5 ms·
Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?
by pandapower2 7y ago
Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?
- bdibs 7y agoProper audit logs that are regularly checked.
- drb91 7y agoAssuming the exfiltration can be differentiated from normal behavior!
- auiya 7y agoSeeing large amounts of encrypted traffic leaving via a DNS tunnel during non-standard business hours for instance would be an example of such an anomaly. It's not always that easy to detect however.
- mirimir 7y agoDidn't Sony pick up exfiltration through exceptional data flows?
- IncRnd 7y agoSony was hacked 19 times in two weeks. There was a lot they didn't pick up on due to the difficulties involved with that.
- cmroanirgo 7y agoEven more interesting is how the FBI knew they'd been infiltrated before they themselves did? (There's the obvious conspiracy style accusation in that they were already in there poking around... but that doesn't seem to ring true in this regard)
- rando444 7y agoFor some clients we use tools that alert if large amounts of data are transferred outside the network in a single flow. So even if it's someone with valid access, it would be investigated immediately.
- jftuga 7y agoWhich tools do you use? I have been looking for something that does this.
- kylel 7y agoIn the Marriot hack post-mortem, they shared that one of the tools they used (which successfully identified the attack) was IBM Guardium. > Accenture told Marriott's IT staff that one of their security products, a database monitoring system called IBM Guardium, had detected an anomaly on the Starwood guest reservation database https://www.zdnet.com/article/marriott-ceo-shares-post-mortem-on-last-years-hack/ https://www.zdnet.com/article/marriott-ceo-shares-post-morte...
- pnutjam 7y agoI'm guessing snort or one on the similar products.
- deleted 7y ago[deleted]
- IncRnd 7y agoWhy do you assume this was an unauthorized person?
- pandapower2 7y agoFair point.
- ectospheno 7y agoSimply storing netflow data and graphing it would show it at a glance. Use a machine setup as a transparent bridge with only physical login if you are paranoid about the netflow data being modified. Hiding on a box is easy. Hiding on the wire is hard.