Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 289
  • Last Modified:

Hacked, Best monitoring for prevention/detection

ok, One of our web servers got hacked this morning. A quick restore of the backup resolved the issue. They where able to get in because this server was not up2date. However, I want to be able to monitor/view attempts. I'm sure this is not the first time and I've never really worried about it much. Now I want to keep a very close eye on things. Our environment is mixed with windows/linux. What would you all suggest I could use to monitor all the servers?
0
cebrooks03
Asked:
cebrooks03
  • 2
2 Solutions
 
aaronblumCommented:
For the *nix boxes, you can generally look under /var/log/ for the security logs and scan for failed attempts.  You can potentially write a script to pull back that information to some central repository if that is what you need.

For Windows you can use the event log viewer to inspect for security events.  Instructions for doing this can be found here:
http://support.microsoft.com/kb/308427

More specific details would help in pinpointing a solution.

Hope this helps,
Good luck
0
 
Rich RumbleSecurity SamuraiCommented:
Snort, plain and simple, you can see the what the actual attack is classified as. You'll want to setup a snort box with 2 nic's, one to administer snort with, the other to sniff traffic with. No need to IP the sniffing NIC, but you do need to send all the traffic comming into your web-servers to it. Cisco switches call this a span port, other switch makers call it port mirroring.
http://en.wikipedia.org/wiki/Port_mirroring
-rich
0
 
Rich RumbleSecurity SamuraiCommented:
Snort can act as an IPS as well, intrusion prevention system, if you use it inline. When an attack packet is found, snort can drop the packer, or send a rst packet back to the attacker to drop the connection on the fly. It's best to start with just monitoring, then if you feel you've eliminated the false positives, you can move to an "inline" snort IPS system.
http://sourceforge.net/project/showfiles.php?group_id=78497
-rich
0
 
cebrooks03Author Commented:
Rich,

thank you. this is exactly what I needed.
0

Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now