Explain Intrusion detection system (IDS)?? Types OF IDS...

An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a Management Station. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. In addition, organizations use IDPSes for other purposes, such as identifying problems with security policies, documenting existing threats and deterring individuals from violating security policies. IDPSes have become a necessary addition to the security infrastructure of nearly every organization.

IDPSes typically record information related to observed events, notify security administrators of important observed events, and produce reports. Many IDPSes can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDPS stopping the attack itself, changing the security environment (e.g. reconfiguring a firewall), or changing the attack's content.

CheckPoint Having Acceleration and Clustering Software Blade

The Check Point Acceleration and Clustering Software Blade delivers a set of advanced technologies, SecureXL and ClusterXL, that work together to maximize performance and security in high-performance environments. These work with CoreXL, which is included with the blade containers, to form the foundation of the Open Performance Architecture, which delivers throughput designed for data center applications and the high levels of security needed to protect against today’s application-level threats.

How to Configure a Cisco ASA 5510 Firewall – Basic Configuration Tutorial

This article gets back to the basics regarding Cisco ASA firewalls. I’m offering you here a basic configuration tutorial for the Cisco ASA 5510 security appliance. This device is the second model in the ASA series (ASA 5505, 5510, 5520 etc) and is fairly popular since is intended for small to medium enterprises. Like the smallest ASA 5505 model, the 5510 comes with two license options: The Base license and the Security Plus license. The second one (security plus) provides some performance and hardware enhancements over the base license, such as 130,000 Maximum firewall connections (instead of 50,000), 100 Maximum VLANs (instead of 50), Failover Redundancy, etc. Also, the security plus license enables two of the five firewall network ports to work as 10/100/1000 instead of only 10/100.

Next we will see a simple Internet Access scenario which will help us to understand the basic steps needed to setup an ASA 5510. Assume that we are assigned a static public IP address 100.100.100.1 from our ISP. Also, the internal LAN network belongs to subnet 192.168.10.0/24. Interface Ethernet0/0 will be connected to the outside (towards the ISP), and Ethernet0/1 will be connected to the Inside LAN switch. 

Check Point : SecurePlatform (SPLAT) Backup Options Available.

One aspect of the Check Point SecurePlatform OS that I struggle to get my head around is backups. There are a few different options, and during the course of researching an upgrade I came across the best explanation I’ve seen yet.  I’ve decided to grab a copy of the relevant text and post it in my blog for future reference here.

Oversimplified Executive Summary

• upgrade_export contains just Check Point configuration
• A backup is an upgrade_export plus SPLAT OS configuration
• A snapshot is a backup plus binary files, both Check Point and SPLAT OS
• As a general rule of thumb, if your restoring on the same hardware a snapshot would be the easiest to use since it contains the most info and an upgrade_export would be the worst, since you’d have to manually restore the most stuff.

Checkpoint : Mount USB Memory Stick / Pen Drive to Splat

Ever wanted to use an USB stick on OpenServer using SPLAT or an appliance?

Just connect the device to an USB port of your choice.

1. Load the appropriate kernel module for handling the USB device.

* modprobe usb-storage

2. Check which new device was bound, for example "/dev/sda1".

* fdisk -l

3. Create a mount point.

* mkdir /mnt/usbdisk

4. Mount USB device.

* mount /dev/sdb1 /mnt/usbdisk

5. Use the device to transfer data as you like.   "[DATA Transafer]"

6. Unmount USB device.

* umount /mnt/usbdisk







What Is SIC (Secure Internal Communication) in Checkpoint Firewall

SIC - Encryption, Authentication and Secure Channel

The following security measures are taken to ensure the safety of SIC:

• Certificates for authentication.

• Standards-based SSL for the creation of the secure channel.

• 3DES for encryption.


******************************************************************************************************

****************************************************************************************************** 

Checkpoint Firewall Logs from CLI

Syntax

fw log displays the content of log files.

