LoveMyTool - Open Community for Network Management and Monitoring

Steganography - The Technology for Hiding (by The Oldcommguy)

What did you say?  Bless you? 

I have decided to write several articles on the Cyber Forensics World for the LMT Readers. 

The first article will be on Steganography or How to hide in Plain Sight –

 Steganography comes from the Greek word steganos or hidden/concealed writing and dates back to Greek times but did not become readily known until 1499 when Johannes Trithemius (German) wrote his book Steganographia which turned out to be a thesis on cryptography and steganography disguised as a book on magic.

 Today, Steganography gives one the ability to hide/conceal something like data, documents or pictures (the payload) inside other written material or pictures.

It is rapidly becoming a preferred method of passing/delivering criminal and or terrorist written material and pictures without easy recognition.

 It is in essence a form of magic with words, numbers and pictures as well as physical objects and of late data networking.

 There are several methods of data networking Steganography –

Having to Buy TAPs is not a Bad Problem (by The TAPman)

Take the test to see if you are a TAPaholic!

 Take the test to see if you qualify as a Certified TAPaholic!

Note from Author and Technical Editor- Not all addictions or obsessions are bad and most should be taken seriously, like drug, alcohol, and many others that are life threatening.

There are also good addictions, and one that we feel, tongue in cheek, all network managers should catch: Tapping, or focusing on getting real visibility into their network, so they can finally really see what is going on!  There are many reasons to become a “TAPaholic” and all of them are good!

So this article is about a good addiction or obsession – becoming a “TAPaholic,” really getting to know your network, and helping those “SPANaholic’s” get a better path in their professional life so they, for once, can see what is really in their network!

So you bought your first TAP to review and solve your compliance problems.  You became a hero for solving that problem and it hardly cost anything.  Now, you’re wondering how many more problems you can find using TAPs.  You’ve taken this first step for “TAPification” of your network, but you may be in danger of becoming a “TAPaholic.”

From now on you will have to be extremely careful or else you may fall into the TAP abyss.  There are still so many problems to solve on your network.  You have in-line appliances that can kill your live traffic if they should fail, and every time you need to apply software patches, you need to reserve a maintenance window.  Worrying about it keeps you and your colleagues up at night. 

But now that you bought your first TAP, you begin to wonder:

1. Could a TAP solve that in-line appliance access problem for me? 
2. Can I safely place an active security appliance on my most critical links?
3. Can I do so without the worry of losing our critical “bread and butter” link in the event that anything goes wrong with the security appliance?
4. Can I do software upgrades and maintenance on the security appliance without having to schedule a maintenance window for the critical link?

I am The TAPman and I’m here to tell you, YES!  Yes, you can! 

Keep Reading and Take the TAPman Test!

 

Why Invest in a Product that is Built Around a Modular Design? (by George Bouchard)

Why is Modularity important when considering purchasing a network access product? Well, for example, it may not be practical to design a house in a modular fashion, but if it were practical, then you could build your house exactly the way you wanted it for your needs today.  And if you only had the need for two bedrooms today, you could design it that way.  As your family grew, you could then add more bedroom modules to accommodate the growth of your family or your mother-in-law coming to live with you.

 
Modularity gives you flexibility…you only have to purchase what you need today, and you can add or change functionality as your needs expand. 

So, when considering equipment to provide Network Access for the tools you need to keep your network safe, secure, and in compliance; it would be wise to consider Network Critical’s SmartNA (Network Access)System.

The SmartNA System will give you the flexibility you need to solve your network access problems today and is so flexible it can be changed to meet your needs of tomorrow.

When it comes to networks, you can guarantee one thing -- the network will GROW.

 

It always does. Even in the smallest of networks, like the one you have in your home, will grow and change.  You will need to add tools and access more links.

 

Security, Forensics and the Database (by Jim Bailie)

Today’s Network Data Access Technology - a Review (by Tim O'Neill)

The Reality of meeting your visualization demands!

TAP, SPAN (rspan), VACL and the latest High Tech Filtering Technology

Just know the Devil or Angel you are dealing with!

Part One!

By: Tim O’Neill – The Oldcommguy™

 

Author’s comments –

-          This article is written for the Lovemytool.com readers!

 

-          All Rights are reserved – Copyright 2010 by The Oldcommguy™!

