Passive Host Auditing

Architecture and Background

jives, Passive Host Auditing Traditionally, IDS systems such as snort have been used to monitor attacks against or within a network. This talk will give the outline for turning those tools around and instead using them to audit networks.

Vulnerability Analysis

We will discuss how to identify OS, tell who is patching, what services are being deployed (perhaps insecurely), and other methods for policy enforcement. This discussion is ideally suited for administrators and security professionals in open and/or decentralized environments, especially those charged with auditing the network.

Exploitation and Demonstrations

While several signatures and sample scripts will be discussed during this talk, this is a relatively new area of auditing and network security so questions, comments and volunteers will all be welcome. Jives has been doing computer security at a major research university for over 5 years.

Remediation and Defensive Strategies

After initially specializing in host security he has moved into network security. In this area he has written several evidence gathering scripts. Recently he has made a hobby out of using the network to answer questions about the host.