De-Coder’s Ring

Consumable Security and Technology

Category: technical (page 2 of 11)

Network Monitoring on the Cheap

I’ve regularly blogged about Suricata, Logstash and Elasticsearch.  Shoot, I’ve built multiple successful commercial tools using that technical stack.  The thing that made us successful wasn’t the tech, but it was how we used the tech to solve a problem that our customers had at that moment in time.

Now it’s time for me to share the secret on how to do it.

Ok, not a secret at all.  If you google, you can figure it out.

With this podcast, I want to introduce the topic to put some context around why those tools are the right tools.

I want to evangelize the idea of EVERYONE monitoring your home or work network with basic rules from places like Emerging Threats.  It’s free, and it’s invaluable to finding/stopping malware/viruses on your network.  Do it now!

Suricata

https://www.elastic.co/

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/_Logstash_Kibana_and_Suricata_JSON_output

https://rules.emergingthreats.net/open/suricata-1.3/

Subscribe here : https://fauie.com/feed/podcast

Suricata – Detecting the (false positive) things

Suricata is a fantastic IDS, and can be used as an IPS

Intrusion Detection System

Intrusion Prevention System

The challenge with making it an IPS, comes with the false positives.  I’ve spent countless hours troubleshooting IDS rules that come from external intelligence.   This is not a knock on Suricata, this is not a knock on shared threat intelligence, they’re both critical components of a mature cybersecurity system.

A few critical points of validating your threat intelligence before throwing it into an IPS:

  1. Make sure it’s not google.com
  2. No private IP addresses
    1. 10.0.0.0/8 IP addresses: 10.0.0.0 — 10.255.255.255
    2. 172.16.0.0/12 IP addresses: 172.16.0.0 — 172.31.255.255
    3. 192.168.0.0/16 IP addresses: 192.168.0.0 – 192.168.255.255
  3. Watch out for IP addresses in general (WHAT?!), especially when they’re owned in a share host (Google, Azure, AWS).. those IPs get recycled SO frequently
  4. Watch out for CDNs.  Specific URLs are fine, but domains that are CDN (cdn.whatevr.com, etc), or anything related to cloud front, that isn’t a specific url, isn’t good.
  5. Prefer host names over IPs, but, make sure URLs are better.

It takes work, it’s hard, but it’ll be worth it.

Tuning is essential.  Tune your rules.

 

Kent Brake – Interview

This is another exciting podcast for the Decoder’s Ring series!

My friend Kent Brake joined me with a wealth of knowledge around cybersecurity and a few tools we can use to get a new network and host-based system monitoring.

Kent’s a seasons security architect and is currently working as a Solutions Architect for a company that you probably know.

In this podcast, we talk about how to start building a network security solution.  We discuss Bro, Suricata, Elasticsearch, Greylog, Splunk and all kinds of fun stuff you can use to create a new monitoring system.

OSQuery?  Yep, talked about that too!

Subscribe here : https://fauie.com/feed/podcast

Technology: The first class citizen

I’ve spent the last few days at Capital One’s Software Engineering conference.   How cool is that?   Hundreds of techs folks gathering for a few days to discuss areas of technology.   These are modern stacks of technology, processes and new paradigms.

For me, I’ve been able to watch about a half dozen talks on Machine Learning, the programming language Go and encryption.  The speakers were excellent, and, if I play my cards right, I’m going to work to get a few of them on here as guest bloggers!

What topics would you want to hear about?

Threat Hunting: tcpdump

This is the second video in my ‘Threat Hunting: With open source software”.   You can find the first video here:  Threat Hunting: The Network and PCAP

This video dives a bit deeper into monitoring networks.  First, we’ll go over how to monitor a modern network, some tips and tricks to help avoid gotchas.

For instance, ever wonder why you can’t see other computers traffic on your network switch? yeah, we talk about that!

We eventually work our way towards using tcpdump.   We’ll monitor live traffic and then store it to disk.  Lots of content in here, so let’s get started!

Older posts Newer posts

© 2018 De-Coder’s Ring

Theme by Anders NorenUp ↑