The full syntax of the fw log command is as follows:

fw log [-f [-t]] [-n] [-l] [-o] [-c action] [-h host] [-s starttime] [-e endtime] [-b starttime endtime] [-u unification_scheme_file] [-m unification_mode(initial|semi|raw)] [-a] [-k (alert_name|all)] [-g] [logfile]

How to Configure DHCP on Cisco Router 871 or 18xx or 21xx or 26xx .(Series)

DHCP stands for Dynamic Host Configuration Protocol. Basically it’s a mechanism which assigns IP addresses to computers dynamically. Usually DHCP is a service running on a server machine in the network in order to assign dynamic IP addresses to hosts. All Cisco 800 series models have the ability to work as DHCP servers, thus assigning addresses to the internal LAN hosts. Without a DHCP server in the network, you would have to assign IP addresses manually to each host. These manually assigned addresses are also called “static IP addresses”.

The PING of Death and Other DoS Network Attacks

What is known as Denial-of-Service (DoS) Attacks.?? Do You Prevent it or Not.? This Question Is Very Difficult.!!

I’m very disappointed to admit that in our days this type of attack is one of the most common attacks found in the network community. The intention of the attacker in this case is to stress the victim with a tremendous amount of spurious traffic so that the network has no more free resources to process normal legitimate traffic.

Learning about these types of network attacks — learning your enemy — will help you be prepared for the worst. Once you understand your enemy’s behavior and the different types of network threats we’ll move on to specific solutions and how to protect your network.

DoS Attacks - Denial-of-Service Attack

Denial of Service Attacks can take many forms. The most important ones are:

• SYN Flood
• UDP Flood
• ICMP Flood
• Land Attack
• Teardrop Attack

All these attacks have one thing in common which is nothing else than making their victim unable to serve legitimate traffic by filling up its session table with malicious connection attempts.

Check Point Authentication Methods

Authentication feature of checkpoint ensures the users trying to access resources in your network are actually authorized to do so.With this feature instead of simply allowing a client access a device, the administrator can request the client to authenticate first before permitting access..................

Checkpoint supports the following three types of authentication methods:
1.Checkpoint User Authentication.
2.Checkpoint Client Authentication.

3.Checkpoint Session Authentication.

1.Checkpoint User Authentication:

In this type of authentication, for every traffic that passes through the firewall, the client user needs to first authenticate.This ensures that only valid authenticated users only are able to access the destination resources. The limitation is user authentication only supports Telnet, HTTP, FTP and RLOGIN attempts.

Checkpoint : Nokia Hardware - Model - Serial Number

Check Nokia Hardware Model Number with Serial Number

FW [Admin]# cat /var/etc/.nvram

---------------------------------------------------------------------

Vendor Nokia
Chassis serialnum: 88064000318
Model IP560

---------------------------------------------------------------------

FW [Admin]#

List Of Checkpoint Ports - Port Used In CheckPoint

TCP Port 256 is used for three important things: Exchange of CA and DH keys in FWZ and SKIP encryption between two FireWall-1 Management Consoles SecuRemote build 4005 and earlier uses this port to fetch the network topology and encryption keys from a FireWall-1 Management Console When instaling a policy, the management console uses this port to push the policy to the remote firewall. TCP Port 257 (FW1_log) is used for logging purposes.

Checkpoint : SPLAT - Disable CD/DVD Rom | Disable CD/DVD Rom From SPLAT (Checkpoint Secure-Platform)

How to disable the "CD/DVD ROM" from "CLI"

FW [Admin]# cd /lib/modules/2.6.18-92cp/kernel/drivers/cdrom

FW [Admin]# mv cdrom.ko cdrom.ko.orig

FW [Admin]# Reboot

or

FW [Admin]# modprobe -r sr_mod

******************************************************************************************************

****************************************************************************************************** 

CBT-Nugget - Netmaster Class Cisco Pix Adaptive Security

Netmaster Class Cisco Pic Adaptive Security CBT

Description:

The Cisco PIX Firewall and/or the Adaptive Security Appliance (ASA) are the cornerstone of the Cisco Self Defending Network. This training package allows you to master these key Cisco security technologies in the most efficient manner possible.

The LEARNiT: PIX/ASA package includes the following:

- Extremely detailed Reference Sheets explaining all major features of the products.

