EXPERT RESPONSE
If you need to transmit NetBIOS or LDAP across an untrusted network (i.e., the Internet, your DMZ, internal network, etc.), use an encrypted VPN to ensure it is protected. For detection, employ strong host-based security on both endpoints. Use both antivirus and antispyware tools to detect any malware inserted there. Also, diligently review the logs from these machines and look for suspicious entries, including changes to critical system files. Next, run a file integrity-checking tool, such as Tripwire, on each endpoint. Then make sure the system administrators on the server side diligently watch for additional users added to the admin group.
If you need more information, you can download the Intrusion Discovery Cheat Sheets I wrote at www.sans.org/resources/winsacheatsheet.pdf
and www.sans.org/resources/linsacheatsheet.pdf.
|
