From: Matt Davis (mattdavis@mytek.net)
Date: Tue Aug 29 2006 - 13:25:19 EDT
Chris,
You're right on with what you're saying. The majority of times we catch
security threats by watch the packet data, the stuff the firewall will miss!
Also by watching every type of logs we can see.
Chris the biggest hurdle to over come isn't protecting the network it's the
educating factor! Having to educate important people the necessary need!
Matt
-----Original Message-----
From: xelerated [mailto:xelerated@gmail.com]
Sent: Tuesday, August 29, 2006 8:32 AM
To: pen-test@securityfocus.com
Subject: Packet Payload
Im posrting this to the pen-test group, rather than firewall or IDS
because it covers many areas.
Id like to see what the pro's think about capturing and storing packet
payloads from firewalls, ids, etc... everything rather than just
loggin the incidents.
Im trying to explain to my management how useful the payloads could be
if we were ever to
really need them, say from a forensics point of view.
To give another example, one time I was seeing lots of firewall drops,
I could tell what ports, src and dest. but no packet data. To everyone
involved it looked like a worm trying to spread.
Well in the end it wasnt, infact is was something that was nice to
know about, but it was not hostile traffic. But if I had been able to
see the payloads i could have seen the data request and known from the
start what it was, or was not.
What would be really great, is a whitepaper covering this, or enough
info/facts that I could throw one together.
thanks!
Chris
C|EH, CISSP
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:52 EDT