Tag Info

Hot answers tagged

272

One thought is to not allow form submission if there is not a value in the password box. Generally if they accidentally entered the password in the username, then there likely isn't going to be anything in the password dialog. It is worth noting that this does not have to be simply done client side, but could also be done on a server as long as the ...


27

Assuming your backend application and SIEM needs to view failed login attempts to various applications (and thus show the "User P@$$w0rd is not valid" error message) then it is not going to be trivial to stop this. However, ensuring that all applications that send sensitive data including usernames and passwords implement HTTPS (encrypted HTTP using SSL) is ...


18

So the problem is that you don't want analysts to see the passwords in the sensitive log files? Caution: Even if you were to use Javascript it doesn't deal with the password data that is stored on your disk in plain text. A better solution is to preprocess the logs before the analysts see them and redact information in the logs. You can do this ...


17

I can only identify three problems with what you're discussing. Users aren't inputting information correctly. Analysts can discern passwords from logs. Passwords are being sent in clear-text and are susceptible to man-in-the-middle eavesdropping. In my opinion, this is fairly simple to fix. Accept user error, grudgingly. Don't log invalid usernames, ...


10

A solution I have seen a few banks implement, at least in web apps, is to have a two page login. On the first page accept only the username On the next page in the process request the password and only echo the username back so it is not an editable field Therefore the only input on the second page should be the password. Since the user knows they must ...


7

This answer is intended to be somewhat abstract, but why not just use a AJAX call on form submit that will validate the username first, and if the JSON encoded result comes back evaluating as boolean true, then allow your form submit to proceed, otherwise return false in the Javascript code to prevent form submission from taking place. Using jQuery: ...


7

Due to the sensitive nature of APT and that it is closely aligned to espionage, the only real way to get a suitable feed will be through Government or National Law Enforcement agencies. The difficulty will be in establishing a level of trust to enable the sharing of information. For organisations within the USA, the advice is to contact your local FBI ...


7

There are two reasons why pre-filtering is done: to save on the EPS (Events Per Second) rate and to reduce the noise. Every SIEM technology has a maximum EPS analysis capability which are restricted either by the hardware or by the software license. When events exceed that limitation, the SIEM server begin to drop the packets. That is why you would only want ...


6

Here is some experience about establishing projects, especially security projects, that applies to consulting and outsourcing that I wrote up on a security stackexchange answer about incident compromises. As for resources, well it is highly dependent on your environment as to what you would need to build and how many people to hire (and at what levels of ...


6

Here are a few different features you should consider, note that you might not need all of these, and one might not be better than the other - but they are points to consider: Coverage: Windows Event Log on servers, all current versions Windows Event Log on clients, all versions in your org (you'd be surprised how many Win98s there still are...) syslog on ...


4

For OSSEC you can generate new keys for every agent that will be reporting to the OSSEC server installed in the OSSIM server (check Analysis | Detection | HIDS) For Snort, the most easy and recommended way is install an OSSIM sensor profile, that comes with the Snort up and provides you the new rules using the command alienvault-update But if you are not ...


4

Solely from the information in your question, narrowing down that list of 86 is not going to be easy - I had a quick flick through as I know a fair few of the top names. Some points: SIEM solutions should all be able to run log correlation type activities Most include device insertion logging and Tripwire type checks (or can incorpoprate Tripwire or any ...


4

Enterprise tools which correlate related security and logs events are generally called Security Information and Event Management (SIEM) systems. Most are designed to accept data from common log formats, IDS alerts, antivirus, firewall rule changes etc. ArcSight(purchased by HP) http://www.arcsight.com/ Very expensive. It's a beast to setup, a beast to ...


3

Looks like a good start from a db outward view by analyzing logs. You'll have the inevitable tradeoff of performance vs amount of logging so give actual numerical requirements in your RFP. You should also take into account the environment around the database. One example is validate the software that accesses the database had static scanning done to find sql ...


3

http://chuvakin.blogspot.com/2011/03/updated-free-log-management-tools.html The above link lists a few tools which are really going to stick out above others, such as that Novell Sentinel Log Manager 25 appears to be better than Splunk if you are starting out and aren't funded by a Global 200 company Q1Labs appears to be attempting to compete with ...


