SlideShare uma empresa Scribd logo
1 de 16
BalaBit syslog-ng Store Box Analyse digitaler "Spuren" im Netzwerk Martin Grauel [email_address] +49 170 8067 345
Agenda Mögliche Beweismittel in der IT-Forensik Logdaten und  IT-Forensik syslog-ng Store Box Problemlösungen SSB Log-Lifecycle
IT-Forensik
Mögliche Beweismittel in der IT-Forensik ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Logdaten und IT-Forensik ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
syslog-ng Store Box ,[object Object],[object Object],[object Object],[object Object],[object Object]
[object Object],[object Object]
Problemlösung 1: Zentrale Speicherung und sichere Übertragung
[object Object],[object Object]
Problemlösung 2: Revisionssichere Speicherung von Logdaten May 27 17:45:21 pluto sshd[18206]: Accepted  publickey for root from 10.1.1.1 port 25436 ssh2 Indexierter Logstore
[object Object],[object Object]
Problemlösung 3: Leistungsfähige Filter und Suchmöglichkeiten Linux:  Accepted publickey for admin from 10.1.1.1 port 25436 ssh2 Juniper: Password authentication successful for admin user 'Peter' at host  192.168.3.1. Fortigate:  user=admin ui=GUI action=login status=success reason=none msg="User admin  login accepted from GUI" Alle Events aus Subnetz A Logstore A Ext. Analysesystem Failed Login Events Login/Logout-Events Logstore B
Der gesamte SSB Log-Lifecycle ...
Alle Probleme gelöst? Wenn der Administrator das Logging auf dem  Client  abschaltet oder manipuliert, ... …  dann bleibt uns nicht viel mehr das Login-Event und eine Mühsame Suche in Speicher- und Diskabbildern … …  oder ...
…  hoffentlich eine  BalaBit  Shell Control Box !
Q & A Vielen Dank für Ihre Aufmerksamkeit ...

Mais conteúdo relacionado

Destaque

How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 

Destaque (20)

2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 

Präsentation BalaBIt: Analyse digitaler Spuren im Netzwerk

  • 1. BalaBit syslog-ng Store Box Analyse digitaler "Spuren" im Netzwerk Martin Grauel [email_address] +49 170 8067 345
  • 2. Agenda Mögliche Beweismittel in der IT-Forensik Logdaten und IT-Forensik syslog-ng Store Box Problemlösungen SSB Log-Lifecycle
  • 4.
  • 5.
  • 6.
  • 7.
  • 8. Problemlösung 1: Zentrale Speicherung und sichere Übertragung
  • 9.
  • 10. Problemlösung 2: Revisionssichere Speicherung von Logdaten May 27 17:45:21 pluto sshd[18206]: Accepted publickey for root from 10.1.1.1 port 25436 ssh2 Indexierter Logstore
  • 11.
  • 12. Problemlösung 3: Leistungsfähige Filter und Suchmöglichkeiten Linux: Accepted publickey for admin from 10.1.1.1 port 25436 ssh2 Juniper: Password authentication successful for admin user 'Peter' at host 192.168.3.1. Fortigate: user=admin ui=GUI action=login status=success reason=none msg="User admin login accepted from GUI" Alle Events aus Subnetz A Logstore A Ext. Analysesystem Failed Login Events Login/Logout-Events Logstore B
  • 13. Der gesamte SSB Log-Lifecycle ...
  • 14. Alle Probleme gelöst? Wenn der Administrator das Logging auf dem Client abschaltet oder manipuliert, ... … dann bleibt uns nicht viel mehr das Login-Event und eine Mühsame Suche in Speicher- und Diskabbildern … … oder ...
  • 15. … hoffentlich eine BalaBit Shell Control Box !
  • 16. Q & A Vielen Dank für Ihre Aufmerksamkeit ...

Notas do Editor

  1. Datenspeicher werden immer größer Verschiedene Devices beteiligt (Server, Laptops, Mobile etc.)
  2. Datenspeicher werden immer größer Verschiedene Devices beteiligt (Server, Laptops, Mobile etc.)
  3. Datenspeicher werden immer größer Verschiedene Devices beteiligt (Server, Laptops, Mobile etc.)
  4. Datenspeicher werden immer größer Verschiedene Devices beteiligt (Server, Laptops, Mobile etc.)
  5. Datenspeicher werden immer größer Verschiedene Devices beteiligt (Server, Laptops, Mobile etc.)