 

-          No one may repost this article without getting permission from me!

 

-          If permission is given then it must be posted as it is, in full context, WITHOUT any changes!

 

-          I welcome higher education organizations to use any of my material for the education of their students!

 

I apologize for the long length of the article in advance, but I felt that I needed to give the most information I had to you for your consideration and edification.

 

Advanced Threat Intelligence and Session Analysis (by Tim Belcher)

Presenter Profile - As Chief Technology Officer for NetWitness, Tim Belcher is responsible for the company's overall product vision, development and technology roadmap. Previously, Mr. Belcher co-founded Riptech where he served as CTO. At Riptech, Mr. Belcher was the visionary behind Caltarian, the award-winning and breakthrough security event correlation technology that was the foundation for Riptech's security monitoring services. Ernst & Young recognized Mr. Belcher for his success with the "Entrepreneur of the Year" award in 2001.

NetWitness is the world leader in real-time network forensics and automated threat intelligence solutions, helping government and commercial organizations detect, prioritize and remediate complex IT risks. NetWitness solutions concurrently solve a wide variety of information security problems including: advanced persistent threat management; sensitive data discovery and advanced data leakage detection; malware activity discovery; insider threat management; policy and controls verification and e-discovery.

Editor's Note - This session was presented at the 2010 Sharkfest Wireshark Developer and User Conference at Stanford University. You can click here to download the PowerPoint presentation.

If you have problem watching this video or if you need a non-Flash version, please click here to go directly to the hosting site. Thanks.

Continue viewing other Sharkfest videos »

Network Janitor – All It Takes Is One Loose End (by Tony Fortunato)

Author Profile - Tony Fortunato is a Senior Network Specialist with experience in design, implementation, and troubleshooting of LAN/WAN/Wireless networks, desktops and servers since 1989. His background in financial networks includes design and implementation of trading floor networks. Tony has taught at local high schools, Colleges/Universities, Networld/Interop and many onsite private classroom settings to thousands of analysts. Tony is an authorized and certified Fluke Networks and Wireshark Instructor. His Pine Mountain Group CNA Level I and II certification demonstrates his vendor neutral approach to network design, support and implementations. Tony has architected, installed and supported various types of Residential Wireless High Speed as well as hundreds of WIFI hotspots. Tony uses a variety of technologies from Powerline, Wireless and wired technologies to find the most cost-efficient and reliable solution for his customers. Tony combines custom programs, open source and commercial software to ensure a simple support infrastructure.

All It Takes Is One Loose End

As part of troubleshooting, I always suggest we ‘clean-up’ and refresh or validate the customers documentation.   I can’t remember how many times this simple exercise resulted in ‘fixing’ a problem.  I love watching the look of confusion in the customer’s face as he mutters, “that’s not supposed to be connected to that”, “this was supposed to be decommissioned a long time ago”, or the ever popular, “who plugged this in?”.

I still remember the computer connected to the corporate DMZ.  Nothing malicious, just never removed after a troubleshooting exercise.

Can't believe everything you read

In this case, I noticed some switches did have labels indicating the IP address of the switch.  Great, a label, not a common site, and I was impressed.  The odd thing about the label was that I noticed it wasn’t within their addressing range.  I asked if they had a management VLAN with a different IP addressing scheme, to which the customer replied, “yes”.  When I probed a bit deeper and queried if the address on the label was within the Management VLAN addressing, the answer was, No.”  Of course the IP address on the label was not reachable, nor within the customer’s addressing ranges.

Monitoring Access and the Race for Cyber Intelligence (by Dennis Carpio)

Author Profile - Dennis Carpio has more than 15 years experience in the networking industry, including 12 years with Net Optics. In his current role as Director of Product Innovation, Dennis works directly with key customers and partners on education about passive network access for secure monitoring solutions as well as identifying future technical advances.

Net Optics is the global leader in building monitoring access devices for use with security and network management tools across the entire network. Their family of taps and monitoring filter devices enables companies to easily deploy the latest intrusion detection and prevention systems, protocol analyzers, forensics appliances and network probes before a threat or network issue arises.

One thing is for certain, and that is cyber warfare is unfortunately no longer found only in speculative fiction; it is with us today. Distributed denial-of-service (DDoS) attacks have been launched against the United States, South Korea, Kyrgyzstan, Estonia and Georgia in recent years, and military and government computer systems around the world are assaulted by intruders daily.

