Security

Ask something
Discussion Locked

How To Verify External/Internal Threat?

0 helpful
5 replies

by tekgeek052401

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

What is another method of determining whether or not an unauthorized access and modification to network policy is a result of an external or internal threat, when the security audit log has been erased and disabled.

We have already re-enabled thesecurity audit function. I am trying to determine whether the hack was external or internal (physical access).

5 replies

by mshavrov

It's pretty "state of art" process. Try to find all footprints available:

* May you estimate what time did it happened? Was it day time or night time?

* Check your firewall log files, if it have any records for that time. Enable more advancedlogging, may be log all transactions for a few days to look for suspicious activity.

* Try to setup sniffer on your network to watch traffic to hacked server. To avoid overflow, use filters to cut off "unwanted traffic".

* If possible, buy andinstall IDS (Intrusion Detection System) to watch your network. It can send administrative alerts on most haching attempts.

* If possible, (I mean, if Operation System allows to do that), forward log messages or SNMP traps to another server.

*Perform system security scanning against server, which was hacked (and against potentially hacked servers). Install required patches, disable unused services, etc.

* Watch your users :-)

Good luck.

by tekgeek052401

This is helpful, however, many of the strategies discussed have been or are being deployed for prevention. IDS wouldn't work, as IP Spoofing is now common method od gaining access. Sniffer is a possibility, but again only tells me what legitimate users are doing (he said/she said scenario. We are setting up FTP site to have auditing logs sent to in the event the logs ever get deleted again. Implementing more robust firewall, so logs will be helpful, but here again, they will need to be set-up to automatically save to FTP site or something. Thank you for the comments and suggestions, am initiating some of your suggestions already. What I am trying to do is figure out whether or not some one came in the bldg to effect the changes/hackor someone from Inet conducted attack.

by penguinsrule

Please let us know a little more about your environment - what's your operating system? Unix? OpenVMS? VM/CMS? Windows 2000? MVS? ??

What's your network environment?
What happened? What's the problem statement?

This discussion is closed to new replies.