SANS is coming to Augusta GA in June!

SANS is coming to Augusta GA in June!  Doug Burks will be teaching SANS SEC503: Intrusion Detection In-Depth and Mark Baggett will be teaching SANS SEC560: Network Penetration Testing.

UPDATE: You can save $500 if you register for one of these classes by May 2. In addition, ISSA members are eligible for a 10% discount! The discount code was sent to the ISSA Members mailing list. If you are a member and you didn't receive the discount code, please contact a Chapter Officer. If you're not already an ISSA member, please consider joining so that you will be eligible for this and other discounts in the future.


For more information, please see:
http://augusta.issa.org/drupal/SANS-Augusta-2012
http://www.sans.org/augusta-2012-cs/

tcpdump and ngrep

Yesterday, I tweeted the following:

tcpdump -nnvvAi eth1 -s0 | grep "Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland"

 So what does it all mean?

-nn This option disables name resolution for IP addresses and port numbers.  Some versions of tcpdump do this with a single "-n", but the double "-nn" option should work on all of them.
vv This option enables Very Verbose output.  It wasn't strictly needed for the purposes of this command, but I'm in a habit of using it.
A This option prints just the ASCII text in the packets.  This is useful when looking for strings like "Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland" or "c99shell".
i This option allows you to specify the Interface (in this case eth1).  eth1 on my Security Onion box at home is connected to a Dualcomm Switch Tap that monitors all ingress/egress of my home network.  Doesn't everybody do full packet capture at home?
-s0 This option sets the snaplen. By default, tcpdump only captures 68 bytes and would therefore not see the entire payload of the HTTP connection.  Setting snaplen to 0 forces tcpdump to capture the entire packet regardless of its size.
grep Since we had tcpdump output in ASCII, we can easily use the standard grep command to look for interesting text strings.

I was waiting on someone to ask the question "Why not use ngrep instead?".  tcpdump's advantage is that it is more universally available than ngrep.  If you're doing Incident Response on a Unix box of some kind, chances are that it already has tcpdump installed and you can use that to look for suspicious traffic as defined above.

Most Unix boxes do not have ngrep installed by default.  But let's assume that you've got a dedicated IDS platform such as Security Onion which just so happens to include ngrep by default.  Here's the  ngrep version of the command:

 ngrep -d eth1 -s0 "Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland"

Here we use the "-d eth1" option to force ngrep to listen on device eth1 and the "-s0" option to force ngrep to look at the entire packet.  Note that, unlike tcpdump's default snaplen of 68 bytes, ngrep defaults to 65536, so this option isn't strictly needed here, but is included for completeness.  After specifying these options, we simply tell ngrep what string to look for.

Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland Oregon 8/22 - 8/27.  Sign up today!
http://www.sans.org/portland-2011-cs-2/description.php?tid=4866

Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland 8/22 - 8/27

Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland Oregon 8/22 - 8/27.  For more information about the class, please see:
http://www.sans.org/portland-2011-cs-2/description.php?tid=4866


Enter Discount Code COINS10 at the time of registration to save $356 on Tuition!

Security Onion featured in SANS Student Project

Security Onion was featured in a SANS Student Project.  Russ McRee, Beth Binde, and Terrence O’Connor recently published Assessing Outbound Traffic to Uncover Advanced Persistent Threat.  Great paper!

SANS 401 Security Essentials mentored by Doug Burks in Augusta GA

I'll be mentoring SANS 401 Security Essentials in Augusta, GA on Thursday nights starting March 3, 2011. ISSA members are eligible for a 25% discount!

SANS 401 Security Essentials mentored by Doug Burks in Augusta GA

Why should you take SANS 401 Security Essentials?


* Considering the SANS Cyber Guardian program, SANS GSE (GIAC Security Expert) certification, or a Masters degree from the SANS Technical Institute? SANS 401 Security Essentials is required for each of these.


* Complement your CISSP. If you've already taken the CISSP, SANS 401 Security Essentials is the perfect technical complement. It takes all the theory that you learned at a high level for the CISSP and applies it in a very practical and updated manner. SANS 401 is "where the rubber meets the road".

* Are you a Systems Administrator or Network Engineer who would like to learn more about security? This course gives a very thorough overview of security theory and practice. Additionally, the tools and techniques that you learn in this class are directly applicable to your current job (and will prepare you for the future).

* Augment your Windows/Linux skills. Highly experienced with Windows, but not so much with Linux? Or the other way around? SANS 401 Security Essentials dedicates an entire section to Windows security and another entire section to Linux security.


