RE: [fw-wiz] Log checking?

From: Rodel Collado Urani (sparc_at_ucomputer.org)
Date: 09/29/04

  • Next message: Fiamingo, Frank: "RE: [fw-wiz] Log checking?" 
    To: luke.butcher@alphawest.com.au, paul@compuwar.net
Date: Wed, 29 Sep 2004 04:23:40 -0700

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    On Tue, 28 Sep 2004 18:12:11 -0700 "Paul D. Robertson" <paul@compuwar.net>
    wrote:
    >On Wed, 29 Sep 2004, Luke Butcher wrote:
    >
    >> It's for this reason I always setup IDS(ii?) inside the firewall.
    >I'm
    >> only worried about what gets through, what's blocked is history.
    >>
    >
    >That's still pretty much logging "known bad" though, isn't it?
    >Heck, if
    >it's known bad, I want to stop it, not alert on it. Blocked getting
    >ignored was pretty much my default too, since we had enough attacks
    >a day
    >that following up would have taken at least one person, maybe more.
    >
    >> It also has the nice side effect of monitoring what people inside
    >your
    >> network are up to. Which for all practical purposes are the only
    >ones
    >> you can actually do anything about.

    Its good thing to monitor all servers running critical applications but
    doing this requires too much work unless there is someone tasked on looking
    every possible security breaches. Since email has been always considered
    a necessity for everyone handling systems and network admin (SNA) then
    one thing that may lessen work than just monitoring every activities
    that the system may occur is by setting an email relay on every servers
    that may alert and administrator whatever is happening in those servers
    such as unauthorized icmp packets, spam, et al.

    >
    >Well, that's one of my reasons for doing permits- more fun to be
    >had
    >LARTing the lusers.
    >
    >> Sometimes if there is no IDS in place (or even if there is depending
    >on
    >> the client), I'll log permits on the firewall but only on more
    >generic
    >> rules e.g. allow inside to ftp to anywhere. Logging everything
    >can
    >> generate too much data, and your signal to noise ratio drops meaning
    >you
    >> might miss something.
    >
    >I didn't constantly monitor everything, but I'd do it as a routine.
    > I
    >also felt that it would help me make a "routine process" case if
    >we ever
    >got challenged for a dismissal.
    >
    >Paul
    >----------------------------------------------------------------
    >-------------
    >Paul D. Robertson "My statements in this message are personal
    >opinions
    >paul@compuwar.net which may have no basis whatsoever in fact."
    >probertson@trusecure.com Director of Risk Assessment TruSecure Corporation
    >_______________________________________________
    >firewall-wizards mailing list
    >firewall-wizards@honor.icsalabs.com
    >http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    RODEL COLLADO URANI
    -----BEGIN PGP SIGNATURE-----
    Note: This signature can be verified at https://www.hushtools.com/verify
    Version: Hush 2.4

    wkYEARECAAYFAkFbb/QACgkQQ7QUZrvBIZ22ygCgoX4dzR50IDnc9jxUs49FbRv9YUAA
    oITIkTI7bZSUHWlN5SlHpNFP73x6
    =zMG+
    -----END PGP SIGNATURE-----

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Fiamingo, Frank: "RE: [fw-wiz] Log checking?"

    Relevant Pages

    • Re: dns on firewall
      ... > The reason for worrying about the firewall itself being compromised, ... > that it becomes easier to use your network for outbound attacks, ... DMZ servers or using different root passwords on your systems it should ...
      (comp.os.linux.security)
    • Advise - Event logs, IDS & firewall log monitoring / reporting
      ... allow us to add functionality for Event log monitoring / IDS and firewall ... Our current setup is 16 servers made up of a combination of mostly Windows ... As far as IDS is concerned, we've used Entercept on one of our other ... With the Watchguard Firewalls, ...
      (microsoft.public.win2000.security)
    • Re: Been hacked
      ... > The system is running linux with an iptables firewall. ... > monitoring program which is missing and there is another monitoring ... Or leaving themselves a nice little hacked-up box for later use on more ...
      (comp.os.linux.security)
    • Re: Traffic Monitor
      ... You can bind such monitoring tool to any NIC on the firewall, ... > My network looks like this: My Link comes in on a Cisco 805 from the router ... > and then one port for the rest of the network which connects to a 100base ...
      (freebsd-isp)
    • Re: Protecting your router.
      ... > and not monitoring your firewalls/routers leaves them exposed. ... and an internal IDS for monitoring hosts should be sustainable. ... That's why I think monitoring in front of your firewall is a needless task. ... looking into the traffic between the perimeter router and the next-layer ...
      (Focus-IDS)