Sancp: Pcap Index

We have been having discussion in #snort-gui regarding pcap indexing lately which will allow us to retrieve the network data based on the index quickly. I have learned about this feature during the use of time machine which will be integrated with Bro-IDS, I especially like their time machine framework which is illustrated here.

Sancp 1.6.2 beta has quite a few new features, one of them is actually in discussion I mentioned above - pcap index. We are actually looking forward for pcap index so that we can retrieve the pcap data based on index instead of doing it manually with tcpdump or other tools. Hopefully the future sguil will support this so we can just right click and obtain the pcap from sancp record.

I was not so sured how to do it with sancp when I took the first look at 1.6.2 beta, after emails exchange with my friend John, I finally have the idea of how to do it. Here's the simple howto -

shell>mkdir sancp-output

shell>echo "default index log" > sancp-pcapindex.conf

shell>echo "format index delimiter=| sancp_id output_filename start_pos stop_pos src_ip_dotted dst_ip_dotted ip_proto src_port dst_port" >> sancp-pcapindex.conf

shell>sancp -i eth0 -c sancp-pcapindex.conf -d sancp-output

The index file is created in sancp-output along with the pcap data. Basically the index file looks like this -

5177639571328195257|sancp-output/pcap.eth1.1205513154|24|114|
192.168.1.101|121.35.19.76|6|51570|80
5177639571328196206|sancp-output/pcap.eth1.1205513154|114|204|
192.168.1.101|86.1.191.36|6|50397|13322
5177639571328204971|sancp-output/pcap.eth1.1205513154|204|294|
192.168.1.101|219.77.117.51|6|35860|6881
5177639571328205574|sancp-output/pcap.eth1.1205513154|294|384|
192.168.1.101|219.90.206.228|6|53729|55265
5177639571328206646|sancp-output/pcap.eth1.1205513154|384|474|
192.168.1.101|76.122.33.223|6|45014|22100
5177639571328208237|sancp-output/pcap.eth1.1205513154|474|1984|
220.140.112.45|192.168.1.101|6|20315|60025
Output truncated ...

To extract the pcap based on its index, you can use getpcapfromsancpindex.pl which is also written by Jlcurry. Download it first -

shell>wget http://metre.net/file/getpcapfromsancpindex.pl

Now you can grep the index and extract its corresponded data by executing -

shell>fgrep "5177639571328208237|sancp-output/pcap.eth1.1205513154|474|
1984|220.140.112.45|192.168.1.101|6|20315|60025" sancp-output/index | ./getpcapfromsancpindex.pl 220-140-112-45

Lets examine the file -

shell>file 220-140-112-45
220-140-112-45: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 65535)

Read it with tcpdump -

shell>tcpdump -ttttnnr 220-140-112-45
reading from file 220-140-112-45, link-type EN10MB (Ethernet)
2008-03-15 00:45:54.396653 IP 220.140.112.45.20315 > 192.168.1.101.60025: . 4279573104:4279574532(1428) ack 1270973978 win 65535

John(Jlcurry) has put up his own note of how to use getpcapfromsancpindex.pl here -

http://metre.net/getpcapfromsancpindex.html

You can also read the interesting interview of me with John about Sancp here.

Enjoy (;])

FreeBSD: Updating ports with csup

I learned about csup during the development of HeX, thanks to chfl4gs_ for that. Now we no longer need to use cvsup to update the source or software packages as csup is the replacement of cvsup which is written in C. In fact, I feel that it is much faster after testing it.

To update the FreeBSD ports, I just need to do the following

shell>cp /usr/share/examples/cvsup/ports-supfile /usr

Edit the ports-supfile by adding the fastest mirror for you(remember nearest is not always the fastest), I choose Taiwan mirror here -

*default host=cvsup.tw.FreeBSD.org

Now run the csup to update the ports

shell>csup -L 2 /usr/ports-supfile

Once the update is done, you will read Finished successfully at the end of message.

