10,206 reputation
33476
bio website secopsmonkey.com
location Dublin, OH
age 34
visits member for 3 years, 7 months
seen 2 hours ago

Security Engineer in the health care field. I get hot for automation, vulnerability management, and hardening.

http://www.linkedin.com/pub/scott-pack/3/689/76a


May
8
comment System Hardening: Outsource to Security Expert or have Sys Admin do it?
@SuziG: It really does. We're all in this together. Thinking otherwise leads to siloism which ends up being rather unpleasant for everyone involved.
Apr
7
comment Log Attacks in Different Files using Snort
Oh sure, it's an available feature but it seems pretty unnecessary for his use case. The most correct method would be to do post processing in your log aggregation system, however that may not necessarily be applicable and preprocessing may be the most logical solution. I wouldn't hold your breath for multithreaded, though. It won't happen until v3 which has effectively been "any day now" for how many years?
Apr
7
comment Log Attacks in Different Files using Snort
Multi-threaded is the primary feature that's been consistently stated, "Coming in 3.0". However they keep backporting 3.0 planned features into the 2.9 series, just not that one. Multiple instances is, unfortunately, still the only way to spread out load beyond one core.
Feb
2
comment Why aren't anomaly-based intrusion detection schemes implemented in Snort?
@Yas: No, it's not. It's simply thresholding based on source/destination connections over time. This could be done in a signature but is much more efficient in a preprocessor.
Feb
1
comment Protecting MYSQL with Fail2Ban?
You could always firewall off to the IP range of the clients.
Jan
16
comment Snort alert log simple question
@user1880405: If the SIDs are different then they're different rules. Sometimes there are multiple ways of detecting specific behavior and it necessitates different rules. The {TCP} bit is probably being added in by whatever front-end you're viewing the alerts with.
Dec
22
comment Does the haystack theory work
For a full understanding of password complexity from the position you're starting would require a bit of a treatise.
Dec
16
comment Course of action with this malware
@danielAzuelos: Indeed, though it can often be tricksome to determine the date unless you did something out of the ordinary or the code was buggy enough to start causing problems immediately.
Dec
16
comment Where did common “minimum password length” guidelines originate?
This is totally a test comment.
Nov
6
comment Using only a firewall, how do I protect a database server from be exposed?
@yzT: Everything until my last paragraph assumes the switch is a simple frame pusher. In truth, it depends on the switch.
Nov
6
comment Difference between IDS and IPS and Firewall
@yzT: For traditional devices yes, but it's important to remember that things are starting to change. Also see Web Application Firewalls which specifically watch HTTP/HTTPS traffic and can even be adaptive to learn what normal web traffic looks like and reject the abnormal stuff.
Oct
29
comment Bruteforce on 10 characters length WPA2 password
This post is a bit of a mess. I started to edit it into shape but soon got lost with not being able to figure out what belongs together. Can you please clean it up to use code blocks, where appropriate, better formatting, punctuation, and other types of readable grammar?
Oct
17
comment How do you destroy an old hard drive?
@AJMansfield: Not to mention badass magnets. I've used them in place of hangers for storage bins and one of our auditors used them as bolt-holders when working on her Jeep.
Oct
9
comment How should I store and maintain secure configuration documents?
While having baselines is admirable, requiring admins to process them as manual scripts is rather unfortunate. An admin can maliciously skip steps they don't want to do, or miss some because they received a phone call. This really needs to be automated into a provisioning and configuration management tool. That way you can master your baselines so that all systems start out exactly the same and your configuration management system handles the deviations from baseline.
Sep
16
comment Popular Security “Cargo Cults”
@Rook: It's all pipes! What's the difference?!
Sep
6
comment Did US and UK spy agencies defeat privacy and security on the internet?
I'm impressed. One of the few times Schneier is actually relevant and not overblown.
Aug
20
comment Risks of Mullions in High Security Areas
@this.josh: 6252 Somerled Avenue in Montreal's West End.
Aug
13
comment Risks of Mullions in High Security Areas
@this.josh: How is that a different risk than drilling through the door, door frame, or wall?
Jul
25
comment Deduplication of Encrypted Files
This is pretty great. I find this pretty dang helpful.
Jul
25
comment Deduplication of Encrypted Files
@tylerl: Oh definitely. To do a real quantitative analysis then yes, that information is required. This was a more theoretic question so I could have generic conversations with storage and/or DB people. Presumably before the analysis occurred.