Reputation
Top tag
Next privilege 100 Rep.
Edit community wikis
Badges
7
Impact
~534 people reached

  • 0 posts edited
  • 0 helpful flags
  • 13 votes cast
Jul
18
comment Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?
@JohannSchwarz Last time I used that it was called ProcMon
Jul
18
revised Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?
Added procmon-link
Jul
17
answered Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?
Sep
24
awarded  Autobiographer
May
24
awarded  Teacher
May
24
answered Information Security Career tracks - Academically vs. IT certifications
May
24
comment How does changing your password every 90 days increase security?
That is the same result that I got after talking to some security auditing people about the sense of ISO 270001 - especially the password-change policy. It was their opinion that frequent password changes force bad passwords. Whereas a good password does not have to be changed that frequently.
May
11
awarded  Commentator
May
11
comment Physical computer security, how to disable USB ports when the computer is 'locked'?
Even so - do you have that problem if you set your default-runlevel to 3 in /etc/inittab, too? I see no reason to run a graphical GUI on a linux server.
May
10
comment Physical computer security, how to disable USB ports when the computer is 'locked'?
On Linux USB-devices are not normally automounted. Normally you need root-access to do so. What Linux are you talking about here?
May
10
answered Physical computer security, how to disable USB ports when the computer is 'locked'?
Apr
30
answered Integrity monitoring for a LAMP server
Apr
30
comment Is there an IDS based on process patterns?
@Polynomial hey - you are triggering a segfault! Is OSSEC the way to go?
Apr
28
awarded  Promoter
Apr
28
revised Is there an IDS based on process patterns?
reduced question to its core.
Apr
20
comment Is there an IDS based on process patterns?
Snort is network based. Is there nothing like an IDS based on process patterns (HIDS) that reacts like the OOM-killer (killing malicious sub-processes)? That would even lead to a process-based HIPS...
Apr
20
awarded  Editor
Apr
20
revised Is there an IDS based on process patterns?
added "maintain" to "configure"
Apr
19
comment Is there an IDS based on process patterns?
I still think that blacklisting is more easy to maintain in my scenario - have you got some pointers to heuristic process analysis HIDS systems?
Apr
19
comment Is there an IDS based on process patterns?
I just read a little bit on the OSSEC page - this seems to be pretty much like logwatch plus fam/aide/samhain/beltane. I did not find a reference to watch for unusual process patterns though. Can you provide me a pointer to that, please?