Manage

Real time network monitoring and forensics

• 4 enterprise database security best practices

  Beyond protecting enterprise databases from vulnerabilities, it is critical to improve and review their security on a regular basis. Learn more with these database security best practices. Continue Reading

• Building an effective security operations center framework

  An effective security operations center framework includes more than just monitoring and analysis. AI and machine learning can also play a role. Continue Reading

• How to prevent port scan attacks

  The popular port scan is a hacking tool that enables attackers to gather information about how corporate networks operate. Learn how to detect and prevent port scanning attacks. Continue Reading

• AI threats, understaffed defenses and other cyber nightmares

   Continue Reading

• AI for good or evil? AI dangers, advantages and decisions

  Good guys and bad guys both use AI, but the bad guys don't need to worry about complying with rules and regulations. What can security leaders do to level the playing field? Continue Reading

• Understand the top 4 use cases for AI in cybersecurity

  AI applications in security offers organizations four unique benefits. Learn how machine learning advances can change industry approaches to threat detection and prevention.Continue Reading

• Virtual network security measures to thwart access threats

  Virtual networks add a layer of complexity to the real networks below them. Follow these three virtual network security measures to prevent complexity from creating issues.Continue Reading

• Ron Green: Keeping the payment ecosystem safe for Mastercard

  "We have invested a billion dollars over the last couple of years just in security," says Ron Green, Mastercard's chief of security, who joined the company in 2014.Continue Reading

• Threat hunting techniques move beyond the SOC

  Tired of waiting for signs of an attack, companies are increasingly adding threat hunting capabilities to their playbooks to find likely ways their systems could be infiltrated.Continue Reading

• The threat hunting process is missing the human element

  Threat hunting hinges on an analyst's ability to create hypotheses and to look for indicators of compromise in your network. Do you have the resources to hunt?Continue Reading

• Allure of the threat hunter draws companies large and small

  Continue Reading

• Is network traffic monitoring still relevant today?

  An increase in DNS protocol variants has led to a higher demand for network traffic monitoring. The SANS Institute's Johannes Ullrich explains what this means for enterprises.Continue Reading

• Does pcAnywhere put election management systems at risk?

  ES&S admitted it installed the insecure remote access program pcAnywhere on election management systems. Learn what pcAnywhere is and what this risk means for election systems.Continue Reading

• How entropy sources help secure applications with SDLC

  Some applications need cryptographic algorithms to test and work properly. Expert Judith Myerson discusses this division in terms of the software development lifecycle.Continue Reading

• Continuous security monitoring advances automated scanning

  Battling threats in today's fast-paced cyberworld means shutting down vulnerabilities fast, which requires round-the-clock monitoring. Learn how to make it happen in your company.Continue Reading

• Set up your system for the best network security possible

  The IT pro's job is to ensure the best network security network performance both. Our guide provides solid steps to take right now to achieve both in this age of mobile and the internet of things.Continue Reading

• How to handle out-of-band management for network infrastructure

  Out-of-band management can be used for handling network infrastructure. Expert Judith Myerson explains the benefits of out-of-band management and how it can be implemented.Continue Reading

• Report: Lack of SSL traffic inspection poses threat to enterprises

  New research shows poor visibility into encrypted traffic increases the risk to enterprises as malicious actors take advantage of blind spotsContinue Reading

• Adjusting a continuous monitoring strategy to a hybrid era

  Your monitoring strategy is vital to keeping networks and data secure. Learn the latest on how to factor the hybrid cloud variable into the security equation.Continue Reading

• Lessons and next steps in continuous security monitoring

  Network visibility is both crucial for enterprise security and difficult to achieve. Organizations have implemented various technologies to allow for continuous security monitoring (CSM), and the U.S. government has also, in recent years, launched ...Continue Reading

• Three ways to build an open source security toolkit

  Enterprises should have a diverse set of open source security tools in their arsenal. Here are three factors that can help guide them in building the right security toolkit.Continue Reading

• How to make threat monitoring effective in these tough times

  Today’s threat environment can be murky, and advanced security monitoring is essential. This three-part guide explains the latest means for rooting out the fast-moving malicious actors that are targeting your enterprise’s systems.
  
