Blog Elements

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

Automated Log Management and Analysis using Splunk for Computer Incident Investigations

2010-07-15/0 Comments/in General Security/by SecurityOrb_Staff

Splunk – I define “Log Analysis” as a process of collecting system logs (syslog) and event data from computer systems, network devices and applications to look for anomalous events that are malicious or are in violation of organizational policies.

Personal Security on Social Networking Sites

2010-07-15/0 Comments/in General Security, Privacy/by admin

Visits to social networking sites account for more than 10% of the total time people spend on the Internet, according Nielsen Online. A social network site focuses on building online communities of people who share common interests and activities, such as Linkedin.com and Facebook.com. Facebook is now the most visited social networking site on the Internet, with nearly 1.2 billion visits in January 2009 alone, while Twitter and Linkedin are steadily gaining ground.

Automated Log Management and Analysis using Splunk for Computer Incident Investigations

2010-07-15/0 Comments/in General Security/by SecurityOrb_Staff

Personal Security on Social Networking Sites

2010-07-15/0 Comments/in General Security, Privacy/by admin

Full Sized Blog Element (Big Preview Pic)

Automated Log Management and Analysis using Splunk for Computer Incident Investigations

2010-07-15/0 Comments/in General Security/by SecurityOrb_Staff

I define “Log Analysis” as a process of collecting system logs (syslog) and event data from computer systems, network devices and applications to look for anomalous events that are malicious or are in violation of organizational policies.

Many organizations spend thousands of dollars on equipment deployment, but ignore the system and event logs from those exact systems. Log analysis is one of the most overlooked aspects of operational computer and network security today.

Traditionally, security teams would use outdated methods and inefficient analysis techniques such as command lines and scripts to review log files. Furthermore, the security team has limited access to data, and when that data has to be collected from multiple locations and equipment to be analyzed, that often increases the amount of time necessary to produce a conclusion of an incident.

By introducing Splunk a search engine for log data that supports many log sources such as Apache access logs, mysql database logs, and any log in standard syslog format, we were able to be more productive in our log analysis.

Splunk comes in two versions, basic and professional. The basic version is free as long as you keep the data limited to 500MB a day while the professional version cost is dependent on the amount of data collected as well as some other neat features.

Splunk provides both real-time and historical visibility into all network, application, server and user activity to support investigations, alerting and reporting. It provides that bridge security and computer investigators need to do their jobs right.

For more information on Splunk and log management you can visit:
www.splunk.com

Personal Security on Social Networking Sites

2010-07-15/0 Comments/in General Security, Privacy/by admin

Hackers have adopted the popularity of social networking sites into their malicious plans to compromise systems and steal personal identifiable information. Recent attacks such as the Koobface virus on Facebook and the clickjacking issues faced by Twitter are all prime examples of the recent challenges. Also, these very same hackers have the capability to remain anonymous on these social networking sites, which enforces the notion, you really do not know who is on the Internet with you.

Security on social networking sites are at a minimal standard right now, they rely on usernames and passwords for authentication and security, which means that anyone who finds out your username and password can gain access to your account. Until social networking site security evolves with time and improves, users need to be very careful and diligent.

Here are a few tips that should assist in making sure you are safe when using social networking sites:

1. Understand how the social networking site displays your information. Some sites will allow the user to control who can see your information, while others will allow anyone and everyone to view postings.

2. Don’t click on shortened (or “condensed”) URL’s, like those created by TinyURL and Bit.ly. There’s no telling where these links lead to, and that makes it easy to funnel you to malicious websites (Drive-by-Download).

3. Be mindful of your personal information such as, don’t post your full name, address, age, hometown or information about your family. Even your screen name can pose a lot of identifiable information.

4. Post appropriate information that are comfortable with others seeing and knowing, such as your employer, co-workers and acquaints. Many people will see your page or postings, including the people who will be interviewing you for a current position or a future job.

5. Remember that once you post information online, it may be impossible to take it back. This includes photos that can be manipulated.

6. Be careful when it comes to online personal socializations such as flirting or disputes. Some people lie about whom they are. Be wary if a new online friend wants to meet you in person.

7. Trust your instincts if you have suspicions. If you feel threatened by someone or uncomfortable because of something online, report it to the police and to the operators of the social networking site. You could end up preventing someone else from becoming a victim.

Social networking sites are evolving into our personal and business lives. People from various stages and walks of life are participating in these events with very little knowledge into the dangers of these social networking sites. The site owners only provide the minimal required security measures, while hackers are using tactics that has shown great success in circumventing them. It is up to us, to do what is necessary to protect ourselves until better security measures are implemented or the hackers give up. Don’t hold your breath on the hacker’s giving up.

For more information on this article and other informative articles go to: www.securityorb.com