3

If the requirement is purely storage (no active analysis required), then it would seem sensible to encrypt the data using GPG/PGP or similar before sending to the offsite facility. At that point from a security standpoint the primary issues are availability of the data to be accessed when required, so it'd be important for the provider to be able to prove ...


3

I don't know whether they have specific SIEM/IDS feeds, but a good intelligence source historically has been iDefense (now part of Verisign - http://labs.idefense.com/). Historically (prior to the security research they're more well known for now) iDefense were a commercial intelligence organisation, and spent a lot of time tracking organised crime and ...


3

Here's a simple answer: Log everything. Everything that can be captured, send it along to your SIEM server. Your focus should be on selecting and implementing an SIEM server that can handle that volume of data and can be used for alerts and reports that provide meaningful security-related information without too many false positives. You should not focus ...


3

This is a mind-blowingly huge question. What you need to log is business specific need. Typically, you want to log administrative logins and changes. But still that is pretty basic. What you need is a better understanding from the people who drive you organization on what systems are important. A good business continuity plan with some risk assessments ...


3

In this day and age most commercial SIEM/SEIM/SIM/SEM/SEEM/CSIM/SCIM/SIM products ship with a large multitude of so called "canned reports". In general each of these reports will be designed to look at specific logs from specific types of systems and process those. For example, given a "Windows - Failed Authentication Attemps" report, one would assume that ...


3

It depends on what kind of event you're considering an incident. There is information you can use to report against realtime (connecting USB devices for instance) that won't necessarily report in the security log. Further service restarts and other relevant events that could be related to security events. Logs for antivirus, and firewalls can be sent as ...


3

From your title it appears you are asking what security incident response and detection technologies are unique to large enterprise environments? Unique technology: A central Security Information and Event Management (SIEM) system - large organizations need to be able to centrally gather logs and alerts from a large number of disparate systems (e.g. ...


3

I realize that this already has an accepted answer but this is a quick summary of how to set this up. snort.conf output alert_syslog: LOG_DAEMON LOG_ALERT rsyslog.conf daemon.* @alienvault-server ossim_setup.conf detectors=...,snort_syslog,... snort_syslog.cfg location=/var/log/daemon.log


3

I personally use Splunk for this very thing. It is free up to 500MB of logs parsed daily, and has a robust search/correlation/dashboard functionality. Plus, it can run Python scripts natively so that you can generate your own data from custom sources. For example, comparing a list of who is supposed to be working with the list of logged in users would be a ...


3

From what you describe of your architecture, this is infeasible, but in my opinion the correct solution is: Don't send the username in the clear, and don't log usernames of failed login attempts. The only place the username and password should go is to the subsystem which checks the password; until that occurs, the username is unauthenticated, arbitrary data ...


2

+1 for schroeder's splunk suggestion. It has quite an exotic learning curve, with basic searches availabe in literally minutes, then it took me a day to understand how to build a complex search. Two more days to have a set of charts (limelines, breakdowns, gauges). I then realized that it makes more sense to create saved searches and work from thre (you ...


2

I like the approach that my current company takes to this problem: if you type your password into the wrong box, an automated system causes your password to expire immediately. Thus the user has to change their password, and the password that is in the log is now no longer vulnerable. Of course, this is still not ideal if the user is still using that ...


2

Client side javascript seems reasonable. Check password field is not empty, prior to submission. Check that the username is in a valid form. Especially elegant is something where the username is required to be an email address. You could additionally forbid password at your password set/change mechanism from being in the form of an email address. Then ...


2

Generally speaking, all client Code are Smart Enough to handle Basic Errors User ID and or Password Missing Password not matching the Guidelines So in any case when you are still seeing these entries in the Log, User P@$$w0rd does not exit [...] An account failed to login: P@$$w0rd [...] None of the Client Validation worked and the System ended up ...


2

The general problem is password-based authentication. Every mom-and-pop shop insists on having own authentication with passwords. This is stupid. Let some other identity provider do the hard work of keeping credentials secure. Do the same as StackOverflow does: allow authenticating with OpenID, Gmail, etc. Your users will thank you for not needing yet ...



Only top voted, non community-wiki answers of a minimum length are eligible