cipherdyne.org

14 August, 2006

Syngress Publishing has allowed me to post one of the chapters I wrote for the book "Intrusion Prevention and Active Response: Deploying Network and Host IPS". This chapter is entitled "Network Inline Data Modification" and explores the concept and implications of configuring an Intrusion Prevention System (IPS) to dynamically rewrite application layer data en route over a network. A PDF version of this chapter can be downloaded here. The book has received positive reviews (including one by Richard Bejtlich of taosecurity.com) on amazon.com. The actual data replacement is accomplished with Snort_inline or with a patch I wrote for the Netfilter string match extension and bundled with fwsnort.

25 May, 2006

Syngress Publishing has allowed me to post the chapter I wrote for the Snort 2.1 Intrusion Detection, Second Edition book entitled "Chapter 12; Active Response". This chapter explores the concept and implications of configuring IDS software to automatically respond to attacks in real time. A PDF version of this chapter can be downloaded here. The book has received positive reviews (including one by Richard Bejtlich of taosecurity.com) on amazon.com. Both psad and fwsnort are discussed within this chapter.

09 May, 2006

In the February, 2006 issue of USENIX ;login: Magazine, I had an article published entitled Single Packet Authorization with Fwknop. This article is available locally here, and provides a summary of the reasons why SPA is a more effective and mature technology than port knocking.

15 August, 2005

Syngress Publishing has published a book entitled "Nessus, Snort, & Ethereal Power Tools : Customizing Open Source Security Applications", and I was the Technical Editor for Chapter 10 "Modifying Snort". This chapter explores the steps necessary to modify Snort to support a custom requirement. Examples are given for two custom projects "Snort-AV" and "Snort-Wireless".

15 February, 2005

I was the lead author of the book Intrusion Prevention and Active Response: Deploying Network and Host IPS. This book was published by published by Syngress Publishing, and is the first to concentrate exclusively on the concept of Intrusion Prevention. There are many books out there that concentrate on the concept of intrusion detection, but few that emphasize intrusion prevention. Although the detection mechanisms used by intrusion prevention systems are derived from the detection world, there are many interesting consequences when devices start interferring with network traffic.

15 December, 2004

I have written an article for USENIX ;login: Magazine entitled "Combining Port Knocking and Passive OS Fingerprinting with fwknop. Fwknop is the first port knocking implementation to combine port knocking and passive OS fingerprinting into a single piece of software. This allows you to do things like only allow Linux systems to connect to your SSH daemon.

25 June, 2004

Syngress Publishing has published the book Snort 2.1 Intrusion Detection, Second Edition, and I contributed "Chapter 12; Active Response". This chapter explores the concept and implications of configuring IDS software to automatically respond to attacks in real time. A PDF version of this chapter can be downloaded here. The book has received positive reviews (including one by Richard Bejtlich of taosecurity.com) on amazon.com. Both psad and fwsnort are discussed within this chapter.

25 April, 2004

I have written an article for Sys Admin Magazine that discusses both psad and fwsnort. The article is entitled "Content Filtering and Inspection with fwsnort and psad", and shows how effective the combination of fwsnort and psad together can instruct iptables to detect and thwart application layer attacks.

15 October, 2003

I have written an article for Information Security Magazine that compares Netfilter to Check Point FW-1. While this comparison may seem somewhat odd because FW-1 is oriented towards commercial customers and emphasizes a nice GUI, Netfilter (like other open source projects) has it where it counts even though it is completely free. The article is entitled "Firewalls: Doing it Yourself".

24 April, 2003

I have written an article for the Linux Journal on a series of steps you can perform to get Linux and Netfilter running on a Nokia IP330 appliance. This hardware is normally used to run Check Point FW-1 firewalls, but it runs Linux just fine. The article is entitled "Running Linux and Netfilter on Nokia IP Series Hardware".