Conducting Defensive Information Warfare on Open Platforms
summary
Defines defensive information warfare as protecting valued data using visibility, detection and response; demonstrates free GNU/Linux tools that actually capture, profile and alert on traffic (mirror/SPAN or taps feeding Snort/Suricata/Bro, ntop/NetFlow, Kismet for Wi‑Fi, full pcap and ELSA/Elastic for logs). Notes the surprising Carna/CARA map with 420,000-host Carna botnet and explains distributed monitoring and Security Onion as a working, quick deployable NSM stack; recommends block cryptographic log signing for tamper evidence.
AI-written summary · about
chapters (16)
- 0:00Intro
- 2:52Presentation Topics
- 4:10What is Information Warfare?
- 11:05Defining the Targets NEWS
- 12:02Defending Information - The Basics
- 13:40Increasing Network Visibility - Overview
- 20:21Network Intrusion Detection Systems
- 24:57Wireless Intrusion Detection Systems KISMET
- 28:27NetFlow Exporters
- 29:43NetFlow Collectors
- 31:05Anomaly Detection Tools
- 35:54Host-based Intrusion Detection Systems
- 38:21Log File Management
- 44:33Collating and Presenting Security Information
- 46:42Focused Distributions
- 48:59Summary
related talks
29mDetection Engineering: Defending Networks with Purpose
34mOSINT for Proactive Defense
43mBuilding a network security practice in your organization | Pannel Discussion
40mEnemy Inside the Gates: Securing the New Battleground
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
04h 02mOpen-source Tools for CSIRTs
52mattack-driven defense
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report