Posts

Security Software & Tools Tips – December 2018

In this monthly post, we try to make you aware of five different security related products.
This is a repost from my personal website Ulyaothroducts.

This month we have choosen for the following:
* ModSecurity
* Snort
* OSSIM
* Nmap
* Osquery

ModSecurity


ModSecurity is a WAF module that can be used for various webservers such as Nginx, Apache and IIS.

Information from the ModSecurity website:

ModSecurity is an open source, cross-platform web application firewall (WAF) module. Known as the “Swiss Army Knife” of WAFs, it enables web application defenders to gain visibility into HTTP(S) traffic and provides a power rules language and API to implement advanced protections.

Website:

https://www.modsecurity.org/

Snort

Information from the Snort website:

Snort is an open source network intrusion prevention system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching, and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.

Website:

https://www.snort.org/

OSSIM

Information from the OSSIM website:

AlienVault® OSSIM™, Open Source Security Information and Event Management (SIEM), provides you with a feature-rich open source SIEM complete with event collection, normalization, and correlation. Launched by security engineers because of the lack of available open source products, AlienVault OSSIM was created specifically to address the reality many security professionals face: A SIEM, whether it is open source or commercial, is virtually useless without the basic security controls necessary for security visibility.

Website:

https://www.alienvault.com/products/ossim

Nmap

Information from the Nmap website:

Nmap (“Network Mapper”) is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

Website:

https://nmap.org/

Osquery

Information from the Osquery website:

osquery exposes an operating system as a high-performance relational database. This allows you to write SQL-based queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.

Website:

https://osquery.io/

Photo by Collin Armstrong on Unsplash

Security Software & Tools Tips – November 2018

In this monthly post, we try to make you aware of five different security related products.
This is a repost from my personal website Ulyaoth.

This month we have choosen for the following:
* Naxsi
* OSSEC
* Forseti Security
* Security Monkey
* OWASP Zed Attack Proxy

Naxi


Naxsi is a module that you can compile with nginx and it then provides “Anti XSS & SQL Injection” capabilities for nginx.

Information from the Naxsi GitHub page:

NAXSI means Nginx Anti XSS & SQL Injection.

Technically, it is a third party nginx module, available as a package for many UNIX-like platforms. This module, by default, reads a small subset of simple (and readable) rules containing 99% of known patterns involved in website vulnerabilities. For example, <, | or drop are not supposed to be part of a URI.

Website:

https://github.com/nbs-system/naxsi

OSSEC


This tools is a free open source host-based intrustion dectection system (HIDS) and it is easy to install, cool thing is that they are compliant with PCI-DSS

Information from the OSSEC website:

OSSEC watches it all, actively monitoring all aspects of system activity with file integrity monitoring, log monitoring, rootcheck, and process monitoring.

When attacks happen OSSEC lets you know through alert logs and email alerts sent to you and your IT staff so you can take quick actions. OSSEC also exports alerts to any SIEM system via Syslog so you can get real-time analytics and insights into your system security events.

Website:

https://www.ossec.net

Forseti Security


This are basically a bunch of tools that will help you improve the security of your GCP.

Information from the Forseti Security website:

A community-driven collection of open source tools to improve the security of your Google Cloud Platform environments.

Website:

https://forsetisecurity.org/

Security Monkey


This is a monitoring tool created by Netflix it checks your configuration, and or for policy changes then it can provide you with alerts.
It currently works both on AWS and on GCP.

Information from the Security Monkey GitHub page:

Security Monkey monitors your AWS and GCP accounts for policy changes and alerts on insecure configurations. Support is available for OpenStack public and private clouds. Security Monkey can also watch and monitor your GitHub organizations, teams, and repositories.

It provides a single UI to browse and search through all of your accounts, regions, and cloud services. The monkey remembers previous states and can show you exactly what changed, and when.

Security Monkey can be extended with custom account types, custom watchers, custom auditors, and custom alerters.

Website:

https://github.com/Netflix/security_monkey

OWASP Zed Attack Proxy (ZAP)

Information from the OWASP Zed Attack Proxy website:

The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers*. It can help you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. Its also a great tool for experienced pentesters to use for manual security testing.

Website:

https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

Photo by arvin febry on Unsplash