IT Security – Follow the breadcrumb trail – Indicators of compromise in Part 2

95036955[1]

In a world where we need to be watching or monitoring our networks continuously knowing what to look out for may be just what we need to help us get started. These important indicators could protect your organization IT security or help you stop an attack in its tracks. So, here is the second installment. HTML Response Sizes This follows on from Part 1 where I talked about monitoring read volumes for databases. Attackers using SQL injection to extract data through a Web application will usually have a larger HTML response size than a normal request. For example, if the attacker extracts the full database, then the response is going to be a much larger file then a normal query. Large numbers of requests for the same file Attackers never give up, it takes a lot of trial and error to compromise a site -- attackers have to keep trying different exploits to find ones that work. And when they find signs that an exploit might be successful, they'll frequently use different permutations to launch it. Mismatched Port-Application Traffic Attackers often take advantage of obscure ports to get around more simple Web filtering techniques. So if an application is using an unusual port, it could be sign of command and control traffic masquerading as "normal" application traffic. Infected hosts could be sending command and control communications masked as DNS requests over port 80 which may appear to be standard DNS queries. DNS Request Anomalies One of the most effective red flags organizations can look for are tell-tale patterns left by malicious DNS queries. Command-and-control traffic is often the most important traffic to an attacker because it allows them ongoing management of the attack and it needs to be secure so that security professionals can't easily take it over. The unique patterns of this traffic can be recognized and is a very standard approach to identifying a compromise. Seeing a large spike in DNS requests from a specific host can serve as a good indicator of potentially suspect activity. Look out for patterns of DNS requests to external hosts. Unexpected Patching of Systems Patching is generally a good thing, but if a system is inexplicably patched and you don’t know anything about it then it could be a sign that an attacker is locking down a system so that other bad guys can't use it for other criminal activity. Most attackers are in the business of making money from your data -- they certainly don't want to share the profits with anyone else! Look out for the final Part 3 coming soon.

IT Security – Follow the breadcrumb trail – Indicators of compromise in Part 2

Trending Articles

Practice Sheet of Right form of verbs for HSC Students

Download: FK ft Shenky – Nakuyewa ”Prod by: Shenky”

How to win at Markstrat (Markstrat Tips and Tricks) – Vodites

Ominde Commission Report and Recommendations – Ominde Report of 1964

Bureau of Internal Revenue: Regional Offices (Directory)

GO 53 on Enhancement of Ex-gratia upto 5 Lakhs Toddy Tappers in Telangana

Cakewalk CA-2A Leveling Amplifier v2.0.1.97 WiN, v2.0.1.96 OSX Incl Keygen

Mp3 Download: Mdu - Kunjenjenjena

How the kill the job , when DTP request running for long hours.

Microsoft Intune から展開しているアプリのアップデートについて

18-year-old girl was beaten for half an hour by two Northampton men in 'an...

Car crash in Dunton Bassett leaves driver in critical condition

Macky 2, Two Others In Road Accident

Application log 00000000000000089514: Could not convert queue DLVST90CLNT

Detroit mafia: D’Anna Brothers agree to plea deal

Delivery block field greyed out using VA02

Muloraki Au

【個人撮影】スマホのプライベート映像♪「中に出さないで///」カラオケ屋での生ハメ撮りが流出ｗ【リベンジポルノ】＠PornHub

BREAKING NEWS: Diamond Platnumz Is Reported Dead After Ghastly Car Accident

FIAT 500 B0111 B0112