Peace ;]

USM: Industry Talk

This Monday, I was glad to be able to present at University Science Malaysia. I always have good feeling when back to Penang and thanks everyone for coming. Our main audience is student so we try to present it in light manner.

I presented about -

- Dive Into Infosec Industry
- HeX System Introductory

And Mel(Spoonfork) presented

- Honeynet Foundation
- Malaysia Distributed Honeynet Project

Mel was with me and hopefully he enjoyed the trip to the North. Thanks to Sara as he linked us up with the USM. We also thank to CW(one of my friend) who has responsible for the arrangement here.

On the other hand, we just knew that this week is ICT week in USM.

Cheers ;]

Sguil 0.7.0 Unleashed

After longggggg period, finally Sguil 0.7.0 is here! Check it out at

- http://sguil.sourceforge.net/news.html

Thanks to the hard work of all the #snort-gui NSM gang!

Enjoy (;])

Ubuntu: Unicornscan Installation

I hate to remember simple thing these days, and the only way to prevent myself to remember simple thing is to write it down so I can refer later. This is Unicornscan installation steps on Ubuntu 7.10, I hope it helps someone if he/she want to try out Unicornscan on Ubuntu. If you don't know what Unicornscan is, here's the description from the Unicorn site -

Unicornscan is a new information gathering and correlation engine built for and by members of the security research and testing communities. It was designed to provide an engine that is Scalable, Accurate, Flexible, and Efficient.

Lets start the installation -

shell>sudo apt-get install libpcap0.8-dev

shell>sudo apt-get install libgeoip-dev

shell>sudo apt-get install libltdl3-dev

shell>wget \
http://www.unicornscan.org/releases/unicornscan-0.4.7-2.tar.bz2

shell>tar xvjf unicornscan-0.4.7-2.tar.bz2

shell>cd unicornscan-0.4.7-2

shell>./configure --prefix=/usr/local/stow/unicornscan-0.4.7-2

shell>make

shell>sudo make install

Simple as it is, time to dive into Unicornscan. In fact they have blog now.

Peace ;]

SinFP: Reading the Signatures

I learned about SinFP from when I first read it in taosecurity blog here, then today I read that it is integrated into Nessus in tenable blog here. Therefore it raises my interest to look at it. Basically SinFP is available in HeX, instead of trying its features, I'm particularly curious about its signature database. I download the latest signature database from its home site -

shell>wget http://www.gomor.org/files/sinfp-latest.db

My habit is using file command to identify what file type it is before openning, and I'm surprised it is not in plain text format like other tools, it's the SQLite 3.x database file.

shell>file sinfp-latest.db

sinfp-latest.db: SQLite 3.x database

Now this is killing me, I'm worse than beginner and totally have no experience in SQLite. I go to its main site and figure there are many big companies using it and it tells how popular it is here. So I need to try it out, the manual really helps but I don't want to read it for casual use, so I need to write it down for my reference in my blog. Below are what I have gone through.

To show the current default setting value -

shell>sqlite3 sinfp-latest.db ".show"

echo: off
explain: off
headers: off
mode: list
nullvalue: ""
output: stdout
separator: "|"
width:

To list the name and file of the database -

shell>sqlite3 sinfp-latest.db ".databases"
seq name file
--- --------------- ----------------------------------------------------------
0 main /home/geek00l/Desktop/sinfp-latest.db

To show all the tables in the database -

shell>sqlite3 sinfp-latest.db ".table"
IpVersion OsVersionFamily PatternTcpOptions Vendor
Os PatternBinary PatternTcpWindow
OsVersion PatternTcpFlags Signature
OsVersionChildren PatternTcpMss SystemClass

Then select everything from the table Os, you can see what OS is available -

shell>sqlite3 sinfp-latest.db "select * from Os"
1|FreeBSD
2|Linux
3|NetBSD
4|OpenBSD
5|SunOS
6|Windows
7|IOS
Output truncated ...

