Re: Open Source Security Information Management (OSSIM)

[Joseph McCray <joe () learnsecurityonline com>]

The group that developed OSSIM has released a VMWare appliance of OSSIM.
You can just boot it up, change the IP and other critical configurations
and get rolling with it right away. 

The one draw back of ANY SEM (Security Events Manager) is that it is a
lot of work on a live network. Especially if you really don't have a
strong IDS and/or incident response background. I'm not saying this to
discourage you from playing with it, on the contrary - what better way
to get the experience. 

Good luck..and I wish you all the best. Let me know if you need any help
with it.

Joe


On Tue, 2007-06-26 at 00:41 -0600, neil () horizontheory com wrote:
> Does anyone have any experience using OSSIM?
>
> I'm looking to beef up security at a school having about a thousand  
> computers, about 800 of them laptops that students and staff take home  
> and bring back, and a bit over a dozen servers (many of which are  
> planned to be taken out of service).  In addition, they have an open  
> wireless connection (though connectivity to the internet is restricted  
> via ISA).  The school is rapidly growing, and while they've been lucky  
> to have mostly benign students, I think the security is inadequate.   
> (I'm looking at some other stuff too, like some firewalls to  
> compartmentalize the network.)
>
> I'm looking to OSSIM to try to help bring a much greater insight into  
> what's travelling across the network.  In particular, I like the sound  
> of anomaly detection, a consolidated place to view all events on the  
> network that can be filtered as needed (to isolate the behavior of a  
> particular box, and thus a user).  Of course, these are imperfect  
> sciences, so I would love to hear how it fares for others.
>
> Ideally, I would like to set up just one OSSIM box to have it monitor  
> the network, but it looks like it would really need agents,  
> particularly on the servers.
>
> Naturaly, any other opinions, feedback, or advice would be great (even  
> if its not about OSSIM, as long as it helps me get to my goal).
>
> Thanks.
-- 
Joe McCray
Toll Free:  1-866-892-2132
Email:      joe () learnsecurityonline com
Web:        https://www.learnsecurityonline.com


Learn Security Online, Inc.

* Security Games        * Simulators
* Challenge Servers     * Courses
* Hacking Competitions  * Hacklab Access

"The only thing worse than training good employees and losing them 
is NOT training your employees and keeping them." 

        - Zig Ziglar

Attachment: signature.asc
Description: This is a digitally signed message part