Posts tagged Automation and Orchestration

Understanding Access Control Lists

Synopsis When it comes to the security regarding routers, switches or on the basic ISP layers, we talk about ACLs. They are generally used to control/manage the inbound and outbound traffic. In this blog, we will be looking into basic configuration of standard IP ACLs also known as Access Lists or in some cases filters. Understanding ACL Access Control [https://www.rapid7.com/fundamentals/what-is-network-access-control-nac/] List as the name suggests is a list that grants or denies permission

7 min Komand

10 Ways to Make Your Security Posture More Proactive

In a perfect world, security teams have everything they need to defend against the complex cybersecurity threat landscape: an enviable team of security pros, sophisticated detection and prevention processes, and intelligent alerting and reporting tools. But in reality, most teams and security operations centers find themselves struggling to keep pace. And whether it’s from an imbalance in people, process, and technology, or a data utilization problem, security teams end up in a reactive state:

6 min Automation and Orchestration

Cybersecurity careers and the certifications needed

Synopsis Cybersecurity has become one of the top sought after careers in the Information Technology field. Careers ranging from an ethical hacker to a security auditor. With so many options to choose from, where do you start to pursue such a purposeful and exciting future? I will explain some of the top certifications that are offered and what fields they are associated with. Institutes and their certifications International Information Systems Security Certification Consortium, Inc. (ISC)2

5 min Automation and Orchestration

Inspecting Network Traffic with tcpdump

Synopsis Tcpdump, as the name suggests, captures and dumps(writes) the network traffic passing through a given server’s or node’s network interfaces . It is a classic command line tool written in 1987 and remains one of the most powerful tools for analyzing network traffic. Many options and filters available in the tool makes it easier to slice and dice the data. The data then can be used by network administrators and enthusiasts for many purposes such as, security & forensic analyses, trouble s

5 min Automation and Orchestration

How to Install OpenVPN on Windows

Synopsis With the growth of online privacy and security concerns, as well as people wanting to work around geo-restrictions, VPNs are becoming much more mainstream. They no longer rest in the realm of security professionals and the overly paranoid. OpenVPN is the most secure VPN protocol you can use and this guide will teach you what it is, as well as how to install it on Windows. If you are looking to install OpenVPN on another operating system, visit their website [https://openvpn.net/index.

3 min Komand

3 Steps for Effective Information Security Event Triage [Infographic]

Before you jump into action when a security alrm sounds, you need to first assess what happened. Pulling together the details of the event will help you determine if there is a real security incident, and if so, how you will need to respond. But often in the frenzy of security alerts, we get caught up in processes or start jumping to conclusions without enough info. This can lead to a haphazard incident response. From my experience, there's a simpler way; one that is efficienct, not bogged dow

4 min Automation and Orchestration

Burp Series: Intercepting and modifying made easy

Synopsis As a penetration tester I have many tools that I use to help with web application testing, but the one tool that never lets me down is Burp suite by portswigger. Burp suite is an intercepting proxy that allows you to modify and inspect web traffic, it comes in two flavors, free and paid. The free version is powerful enough to assist any pen test engineer, whereas the paid version will add extra features to make your tests go smoother and faster. I am going to walk you through the beg

7 min Komand

How to Render Components Outside the Main ReactJS App

We use React here at Komand as one of our core libraries in our front-end applications and while it does a great job of abstracting away the code for managing the DOM, sometimes that can be problematic. With React, you have JSX which is just XML sugar for declaring what DOM elements you want React to render. React just renders the elements where they are defined within the JSX. For example, this JSX… <div className=“content”> Content <Modal> I’m a modal </Modal> </div> ... would res

6 min Komand

SOC Series: How to Make a Security Operations Center More Efficient

You have your security operations center (SOC) [https://www.rapid7.com/fundamentals/security-operations-center/] in place, now what? Creating a SOC is not a cheap undertaking, so to be sure your investment in people and resources pays off, your next task is to make it as efficient as possible. Efficiency drives time-to-response, and with intrusion detection and incident response, optimizing for this metric is crucial. Over the long term, it also becomes more cost-effective. I’ve seen the good

5 min Komand

Early Warning Detectors Using AWS Access Keys as Honeytokens

Deception lures are all of the rage these days [http://blogs.gartner.com/anton-chuvakin/2016/11/21/our-applying-deception-technologies-and-techniques-to-improve-threat-detection-and-response-paper-is-published/?utm_content=buffera88d3&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer] , and when deployed properly, are extremely low overhead to maintain and trigger little to no false alarms. Honeytokens, closely related to honeypots, are ‘tripwires’ that you leave on machines and data

4 min Komand

Adding Proactive Components to Your Incident Response Process

Effectiveness in security operations is a common theme these days. Often, security teams already have a long list of ways to optimize their current programs and processes, but not enough time to endlessly fiddle with the details. Choosing methods to boost effectiveness usually comes down to scale of impact and, ultimately, priority. One high visibility way to improve your response times, and, as a result, the success of your team is by shifting from a reactive security posture to a proactive on

3 min Komand

3 Signals Your Security Workflows Are Inefficient

When valuable time is spent on mundane tasks, it means that there isn’t enough for strategic planning or timely response to security events and incidents. That’s how threats go unnoticed and vulnerabilities remain open for days, weeks, or months at a time. With the cost of a data breach averaging $4 million [http://www-03.ibm.com/security/data-breach/], this can’t be ignored. Every security team worth its salt wants to: * Prove their value by doing high-value and strategic work, and; * Catch

8 min Automation and Orchestration

How to Use OpenVAS to Audit the Security of Your Network (2/2)

Synopsis Last time [/2016/11/08/how-to-use-openvas-to-audit-the-security-of-your-network-12/], we discussed how to install the Open Vulnerability Assessment System (OpenVAS), on Debian GNU/Linux. OpenVAS is a Free/Libre software product that can be used to audit the security of an internal corporate network and find vulnerabilities in a free and automated fashion. Now that we have access to the Greenbone Security Assistant web application, the tool that will allow us to manage and configure Open

1 min Automation and Orchestration

A Guide on Security Automation Best Practices

Ask three different security teams what is holding them back from faster time-to-response and chances are you’ll get three different answers: 1. Manual, time-intensive processes 2. Lack of integrated tools 3. Lack of development resources All of these problems exist across both big and small companies in any industry, from healthcare to finance to e-commerce. But in a digital world where attacks are both prevalent and pervasive, defenders always need to be a step (if not two) ahead. This i