Year: 2007
Open Event Log Project: No Longer Online
Since the Open Event Log Project wiki has not been actively updated over the past few months, with the exception of porn URL’s (thank you Ron Gula for bringing that to my attention), I’ve decided to take it offline. I simply don’t have the time to maintain it.
Maybe I’ll revisit this endeavor in the future, when I have more free time, as it could easily be a full time job to search out logs and explain what they do. Sounds like a business model to me 🙂
Suggested Blog Reading – Wednesday August 29th, 2007
This week is no better than the last. Hopefully I’ll be able to get these posts back on track shortly.
Here is the list:
Virtualized rootkits – Part 1 / Virtualized rootkits – Part 2 – Interesting articles on virtualized rootkits (a rather hot topic pre- and post-Blackhat)
There has been a lot of buzz around the topic of virtualized rootkits. Joanna Rutkowska has been working on a new version of Blue-Pill, her proof of concept invisible rootkit, while a team made by three prominent security experts (Thomas Ptacek, Nate Lawson, Peter Ferrie) challenged her that there is not an “invisible” rootkit, and that they were going to present at BlackHat conference various techniques to detect Blue-Pill. Federico Biancuzzi interviewed both sides to learn more.
Why IDS will be around – So IDS isn’t dead now? 🙂
OK, here’s the post I promised on why I agree that IDS is not dead and won’t be for a while. What it all essentially comes down to is reality. In theory, the way anyone’s network should be designed is in the fashion of the Core-Distribution-Access methodology.
Event Processing – Normalization – This is a very good article on event normalization and what it is exactly.
The process of taking raw input events and extracting individual fields is called normalization. Sometimes there are other processes which are classified as normalization. I am not going to discuss them right here, but for example normalizing numerical values to fall in a predefined range is generally referred to as normalization as well.
Harvard Business Review: Excellent Data Breach Case Study… – I love seeing stories like these – great info for presentations 😉
I read the Harvard Business Review frequently and find that the quality of writing and insight it provides is excellent. This month’s (September 2007) edition is no exception as it features a timely data breach case study written by Eric McNulty titled “Boss, I think Someone Stole Out Customer Data.”
Pixy – New & Free Open-source XSS and SQL Injection Scanner for PHP Programs – Another tool to add to your belt.
Pixy is a Java program that performs automatic scans of PHP source code, aimed at the detection of XSS and SQL injection vulnerabilities. Pixy takes a PHP program as input, and creates a report that lists possible vulnerable points in the program, together with additional information for understanding the vulnerability.
Analyzing a Suspect WMF File – Great article Didier!
My analysis will show that this WMF file doesn’t contain shellcode. I use a tool I discovered recently, the 010 Editor, a professional hex editor with binary templates. Binary templates allow you to define the structure of a binary file with a C-like scripting language. A binary file parsed with a template is much easier to understand, as you will see. Unfortunately, I found no free alternative for this tool.
Studnets Accidentally E-mailed Personal Information On Thousands of UIUC Students – Sigh….
University of Illinois, Urbana-Champaign officials are apologizing to students after an e-mail to 700 College of Engineering students about a new Lego Robotics class was found to contain the personal information of 5,247 students. The e-mail contained a spreadsheet that a staff member used to gather e-mail address. Along with e-mail address, the spreadsheet contained other personal information including name, major, gender, race and ethnicity, class, date admitted, spring 2007 grade point average, and cumulative GPA as well as local address and phone number. The mistake was identified almost immediately after the 7:51am was sent out. By 10:08am the University issued another e-mail to the student that received the spreadsheet asking them to delete the file and the original e-mail message. UIUC officials are meeting to discuss how to best notify the affected students.
Finding Sensitive Data as a Consultant with Nessus – Good post Ron. I’d like to see more of these that focus on using Nessus from a consultants perspective.