You can also select everything from multiple tables at the same time with comma, I pipe it to less for navigation purpose -

shell>sqlite3 sinfp-latest.db "select * from Os ,OsVersionFamily, Vendor, PatternBinary, Signature;" | less

You can also dump the signature into raw file and examine it later since it is in plain text form, here I dump it to sinfp-raw.sig file -

shell>sqlite3 sinfp-latest.db "select * from signature" > sinfp-raw.sig

The sqlite3 command line is quite flexible, you can turn on or off its setting in command line directly, as I want to see the header(title of the column) and table in column form, I add -header and -column when running it, for the sql syntax, you can see I use limit 5, this is quite basic stuff for experience SQL database administrator -

shell>sqlite3 -header -column sinfp-latest.db "select * from Os limit 5"

idOs os
---------- ----------
1 FreeBSD
2 Linux
3 NetBSD
4 OpenBSD
5 SunOS

You can also turn it into CSV format using -separator ',' -

shell>sqlite3 -header -separator ',' sinfp-latest.db "select * from Os, Signature limit 5"

idOs,os,idSignature,trusted,idIpVersion,idSystemClass,idVendor,idOs,
idOsVersion,idOsVersionFamily,idP1PatternBinary,idP1PatternTcpFlags,
idP1PatternTcpWindow,idP1PatternTcpOptions,idP1PatternTcpMss,
idP2PatternBinary,idP2PatternTcpFlags,idP2PatternTcpWindow,
idP2PatternTcpOptions,idP2PatternTcpMss,idP3PatternBinary,
idP3PatternTcpFlags,idP3PatternTcpWindow,idP3PatternTcpOptions,
idP3PatternTcpMss
1,FreeBSD,1,1,2,1,1,1,1,1,1,1,1,1,1,1,1,1,2,1,2,2,2,3,2
1,FreeBSD,2,1,2,1,1,1,3,2,1,1,1,1,1,1,1,1,4,1,2,2,2,3,2
1,FreeBSD,3,1,2,2,1,2,5,3,3,1,3,1,1,3,1,4,5,1,2,2,2,3,2
1,FreeBSD,4,1,2,2,1,2,7,4,3,1,3,1,1,3,1,4,6,1,2,2,2,3,2
1,FreeBSD,5,1,2,1,1,3,9,5,3,1,5,1,3,3,1,5,7,3,4,2,2,3,2

If you want to learn how the data is inserted to the database, using .dump to dump them in SQL text format. I figure this is useful especially to beginner like me -

shell>sqlite3 sinfp-latest.db ".dump Os"

shell>sqlite3 sinfp-latest.db ".dump Signature"

Of course this is not something I'm really good at, but learning something new is always fun, I think if you are SQL database administrator or developer, you can take advantage of SQLite quickly. I learn MySQL while using Sguil and now I take a brief look at SQLite while trying out Sinfp, all I can say is you always learn something else.

Enjoy ;]

raWPacket: More Papers

While discussing with Hol about fl0p, I came out the idea of writing this paper - Basic Fl0p Signature Writing Guide to compliment his paper which I will put up soon. If you don't know what is fl0p, check out its description from Michal Zalewski himself -

Fl0p is a passive L7 flow fingerprinter that does not examine packet payloads, only their relative sizes, the sequence of client-server traffic, and its timing. The tool can be thus used to peek into encrypted tunnels, automatically tell users from robots, and far more.

On the other hand, dakrone has also published his first paper - An Introduction To NSM Console. The paper will cover the underlying concept of NSM Console and its functionalities.

I hope all the raWPacket team members can contribute more papers so we have richer documentation to share with the world as we have benefit from others papers too.

Enjoy ;]

Argus 3: Tips & Tricks

I have labeled all my argus 3 blog post to make it easy for people who are interested in it. You can find them at -

http://geek00l.blogspot.com/search/label/Argus3

If you are using argus, and would like to know how to use certain client tools and you think it might be useful, feel free to email me as well and maybe I can put up the tips and tricks for it.

Peace ;]

HITB Conference and Training in Dubai

Again this time, me and mel(spoonfork) will be going to conduct Structured Network Threat Analysis and Forensics training in HITB Conference Dubai. The training is more of how you can perform packet examination, analysis and threat detection using various Open Source tools with effective methodologies, we are going to use HeX liveCD for the training if you ask me.

