• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Network security and intrusion detection

N

Nman

Limp Gawd
Joined
Feb 22, 2001
Messages
145
Hi all,

With all the news surrounding corporate hacking on the rise I wanted to ask the question. For a home based user. Cable modem to router to pc's connected. What tools are available to detect a network intrusion for the home user? Are there also any good places to learn how to track and trace the intrusion back to the source? Was wondering how the enforcement community can track and trace the hacktivist groups back to thier source.

Thanks!
 
You could build your own pfSense router and the use the Snort Package. You could also just simply setup your own stand alone IDS on your home network. This would involve building a new computer and installing something like Snort. To make things easy I would look into instasnorby. http://snorby.org/ You could also install snort or some kind of IDS running inside a virtual machine on a current computer. To run your own IDS you will also need to have a managed switch that supports a span/mirror port to direct all network traffic to the IDS.
 
pfSense and Snort is an excellent option. ClearOS, Untangle, and Astro are also very good options for UTM devices with IDS/IPS.

If you are a home user though with no open ports on your firewall, you really have nothing to worry about. Hacks from the outside are only against web facing applications. If you don't have any web servers, or VPN open on your network then there is nothing to hack, other then a reverse bind attack, which really doesn't work over the WAN very well.
 
i have heard some say that IDS really isnt what it used to be these days, and that it is more for show then actually stopping things...

Thoughts?

Since most hacks go through an exploit in something being hosted like Apache, PHP, they can often get past any IDM because of a flaw in code...
 
IDS is just one piece of the puzzle when it comes to detecting / stopping threats. A necessary piece in a good layered defense, however people seem to go to extremes on IDS / IPS, either they think that they will stop everything and have no need for more security, or they are just a checkbox on an audit that is required but really does nothing. IDS on the WAN side for me holds little to no value to me other then a log of people running portscans and the like, however on the LAN side it can be very valuable if someone is breaching multiple systems during an attack.
 
You must log in or register to reply here.
Back
Top