I have been given the task of configuration audit as my first task in my first job. As a challenge I have to find vulnerabilities by reading the logs of the PuTTy session and I do not have access to the console.
Please share if you have any links to read and learn about doing config reviews of IDS/IPS. Particularly,
What are some of the common mistakes that are found during the configuration audit of IPS/IDS?
I am looking for something along the lines of this. Only since I have do not have access to the console, I have to read in between lines to find vulnerabilities. Through the configuration, if I find something like:
manage telnet status set enable. I know that telnet is enabled, so I will report it as a finding.