Besides I hope to meet speakers and UAE folks who are involved in network security operation, that's going to be fun.

I'm now thinking of developing another training contents, most properly about network flow analysis and how can you apply it in real world network deployment. What do you think?

Cheers ;]

Argus 3: Audit Trail with HGWL

I have discussed about the Harimau Global Watchlist here, initially one of the reason Spoonfork developes HGWL is to put all the malicious IP addresses in one place so that it can be used with argus. In fact it can be used with any network flow technology but I'm going to show how you can use HGWL and argus 3 to perform trail auditing.

Obtaining the Harimau Global Watchlist -

shell>wget http://watchlist.security.org.my/all.txt

Generate IP addresses list from argus data(shit.arg3) -

shell>racluster -M rmon -m saddr -r shit.arg3 -s saddr - ip > IP.list

I use -M rmon to convert argus biflow data to uniflow, the source and destination doesn't matter now, with that I just need to specify it to show source address by using -s saddr and I will be able to obtain all the IP address. The -m saddr is used here to cluster source address field only so the same IP is only shown once.

Filtering out suspected IP addresses -

shell>for host in `cat IP.list`; \
do egrep $host all.txt >> Suspect.list; done

61.187.72.70, http://www.dshield.org/ipsascii.html, Dshield: Top IPs, dshield-top-ips, 2008/03/16 00:00:08
61.193.128.171, http://www.dshield.org/ipsascii.html, Dshield: Top IPs, dshield-top-ips, 2008/03/16 00:00:08
65.160.238.180, http://www.dshield.org/ipsascii.html, Dshield: Top IPs, dshield-top-ips, 2008/03/16 00:00:08
66.45.254.244, www.emergingthreats.net/rules/bleeding-rbn.rules, ET RBN Known Russian Business Network Monitored Domains (15), rbn, 2008/03/16 00:03:31
195.161.8.1,http://www.senderbase.org/home/detail_spam_source,senderbase-spam-source,2008/03/16 00:28:34
202.58.85.15, http://www.dshield.org/ipsascii.html, Dshield: Top IPs, dshield-top-ips, 2008/03/16 00:00:08
217.175.134.217, http://www.dshield.org/ipsascii.html, Dshield: Top IPs, dshield-top-ips, 2008/03/16 00:00:08
218.30.19.40, http://www.dshield.org/ipsascii.html, Dshield: Top IPs, dshield-top-ips, 2008/03/16 00:00:08
221.6.4.67, http://www.dshield.org/ipsascii.html, Dshield: Top IPs, dshield-top-ips, 2008/03/16 00:00:08
221.237.161.186, http://www.dshield.org/ipsascii.html, Dshield: Top IPs, dshield-top-ips, 2008/03/16 00:00:08

Most of the time we start doing audit trail when IDS is giving us pointer. Now we can start querying the IP addresses in Suspect.list from argus data when there's matching and tracing its network activities. For example -

shell>ra -nr data.arg3 - host 195.161.8.1

StartTime Flgs Proto SrcAddr Sport Dir DstAddr Dport TotPkts TotBytes State
13:00:58.918872 e tcp 195.161.8.1.10424 -> 192.168.42.109.25 16 1559 RST
13:00:59.275570 e tcp 192.168.42.109.28457 -> 195.161.8.1.113 1 60 REQ
13:02:03.314641 e d tcp 195.161.8.1.24113 -> 192.168.42.109.25 8 698 RST
13:02:03.815631 e tcp 192.168.42.109.28493 -> 195.161.8.1.113 1 60 REQ

Output truncated ....

End for this.

The new client tool - rastream is included in argus 3 lately as argus data stream block processor, I'm thinking of using it to perform HGWL matching operation automatically once the argus data is generated so that we can catch near real time suspected host to watch possible ongoing malicious actions, maybe I will discuss about rastream in future blog post.

