Monitoring is the act of looking on the processes or systems for performance, supervision and surveillance.
1
vote
0answers
53 views
Intrusion prevention in windows azure?
When using the Windows Azure IAAS servers how does one setup IPS for all incoming traffic to these servers? How would a regular user who runs his whole environment within Azure make sure that he can ...
2
votes
2answers
49 views
Securely share audio files
I work for an insurance broker that sometimes has to share our customer calls with the insurance company we are underwriting for.
Generally this means retrieving the call from our call recording ...
1
vote
1answer
180 views
Major differences between Kali and SecurityOnion
Curious about the major differences between Kali Linux and SecurityOnion. Do you think it would be easy or useful to replicate what has been done with SecurityOnion on Kali? Why is there such a ...
3
votes
3answers
102 views
Log Attacks in Different Files using Snort
How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
0
votes
2answers
73 views
Corporate IT monitoring and access to user private data (keylogging? https data transmission?) [closed]
I work at a large company that requires employees to sign a digital certification saying that we recognize the right of the said company to monitor all data and communication on our work laptops, and ...
1
vote
1answer
62 views
Blocking Internet Monitoring Software
So if a provider has software that blocks you from using their internet to connect to, say, Spotify or Skype. Is there a way to block your computer from communicating that this program is running? Or ...
2
votes
2answers
808 views
SSL VPN Detection and possible to block
Is it possible to determine the difference between a VPN on port 443 compared to standard SSL traffic?
In order to access SSL websites you need port 443 open but if you setup a VPN Service on port ...
-2
votes
1answer
177 views
Identifying Visitor's using Proxy [duplicate]
I want to detect my website visitor's using any duplicate proxies ?
If so how to avoid them? also how to identify the proxy is an HTTP proxy or a SOCKS proxy ?
0
votes
1answer
168 views
Figure out how internet access is being monitored [closed]
I suspect that someone is monitoring my internet connection.
Said person has revealed information about sites I visit and online conversations (Facebook) even when I am not using his/her network.
...
3
votes
1answer
108 views
How to secure MySQL data from changes?
I'm looking for a way to secure MySQL data in particular tables for example settings table.
Ideal solution would hook up to database and log all INSERT, UPDATE and DELETE requests to particular ...
1
vote
2answers
551 views
Sending Syslog/SNMP information over the internet using standard UDP port 514
I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends ...
1
vote
1answer
177 views
EMET and AntiVirus
I've just heard about and started playing with EMET and I am curious, do any AV or security suite applications do what EMET does or is EMET something entirely different?
-1
votes
2answers
114 views
ISMS for SMB (Small And Medium Enterprise)? [closed]
Is there an Information Security Management System (ISMS) existing for SME/ SMB, if not why ?
The so called GRC suites are mainly targeted towards Fortune 100 (may be up to fortune 1000) companies , ...
2
votes
1answer
78 views
What kind of monitoring system can we have for existing security systems in the vehicles?
The vehicles are fitted with a security system to track their movements and report it back to their owners if they are moved unauthorized.
My question is: can we have an additional security system ...
3
votes
1answer
78 views
SNMPv2 and Community Security
When working with servers on the internet and doing monitoring is there any dangers using SNMPv2?
I am working with observium and have the following:
/etc/snmpd.conf
com2sec readonly default ...
1
vote
1answer
287 views
Files to monitor in linux
All,
I have been googling around for different guides on what files to monitor that people would edit for malicious intent. In my readings so far, i have found the common files people edit.
so far i ...
-1
votes
1answer
145 views
User login monitoring tool [closed]
Our client has a Windows workgroup LAN with a UNIX/Oracle database server. We want a tool which can log login/logout details of network users to the database server. The problem is that we can't ...
4
votes
3answers
269 views
Application to monitor software activities
I am doing black box testing on a software which is installed in my local machine. I want to analyze and see the list of files and registry entries that software create/modify/delete. Basically ...
-3
votes
1answer
348 views
Web GUI for Snort + ModSecurity [closed]
I'm trying to find a suitable (or easily modifiable) web GUI for snort + modsecurity logs. As far as I know, Splunk can do that by installing the snort and modsecurity plugins. Is there any other ...
3
votes
3answers
179 views
Is it advisable to fully record terminal interaction for incident response?
We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
2
votes
4answers
1k views
How to remote monitor a computer network traffic?
I would like to know if it is possible to remote monitor the incoming and outcoming network traffic of a specific IP from my network. I need to log the time, ip numbers and port that contact the ...
5
votes
3answers
2k views
Need a software that can monitor and log network traffic of installed applications [closed]
I need to monitor and log network activities of a specific software installed on my system.
I know there are lots of network monitoring software out there, even system explorer has one built in.
I ...
0
votes
2answers
488 views
Keyloggers - Ports used by keyloggers
According to this article, keyloggers usually make use of the FTP ports and email ports:
http://rbmikrotik.blogspot.com/2011/07/how-to-block-port-frequently-keylogger.html
My question is, can a ...
