Downloaded 20 times
More Related Content
Similar to How to Use Open Source Tools to Improve Network Security
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
How to Use Open Source Tools to Improve Network Security
- 1. How to UseOpen Source Tools to Improve Network Security
- 2. How to GetResources This presentation, links, PDFs, Code and Recorded Demo will be shared with my Blog www.mhmd.io SlideShare This Presentation will be on SlideShare GitHub Code Any Code Present Here will Be Shared on GitHub Repo, visit my Blog for more info. This Presentation is free to use under Creative Commons Attribution license. YouTube Channel This Presentation Demo will be on YouTube
- 3. I am Mohamed Almusaddar ◉Infrastructure/Cloud Manager at Al-Aqsa University ◉ Cloud Solution Architect ◉ Open Source Security Tools Specialist You can find me at: ◉ @mhmd_io Salam!
- 4. Contribution to OpenSource Security Projects
- 5. FOSS security tools Toprotect your systems/Network Infrastructure 1
- 6. “ There are thousandsof open source security tools with both defensive and offensive security capabilities.
- 7. Five-Stage Process forDIY Network Security ◉Vulnerability Analysis ◉Configuration Analysis ◉Log Analysis ◉Monitoring and Alerting ◉Intrusion Detection Systems
- 9. Vulnerability Analysis Part ofYour DIY SIEM System
- 10. OpenVAS is a powerfulopen source vulnerability scanner that will perform thousands of checks against a system looking for known security vulnerabilities. Vulnerability Analysis Solutions Nikto Web Scanner Vulnerable web scripts, configuration errors and web server vulnerabilities can all be detected. Arachni provides coverage, vulnerability detection for web application Nmap Port Scanner Test open ports with the ability to scan all ports and complete net blocks
- 11. Configuration Analysis Part ofYour DIY SIEM System
- 12. Configuration Analysis Lynis Security auditingand hardening tool, for UNIX- based systems. MBSA – Not Open Sourced determine security state by assessing missing security updates and less-secure security settings within Microsoft Windows
- 13. Log Analysis Part ofYour DIY SIEM System
- 14.
- 15.
- 16. Monitoring and Alerting Partof Your DIY SIEM System
- 17. Monitoring/Metrics Icinga2 Icinga is aresilient, open source monitoring and metric solution system Grafana is an open source metric analytics & visualization suite. It is most commonly used for visualizing time series data for infrastructure and application analytics
- 18. Collect metrics fromevery device
- 19.
- 20. Intrusion Detection Systems Partof Your DIY SIEM System
- 21. Intrusion Detection System NIDS Snort/Suricatawithin Security-Onion HIDS OSSEC is a scalable, multi- platform, open source Host-based Intrusion Detection System (HIDS) v2.9.0 on Feb 9
- 23. Collect Logs fromevery device LogsVulnerabilities IDS Reports
- 24. Summary ◉ Elastic Stackfor Logs Management ◉ OSSEC for HIDS ◉ SecurityOnion for NIDS ◉ Icinga2/Grafana for Metrics/Monitoring/Alerting ◉ Kali for Nmap/WireShark/Pen. Tests ◉ Vulnerability Analysis Stack ◉ Configuration Analysis Stack
- 25. Security Onion • fullpacket capture • NIDS and HIDS • powerful analysis tools • ELK Stack support ( near future ) • Add needed Kali tools to Security-Onion • Add Vulnerability scanner tools to Security-Onions • Backup Server • Logs Server • Monitor Server All-in-One Tool ? SMB
- 26. How to Deploy AdoptOpen Source Security Solutions 2
- 27. Deployment Plan ◉Read Documentation,Tutorials, Case Studies ◉Localhost VM Environment ◉Documentation ◉Testing Lab – Physical-Environment + semi- Automation ◉Documentation ◉Deployment – Production + full-automation ◉Documentation / Reports
- 28. Any questions ? Youcan find me at ◉ @mhmd_io ◉ admin@mhmd.io Thanks!
Editor's Notes
- #4 I am Mohamed Almusaddar Infrastructure/Cloud Manager at Al-Aqsa University Cloud Solution Architect Open Source Security Tools Specialist
- #7 Open Source Cybersecurity Catalog Homeland Open Security Technology (HOST) HOST’s focus is on open source security software. Its mission is: • identifying new, emerging and undervalued open source solutions to cyber security challenges and sharing that information broadly • making strategic investments in projects with high-impact potential • encouraging innovation by enabling cross-industry collaboration
- #8 Goals Assists with compliance testing (HIPAA/ISO27001/PCI DSS) Configuration management Software patch management System hardening Penetration testing Intrusion detection Audience Typical users of the software: System administrators Auditors Security officers Security professionals
- #11 You might be auditing your network because you have already been attacked, or to better understand your network SI security level, or as the first step in planning a security strategy.
- #13 Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening
- #15 Elasticsearch is an open source search engine based on Lucene, developed in java. It provides a distributed and multitenant full-text search engine with an HTTP Dashboard web-interface (Kibana) and JSON documents scheme. Elasticsearch is a scalable search engine that can be used to search for all types of documents, including log file. Elasticsearch is the heart of the 'Elastic Stack' or ELK Stack. Logstash is an open source tool for managing system events and logs. It provides real-time pipelining to collect data. Logstash will collect the log or data, convert all data into JSON documents, and store them in Elasticsearch. Kibana is a data visualization interface for Elasticsearch. Kibana provides a pretty dashboard (web interfaces), it allows you to manage and visualize all data from Elasticsearch on your own. It's not just beautiful, but also powerful. Beats are data shippers, lightweight agents that can be installed on the client nodes to send huge amounts of data from the client machine to the Logstash or Elasticsearch server. There are 4 beats available, 'Filebeat' for 'Log Files', 'Metricbeat' for 'Metrics', 'Packetbeat' for 'Network Data' and 'Winlogbeat' for the Windows client 'Event Log'.
- #22 Analysis You can analyze NIDS alerts from Snort/Suricata via: Squert ELSA Sguil