Using OpenBSD, Snort, Linux, and Other Tricks

Architecture and Background

Thomas J. Munn present 'Using OpenBSD, Snort, Linux, and Other Tricks' at DEF CON 9, analyzing core mechanics and architectural assumptions surrounding openbsd, snort, intrusion-detection, network-defense in the blue-team domain.

Vulnerability Analysis

The technical evaluation inspects structural design weaknesses, protocol exposure points, and common attack primitives.

Exploitation and Demonstrations

Thomas J. Munn - Using Open BSD, snort, Linux, and a few other tricks to set up a transparent, ACTIVE Ids Basically I will cover: How to set up Snort Sensor in Openbsd. - How to use Perl & Rules to actively adapt rules to attacks, while keeping yourself from being "DOSSED" - How to use ACID to make logs more easily accessible, and analyzed, - How to Use database portion to look at historical attack trends and react appropriately. - How to set up "safe" management segment on your network that is both accessible to you, but hard for "them" to get into.

Remediation and Defensive Strategies

Defenders and system administrators receive concrete hardening strategies, architectural best practices, and detection guidance to mitigate threat impact.