Incident response Questions


Cisco 1811/1812 vs Netscreen 5GTE
Hello all, Did any of you have/had any experience with both Cisco 1811/1812 and Netscreen 5GT(E)? Which one is better/faster/has more features/more user friendly according to you? What I need is a router/firewall/IPS appliance that will allow me to set up some DMZ and two LANs and that will serve as a VPN end point [...]

Answer Question   |  July 26, 2005  3:13 AM
Cisco, Firewalls, Forensics, Incident response, Intrusion management, Juniper Networks, NetScreen, Network security, Networking, Product evaluation, Routers, Security, Security products, VPN, Wireless
asked by:
0 pts.

Accessing MS Exchange Server on DMZ zone of Cisco Pix 515E as local server
Hi, We currently have a MS Small Business Server 2000 (of which Exchange Server is a part) configured on the LAN behind a firewall and use POP3 Connector of MS Exchange to retrieve external mails. Our users connect to the MS Exchange Server within the LAN without requiring to connect to the Internet. The question [...]

Answer Question   |  September 6, 2005  3:48 AM
Firewalls, Forensics, Incident response, Intrusion management, Network security, VPN, Wireless
asked by:
0 pts.

asked by:
0 pts.

Forensic Search for Email Recipient
Hello, I am hoping someone can help me with a question. I have found through return receipt someone within my organization has intercepting an e-mail. I think someone may have spoofed the user ID that is indicated on the return receipt. Is there any way in Notes for an Administrator to determine the device ID [...]

Answer Question   |  July 6, 2005  9:46 AM
Incident response
asked by:
0 pts.

Demilitarized zone using iptables?
Hi, I’m the Assistant Editor for SearchEnterpriseLinux.com. One of our users, “ruhi,” posted the following question. Can you help? “I have to plan and design a demilitarized zone using iptables. How can I do this?” You can post your answer here on ITKE, or reply to mailto:editor@searchenterpriselinux.com?subject=iptables Thanks! Amy Kucharik Assistant Editor, SearchEnterpriseLinux.com TechTarget 117 [...]

Answer Question   |  June 16, 2005  5:00 PM
Administration, Architecture/Design, Features/Functionality, Firewalls, Forensics, Incident response, Installation, Intrusion management, Management, Network security, Product/service procurement, Security, Security management, Security products, Signature updating/Management, VPN, Wireless
asked by:
105 pts.

Consolidated Security Product/Approach? What about layered approach?
Hi Punnet, I’m a It Director at lasrge Media firm in NY. Looking at the security overhaul in the recent months and business looking to cxonsolidate the offices enviornment the talk of the town is to have ALL IN One device which does Firewall,IDS,VPN etc. I thought layerd security approach was the way to go [...]

Answer Question   |  June 20, 2005  10:36 AM
Administration, Architecture/Design, Cabling, Cisco, DataCenter, Desktop vs network-based firewalls, Firewalls, Forensics, Hardware, Hubs, Incident response, Information risk management, Intrusion management, IT architecture, Network security, Networking, Nortel, Product evaluation, Routers, Security, Security management, Security products, Switches, VPN, Wireless
asked by:
0 pts.

Sendig Mail to user@IP
We have two Mx Record (same ISP) pointing to the same mail server. The Mail Server is REDHAT Linux. I want to send a mail to user@ip address (first or second Mx Record). This is basically to test if first Mx record fails, will the second record be used. I would be sending this mail [...]

Answer Question   |  June 13, 2005  11:29 PM
Biometrics, DHCP, Digital certificates, DNS, E-mail applications, Exchange, Firewalls, Forensics, Identity & Access Management, Implementation/Management, Incident response, Intrusion management, Linux, Linux Distributions, Network security, Network testing, Networking, Networking services, Performance management, Protocol analysis, provisioning, Red Hat Enterprise Server, Red Hat Fedora, Security, Security tokens, Sendmail, Servers, Single sign-on, Tech support, VPN, Wireless
asked by:
60 pts.

asked by:
5 pts.

asked by:
0 pts.

