Posts tagged Komand

3 min Komand

Enabling Security ChatOps with Security Orchestration and Automation

Many security teams today are using communication tools like Slack as a hub for incident management. DevOps teams call this, “ChatOps,” and it’s a streamlined way of communicating -- teams know the moment an issue arises so that they can respond faster and more collaboratively. In order for ChatOps to be truly effective for security purposes, it requires orchestration to bring together your tools [https://www.rapid7.com/fundamentals/security-orchestration/] in Slack and automation to enable s

3 min Automation and Orchestration

The Team Cymru Malware Hash Registry

Synopsis: Team Cymru’s Malware Hash Registry (MHR) is a useful tool for scanning suspicious files. It is free for private use and provides an excellent addition to a comprehensive security plan. It scans the hash of a file against a number of anti-virus packages and then lets you know if the file has previously been detected as malware. Who Are Team Cymru? Team Cymru is an internet security research group that operate out of Illinois as a non-profit organization. Cymru is pronounced Kum-ree, wh

5 min Komand

How to Get Buy-In from the Budget Holder for a New Security Product

You’ve found a new security product — one that promises to enhance your job, make you more efficient, and save time and money for the organization. You think it will make a great addition to your current arsenal of security tools. Other security professionals recommend it, too. But one problem: you don’t control the budget. So how do you go about getting buy-in for a new security product? In this post, we’ll offer a framework and the exact questions you should be prepared to answer to make this

3 min Automation and Orchestration

How to Configure a Basic IPsec Tunnel

Synopsis I recently started the blog under the tag IPsec. Anyone having background in this regard would know that this topic is too elaborate to be covered with a single article. I will be doing a series of articles to touch as many details as I can. But first things first: you need to know about the basics of IPsec. I would like to share with you a way to configure an IPsec tunnel under main mode. Configuration Please note in advance the following is a precise configuration for when we need to

5 min Automation and Orchestration

How to Install Suricata NIDS on Ubuntu Linux

Synopsiss Suricata is a free and open source fast network intrusion system that can be used to inspect the network traffic using a rules and signature language. Suricata is funded by the Open Information Security Foundation [https://oisf.net/] and used for network intrusion detection, network intrusion prevention and security monitoring prevention. It is capable of handling multiple gigabyte traffic, display it on screen and also send alerts through email. Suricata’s architecture is very similar

5 min Automation and Orchestration

How To Protect SSH and Apache Using Fail2Ban on Ubuntu Linux

Synopsis Fail2Ban is a free and open source intrusion prevention software tool written in the Python programming language that can be used to protects servers from different kinds of attacks. Fail2Ban works by continuosly monitoring various logs files (Apache, SSH) and running scripts based on them. Mostly it is used to block IP addresses that are trying to breach the system’s security. It can be used to block any IP address that are trying to make many illegitimate login attempts. Fail2Ban is s

5 min Automation and Orchestration

Detection and Analysis Phase of Incident Response Life Cycle of NIST SP 800-61

Synopsis In the series of articles titled “Incident Response Life Cycle in NIST and ISO standards” we review incident response life cycle, as defined and described in NIST and ISO standards related to incident management. We introduced these standards in the first article in this series [/2017/01/11/recommendations-for-incident-response-team-included-in-nist-special-publication-800-61/] . In previous article in this series [/2017/02/16/preparation-phase-of-incident-response-life-cycle-of-nist-

3 min Automation and Orchestration

Understanding GRE (2/2)

Synopsis: In the last post [/2017/01/30/understanding-gre/], I talked about the GRE tunnels, it’s Class of Service and the Firewall Filters it offers.  The next step is to learn about the simplest way to configure a tunnel between two sites using GRE.  This article aims to give understanding about the Configuration of GRE Tunnels for Juniper Networks. Pre-requisites: Before we go in the actual configuration, here is a checklist that you must have before configuring your GRE tunnel between sites

3 min Automation and Orchestration

Basics of IPsec

What is IPsec? IPsec is a framework of related protocols that secure communications at the network or packet processing layer. It can be used to protect one or more data flows between peers. IPsec enables data confidentiality, integrity, origin authentication and anti-replay. Why was IPsec created? There was a dire need of communicating data packets securely over large public WAN (mainly Internet). The solution was development of many networking protocols among which IPsec is one of the most de

2 min Komand

InfoSec Valentines: Show a Security Nerd How Much You Care

It's no secret that we ❤️ security defenders. And while we typically show our love through helpful insights and technique-driven articles, there's just something about this time of year that makes us want to display it in an entirely different fashion. We present to you infosec valentines! We know this isn't a new phenomenon [https://twitter.com/search?q=%23infosecvalentines&src=typd], but with all the doom and gloom that winter brings, creating and sharing infosec valentines got us excited. S

4 min Komand

Defender Spotlight: Scott J. Roberts, Security Operations Manager at GitHub

Welcome to Defender Spotlight! In this blog series, we interview cybersecurity defenders of all varieties about their experience working in security operations. We inquire about their favorite tools, and ask advice on security topics, trends, and other know-how. Scott J Roberts is an incident handler, team lead, and developer at GitHub, the world's code collaborative development platform. Scott has worked major investigations involving criminal fraud & abuse and nation state espionage while wit

2 min Komand

Managing Third-Party Vulnerabilities with Security Orchestration and Automation

Industry-best practices dictate that companies should keep software up-to-date as part of maintaining a healthy security posture. Yet many companies struggle with vulnerability management, especially when it comes to vendor and third-party software. Third-party vulnerability management is often a balance between ensuring that critical bugs get reviewed and applied quickly, while reducing the risk of downtime due to a potentially unstable patch. When it comes to managing a complex vendor vulnera

3 min Komand

Getting the Most Value out of Your Security Products

We know how difficult it can be to get the full value from security products — especially when many don’t connect with others easily. Some products take too long to fully configure; others suffer from feature bloat, making them difficult to use; and some, sadly get forgotten, simply collecting dust on the shelf. Here’s how to better utilize each security tool you already have so you can maximize that investment and get more done, faster. Make a Plan Before you get started, take a moment to de

5 min Komand

Fine Tuning Your Intrusion Detection System to Minimize False Positive Alerts

Monitoring and protecting your company’s assets is one of the most important jobs you can perform. It can be tedious sometimes, but overall it can have the biggest impact to the business if compromised. Having alerts set up in your SIEM, IDS and FIM solutions can ultimately keep you on track. Eliminating false positive results can be a whole different story. Being able to pick out false positives from your environment is a huge undertaking but grants great reward. Below are some steps that you

3 min Automation and Orchestration

Understanding Generic Routing Encapsulation (GRE) (1/2)

Synopsis To transport packets in a private and secure path over a public network, we use the process of encapsulating packets inside an IP encapsulation protocol. GRE follows this protocol and sends packets from one network to another through a GRE tunnel. In this blog, we will understand what is encapsulation, the CoS of GRE and firewall filters in GRE. Understanding GRE – Generic Routing Encapsulation What is encapsulation? The general internal representation of an object or data or packet is