Cyber Defence Operations

Fri, 04 Mar 2022 17:41:11 +1100

Semester 1 2022 has snuck up on me again. This semester as part of the UNSW and ADFA run Master of Cyber Security degree, I’m taking the blue team core unit ZEIT8026 Cyber Defence - Network Security Operations (SecOps) lectured by Dr Waqas Haider and Dr Nour Moustafa. Unlike its sister red team unit ZEIT8020 Cyber Offense - Cyber Network Operations (CNO) which I took in 2018, ZEIT8026 aims to lay the foundational knowledge of cyber defence operations:

Packet Analysis Basics

Tue, 15 Jan 2019 21:29:10 +0000

An evolving list of resources around packet analysis tips and tricks.

Terminology

SOC, or Security Operations Center, is a central location composed of leading edge tools, technology and peeps (intel gatherers, analysts) that deals with security issues at an organisational and technical level.
IDS, or Intrusion Detection System, is a device that monitors network traffic for threats to the environment, proactively alert the SOC analyst of potential problems.
IPS, or an Intrusion Prevention System, is more sits inline, and can take active or passive mitigation actions.
SIEM, or Security Information and Event Management, is all about the collection and aggregation of alerts and logs for event tracking, retention and correlation from multiple hosts.

Cheat sheets

Anatomy of a Packet

OSI Model Layers

7: application: HTTP, FTP, DNS
6: presentation: SSL, JPEG
5: session: SQL, SCP, NetBIOS, SOAP
4: transport: TCP, UDP
3: network: IPv4, IPv6, ICMP
2: data-link: PPP, ARP, CDP
1: physical: Ethernet, Bluetooth