This is a presentation I created for an internal contest at LogLogic. Security is just one use case and the lack of visibility is true for others like IT operation, compliance, etc. this is what we address with our 360 insight solutions.
Log Caliper 1.1 is now available, I added support of Bytes/s, KiloBytes/s, KiloBits/s, MegaBits/s and GigaBits/s and extended the database with common products average log size. I'm really having fun to code this App and now start to design the v 2.0 so any feedback welcome. You can download it on the itunes App Store. If you leave in the US and you want a promo code, just send me a direct message via Twitter and I will send you one.
Snap from today at the Secureworld expo Bay Area.
Today Twitter (and Facebook) have been targeted by a Distributed Denial Of Service attack (DDOS). There are several techniques to mitigate a DDOS but I'm interested by one: the IP black-listing that can be address by both Security Event Management and Network Configuration and Change Management solutions.
This short presentation describe how SEM and SCM work together to mitigate DDOS.
It’s usually not easy to explain people how log injection attacks are used to decoy a weak log management system. I see in this video an example of what this kind of attack can be in the real world.
This crew creates the illusion of an escape attempt that may divert security guard attention. In the Log Management world this kind of “attack” is called Log Injection: invalid entries taken from user input are inserted in logs that monitoring systems will misinterpret. This trick allows an attacker to mislead detection engine or administrators and covers his traces.
Fake logs can be created using simple log injection techniques that work in the same way as SQL injection. In this example, I just pass the user name in a way that would trick a log analysis tool, making it thinking that the source IP of the connection is not what it really is:
[chris@host log]$ ssh "myfakeuser from 10.1.1.1 port 123 ssh2" @192.168.5.1
Logs on the SSH server look likes that:
Aug 5 14:54:00 host sshd[5870]: Invalid user myfakeuser from 10.1.1.1 port 123 ssh2 from 192.168.50.65
Aug 5 14:54:03 host sshd[5870]: Failed password for invalid user myfakeuser from 10.1.1.1 port 123 ssh2 from 192.168.50.65 port 34813 ssh2
The attacker faked the username and the source IP address to trick the security analyst and to hide his own activity. The usage of an advanced Log Management solution will prevent this kind of attack, actually it should be able to recognized misformatted logs.
The new SEM v3.3 provides two new single correlation rules to detect users that are sharing their logins and passwords on the network or user accounts that has been compromised. Let's try it on your network! ;-)
This presentation in an introduction to LogLogic Security Event Manager. It includes 5 screencasts describing correlation, incident management and reporting capabilities.
