Building on the Networking Basics article previously written and a high-level overview of How Servers Serve Content, I wanted to write about how data actually moves over a network. That is, what happens when a user on a network node communicates with another networked node. There are two main models that are accepted: the Open Systems Interconnection (OSI) model separates … [Read more...]
Indicators of RDP Brute Force Attacks
I have been investigating an incident involving two EC2 instances on AWS that were infected with ransomware, cryptocurrency miners, and other types of malware. Sounds scary, right?! Well actually, the approaches that the attackers took to get onto the hosts do not appear to be that sophisticated, and this type of attack could occur in any environment, not just in the cloud. … [Read more...]
Where in The World Is That Network Traffic Coming From?
In a past article, I explained how to auto-block hosts with a WatchGuard Firebox. Yesterday alone my logs showed over 100 IP addresses auto-blocked in one day on a Firebox used for testing purposes. The list included over 1000 blocked IP addresses. I also noticed the Firebox shows a limited number of blocked hosts so the total number of blocked hosts may be longer than what the … [Read more...]
Auto-Blocking Suspicious Hosts Found in Traffic Logs
Many attackers and hosts infected with malware try to infect other hosts by scanning networks for open ports exposed to the Internet. After finding an open port, a malicious third party will attack software running on that port using known vulnerabilities. These published software flaws can cause damage or allow unauthorized access to hosts and networks. Often vendors publish … [Read more...]
How to Automate Deployment of a WatchGuard Firebox Cloud on AWS
The last Secplicity blog post in this series on cloud security described the security benefits of CloudFormation for automated deployments. CloudFormation can deploy security appliances in AWS accounts that help protect applications and data in cloud environments. UTM (or Next-Gen Firewall) on AWS Deploying a WatchGuard Firebox Cloud is one way to increase security in an … [Read more...]
