Network Security Blog

Sourcefire has announced that the company will be expanding into a lot of new security specialties beyond Intrusion Detection and Intrusion Prevention. I think it’s a very good move for them and builds on their existing strengths, but only time will tell if it’s going to be a successful strategy. Over at SearchSecurity Nick Selby has written an interesting analysis of the Sourcefire move. I understand it a lot better having read the article.

Sourcefire’s strength has always been in analyzing network traffic, since that’s what IDS boils down to.  They got a lot more in depth with their software  when they introduced RNA.  Adding anomaly detection, vulnerability assessment (passive or active, I wonder) and network access control is just extending that expertise even further.  And, as the article notes, they’ve already got a foothold any many, many networks, which isn’t going to hurt them in the least.

Technorati Tags: security, snort, sourcefire

I’ve never owned a BlackBerry of any flavor, but I know many people who rely on them to get all of their system alerts and in some cases, all of their connection to the real world.  I can only imagine what sort of heart ache they’re having while the BlackBerry network is down.  This should make an interesting story when we find out what happened at RIM; it takes a lot for a company to hunker down and quit communicating with the outside world, so this must be pretty major

Technorati Tags: security, mckeay, blackberry, RIM

Finally, episode 66 is out!  Or at least that’s the way it feels to me.  Life has been incredibly busy, though I’m starting to get a handle on everything I need to do on a daily basis and I’m able to make the time to podcast again.  I’ll be honest, this show is a little more of a ramble than I usually record, but I guess that’s what to expect after a three week break. 

Show notes:

• Endpoint Security by Mark Kadrich
• Where I’ll be in the near future:
• Linuxfest Northwest, Bellingham, WA
• Sonoma County Systems Administrators
• Texas Regional Infrastructure Security Conference
• Shmoocon videos are available for download
• Practicing street smarts at the ATM
• Lenders misusing student database
• Tonight’s music:  Beat the Machine by Kingfinger

Network Security Podcast, Episode 66, April 17, 2007

Time:  29:46

Technorati Tags: security, mckeay, Ron Gula, Tenable Network Security, Tenable

Unluckily, given what’s been happening in Florida the last couple of months, I think Greg Dean of the Real Life cartoon is wrong and the premise of “Man of the Year” is closer to reality than the thinks.

No, the two subjects aren’t related other than overlapping in time.  I just thought it would be easier to write one short post rather than two micro posts. 

First of all, I got Dugg for the first time yesterday morning; the lock picking video I posted a couple of weeks ago caught someone’s attention and was posted to Digg, tripling my normal traffic.  I’ve got another video from Toool that I should have up in a couple of weeks, but I want to finish off some of the video from RSA first.  Yes, I’m still working on that video; it takes a lot more work than I originally thought to edit a video, though I’m getting a lot better at it.  If you tried to get to the site yesterday and it timed out, now you know why.  My poor little home network wasn’t totally hammered, but it was definitely impacted.

Second, I tried playing with the BackTrack 2.0 LiveCD yesterday.   On my HP dv8000, BackTrack recognizes all of my hardware and Kismet works like a charm.  My only problem is the touchpad which has a few minor issues.  Hooking up my wireless mouse made that problem go away.  On the other hand, on my Mac Book Pro, all of the hardware is recognized properly when I use the ATI drivers, with the exception of my wireless card.  There are ways to get BackTrack to recognize the card, or so I’ve read, but I didn’t have time to try them last night. 

My moment of horror came this morning when I tried to boot the MBP:  “No boot disk found”!!!!!  I had read that the system was supposed to automatically go back to booting from the HD after using a LiveCD, but this was obviously wrong.  A quick Google search turned up a solution, holding down the Option key during boot will take you to the boot device menu.  I felt like such a noob, which I guess I still am concerning the MBP.  By the way, holding down the ‘C’ key during boot is how you get a MBP to boot from CD.

Technorati Tags: security, mckeay, digg, Mac, wireless, Backtrack

I haven’t taken a look at the BackTrack LiveCD in a while, but now that version 2.0 of the CD is out, I’m going to give it another try.  They’ve got a glowing review of the distro over at Darknet.org.uk, which is always a good reason for me to check out any product.  I’m hoping the download finishes soon, cause I’ve got a laptop I’d like to play with this on, especially if it’s as good as recognizing the wireless cards as the review says.  I haven’t done any war driving in quite a while and I’d like to see what’s changed in my neighborhood in the last little while.

Technorati Tags: security, mckeay, BackTrack

I have to admit I’ve been falling down on reading and responding to some of my email lately.  Buried amongst the mass of emails was a little notification from my friend, Robyn Tippins that she has become the Community Manager for this little project called MyBlogLog.  I don’t know exactly how close the position of Community Manager is to Product Evangelist, but reading the description on the site, I think there’s more similarity than difference.  I’ll have to get together with Robyn some day soon now that she’s moved out here to the sunny West Coast.  I know I can learn a lot from Robyn about community outreach and support.

Congratulations Robyn, you really deserve it! 

Technorati Tags: Robyn Tippins, Mybloglog, Yahoo, community

Technorati Tags: security, mckeay, Rothman, RSA, Podtech

According to Microsoft, they’re seeing a 0-day attack against a limited number of sites affecting DNS on Windows Server 2000 and 2003.  David Maynor took this as a good example for those people who think that 0-day attacks aren’t happening in the real world. 

Technorati Tags: security, mckeay, Microsoft, DNS, 0-day, Maynor