Computer and Network Security
CS494/594            Class 12   11/14/06

Topics

• network defenses
• firewalls
• intrusion detection/prevention
• forensics -- cyber CSI
• lecture slides

Required reading

• Text 18.1, 18.2, 20.1
• Network (In)Security Through IP Packet Filtering
• computer forensics
• Secure Deletion of Data from Magnetic and Solid-State Memory

Additional reading

• Thinking about Firewalls
• firewall toolkit fwtk
• SOCKs RFC1928 and SOCKS info or here
• firewall FAQ
• Window's personal firewalls conseal or zonealarm or network ICE
• Windows XP firewall
• Linux IPTables How To
• MAC OS X firewall ipfw
• linksys router/firewall/NAT box for cable/dsl modems
• httptunnel tunneling through a firewall with http
• SAFE best practices for securing an enterprise network

  IDS
  "If you bring a Ranger with you, it is well to pay attention to him" --- J.R.R. Tolkein, The Fellowship of the Ring

• SANS IDS faq
• LBL's Paxson's bro
• RealSecure or NetRanger or snort
• just use tcpdump as in shadow project
• Linux LIDS
• Ptacek's eluding network intrusion detection and vulnerabilities of IDS's
• Forrest's computer immune systems for IDS
• IPS and ISS's proventia
• A Behavioral Approach to Worm Detection
• honeypots and honeynet and An evening with Berferd

  forensics

• wikipedia computer forensics
• RFC 2350 expectations of Computer Security Incident Response Teams (CSIRTs)
• TCT the coroner's toolkit, forensic postmortem
• sleuthkit UNIX forensics and autopsy forensic browser and article
• encase forensics (product description) and FIRE bootable forensics and ProDiscover
• FTK forensics toolkit
• malware analysis or here
• windows malware analysis tools vmware or ollydbg or IDA Pro or sysinternals tcpview/regmon/filemon/process explorer or pslist or regshot or PEiD or PEview or fport
• online forensics of win/32 plus toolkit
• Foundstone tools or sysinternals tools
• computer cop write blocker
• dependencywalker ldd-like DLL usage of windows .exe
• SANS forensics
• NIST incident response guidelines 800-61
• Solaris fingerprint database MD5 of executables etc.
• remote device fingerprinting
• knoppix bootable linux security CD also trinux and phlak and las and whoppix
• NSRL library of hashes for software
• search and seizure of computers
• book Computer Forensics: Incident Response Essentials
• seizing electronic evidence pdf
• forensics hardware PC, disk attachments, USB write block and forensic laptop
• wipe wiping magnetic media and Gutmann's Secure Deletion of Data from Magnetic and Solid-State Memory
• Security Certification Essentials or certified ethical hacker CEH
• GIAC certifcation or CISSP or CCSP or How to become a cyber-investigator
• as always, cruise the security page