- Video-On-Demand recordings by NetMasterClass instructors.

- Practice Exam Database.

This course is recommended for the following IT Professionals:

• Those that want to master the PIX/ASA devices for network implementations.
• Those that want to obtain the CCSP Certification.
• Those that want to begin CCIE Security track preparation.

EBook - Cisco ASA: All-in-One Firewall, IPS, and VPN Adaptive Security Appliance (2nd Edition) - 2009

Cisco ASA: All-in-One Firewall, IPS, and VPN Adaptive Security Appliance

Cisco Press | ISBN: 1587058197 | Dec 29, 2009 | 1152 pages | PDF | 25.7 MB

For organizations of all sizes, the Cisco ASA product family offers powerful new tools for maximizing network security. "Cisco ASA: All-in-One Firewall, IPS, Anti-X and VPN Adaptive Security Appliance" Second Edition, is Cisco's authoritative practitioner's guide to planning, deploying, managing, and troubleshooting security with Cisco ASA.

Written by two leading Cisco security experts, this book presents each Cisco ASA solution in depth, offering comprehensive sample configurations, proven troubleshooting methodologies, and debugging examples. Readers will learn about the Cisco ASA Firewall solution and capabilities; secure configuration and troubleshooting of site-to-site and remote access VPNs;Intrusion Prevention System features built into Cisco ASA's Advanced Inspection and Prevention Security Services Module (AIP-SSM); and Anti-X features in the ASA Content Security and Control Security Services Module (CSC-SSM).

EBook - Snort IDS and IPS Toolkit (Jay Beale's Open Source Security)

Snort IDS and IPS Toolkit (Jay Beale's Open Source Security) 

Publisher: Syngress | ISBN: 1597490997 | edition 2007 | PDF | 766 pages | 12,2 mb

This fully integrated book, CD, and Web toolkit covers everything from packet inspection to optimizing Snort for speed to using the most advanced features of Snort to defend even the largest and most congested enterprise networks. Leading Snort experts Brian Caswell, Andrew Baker, and Jay Beale analyze traffic from real attacks to demonstrate the best practices for implementing the most powerful Snort features.

Design Of A Default Redhat Server 6.2 As Honeypot | HoneyPot Methods

Introduction

The following paper is a description of how I have designed and implemented a honeypot system. The paper describes how the honeypot is used to capture data in layers using different techniques. The aim of the honeypot is to discover the techniques and tactics used by blackhats (hackers) to compromise computer systems. The methods used are similar to the methods used by the Honeynet Project.

EBook - "Microsoft Log Parser Toolkit: A complete toolkit for Microsoft's undocumented log analysis tool" by Gabriele Giuseppini, Mark Burnett, Jeremy Faircloth and David A. Kleiman

Microsoft Log Parser Toolkit: A complete toolkit for Microsoft's undocumented log analysis tool

Publisher: Syngress | ISBN: 1932266526 | edition 2005 | PDF | 465 pages | 83,8 mb

Written by Microsoft's Log Parser developer, this is the first book available on Microsoft's popular yet undocumented log parser tool. The book and accompanying Web site contain hundreds of customized, working scripts and templates that system administrators will find invaluable for Analyzing the log files from Windows Server, Snort IDS, ISA Server, IIS Server, Exchange Server, and other products.

What Are Honeypots / Honeynets ? – Fully Explained

What Are Honetpots ?

Just as honey attracts bears, a honeypot is designed to attract hackers. Honeypots have no production value. They are set up specifically for the following purposes:

• Providing advance warning of a real attack.
• Tracking the activity and keystrokes of an attacker.
• Increasing knowledge of how hackers attack systems.
• Luring the attacker away from the real network.

It is a trap as bears are attracted to honey in the same way a honeypot is designed to attract hackers and black hat people.They are used specifically for the following purposes:

1.Warn about a future attack.
2.Monitoring the activity of an attacker
3.Inorder to know the way of attack used by the attacker.
4.Creating a virtual environment to mislead the attack.
5.It is also very useful in malware analysis.