Imagine security analysts easily finding answers to questions about your organization’s network such as: What devices have port 445 enabled? What servers are running an old version of Apache? How many web cameras are on our network? Envision automatic notifications when outdated or vulnerable software is detected in your organization! That’s the value of the NIST asset inventory in the cybersecurity framework.
Someone recently contacted me concerned their Google account might be compromised. Although they live in California and have never traveled to Europe, Google will redirect them to European versions of Google, usually the Czech version. The individual informed me that after signing into a Google service from her home, Google notified her via email that a new sign-in was detected coming from Prague.
The last three articles I’ve published step you through how to setup the Bro intrusion detection system (IDS) on Red Hat 7. You’ve read through installing prerequisites, compiling and installing Bro, and configuring it for the first time. But despite anyone’s best efforts, there is likely to be some hiccups along the way. Your Bro workers might drop packets, hit a Bro bug, or perhaps a worker crashes. This post will examine some tools to help you diagnose common issues and unfold some potential causes and solutions with Bro.
The Bro IDS is great at analyzing network traffic, not to mention it’s very capable at detecting and logging issues that it finds in your network traffic. It’s amazing that an open-source project has progressed this far. This post covers configuring Bro and running it.
Let’s review what we have covered in part one and part two of this guide:
- Prerequisites for Bro IDS are installed, including:
- Other needed packages
- OS settings are adjusted, including:
- Memory/buffers settings are adjusted
- Bro is compiled
- Plugins are compiled and installed, including:
- Setcap (which enables some permissions for non-root users)
This section will go into configuring various settings in Bro, then starting Bro. We’ll also explore how to check on the health of Bro.
This is part two of a four part series on getting started with the Bro IDS. See part one on installing the Bro prerequisites. This post is about installing and preparing Bro.
Bro Compilation and Installation
Now that the prerequisites are taken care of, it is time to compile and install Bro. I downloaded Bro 2.5 IDS from bro.org and extracted it. After entering the directory, I ran
./configure --with-pfring=/usr/src/PF_RING --with-pcap=/opt/pf_ring-6.5.0 --prefix=/opt/bro
Below is the output from my ./configure command. It is okay to see failures on some of the lines since some items might not be needed for your system. If you followed this guide, you should see successful messages for GeoIP, gperftools, and PF_RING as highlighted in the output below. (Note, I skipped installing GeoIP so my message will show false below.)
If you have a computer network then you need to ensure an intrusion detection system (IDS) is a part of your cybersecurity strategy. The value of monitoring the traffic on your network far outweighs the cost of a breach. Although most IDS systems are commercial, there are a few open-source IDS solutions.
Snort and Suricata are popular open-source firewall/IDS solutions, but come with a few drawbacks. For a small operation they may work well, but for medium or larger networks they can bring more work and less value. Their key drawback at this time is that Snort/Suricata-capable devices do not communicate with other capable devices on the network, nor are they centrally managed. With cyberattacks becoming more sophisticated, a security-conscious organization needs a better solution.
There is a third major player in the open-source IDS game. The Bro Network Security Monitor, developed originally by higher education, provides both a network protocol analyzer and a security tool. It’s strength is the ability to correlate traffic across multiple Bro devices on a network, and add additional and customizable plugins. In other words, instead of having multiple independent IDS boxes on your network, you could have a single clustered system that correlates information across the network.
This is part two of a a two-part series to configure a Palo Alto Networks firewall in a virtual environment. Palo Alto Firewalls are a great asset for any organization as it includes many advanced features to detect and stop bad network traffic.
Configuring the Palo Alto
At this point, the virtual environment is setup (see part 1). I am plugged into my router and can access the ESXi box and Palo Alto from the internal network. Now it’s time to configure the Palo Alto.
The Palo Alto Networks firewall is quite an amazing piece of engineering. This state-of-the-art firewall not only includes traditional firewalling on layer 3 and 4, but it also provides application-level firewall capabilities, user-level policies, DDoS protection, threat prevention, and a whole lot more. In short, it makes a network and security guy like me drool.
I recently came across a problem with a Sony Blu-Ray player, specifically the model BDP-S3200 running software version M19.R.0071. When I open the network status screen, it shows valid IPV4 network settings such as a good IP address, a subnet mask, DNS servers, etc. However, there is a glaring message on this screen that reads, “Internet Connection: Failed.” I can use the internet browser just fine to access different websites like Youtube and Google. However, when attempting a software update of the player, it would report that it did not have an internet connection. And to add to the confusion, that same player would perform the software update and see it has a valid internet connection when it is connected on a different network. When I performed the network diagnostics, it reports there is an error connecting to the DHCP server.