These are just a few reasons to register for SANS 401 Security Essentials. For more information, please see:

SANS 401 Security Essentials mentored by Doug Burks in Augusta GA

Don't forget that ISSA members are eligible for a 25% discount! If you would like to register for the ISSA and/or SANS 401, please let me know and I'll be glad to help!

CISSP Resources: Cryptography

My SANS MGT414 CISSP class is about to study the Cryptography domain. An excellent resource that I recommend to anybody learning about Cryptography is Cryptool:

"CrypTool is a free, open-source e-learning application, used worldwide in the implementation and analysis of cryptographic algorithms. It supports both contemporary teaching methods at schools and universities as well as awareness training for employees and civil servants. "

-- http://www.cryptool.com/

Cryptool lets you see and interact with several different cryptographic methods, which reinforces the theory that we learn in the textbooks.

Download Cryptool from:

http://www.cryptool.com/

CISSP Resources

I'm mentoring SANS MGT414 Training Program for CISSP right now. Here are some additional resources for students studying for the CISSP.

CISSP All-in-One Exam Guide by Shon Harris:

http://www.amazon.com/CISSP-All---One-Guide-Fifth/dp/0071602178/ref=sr_1_1?s=books&ie=UTF8&qid=1286965168&sr=1-1

Official (ISC)2 Guide to the CISSP CBK by Harold Tipton:

http://www.amazon.com/Official-Guide-CISSP-Second-Press/dp/1439809593/ref=sr_1_2?s=books&ie=UTF8&qid=1286965168&sr=1-2

CISSP Study Guide by Eric Conrad and Seth Misenar (both SANS Instructors):

http://www.amazon.com/CISSP-Study-Guide-Eric-Conrad/dp/1597495638/ref=sr_1_10?s=books&ie=UTF8&qid=1286965168&sr=1-10

Eric Conrad has a sample chapter of his Study Guide available on his website:

http://www.ericconrad.com/2010/09/cissp-study-guide-sample-chapter-posted.html

He also has 500 free CISSP questions:

http://www.ericconrad.com/2010/08/500-free-cissp-practice-questions.html

More sample questions and forums:

http://www.cccure.org/

Congratulations to the latest SANS GSEs!

Congratulations to the latest SANS GSEs!

Doug Burks

Mike Cardosa

Jim Clausing

Vishal Hariprasad

Seth Misenar

Chris Mohan

If you are considering the SANS GSE, I highly recommend that you pursue it. It is a challenging but fun exam and it definitely gives you the opportunity to showcase your skills.

For more information about the SANS GSE, please see:

http://www.giac.org/certifications/gse.php

Greater Augusta ISSA 2010 Q4 Public Meeting: Doug Burks presents "Security Onion: Intrusion Detection for your Network in Minutes"

Please join us at the Greater Augusta ISSA Q4 meeting on Thursday, October 28. This is our last public meeting of 2010! I will be presenting "Security Onion: Intrusion Detection for your Network in Minutes". Security Onion is a project that I've been working on for the past few years. Its goal is to provide a pre-configured Intrusion Detection environment that can be downloaded for free and put to use in your network in less than an hour. It's based on Xubuntu 10.04 and contains Snort, Suricata, Sguil, Xplico, Vortex IDS, Bro IDS, Chaosreader, driftnet, hping3, scapy, Wireshark, and many other tools. Come see what Security Onion can do for you!

What: The Greater Augusta ISSA 2010 Q4 Public meeting: Doug Burks presents "Security Onion: Intrusion Detection for your Network in Minutes"
How: This is a FREE public meeting. Please confirm your reservation by sending an email to reservations@augusta.issa.org
When: Thursday October 28 9:00 - 11:00 AM
Where:
University Hall room 242
Augusta State University
2500 Walton Way
Augusta, GA 30904
http://www.aug.edu/public_relations/pr_map_campus.htm

On the morning of the presentation, don't forget to swing by the ASU Public Safety office to get a visitor pass for the parking lot. The Public Safety office is in the back corner of the campus. You can see it at the bottom-left of this map:
http://www.aug.edu/public_relations/asumap/images/PARKINGMAP1008PR.jpg

Speaker Bio
Doug Burks has over 10 years experience in Information Security. He has a Bachelor's degree in Computer Science and also holds the GSE, GPEN, GCIA Gold, GSEC, and CISSP certifications. Doug has worked in many organizations over the years, including government facilities, chemical plants, and the media industry. He excels at providing secure solutions for any environment using a budget of any size. Doug is the author of Security Onion Live (http://code.google.com/p/security-onion/ ), a free bootable DVD that contains many security tools. You can read more about Doug by visiting his blog athttp://securityonion.blogspot.com/.

SANS 560 Network Penetration Testing and Ethical Hacking -- Free Preview!