What law enforcement to contact if an intrusion is discovered?
New regulations concerning unauthorized access to sensitive customer information talks about contacting law enforcement, if applicable. While hoping it is a plan that I never need, in an intrusion responce plan, where sensistive customer information may have been accessed and you are required to notify some customers of this fact; 1)Would you contact law enforcement? [...]

Answer Question   |  May 18, 2005  8:58 AM
Incident response, Information risk management, Security, Security management
asked by:
0 pts.

Desktop firewalls: Windows XP vs 3rd party
For those with more experience with Windows XP, what do you think of the native personal firewall software? We recently upgraded a remote user to Windows XP from Windows 2000 Pro (actually, he got a new laptop). He connects to the Internet over DSL and we installed a free ZoneLabs firewall when he was running [...]

Answer Question   |  May 17, 2005  7:09 PM
Desktop vs network-based firewalls, Firewalls, Forensics, Incident response, Intrusion management, Microsoft Windows, Network security, VPN, Windows XP, Wireless
asked by:
0 pts.

Data vs. perimeter vs. network security
A short time ago, author Wes Noonan wrote some tips for SearchWindowsSecurity.com about <a href=http://searchwindowssecurity.techtarget.com/originalContent/0,289142,sid45_gci1007026,00.html>deperimeterization</a>. He explained how security is always pitted against business needs, and perimeters have become porous because businesses require traffic from SMTP, HTTP or VPNs to pass through the firewall. He then offered techniques for keeping data safe in spite of [...]

Answer Question   |  May 4, 2005  4:36 PM
Administration, Application security, Architecture/Design, backdoors, Biometrics, Compliance, configuration, CRM, Current threats, Database, Desktop vs network-based firewalls, Digital certificates, Disaster Recovery, Documentation, Encryption, Exchange, Features/Functionality, Firewalls, Forensics, Hacking, Host-based IDS/IPS, human factors, Identity & Access Management, IDS vs IPS, IDS/IPS management, Incident response, Installation, Instant Messaging, Intrusion management, Managed security services, Management, Network security, Network-based IDS/IPS, Networking, Outsourcing/Managed services, patching, PEN testing, Platform Security, Policies, Product evaluation, provisioning, Risk management, Secure Coding, Security, Security management, Security products, Security Program Management, Security tokens, Service and support, Signature updating/Management, Single sign-on, Software vs appliance, Spyware, Trojans, Viruses, VPN, Vulnerability Assessment & Audit, vulnerability management, Wireless, worms
asked by:
0 pts.

PIX VPN DHCP Relay not relaying DHCP packets
Hi, I’ve setup a VPN across 2 PIX506e’s using primarily the PDM software. IT is a very basic setup using PDM. I also needed DHCP relay to relay from clients on pix B to pixA and then the dhcp server. So I add in the DHCP relay server address on pixB and point to the [...]

Answer Question   |  May 5, 2005  12:13 PM
Administration, Architecture/Design, Cisco, DHCP, DNS, Firewalls, Forensics, Incident response, Installation, Intrusion management, Management, Network security, Networking, Networking Equipment, Networking services, Routers, Security, Service and support, VPN, Wireless
asked by:
0 pts.

asked by:
0 pts.

Segmenting the LAN for Security purposes
The worm Mspn32 came in on one machine behind the firewall and spread over e-mail or network to other departments. Could I isolate a worm once it’s inside by dividing up my LAN into departments or sections with either departmental firewalls or managed switches and VLANS? Anyone doing this, experience with either, recommended hardware or [...]

Answer Question   |  April 20, 2005  5:40 PM
Firewalls, Forensics, Incident response, Intrusion management, Network security, VPN, Wireless
asked by:
0 pts.

Service.exe Process
I have a w2k pro computer that is experiencing an incredible slowness, when I check the runing processes, I find service.exe is eating up over 90% of the cpu, starving out any other application/process. Has anybody come accross this problem and knows how to fix it? any suggestion would be appreciated. thanks.

