Когда речь заходит о мониторинге безопасности внутренней корпоративной или ведомственной сети, то у многих возникает ассоциация с контролем утечек информации и в...

As organizations responsible for Industrial Control System (ICS) networks continue to acknowledge the current threat landscape, they are rapidly looking to instrument their networks for visibility. This visibility is key to helping identify nefarious activity and to investigate potential breaches. ICS and SCADA networks are often characterized by very rigid change control policies and diverse vendor-dependent systems. Often times installing agents on endpoint devices is not an option and the cost to implement a full packet capture solution puts it out of reach. This can put system and security administrators in a position that leaves them feeling helpless. Fortunately, there are options.  In this presentation, Robert M. Lee and Chris Sanders will discuss solutions for instrumenting ICS networks for security visibility. This will begin with a high level discussion of network security monitoring (NSM) and asset identification, followed by an overview of network architecture and chokepoints relevant to capturing…

What is Bro IDS (Zeek)? Thinking about Bro as an IDS alone doesn't accurately describe the breadth of its capabilities. Let's break down a more effective description.