1. FORESEC Academy FORESEC Academy Security Essentials (III)

2. FORESEC Academy Need for Network-based Intrusion Detection  Most attacks come from the Internet  Detecting these attacks allows a site to tune defenses  If we correlate data from a large number of sources we increase our capability The statistic that 90% of all attacks are perpetrated by insiders is dead wrong.

3. FORESEC Academy Inside a Network Attack WinNuke, (also called OOBNuke), uses TCP 139 and OOB Data, even if NetBIOS is not enabled. It results in the “Blue Screen of Death”. Patches/service packs are available OOB stands for Out Of Band and is actually misnamed; it should say.Urgent mode., which is Urgent bit set in the TCP header flags and the urgent pointer.

4. FORESEC Academy Nuke’eM Screen

5. FORESEC Academy BlackIce – Nuke ‘Em Detection

6. FORESEC Academy Network Intrusion Detection 101

7. FORESEC Academy BlackIce - Enable Logging

8. FORESEC Academy BlackIce - Viewing Logs

9. FORESEC Academy BlackIce - Visualization Tools

10. FORESEC Academy Libpcap-based Systems

11. FORESEC Academy Network Intrusion Detection With Snort

12. FORESEC Academy Snort Design Goals  Low cost, lightweight  Suitable for monitoring multiple sites/sensors  Low false alarm rate  Efficient detect system  Low effort for reporting

13. FORESEC Academy Snort

14. FORESEC Academy Writing Snort Rules  Can create custom rules to filter on specific content.  Pre-loaded with hundreds of rules (but you may need to create one or more custom rules)  Simple to write yet powerful enough to capture most types of traffic  Options - Basic (Pass, Log, Alert) - Advanced (Activate, Dynamic)

15. FORESEC Academy