Re: unusual user activities

[Voulnet <voulnet () gmail com>]

What does internet traffic through SMB usually means?

On Fri, Aug 26, 2011 at 7:49 PM, William Baltas
<bill.baltas () cleanwaterteam com> wrote:
>   Unusual behavior is difficult to define if you don't define normal behavior first.  For example, several years ago 
> I worked for a police agency.  When IT started analyzing traffic patterns we noticed items we thought very unusual 
> (traffic to adult/porn sites, download of suspicious files, etc.)  We contacted the Detective Bureau with our 
> findings, and found that the officers in question were conducting ongoing investigations; this traffic was normal.  
> In my current position, this traffic would be grounds for termination.
>
>   The following might be considered unusual:
>
>   Traffic to the internet using the SMB protocol.
>   Sending email directly from a workstation, bypassing smtp servers
>   Connections to thousands of hosts from a single workstation
>   Anti-Virus/Malware alarms on a workstation over a period of time (it's not unusual for someone to get infected from 
> time to time)
>   Users that have A/D accounts consistently locked out (this is probably not the user with the locked account, but 
> someone trying to access the locked account.)
>   Be aware of staff that asks for permissions to files and directories where they are not authorized.
>   Look for traffic such as port scanning
>   Watch for applications such as sam spade, angry IP scanner, cain and able, nmap and others
>   If you have port security set on your switches, watch for ports that are continually disabled
>   Look for DNS zone transfers from workstations and servers that are not your DNS servers.
>
>   I hope this helps.
>
>   Bill
>
>
>   -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of websicher () googlemail 
> com
> Sent: Friday, August 26, 2011 1:03 AM
> To: security-basics () securityfocus com
> Subject: Re: unusual user activities
>
>   Hi,
>
>   "unusual behaviour" is a very wide field from my perspective - but let's give it a try:
>
>   #1: Use of (web) proxy:
>   You could monitor the URLs the user called. If ofentimes a web proxy website is visited (e.g. hidemyass.com) it 
> could be hint for illegal web activities (e.g. trying to hack sth.)
>
>   #2: Online bookmarks:
>   Primarily it's not a network topic but a security issue I witnessed some years ago. A company's employee stored his 
> bookmarks to internal servers (including port numbers, etc.) on a publicly accessible external bookmarking website.
>
>   #3: Number of uploads:
>   If there's a remarkable number of uploads from the user's PC it may be the case that he "exports" company data to 
> his own storage area, e.g. Google Docs. You should monitor the upload traffic.
>
>   #4: Upload / Download volume:
>   You should compare the user's upload and download data volumes compared to the average of employees with the same 
> job position or in the same department. (e.g. an IT person will probably have a higher volume than an HR employee)
>   If the volumes are significantly above the average you should closely monitor the traffic.
>
>   Well that's all I can think of at the moment. If you provide more details on which areas you'd specifically like to 
> cover maybe we can add more ideas.
>
>   Cheers,
>   Pascal
>
>   ------------------------------------------------------------------------
>   Securing Apache Web Server with thawte Digital Certificate
>   In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
> how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
> purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
> set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
> certificates.
>
>   http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
>   ------------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
> how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
> purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
> set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------