There are many consultants that use Nessus to scan a customer network for vulnerabilities and report a laundry list of security issues which need to be fixed. Another valuable service that can be performed by a consultant is to audit where sensitive data resides in an organization and what sort of access can be gained to it. This blog entry discusses what can be accomplished with the Nessus scanner and what additional types of data analysis can be performed with the sensitive content checks available with the Nessus Direct Feed.
Book Review: PCI Compliance: Implementing Effective PCI Data Security Standards
When I first received this book from Syngress I was very excited. I knew nothing about PCI compliance — other than it was big ticket item and everyone processing Visa transactions was affected in some way because of it. I can honestly say that I tore through this book and didn’t put it down until I reached chapter 13. I was completely wrapped up in it as it was something I knew nothing about and wanted to know more!
Chapters 1 through 3 introduce you to the concepts behind PCI compliance including what it is and who needs to comply. These chapters really set the stage for what the rest of the book has to offer the reader.
Chapter 4 provides a technology overview of firewalls, intrusion systems, antivirus solutions, and common system default settings. Personally I felt that Chapter 4 was filler content just to add a chapter. It may, however, serve as a good reference for those in management roles who do not have “hands-on” interaction with the architecture of their environment.
Chapter 5 explains how to go about protecting your cardholder data as dictated by PCI requirements 3 & 4. This is a great chapter for anyone new to securing infrastructure to meet the requirements of a PCI audit. The authors also provide a fantastic section entitled “The Absolute Essentials” which offers suggestions on the minimum protection you can employ to protect your cardholder data.
Chapter 6 was by far my most favorite chapter and Syngress has offered it as a free download from their website. Many of you know what I do for a living and know how important understanding logging and requirements for logging is for my day-to-day duties. This chapter focuses around PCI Requirement 10 which details how you must handle the log data collected in your PCI environment. As soon as I started reading this chapter I knew that Dr. Anton Chuvakin had written this section of the book, or at least had a heavy insight into its direction. This chapter alone makes the book worth its weight in gold.
Chapter 7 details the importance of access control in your PCI environment. For obvious reasons, access to your cardholder data must be recorded and checked with a fine tooth comb. User privileges, authentication, authorization, and user education is also covered in this chapter. This chapter goes further to provide examples of ensuring your Windows, Unix/Linux, and Cisco infrastructure meet PCI requirements.
Chapter 8 explains how to leverage vulnerability management solutions to meet the requirements outlined in sections 5, 6, and 11 of the PCI requirement. The authors also provide two very good case studies to help the reader put things into perspective.
Chapter 9 focusses on the monitoring and testing of your environment. The authors are quick to point out that monitoring and testing must continue even after the audit in order to ensure you remain compliant.
Chapter 10 details how to drive your PCI project from the business side in order to ensure you accomplish your objectives. Suggestions are provided on budgeting time and resources, keeping staff in the loop, and justifying the business case to your executive team. The authors also offer a step-by-step “checklist” for ensuring your project runs smoothly and that all of your bases are covered.
Chapter 11 explains the various responsibilities within the organization for ensuring the PCI project succeeds. One of the key things to take away from this chapter is the role of the Incident Response team and its need to understand the requirements of PCI compliance.
Chapter 12 is a really good “eye-opener” that prepares you for the failure of your first audit. The key thing to take away from this is chapter is to not blame the auditor the same way you shouldn’t blame a referee in sports. They’re simply there to do their job to the best of their ability. If you have a problem with the way they are doing their job, bring it up with their superior. Perhaps their decision will get overturned?
Chapter 13 brings you into a “OK, now what?” phase. This chapter provides a detailed overview of the various requirements and breaks each requirement into “Policy Checks” and “Hands-on Assessments” sections. The policy checks discuss policies that should be reviewed to verify that they are up-to-date and the hands-on assessments sections give ideas on testing these policies. The beauty part is that the authors suggest open source solutions to help you protect your PCI compliant investment.
I give this book 5 stars as it is the best PCI reference I have found on the market. Everything I found in this book will allow me to understand the compliance requirements of my existing customers, their process, and their overall goals. Hats off to the entire team of authors.