Some attacks come from nation-states, but others are perpetrated by transnational and unaligned rogue groups. Those bent on inflicting harm on nations and citizens not only use networks as an attack vector, but also for organizing, recruiting, and publicizing their beliefs and activities.

On the other side of the fence are the good guys, the members of the cyber intelligence community who aim to understand and track the bad guys, and ultimately stymie their plans. Due to the pervasive use of networks by radical and criminal organizations in the modern world, a great deal can be learned about terrorists by examining their use of the World Wide Web, and how the Internet is used as a vector to attack both public and private systems.

Compliance Costs, Infected Computers, Data Breaches and More ... Are You Worried YET? (by Tim O'Neill)

Editor Profile - Tim O’Neill is an independent technology consultant. He has over 30 years experience working in the WAN, Analog, ISDN, ATM and LAN test market. Tim has worked with companies like Navtel, Network General, Ganymede and ClearSight Networks and is now helping companies get lab recognition and technology verification. Tim is also the Chief Contributing Editor for LoveMyTool.com, a website designed to help network managers gain access to valuable information and real solution stories from other customers. Tim is a patent holding, published and degreed engineer, who has seen this technology grow from Teletype (current loop) data analysis to today’s 10 Gigabit LAN’s focused on business applications with heavy compliance demands.

Tim can be reached at oldcommguy (at) bellsouth (dot) net.

Data Security Compliance Costs, Infected Computers, Data Breaches and more that are plaguing today’s firms!

Are you worried YET?

I recently read these amazing and very scary statistics that are discussed on the MXLogic website -

• The number of computers infected by malware designed to steal personal or banking information for identity theft and fraud has shot up 600 percent in the past year, according to a report from web security firm Panda Security.

  The growth of unique malware has nearly tripled in the first half of 2009 - compared to 2008, according to web security researchers from antivirus firm McAfee.

• In total, McAfee has spotted 1.2 million unique pieces of malware so far this year, nearly as much as produced in all of 2008 and almost six times the amount of malware in all of 2007, reported on the Avert Labs blog.

"Security and compliance issues facing companies and their IT staff are exploding, and at the same time becoming increasingly more complex and dangerous. MX Logic solutions are designed to address these issues in a way that reduces costs and alleviates the pressures placed on overworked IT staff," said Sam Masiello, Director of Threat Management at MX Logic (now part of the McAfee SaaS Business Unit).

• Cybercriminals use malware to infect PCs with malicious code that can steal data for identity theft, sending out spam and distributing malware to other PCs.

The State of Our Networks (by Tim O'Neill)

Editor Profile - Tim O’Neill is an independent technology consultant. He has over 30 years experience working in the WAN, Analog, ISDN, ATM and LAN test market. Tim has worked with companies like Navtel, Network General, Ganymede and ClearSight Networks and is now helping companies get lab recognition and technology verification. Tim is also the Chief Contributing Editor for LoveMyTool.com, a website designed to help network managers gain access to valuable information and real solution stories from other customers. Tim is a patent holding, published and degreed engineer, who has seen this technology grow from Teletype (current loop) data analysis to today’s 10 Gigabit LAN’s focused on business applications with heavy compliance demands.

Tim can be reached at oldcommguy (at) bellsouth (dot) net.

The State of today’s Networks!

What is happening to our networks and data?

Are you prepared?

The hidden costs of mismanaging your network and your essential tools!

Today’s networks are beginning a final merger which will allow for all phases and types of auditing, monitoring and analysis – This will be the access merger for Compliance both lawful and libelous, Security – From policy management to prosecution and Networking – focused on successful application delivery while supporting both Corporate and Personal networking needs. This merger will be mainly viewed as an access challenge as there must be a single view or access point to successfully manage all these crucial areas while increasing the productivity of your ever shrinking staff charged with these tasks.

Just for the sake of network security, companies must have network access that is secure and is only available to the correct Team members. Further within this governed access there must be individual access so that each member of the Team can focus on his or her area of expertise. For example – The Compliance person may want to monitor and save only connection information – The “who is connected to what application” or “who has access to the protected data”. There is no need for the Compliance person to be monitoring response times or foundation information. The Security person may only be looking for certain words or phrases, unusual or aberrant behavior that is the signature of an attack.