Reorientation

Today was a reorientation for me.  I was introduced to the Solarwinds Orion product that D87 is evaluating, instructed to configure it for SMS and/or email alerts about failing interfaces/equipment, and reported my findings so far in IDS/IPS research.  Jason gave a little background on the history of programming and the current state of networking.  He used this to springboard into a rant on OpenFlow and his hatred of IOS.  I finally got a "tour" of the datacenter and spent the rest of the day looking at more IDS options.

Todays' readings

I get the feeling I'll be doing this a lot.

SANS Institute paper on the future of IDS and IPS technologies (from 2004!)
http://docs.google.com/viewer?a=v&q=cache:AEfCPDHAhfEJ:www.sans.org/reading_room/whitepapers/detection/understanding-ips-ids-ips-ids-defense-in-depth_1381+comparison+of+ids+and+ips&hl=en&gl=us&pid=bl&srcid=ADGEESirIjpMn52Yw07jQCp02DdB1QCSE8nwHW2B1ORCGazDXHX7v5z7CT_Fkz10prXkHReJp7baKzVpgaC4ssgquLzf9ygaoCMfuggu1DQYlCqU6BZubWysClgm5ksfR7cawNAHUP7K&sig=AHIEtbRO3axdlB2ya7a8lx70qi_P07t0oA

Shelia design paper
http://www.cs.vu.nl/~herbertb/misc/shelia/shelia07.pdf

Shelia for Dummies
http://www.cs.vu.nl/~herbertb/misc/shelia/00SHELIA_HOWTO.txt

I'm beginning to see a pattern here...

Once again feel like I didn't get a lot done today although that's probably because I was reading all day.  Research included:

IDS/IPS systems and the roughly 2.3 gajillion permutations thereof
Honeypots of various flavors (proxy, client, spam, etc.) with an emphasis on Shelia for now

I also logged into the AlienVault IDS and started poking around the plugins section.  Maybe I'll go home and research the 263 that have been installed on the system here.  Maybe not.

Day 2

Pretty much we just screwed around today.  I got more specific assignments, got the learning contract signed by Jason, and did a little research on OSSIM technologies.  Oh!  I also sat in on meetings with several teachers and even the HS principal.  Evidently most of the faculty is unaware of the blatant misuse of technology resources so we introduced them to NetSupport which allows you to remotely view and control the students computers and even IM and lock the screens and loads of other incredibly useful crap.

"So you mean I can keep Sean off Facebook while I'm talking?" John asks.
"Of course not!  I don't Facebook while you talk John.  It's so you can log me out when you find my taste in porn offensive!" Sean says.

And then there was work

My first day as a pseudo-official technology intern involved getting introduced to a few aspects of the D87 way of life.  For example, we spent 3 hours in the technology computer lab remotely viewing students "working" and subsequently kicking them off and directing them to the principal.  I also got an account and an excruciatingly basic idea of how they were setting up an IDS (in this case OSSIM) as well as my first assignment!  I'm supposed to help set it up.  Apparently it's a collection of lots of cool and useful tools or something and it's really complicated because they aren't really meant to be aggregated.  Oh well!