  There ...Continue Reading

• Why relying on network perimeter security alone is a failure

  A network perimeter security strategy alone can no longer protect enterprises. Expert Paul Henry explains why organizations must adapt.Continue Reading

• How best to monitor today's murky threat environment

  Today's threat environment can be murky. Learn the latest means for rooting out the fast-moving malicious actors that populate it.Continue Reading

• Cyberhunting: Why enterprises need to hunt for signs of compromise

  Cyberhunting can be a critical component of enterprise security. Expert Eric Cole explains how it can prevent attacks.Continue Reading

• Haven't suffered a network security breach recently? Think again

  If you think your organization hasn't suffered a network security breach in the last six months, you're just not looking closely enough, according to Eric Cole at RSA Conference 2015.Continue Reading

• State of the Network study: How security tasks are dominating IT staff

  The majority of networking teams are regularly involved in enterprise security tasks. Expert Kevin Beaver explains the phenomena and how to embrace it.Continue Reading

• Offensive countermeasures: How they can slow down adversaries

  Sometimes the best defense is a good offense. Expert Eric Cole explains the merits of offensive countermeasures in the enterprise.Continue Reading

• Four strategies to protect the new perimeter network

  Today's protection strategies are trying to take the perimeter and collapse it inwards by focusing more controls across the network on a misbehaving machine or application.Continue Reading

• How emerging threat intelligence tools affect network security

  Up and coming threat intelligence tools aim to improve data security and even standardize threat intelligence across the industry. Expert Kevin Beaver explains how.Continue Reading

• Windows Forensic Analysis Toolkit: Advanced Analysis Techniques for Windows 8, Fourth Edition

  In this excerpt of Windows Forensic Analysis Toolkit, author Harlan Carvey discusses what Volume Shadow Copies are and how they affect forensic analysis in Windows 8.Continue Reading

• Python Forensics: A Workbench for Inventing and Sharing Digital Forensic Technology

  In this excerpt of Python Forensics, author Chet Hosmer offers some ground rules for using the Python programming language in forensic applications.Continue Reading

• Using crypto-free zones to thwart advanced attacks

  Dr. Eric Cole explains how the use of crypto-free zones to prevent last-mile network encryption can thwart stealthy advanced attacks that often go undetected.Continue Reading

• How to perform a next-generation network security audit

  The rapid evolution of networks has created a number of challenges for security admins, especially when it comes to network security audits. Expert Kevin Beaver offers pointers on performing a next-gen network security audit.Continue Reading

• Continuous monitoring program demystified

  For many security teams, "continuous monitoring" is a vague concept associated with FISMA compliance. A continuous monitoring program can be simple or complex, depending on your technology, budget, and compliance and security requirements. Even for ...Continue Reading

• Next-generation tools for next-generation network security

  The next-generation network -- one that must encompass the cloud, mobility and Internet of Things devices -- requires a different standard of network monitoring tools. Learn about new and improved tools that conquer those challenges.Continue Reading

• How to use Kismet: A free Wi-Fi network-monitoring tool

  In this video, CBT Nuggets' Keith Barker shows how to use the free Wi-Fi network monitoring tool Kismet to find possibly malicious wireless networks.Continue Reading

• Incident response planning for DNS attacks against enterprises

  Practicing incident response for a DNS attack will help enterprises recover faster. Nick Lewis offers incident response planning best practices.Continue Reading

• Network tap vulnerabilities: Network traffic security over the Internet

  Is there any viable way to mitigate the risks of a potential wide-area network tap and ensure network traffic security over the Internet?Continue Reading

• Why TCP traffic spikes with source port zero should sound an alarm

  Are spikes in TCP traffic with source port zero warning signs that future attacks are imminent? Discover why enterprises should be concerned.Continue Reading

• Continuous security monitoring: What enterprises can learn from CDM

  Uncover key continuous security monitoring tips enterprises can take away from the federal government's Continuous Diagnostics and Mitigation program.Continue Reading

• How to manage TeamViewer security risk, mitigate the TeamSpy malware

  In light of the recent TeamSpy malware, Nick Lewis examines whether TeamViewer's security risk has reached an acceptable level for enterprises.Continue Reading

• How threat intelligence can give enterprise security the upper hand

  Expert Nick Lewis covers the benefits of threat intelligence for enterprises, plus how to integrate intel feeds with existing security programs.Continue Reading

• How context-aware security can improve enterprise APT detection

  Expert Brad Casey explains why enterprises are turning to context-aware security approaches to improve their APT detection capabilities.Continue Reading

• SIEM best practices for advanced attack detection

  SIEM struggles are common, but Mike Rothman explains why SIEM products are critical for advanced attack detection, and offers a SIEM tuning step-by-step.Continue Reading

• Should syslog format be mandatory in a log management product?

