Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Can I Get More Mileage From My Existing Security Tools?
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
11/21/2019 | 1:53:26 PM
There are a number of things

What do you advise?
  1.  Start looking into moving to IPv6, it gives users the abilityt to configure IPSec VPN AES256 connections to remote sites
  2. Enable SELinux on Centos/RHEL machines because of its ability to monitor filesystem, user, ports, network, applications and access to your system, most people have turned it off because the understand the power of it. NSA helped to develop it to thwart attacks
  3. User can utiize PfSense, this is apowerful security solution that gives users the ability to monitor, thwart network traffic (it allows the user to configure IPS/IDS, Network Monitoring, FW, routing, DNS which can all be done by configuring it on a virtual machine (free)
  4. Utilize UFW (Uncomplicated Firewall) along with logwatch, logwatch reviews the traffic from the Linux machine by extract log information and UFW blocks the traffic, we have found that UFW has blocked China, North & South Korea, Iran, Iraq locations
  5. Setup a honeypot and see what happens with the traffic accessing the network
  6. Confgure your cloud environment using a multi-layered approach (subnets) where Zone 0 (DB, Zone 1 (admin), Zone 2 (user), Zone 3 (DMZ) and Zone 4 (Internet), this can be done using Terraform, PowerShell or Python coding tools. Also, remove the public ip address from the machines that are not part of the DMZ or Internet. You could put your web traffic in the DMZ and isolate only certain ports where the SIEM (PfSense, Cisco, PaloAlto) can idenfity and mitigate that traffic
  7. Finally, if you a regional organization or national organizaiton, then add ACLs to block entire countries especially if the organization is not doing business in that country.
  8. Develop a relationship with certain vendors who have incorporated AI/ML in their mix of products, this will help the end-user make decisions even with a skeleton evening crew.

Todd


Malicious USB Drive Hides Behind Gift Card Lure
Dark Reading Staff 3/27/2020
How Attackers Could Use Azure Apps to Sneak into Microsoft 365
Kelly Sheridan, Staff Editor, Dark Reading,  3/24/2020
8 Infosec Page-Turners for Days Spent Indoors
Kelly Sheridan, Staff Editor, Dark Reading,  3/23/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5527
PUBLISHED: 2020-03-30
When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions) receives massive amount of data via unspecified vectors, resource co...
CVE-2020-5551
PUBLISHED: 2020-03-30
Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service attack and/or execute an arbitrary command. The affected DCUs are installed in Lexus (LC, LS, NX, RC, RC F), TOYOTA CAMRY, and TOYOTA SIENNA manufactured in the re...
CVE-2020-10940
PUBLISHED: 2020-03-27
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
CVE-2020-10939
PUBLISHED: 2020-03-27
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
CVE-2020-6095
PUBLISHED: 2020-03-27
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.