Cisco Network Infrastructure Design

I stay alert for good resources on network infrastructure design. I found these on the Cisco web site. Of the documents listed here, I thought these looked intriguing:

• Data Center Networking: Infrastructure Architecture


• Data Center Networking: Internet Edge Design Architectures


• Data Center Networking: Securing Server Farms


• Data Center Networking: Enterprise Distributed Data Centers

It's also a good idea to visit Cisco's SAFE site and read SAFE: A Security Blueprint for Enterprise Networks document and SAFE Blueprint for Small, Midsize, and Remote-User Networks.

Read More

Stegtunnel New Release

PacketStorm alerted me to the newest release of stegtunnel. As a network security analyst, I like to keep an eye out for these sorts of tools. I'll test it when I have time. This tool also manipulates the IP ID field, just as Craig Rowland's covert_tcp program did in 1996. From the stegtunnel description:

Stegtunnel is a tool written to hide data within TCP/IP header fields. It was designed to be undetectable, even by people familiar with the tool. It can hide the data underneath real TCP connections, using real, unmodified clients and servers to provide the TCP conversation. In this way, detection of odd-looking sessions is avoided. It provides covert channels in the sequence numbers and IPIDs of TCP connections.

Read More

FreeBSD 4.8 Released

FreeBSD 4.8 was released late Thursday night. FreeBSD 5.1 is scheduled for release 2 Jun 03. I'm looking forward to reading the fourth edition of The Complete FreeBSD, hopefully later this month.

Read More

Removing Content from Google

A FIRST post alerted me to this article on Removing Your Materials from Google. For example:

if you want your materials removed right away, you can use the automatic remover at http://services.google.com:8882/urlconsole/controller. You'll have to sign in with an account (all an account requires is an email address and a password). Using the remover, you can request either that Google crawl your newly created robots.txt file, or you can enter the URL of a page that contains exclusionary META tags.

Read More

Rik Farrow on VLANs

Rik Farrow wrote another great article, VLANs: Virtually Insecure?. That same issue of Network Magazine features a product highlight of a XML firewall built by Data Power Technology. I find this interesting because we now have to inspect, filter, and alert on traffic to specific ports like 80 tcp. This happens when developers code multiple protocols for a single port. We already have this problem with the Windows networking world, where ports 135, 137, 138, and 139 are used for multiple purposes by multiple services. Unfortunately, businesses can't firewall off port 80 to the world.

Read More

Review of Special Ops: Host and Network Security for Microsoft, UNIX, and Oracle Posted

Amazon.com just posted my five star review of Special Ops: Host and Network Security for Microsoft, UNIX, and Oracle. From the review:

"Special Ops" is one of the most useful security books I've read -- and my library includes 92 titles acquired since 2000. "Special Ops" is not "Hacking Exposed" with a white-and-camouflage cover. While the "Hacking Exposed" series is more assessment- and enumeration-centric, "Special Ops" spends more time on proper installation and deployment of services and applications. Most usefully, "Special Ops" succinctly and powerfully addresses topics neglected by other security books.

Read More

Melissa Virus Four Year Anniversary

Four years ago today the Melissa virus caused lots of headaches and early morning calls. My then-fiance and I were getting photos taken when I received an "all officers" call. I spent the rest of the weekend at the AFCERT dealing with the virus. That event prompted our unit to establish a full-time anti-virus crew.

My friend Stephen Northcutt of SANS fame reviews items for Amazon.com too. I was pleased to see he wasn't thrilled by the second edition of Firewalls and Internet Security, either.

Read More