3 ms·

OK, but the article is light on solutions. In fact, I don't see any solutions.

by e40 12y ago

snowwrestler 12y ago
1) Make it difficult for bad guys to move around inside your network. This includes employing strict and disciplined use of access controls to manage where each employee can go in the network. That way if some assistant's account gets compromised, the bad guy can't just log into the email server or file share root. It also includes keeping every machine's software patched and up to date. That makes it more difficult for bad guys to use known exploits to escalate privileges within the network. It also includes enforcing strong password policies--and giving every employee a secure password management solution. (So they don't use Excel.) 2) Keep an eye on the internal network. Network admins and security folks can use software tools (example: Netwitness) to know what traffic typically looks like on the network, and to detect anomalies. For example, if a lot of data starts flowing from a file share to a computer that typically does not access that share. Or if a lot of data starts heading out of the firewall to an address that no one has ever connected to before. Or if a VPN account authenticates at a weird hour or from a new address. For example, at my employer, if I VPN in after about 10pm, I get an email or phone call from Net Sec asking if that is really me. If I connect to IRC from within the LAN--same thing. Any file transfer larger than a certain size gets flagged for follow up. Etc.
- walterbell 12y ago
  Along these lines, overlay VPNs can be used behind the firewall to segment the internal network, e.g. to isolate developers -- finance -- task workers. This limits the scope of any breach and makes it easier to contextualize activity.
higherpurpose 12y ago
Here are some: https://www.blackhat.com/docs/webcast/bh-wb-May12-Making_Life_Difficult_for_Malware.pdf https://www.blackhat.com/docs/webcast/bh-wb-May12-Making_Lif...
slyfox117 12y ago
I work for a company, ExtraHop Networks, that is starting to see some use in cases like this. We do passive packet analysis from L2 to L7. Things like network traversal, odd tunnelling behaviors (DNS, reverse SSH, etc), even nmap scans can be investigated with our platform. ExtraHop doesn't position itself as security company, but is focused on application and network visibility using the communication itself, and security starts with visibility after all.

OK, but the article is light on solutions. In fact, I don't see any solutions.

by e40 12y ago

OK, but the article is light on solutions. In fact, I don't see any solutions.

1) Make it difficult for bad guys to move around inside your network. This includes employing strict and disciplined use of access controls to manage where each employee can go in the network. That way if some assistant's account gets compromised, the bad guy can't just log into the email server or file share root. It also includes keeping every machine's software patched and up to date. That makes it more difficult for bad guys to use known exploits to escalate privileges within the network. It also includes enforcing strong password policies--and giving every employee a secure password management solution. (So they don't use Excel.) 2) Keep an eye on the internal network. Network admins and security folks can use software tools (example: Netwitness) to know what traffic typically looks like on the network, and to detect anomalies. For example, if a lot of data starts flowing from a file share to a computer that typically does not access that share. Or if a lot of data starts heading out of the firewall to an address that no one has ever connected to before. Or if a VPN account authenticates at a weird hour or from a new address. For example, at my employer, if I VPN in after about 10pm, I get an email or phone call from Net Sec asking if that is really me. If I connect to IRC from within the LAN--same thing. Any file transfer larger than a certain size gets flagged for follow up. Etc.

walterbell 12y ago
Along these lines, overlay VPNs can be used behind the firewall to segment the internal network, e.g. to isolate developers -- finance -- task workers. This limits the scope of any breach and makes it easier to contextualize activity.

higherpurpose 12y ago

Here are some: https://www.blackhat.com/docs/webcast/bh-wb-May12-Making_Life_Difficult_for_Malware.pdf https://www.blackhat.com/docs/webcast/bh-wb-May12-Making_Lif...

slyfox117 12y ago

I work for a company, ExtraHop Networks, that is starting to see some use in cases like this. We do passive packet analysis from L2 to L7. Things like network traversal, odd tunnelling behaviors (DNS, reverse SSH, etc), even nmap scans can be investigated with our platform. ExtraHop doesn't position itself as security company, but is focused on application and network visibility using the communication itself, and security starts with visibility after all.