Web-)Security-Architectures

I just started to work on my thesis to finish my studies. However the field in which I write my thesis is pretty much new to me. I have the task to build a "Remote-Access Strategy/Architecture" to ...
3
votes
2answers
168 views

Is this enough for an NIDS

I am doing my senior project on network intrusion detection system (ethernet networks) and I am having a bit of trouble deciding if I have added enough features. Currently the system detects the ...
5
votes
2answers
1k views

Snort Sensor Placement

I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
4
votes
1answer
438 views

Outbound TFTP request to 255.255.255.255

Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255 Anyone have a clue as to what this may ...
1
vote
3answers
202 views

will all instrusion dectection will become host-based? [closed]

Will all intrusion detection become host-based once all network packets have been encrypted?
2
votes
2answers
769 views

Is traffic sent by Mouse Without Borders encrypted?

Some of our users have installed Mouse Without Borders and I wanted to know if it is possible to intercept the traffic being sent between the two computers and read it in some meaningful manner. I was ...
2
votes
1answer
282 views

Stateful Signatures in an IPS

I am researching IPS devices and their signatures both stateful and stateless. The test network I am looking to implement the IPS in has asymmetric traffic so stateful inspection would be nearly ...
0
votes
1answer
106 views

Is there a Snort rule that equates to “something suspicious flagged from a client side application?”

The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
5
votes
2answers
7k views

Detecting the presence of wifi devices

Is it possible, with a normal wifi adapter, to detect present wifi devices in the surrounding? Let's say, is it possible to detect an Iphone with wifi switched on in the range of my wifi adapter? ...
1
vote
1answer
431 views

types of intrusions on host [closed]

I am implementing an IDS and just want to know that what are the possibilities with which the intrusion can occur.I am just doing a literature survey over the atacks possible so I want to know that ...
2
votes
2answers
609 views

How can an IPS\IDS detect SQLi \ XSS (or other application layer) attacks?

I've been thinking about how an IPS works, and as far as I know it inspects the packets on the TCP\IP layer. How can it detect attacks on higher levels without harming the user experience? How does ...
8
votes
2answers
196 views

Can you tell if an attack is successful by looking at IPS logs?

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
0
votes
2answers
1k views

How do we protect our server from anonymous hacker? [duplicate]

Possible Duplicates: Hardening Linux Server How to best defend against Targeted Attacks? I read this news: Anonymous hacker group hits Apple, publishes data My question: How do we ...
5
votes
3answers
601 views

Best practice for creating an initial IPS policy

I see that most IPS available in the market comes with a basic pre-defined policy which administrators can base on when creating their initial IPS policy. However, these policy may be insufficient and ...
17
votes
5answers
6k views

Do you detect/react to DNS tunnelling?

I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
4
votes
3answers
351 views

Information gathering before deploying a Network IPS

I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
4
votes
2answers
462 views

Has anyone else seen commands embedded in an ICMP echo request?

My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload. The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP ...
6
votes
3answers
378 views

How can an IPS be fingerprinted?

I'm not trying to solve a current technical problem but I came across this and have been wondering how it's done. Intrusion Prevention Systems are supposed to let all network traffic pass through and ...
4
votes
2answers
1k views

Can you have 2 promiscuous (sniffing) ports on a single machine?

I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?
3
votes
1answer
201 views

Checkpoint NGX IPS & NAT

how does CheckPoint R65/R70 handle IPS violations of outbound traffic from hosts that are NAT'ed? Is it necessary to include the NAT'ed IP in the exceptions list or is it sufficient to include the ...
12
votes
2answers
5k views

How do Intrusion Detection Systems (IDS) work?

How do Intrusion Detection Systems (IDS) work? As I understand it, they monitor network traffic but what exactly do they look for? How can they tell apart regular activity from intrusions?
16
votes
3answers
921 views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
1
vote
1answer
163 views

What is your experience with AlertLogic?

Do you have any insight, or experience (good or bad) regarding AlertLogic? In what areas can they improve, what areas are they lagging in?
5
votes
3answers
621 views

How do I identify an unknown port/protocol that my IDS picks up?

Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the ...
7
votes
3answers
407 views

Popularity of Anomaly based IDSes

I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...
6
votes
4answers
571 views

Is Stonesoft's “advanced evasion technique” a major problem?

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...
5
votes
2answers
139 views

Managing a team of IDS experts; how would you orgainze your team?

Suppose you are managing a team of Intrusion Detection Experts: ...what are the functional areas of the IDS knowledge space would you group your team into? ...how would you structure your team? ...