The Greater Augusta ISSA will present a 2-hour preview of the upcoming SANS 560 Mentor class on Thursday, July 15th. Please join us for a FREE preview of this exciting class!

What: The Greater Augusta ISSA presents a SANS 560 Preview
How: This is a FREE public meeting. Please confirm your reservation by sending an email to reservations@augusta.issa.org
When: Thursday, July 15 9:00 AM - 11:00 AM
Where:
Augusta State University
2500 Walton Way
Augusta, GA 30904
Allgood Hall E-258
Please click here for directions to campus:
http://www.aug.edu/public_relations/pr_map_campus.htm

On the morning of the presentation, don't forget to swing by the ASU Public Safety office to get a visitor pass for the parking lot. The Public Safety office is in the back corner of the campus. You can see it at the bottom-left of this map:
http://www.aug.edu/public_relations/asumap/images/PARKINGMAP1008PR.jpg

SANS 560 Network Penetration Testing and Ethical Hacking in Augusta starts 8/17

I will be mentoring SANS 560 Network Penetration Testing and Ethical Hacking in Augusta starting Tuesday, August 17. Typical SANS Mentor sessions are one night a week for 10 weeks, but this class will meet twice a week (Tuesdays and Thursdays), so we'll complete the course in only 5 weeks.

Who should take this course?

• Do you perform penetration testing?
• Do you procure penetration testing?
• Do you manage penetration testers?
• Did you take SANS 504 and really enjoy the Hacker Techniques portion?
• Do you want to know more about how the bad guys perform recon, scan for vulnerabilities, perform exploitation, gain command execution, and then pivot further into the target environment?

If you answered yes to any of these questions, then you need this class!

For more information about the course, please see:

http://www.sans.org/mentor/details.php?nid=22318

A 25% discount is available for ISSA members! Even if you're not currently an ISSA member, you can join today for only $120 to obtain the 25% discount (which will save you over $700).

To join the ISSA and/or register for SANS 560, please contact me.

Computer Security Training

SANS has a new web site for those interested in Computer Security Training:

Computer Security Training

SANS 401 Mentor class coming to Augusta!

I'll be mentoring SANS 401 Security Essentials in Augusta, GA on Tuesday nights starting January 12, 2010. ISSA members are eligible for a 25% discount!

SANS 401 Security Essentials mentored by Doug Burks in Augusta GA

Why should you take SANS 401 Security Essentials?

* Are you a Systems Administrator or Network Engineer who would like to learn more about security? This course gives a very thorough overview of security theory and practice. Additionally, the tools and techniques that you learn in this class are directly applicable to your current job (and will prepare you for the future).

* DoD 8570 Compliance. If you work for the Department of Defense (or would like to), DoD Mandate 8570 requires security certification for any employee performing Information Assurance (security) work. The Security Essentials certification is among those required for 8570. For more information, please see the SANS 8570 page.

* Complement your CISSP. If you've already taken the CISSP, SANS 401 Security Essentials is the perfect technical complement. It takes all the theory that you learned at a high level for the CISSP and applies it in a very practical and updated manner. SANS 401 is "where the rubber meets the road".

* Augment your Windows/Linux skills. Highly experienced with Windows, but not so much with Linux? Or the other way around? SANS 401 Security Essentials dedicates an entire section to Windows security and another entire section to Linux security.

* Considering the SANS GSE (GIAC Security Expert) or SANS Masters program? SANS 401 Security Essentials is required for both.

These are just a few reasons to register for SANS 401 Security Essentials. For more information, please see:

SANS 401 Security Essentials mentored by Doug Burks in Augusta GA

Don't forget that ISSA members are eligible for a 25% discount! If you would like to register for the ISSA and/or SANS 401, please let me know and I'll be glad to help get you registered.

Know Thy ISP

From http://www.pcworld.com/article/168160/ussouth_korea_cyberattack_lessons_learned.html:

"Investigators may not yet know who was behind a series of cyberattacks on the U.S. and South Korea, but analysts are getting a better grasp on where the nations' governments may have gone wrong. Numerous government Web sites in both countries have been hit by distributed denial-of-service attacks, starting on the Fourth of July and continuing into today. Dozens of high-profile sites have been targeted, including those of the Federal Trade Commission, the Department of Treasury, and other major federal agencies."

Quote of the day:

"'Too many federal agency security people did not know which network service provider connected their Web sites to the Internet,' explains Alan Paller, director of research at the SANS Institute, a security research organization."

Alan's statement is quite scary, but I'm sure quite true. When the killer clowns come knocking at your firewall's door, you need to be able to pull the plug in a hurry. Perhaps we should have Internet fire drills where we propose a mock DDoS attack and have our technicians play out the scenario. Who ya gonna call?