  Matt Pascucci discusses what to look for when evaluating a log management product and whether syslog format should be a requirement.Continue Reading

• Marcus Ranum chat: Network threat detection and wireless attacks

  Security expert and Information Security magazine columnist goes one-on-one with Aaron Turner, co-founder of security consulting firm N4Struct.Continue Reading

• At Your Service: December 2006 managed services security news

  Continue Reading

• How to setup and configure syslog to view and filter data

  Continue Reading

• Network log management on a budget: How to streamline log analysis

  Expert Matt Pascucci examines free tools and offers simple tactics that organizations can use to streamline the network log analysis and management process.Continue Reading

• Network Forensics: Tracking Hackers through Cyberspace

  Authors Sherri Davidoff and Jonathan Ham discuss the benefits of Web proxies and caching for forensic analysts in this chapter excerpt from their co-authored book, Network Forensics: Tracking Hackers through Cyberspace.Continue Reading

• Print-management software security starts with a private IP address

  Print-management software shouldn’t provide a great risk to a company provided it uses a private IP address, says expert Mike Chapple.Continue Reading

• Marcus Ranum chat: Information security monitoring

  Security expert and Information Security magazine columnist Marcus Ranum talks to Richard Bejtlich, CSO and vice president, Mandiant Computer Incident Response Team (MCIRT) at security firm Mandiant.Continue Reading

• Database monitoring best practices: Using DAM tools

  To effectively use DAM tools, admins must prioritize which transactions are important, learn how to collect events, and write and implement database security policies.Continue Reading

• PuTTY configuration tips: How to connect to remote network systems

  Peter Giannoulis reviews PuTTY and explains how to use the Windows-based program as an SSH, telnet and rlogin client.Continue Reading

• Best practices for (small) botnets

  Your enterprise might have a strategy to deal with a large-scale botnet attack, but how would you deal with a micro-botnet that knows how to bypass antivirus and firewalls? Get botnet help with this expert advice.Continue Reading

• Preventing SQL injection attacks: A network admin's perspective

  Your database administrators and application developers should certainly be following best practices to avoid SQL injections, but Michael Cobb explains how network admins can do their part to fight those security exploits.Continue Reading

• Port scan attack prevention best practices

  While it's impossible to prevent against all port scanning attacks, there are best practices for port scanning security (such as a port scanning firewall) that can keep your network secure. Expert Mike Chapple weighs in.Continue Reading

• An inside look at security log management forensics investigations

  David Strom provides some examples of log data that provided key clues to enterprise data breaches.Continue Reading

• Tying log management and identity management shortens incident response

  Tying log management to user identity shortens incident response and forensics investigation cycles. Learn how compliance has mandated that organizations determine not only when incidents occurred, but who is responsible for unauthorized access.Continue Reading

• Product Review: Deepdive's DD300

  Deepdive's DD300 appliance helps you identify and discover data on your network.Continue Reading

• Is security improved when the number of Internet gateways is reduced?

  A single entry point has often been thought easier to defend than multiple entry points. There are some caveats to reducing the number of Internet gateways, though, as expert Michael Cobb explains.Continue Reading

• Web scanning and reporting best practices

  Implementing a solid Web scanning routine is a key way to avoid corporate Web application attacks. And with industry requirements such as PCI DSS, performing vulnerability scans are also required to stay compliant. In this tip, contributor Joel ...Continue Reading

• Data Loss Prevention Tools Offer Insight into Where Data Lives

  DLP tools help mitigate incidents and aid with data discovery.Continue Reading

• What security issues can arise from unsynchronized system clocks?

