How to detect hackers on your web server A discussion of the methods used by hackers to attack IIS web servers, and how you can use event log monitoring on your web server to be alerted to successful attacks immediately.
Using events-per-second as a factor in selecting Security Event Management tools Events Per Second, or EPS, as it is commonly referred to in the world of network security, is a measurement that is used to convey how fast a network generates data from its security devices (firewalls, Intrusion Detection Systems (IDS), servers, routers, etc.), and/or how fast an SEM product can correlate data from those devices. A savvy buyer will match the EPS his network is generating to those that can be accommodated by the SEM tool that he is purchasing. For the purpose of this article, we define the EPS that can be accommodated by an SEM tool more precisely as the number of security-related events a product can receive, normalize, analyze/correlate, and display or act on in the form of results within an acceptable time frame.
A Unix Perspective on Oracle Archive Redo Log Files In this article, I will review archived redo log files (ARLFs) from an SA perspective, without the need to log in to the database or use SQL statements. I will cover where archived ARLFs come from, where they go, what they contain, how their use has evolved over time, and how they can make or break your system. A summary checklist of issues and questions will be provided that the SA and DBA can review together to help ensure improved support and coverage.
An Approach to UNIX Security Logging Off-line intrusion detection systems rely on logged data. However, the logging mechanism may be complicated and time-consuming and the amount of logged data tends to be very large. To counter these problems we suggest a very simple and cheap logging method, light-weight logging. It can be easily implemented on a Unix system, particularly on the Solaris operating system from Sun. It is based on logging every invocation of the exec(2) system call together with its arguments. We use data from realistic intrusion experiments to show the benefits of the proposed logging and in particular that this logging method consumes as little system resources as comparable methods, while still being more effective.
Actions
Category Stats