5 min
Automation and Orchestration
How to Install Suricata NIDS on Ubuntu Linux
Synopsiss
Suricata is a free and open source fast network intrusion system that can be
used to inspect the network traffic using a rules and signature language.
Suricata is funded by the Open Information Security Foundation
[https://oisf.net/] and used for network intrusion detection, network intrusion
prevention and security monitoring prevention. It is capable of handling
multiple gigabyte traffic, display it on screen and also send alerts through
email. Suricata’s architecture is very similar
5 min
Automation and Orchestration
How To Protect SSH and Apache Using Fail2Ban on Ubuntu Linux
Synopsis
Fail2Ban is a free and open source intrusion prevention software tool written in
the Python programming language that can be used to protects servers from
different kinds of attacks. Fail2Ban works by continuosly monitoring various
logs files (Apache, SSH) and running scripts based on them. Mostly it is used to
block IP addresses that are trying to breach the system’s security. It can be
used to block any IP address that are trying to make many illegitimate login
attempts. Fail2Ban is s
5 min
Automation and Orchestration
Detection and Analysis Phase of Incident Response Life Cycle of NIST SP 800-61
Synopsis
In the series of articles titled “Incident Response Life Cycle in NIST and ISO
standards” we review incident response life cycle, as defined and described in
NIST and ISO standards related to incident management.
We introduced these standards in the first article in this series
[/2017/01/11/recommendations-for-incident-response-team-included-in-nist-special-publication-800-61/]
.
In previous article in this series
[/2017/02/16/preparation-phase-of-incident-response-life-cycle-of-nist-
3 min
Automation and Orchestration
Understanding GRE (2/2)
Synopsis:
In the last post [/2017/01/30/understanding-gre/], I talked about the GRE
tunnels, it’s Class of Service and the Firewall Filters it offers. The next
step is to learn about the simplest way to configure a tunnel between two sites
using GRE. This article aims to give understanding about the Configuration of
GRE Tunnels for Juniper Networks.
Pre-requisites:
Before we go in the actual configuration, here is a checklist that you must have
before configuring your GRE tunnel between sites
3 min
Automation and Orchestration
Basics of IPsec
What is IPsec?
IPsec is a framework of related protocols that secure communications at the
network or packet processing layer. It can be used to protect one or more data
flows between peers. IPsec enables data confidentiality, integrity, origin
authentication and anti-replay.
Why was IPsec created?
There was a dire need of communicating data packets securely over large public
WAN (mainly Internet). The solution was development of many networking protocols
among which IPsec is one of the most de
2 min
Komand
InfoSec Valentines: Show a Security Nerd How Much You Care
It's no secret that we ❤️ security defenders. And while we typically show our
love through helpful insights and technique-driven articles, there's just
something about this time of year that makes us want to display it in an
entirely different fashion.
We present to you infosec valentines! We know this isn't a new phenomenon
[https://twitter.com/search?q=%23infosecvalentines&src=typd], but with all the
doom and gloom that winter brings, creating and sharing infosec valentines got
us excited.
S
4 min
Komand
Defender Spotlight: Scott J. Roberts, Security Operations Manager at GitHub
Welcome to Defender Spotlight! In this blog series, we interview cybersecurity
defenders of all varieties about their experience working in security
operations. We inquire about their favorite tools, and ask advice on security
topics, trends, and other know-how.
Scott J Roberts is an incident handler, team lead, and developer at GitHub, the
world's code collaborative development platform. Scott has worked major
investigations involving criminal fraud & abuse and nation state espionage while
wit
2 min
Komand
Managing Third-Party Vulnerabilities with Security Orchestration and Automation
Industry-best practices dictate that companies should keep software up-to-date
as part of maintaining a healthy security posture. Yet many companies struggle
with vulnerability management, especially when it comes to vendor and
third-party software.
Third-party vulnerability management is often a balance between ensuring that
critical bugs get reviewed and applied quickly, while reducing the risk of
downtime due to a potentially unstable patch. When it comes to managing a
complex vendor vulnera
3 min
Komand
Getting the Most Value out of Your Security Products
We know how difficult it can be to get the full value from security products —
especially when many don’t connect with others easily. Some products take too
long to fully configure; others suffer from feature bloat, making them difficult
to use; and some, sadly get forgotten, simply collecting dust on the shelf.
Here’s how to better utilize each security tool you already have so you can
maximize that investment and get more done, faster.
Make a Plan
Before you get started, take a moment to de
5 min
Komand
Fine Tuning Your Intrusion Detection System to Minimize False Positive Alerts
Monitoring and protecting your company’s assets is one of the most important
jobs you can perform. It can be tedious sometimes, but overall it can have the
biggest impact to the business if compromised.
Having alerts set up in your SIEM, IDS and FIM solutions can ultimately keep you
on track. Eliminating false positive results can be a whole different story.
Being able to pick out false positives from your environment is a huge
undertaking but grants great reward.
Below are some steps that you
3 min
Automation and Orchestration
Understanding Generic Routing Encapsulation (GRE) (1/2)
Synopsis
To transport packets in a private and secure path over a public network, we use
the process of encapsulating packets inside an IP encapsulation protocol. GRE
follows this protocol and sends packets from one network to another through a
GRE tunnel. In this blog, we will understand what is encapsulation, the CoS of
GRE and firewall filters in GRE.
Understanding GRE – Generic Routing Encapsulation
What is encapsulation? The general internal representation of an object or data
or packet is
5 min
Komand
How to Automate Response to Endpoint Threats with Sysdig Falco, Splunk, Duo, and Komand
Many security teams use endpoint threat detection solutions to detect and
respond to threats like malware, credential theft, and more. In a common
architecture using a SIEM or Log Management solution, alerts from endpoint
detection products can be managed and correlated with telemetry from other
solutions or logs, and validated:
Generally, a human being has to get involved anywhere from the third step
forward. Can we do better?
Using a typical architecture with a real endpoint threat detecti
5 min
Automation and Orchestration
Two Factor Authentication Methods and Technologies
Synopsis
Authentication is a critical step that forms the basis of trust on the Internet
or any network based transactions. To state simply it verifies that the person
or entity is who they claim to be. However authentication mechanisms are
constantly under attack. Two Factor Authentication is an evolution to counter
these security threats. This tutorial takes a look at various types of
authentication methods and technologies behind them.
Different Types of Authentication Factors
Three distinct
3 min
Komand
The Most Repetitive Tasks Security Analysts Perform
It’s not very productive to come into work day in and day out just to perform
the same task dozens of times when you were trained to hunt threats and
remediate complex problems.
The repetition of rote tasks like IP scoring, alert monitoring, and URL lookups
can be fatiguing and dissatisfying, which, as major security breaches show
[http://www.darkreading.com/attacks-and-breaches/target-ignored-data-breach-alarms/d/d-id/1127712]
, can cause alerts to slip through the cracks and threats to get in
4 min
Komand
Introducing Komand’s Security Orchestration and Automation Platform
It was just a few months ago when we launched our beta program. And with beta
users working within our security orchestration and automation platform
[https://www.rapid7.com/solutions/security-orchestration-and-automation/], we
built out new features, refined others, and overall fortified our solution.
We validated that security teams not only want to save time, increase
productivity, and streamline operations, they also need a tool that would allow
them to add automation to their security work