SANS Courses for the US-CERT GFIRST conference in August

Announcement from SANS:

"In August, SANS will be running 5 tracks in support of the US-CERT GFIRST conference taking place at the Omni Hotel at CNN Center (http://www.us-cert.gov/GFIRST/). SANS is pleased to present the following course offerings:

Security 501: Advanced Security Essentials - Enterprise Defender
http://www.sans.org/atlanta09/description.php?tid=2722
August 17-22

Security 504: Hacker Techniques, Exploits & Incident Handling
http://www.sans.org/atlanta09/description.php?tid=243
August 17-22

Security 441: Windows Forensics
http://www.sans.org/atlanta09/description.php?tid=3012
August 27-28

Security 553: Metasploit for Penetration Testers
http://www.sans.org/atlanta09/description.php?tid=3022
August 27

Security 517: Cutting-Edge Hacking Techniques
http://www.sans.org/atlanta09/description.php?tid=1927
August 28

This will be the first time we are offering Security 501 and a rare opportunity to take this course from Dr. Eric Cole in a small class setting. We are also offering 3 short courses which offer a great opportunity to get SANS content in only 1 or 2 days."

Suggestions for the Security Onion LiveCD

I'm currently working on the next version of the Security Onion LiveCD. What specific packages/features would you like to see added to the Security Onion LiveCD? Post a comment here or contact me on Twitter. Thanks!

The Security Onion LiveCD is now available!

The Security Onion LiveCD is now available! You can download it from the following location:
http://distro.ibiblio.org/pub/linux/distributions/security-onion/

What is it?
The Security Onion LiveCD is a bootable CD that contains software used for installing, configuring, and testing Intrusion Detection Systems.

What software does it contain?
The Security Onion LiveCD is based on Xubuntu 9.04 and contains Snort 2.8.4.1, Snort 3.0.0b3 (Beta), sguil, idswakeup, nmap, metasploit, scapy, hping, fragroute, fragrouter, netcat, paketto, tcpreplay, and many other security tools.

What can it be used for?

• The Security Onion LiveCD can be used for Intrusion Detection. Simply boot the CD and double-click either the Snort-Sguil or SnortSP-Sguil desktop shortcuts. The Snort and Sguil daemons will then start, listening on eth0 for any suspicious traffic and creating alerts in the Sguil console.
• The Security Onion LiveCD can be used to test an Intrusion Detection System. Simply boot the CD and use the included tools (such as nmap, metasploit, idswakeup, scapy, hping, and others) to test your existing IDS or to test the included Snort 2.8.4.1 and Snort 3.0 Beta 3.
• The Security Onion LiveCD can be used to install an Intrusion Detection System. Simply boot the CD and double-click the Install desktop shortcut. For more information about installation, please see the README desktop shortcut.

You can read more about the Security Onion LiveCD (and, specifically, the integration of Snort 3.0 and Sguil) in my SANS GCIA Gold Paper "Snort 3.0 Beta 3 for Analysts".

Please take a look at the Security Onion LiveCD and let me know what you think!

* Special thanks to:

• Marty Roesch and the whole SourceFire team for all of their work these last 10 years to get Snort to where it is today.
  
• The Sguil team for the best open-source tool to manage Snort alerts.
  
• The SecurixLive crew for their awesome NSMnow installer, the easiest way to install and configure Snort/Sguil on Ubuntu Linux.
• Ubuntu (and Debian) for their well-made Linux distribution(s).
• The Reconstructor team for a very easy to use tool for remastering Ubuntu LiveCDs.
• All developers in the open-source community who work so hard and produce such amazing tools.
  

Announcing Detroit Dave's Raves

One of my SANS 503 Mentor students has started his own blog. Check it out at:
http://detroitdavesraves.blogspot.com/

SANS 503 Mentor class is full

Registration is now closed for the previously mentioned SANS 503 Mentor class here in Augusta. This was the first SANS Mentor class to sell out in a few years! Thanks to all who registered.

Links for Binary and Hex Refreshers

If you're about to take SANS 503 and it's been a while since you've had to deal with the world of binary and hex, here are a few good links for refreshing your memory:
http://en.wikipedia.org/wiki/Hexadecimal
http://en.wikipedia.org/wiki/Binary_numeral_system
http://www.underground-security.com/downloads/crew/frostbyte/tutorials/conversions-tutorial.php
http://www.blaenkdenum.com/binary-and-hexadecimal/
http://www.permadi.com/tutorial/numHexToBin/index.html
http://atrevida.comprenica.com/atrtut01.html
http://www.sans.org/training/tcpip_quiz.php