0
votes
1answer
143 views
Tracking information on HTTPS connection
My organization uses cyberoam firewall. They are monitoring all activities including my search text in Google, Wikipedia etc. So recently i changed to HTTPS versions and now using HTTPS connections of ...
0
votes
0answers
21 views
Steganalysis of outgoing traffic [duplicate]
Possible Duplicate:
Detecting Steganography in images
Is there any commercial traffic monitoring systems that implements steganalysis and could issue a warning upon suspicious file transfer ...
2
votes
1answer
275 views
How should I audit and monitor shared TCP ports in Windows?
Windows has a feature called .NET TCP Port Sharing which allows different .NET applications to share the same TCP/IP port.
I would like to monitor the source and destination connections of each ...
-1
votes
1answer
228 views
How to Transfer packets from one ethernet card to another [closed]
I have a desktop with two ethernet(etho,eth1) cards and OSSIM installed in it. I have a laptop with webmin installed, where i want to write rules for transferring packets from eth1 to eth0. Both the ...
3
votes
2answers
2k views
How effectively can ISPs detect illegal file sharing?
Recently the USA passed a law requiring ISPs to spy on their customers' internet connections to check for illegal file sharing. I assume that they would do this by sniffing packets, but doesn't this ...
6
votes
6answers
4k views
How to detect eavesdropping by your ISP
I've noticed some funny behavior lately with my home Internet connection such as connections dropping frequently, rate limiting occuring, and packet loss.
I know how to get around this online, use a ...
3
votes
3answers
193 views
Monitoring for security threats
I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
13
votes
6answers
21k views
How can I identify my phone call is being tracked or tapped?
When I read about mobile call tracing, the hackers/security experts track and record mobile phone calls somehow.
Is it possible for us to identify that our call is tracked by someone or heard by ...
6
votes
2answers
296 views
Suspicious 'upstream' traffic
We are seeing unusual amounts of traffic heading upstream on our WAN connection, during the day our system can exceed (or attempt to exceed) the 1Mbps limit imposed on the connection.
I have PRTG ...
13
votes
5answers
806 views
Neural networks & anomaly detection
Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
4
votes
1answer
751 views
Server monitoring for security
We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats.
Our clients may use ...
1
vote
0answers
136 views
GSM monitoring system [closed]
Please help me clarify with GSM monitoring system (active style and semi-active).
I cannot differentiate these 2 types of monitoring systems. If anyone can tell me exactly how they operate?
Thank you ...
0
votes
1answer
198 views
Monitor traffic
I use my laptop as Access point for all other devices around me. Is there any way that i can monitor the data/browsing that other people are through my system's access point. As I can think all the ...
5
votes
2answers
1k views
Snort Sensor Placement
I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
0
votes
1answer
886 views
Monitor incoming TCP/UDP flood attack and graph it
I'm preparing a presentation on a security issue and want to include a demonstration. It won't be in real time, I just need to show some pictures of the results.
I have some VPSes that will perform a ...
5
votes
3answers
818 views
What are the most common files to check with File integrity monitoring software?
I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server.
Is there a ...
4
votes
6answers
7k views
monitoring outgoing network traffic
The graphs for one server that I am using are showing consistent 7.5 kb/s outgoing network traffic that started a few days ago.
How can I monitor/log/capture/analize this traffic to see what is it,
...
3
votes
2answers
547 views
How do companies track employee usage on corporate computers?
For companies that needs to monitor computer usage by employees, what systems are usually set up to do so (monitoring software, hardware, etc.)?
What are the financial costs involved in setting up ...
1
vote
2answers
579 views
Strange Event Log Entry - Windows Server 2008
Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC.
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: ...
5
votes
2answers
2k views
Virus detection with Process Explorer
Can Process Explorer ( Windows apparently) detect a virus? Is it even possible?
9
votes
3answers
14k views
Monitoring file access on Windows
I need a way to monitor user file access on windows. What I need is:
monitoring of user opening, modifying (don't need to know what the changes were, just that a file was modified), copying, pasting ...
14
votes
5answers
717 views
Safe way to authenticate (multi-factor authentication?) while being monitored?
(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.)
...
5
votes
3answers
602 views
Best practice for creating an initial IPS policy
I see that most IPS available in the market comes with a basic pre-defined policy which administrators can base on when creating their initial IPS policy. However, these policy may be insufficient and ...
4
votes
3answers
351 views
Information gathering before deploying a Network IPS
I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
1
vote
2answers
204 views
Tracking a user account
Hi
I suspect a former employee of the company I work for still have access to the servers, in fact I’m sure he does. When he left the company in December he neglected to remove his personal files ...
5
votes
2answers
132 views
Monitoring a specific application for creation or modification of files
I don't know if I'm looking for a file integrity monitoring software here.
Basically let's say we have firefox or chromium, let's say the user is watching a youtube video, then we'll find that video ...
6
votes
5answers
300 views
What's the real reason behind blocking the social sites? Even legitimate sites like twitter which acts as a knowledge repository?
I see some sites are blocked for IT security at schools, colleges and offices. But, why do some obvious good sites are blocked too?