Answer Question   |  June 8, 2005  1:02 PM
Application security, Database, DataCenter, Development, Encryption, Exchange, Incident response, Instant Messaging, Secure Coding, Security, Vulnerability Assessment & Audit
asked by:
0 pts.

Found Trojan.ByteVerify on my computer
Hi All, Symantec recently discovered Trojan.ByteVerify on my computer. I run system checks weekly and am always cautious about the e-mails I open, the web sites I go to and what I click on, so I was pretty surprised to find I had a Trojan. It was quarantined and removed, but I’m worried about what [...]

Answer Question   |  June 24, 2010  10:20 AM
Administration, Architecture/Design, backdoors, Compliance, configuration, CRM, Current threats, Disaster Recovery, Documentation, Features/Functionality, Firewalls, Forensics, Hacking, human factors, IDS/IPS management, Incident response, Installation, Intrusion management, Management, Network security, patching, PEN testing, Platform Security, Policies, Risk management, Security, Security Program Management, Service and support, Signature updating/Management, Spyware, Trojans, Viruses, VPN, vulnerability management, Wireless, worms
asked by:
0 pts.

Backup of Router & Pix IOS
How can we protect our router & pix firewall & how can we recover the ios when ios is totaly corrupted. how can we take backup of ios through tftp server. Please guide step by step as i am new to router & pix firewall. can u provide me website link from where i get [...]

Answer Question   |  April 19, 2005  5:08 AM
Administration, Cisco, Firewalls, Forensics, Incident response, Installation, Intrusion management, Network security, Networking, Service and support, VPN, Wireless
asked by:
0 pts.

I’ve been hacked — I think….
I’m an IT administrator with a little over 500 end users, running Windows 2000 and XP. One of our users is experiencing a problem with her Internet connection suddenly dropping for no apparent reason. When she restarts her computer, everything works fine for awhile, but then the connection drops again. The funny thing is, she’s [...]

Answer Question   |  August 2, 2009  9:52 AM
Administration, Application security, Architecture/Design, Bigfix, Biometrics, Cisco, Citadel, Compliance, Computer Associates, configuration, Configuresoft, CRM, Cylant, Database, DataCenter, Desktop antivirus, Desktop management applications, Digital certificates, Disaster Recovery, Documentation, Ecora, Encryption, Enterasys Networks, Exchange, Features/Functionality, Firewalls, Forensics, GFI, Hewlett-Packard, Host-based IDS/IPS, Identity & Access Management, IDS vs IPS, IDS/IPS management, Incident response, Installation, Instant Messaging, Internet Security Systems, Intrusion management, Juniper Networks, Managed security services, Management, Microsoft Windows, Network Associates, Network Elements, Network security, Network-based IDS/IPS, NFR Security, Outsourcing, Outsourcing/Managed services, patching, Patchlink, PEN testing, Platform Security, Policies, Product evaluation, Product/Service evaluation, provisioning, Redundancy, Risk management, Sana Security, Secure Coding, Security, Security Program Management, Security tokens, Service and support, Service contracts, Service evaluation, Shavlink Technologies, Single sign-on, Snort/Sourcefire, St. Bernard Software, StillSecure, Symantec, Tripwire, Vendors, VPN, VSecure, Vulnerability Assessment & Audit, vulnerability management, Wireless
asked by:
0 pts.

PIX – Allow UDP replies in.
Hi All, The president of my company has started to use skype (www.skype.com). There is a function in the program to do file transfers. When we try that the program show that it has to relay the transfer and when it does that it limits the bandwith to 0.5kB/second. I’ve pasted the documentation that skype [...]

Answer Question   |  April 8, 2005  9:56 AM
Administration, Cisco, Firewalls, Forensics, Incident response, Installation, Intrusion management, Network protocols, Network security, VPN, Wireless
asked by:
0 pts.