  Network administrators don't always pay enough attention to the issues of system clock accuracy and time synchronization. Michael Cobb explains why that can lead to security problems.Continue Reading

• SIM and NBA product combination is powerful

  The recent announcement that Mazu Networks, a provider of network-based analysis (NBA) tools, and eIQnetworks, a supplier of SIM products, underscores the trend towards convergence in the NBA and SIM markets. The value proposition is clear: two ...Continue Reading

• Product review: Unified threat management (UTM) devices

  Unified threat management devices consolidate several network security functions into one product. This article evalutes six UTM appliances; each had to act as a firewall and virtual private network and provide antivirus, Web content filtering, ...Continue Reading

• How to setup and configure syslog to view and filter data

  Your network devices are trying to tell you that you're under atta ck. Syslog helps you sort through the data overload and get the message.Continue Reading

• Nmap parsers and interfaces

  SearchSecurity expert contributor Michael Cobb continues his series on Nmap with a detailed look at Nmap parsers and interfaces.Continue Reading

• Interpreting and acting on Nmap scan results

  As we continue our series on Nmap in the enterprise, SearchSecurity expert contributor Michael Cobb explains how to run some of the more regular Nmap scans.Continue Reading

• Techniques for improving Nmap port scan times

  As we continue our series on using Nmap in the enterprise, SearchSecurity expert Michael Cobb provides commands that will help you adjust your Nmap scan times appropriately -- whether you want Nmap to run slow and quietly, fast and furious, or ...Continue Reading

• Buyers look for demonstrable success in innovative companies

  Cool Tech Ain't Enough.Continue Reading

• Nmap: More port scanning techniques

  In this fifth tip in our Nmap manual, SearchSecurity.com expert Michael Cobb looks at some of the Nmap port scanning techniques that exploit certain idiosyncrasies of specific platforms or protocols in order to better differentiate between open and ...Continue Reading

• Nmap: How to scan ports and services

  Nmap is the ideal tool for performing a simple network inventory or vulnerability assessment. This article offers tips on how to use a NmapContinue Reading

• How to install and configure Nmap on Linux

  Get tips on how to install and configure Nmap on Linux in an enterprise network environment.Continue Reading

• How to install and configure Nmap for Windows

  In this second installment of our Nmap Technical Manual, SearchSecurity expert Michael Cobb offers pointers on how to install and configure Nmap for Windows.Continue Reading

• Nmap: A valuable open source tool for network security

  Open source tool Nmap is a popular choice amongst hackers and security pros alike for network mapping, port-scanning and testing for network vulnerabilities.Continue Reading

• Security Device Testing

  Karalon's Traffic IQ Pro 1.0Continue Reading

• Hot Pick: NFR Security's Sentivist 5.0

  NFR Security's Sentivist 5.0Continue Reading

• To Catch a Thief

  Forensics tools aren't only used in high-profile cases.Continue Reading

• Beyond network perimeter defense: A 'submarine warfare' strategy

  Today's attacker can be anywhere, meaning network perimeter defense alone is futile. Change your thinking, and your tactics.Continue Reading

• How to avoid federal Wiretap Act issues with a honeypot network security system

  Hackers have rights, too. How can you deploy honeypots without running afoul of the law?Continue Reading

• Honeypot technology: How honeypots work in the enterprise

  The founder of the Honeynet Project explains how honeypots work and how they complement other technologies.Continue Reading

• Designing a defense-in-depth network security model

  We challenged networking and firewall vendors to provide defense-in-depth security from the perimeter to the core. Their responses give us a glimpse into the future of enterprise network security.Continue Reading

• Network security checklist a best-practices reminder

  Security services provider Red Siren has updated its network infrastructure security checklist, a collection of best practices for network administrators and chief security officers.Continue Reading

• Password pain relief

  Passwords have long been the bane of both users' and IT's existence. They have been a nuisance for your employees to remember and your help desk to deal with. However, up-and-coming options are ready to help relieve you of the headache.
  
  In ...Continue Reading

• Network forensics analysis: The future of real-time monitoring?

  Network forensics involves the capturing, recording and analysis of network events to help security teams investigate incidents, find the root of the problem, and counter potential future attacks.
  
  Through network forensics analysis, ...Continue Reading