Updates: My friend scholar01 has shown me useful trick, instead of using for host in `cat IP.list`; do egrep $host all.txt >> Suspect.list; done, it is better to use fgrep -f IP.list all.txt as fgrep has advance engine for matching static strings at once. Thanks.

Enjoy (;])

Message to network device vendors

These days command line interface(CLI) becomes not so popular to manage network devices such as routers, switches and etc anymore, the replacement is the "not so shiny" web graphical user interface(GUI).

Basically I have no complaint about the usability of web GUI, it provides really easy to use interface for new users and good kickstart to manage the network devices especially when you are not familiar with specific network devices, but I really have one rant here. There are many vendors producing web GUI that only works well on certain web browser especially Internet Explorer, and there's no access through CLI, this is annoying to network administrators that are using open source softwares.

To the vendors, if you can't produce the web GUI that works across multiple web browser platforms, then just give us CLI(ssh preferred) and we can work it out instead of seeing your ugly GUI which is non-productive.

Thanks ;]

raWPacket: New Members

We are now welcome two new members joining raWPacket team. They are -

- Hol(Rob Floodeen)

- Saravanan

Hol is contributing few interesting papers which I will put it up in rawpacket site soon. Saravanan is the maintainer for our own version of fl0p and he will also involve in Ular FVS project which lead by Zarul.

On the other hand, Guti who is our web master since day 1, will be involving in honeynet and HeX sensor project.

Kudos (;])

FreeBSD ldconfig

In orde to configure the shared library cache for ELF format on FreeBSD, you can add all the directories that contain the shared libraries to /etc/ld-elf.so.conf.

shell>cat /etc/ld-elf.so.conf
/lib
/usr/lib
/usr/lib/compat
/usr/local/lib
/usr/local/lib/compat
/usr/local/lib/compat/pkg
/usr/local/lib/graphviz
/usr/local/lib/mysql
/usr/local/lib/nss
/usr/local/lib/pth
/usr/local/share

Then run -

shell>ldconfig -elf /etc/ld-elf.so.conf

Now you can check the hints file -

shell>strings /var/run/ld-elf.so.hints
Ehnt
/lib:/usr/lib:/usr/lib/compat:/usr/local/lib:/usr/local/lib/compat:
/usr/local/lib/compat/pkg:/usr/local/lib/graphviz:
/usr/local/lib/mysql:/usr/local/lib/nss:
/usr/local/lib/pth:/usr/local/share

All of them are added now. If you have shared object missing or not found error when you launch certain application next time, please add the directories that containing its shared library in /etc/ld-elf.so.conf and follow the steps above will do.

Peace ;]

HeX BitTorrent

Enhanced is kind enough to put up HeX in his Security Torrent Depot which you can find at -

- http://www.redsphereglobal.com:88/

Instead of using http/ftp mirror, now you can download HeX using BitTorrent. If you want to contribute to HeX project, the easiest way is seeding ;).

Enjoy ;]

Updates

Idle is bad for a blogger, here's the update for most of the things I have been following -

- FreeBSD 7 is released

- Wireshark 0.99.8 is released

- Ourmon 2.8 is released

You can find the FreeBSD 7 release note here and interesting interview here to study what are the features and fixes offered by them. For wireshark, read this one. I'm particularly interested in the ntar(next generation pcap) and rpcap support. Last but not least, check out the new features that are included in Ourmon 2.8 here! It is now supporting threads and people with multiple cpus(quad core!) most likely will benefit from it, I'm also looking into blacklisting feature and maybe it can integrate with our Harimau Watchlist.

I'm busy with my personal thingy so I won't be very active until mid of March, anyway with the release of FreeBSD 7, HeX 2.x engineering begins!

Cheers ;]

HeX 1.0.3 Release

HeX System 1.0.3 is finally released, we call it CNY(Chinese New Year) release, in fact it is Valentine now. Here's the list of changes -

Fixed:
- pkg_info works after installation
- ping works without sudo
- procfs is correctly mounted on /proc at boot

Upgraded:
1. NSM Console 0.6-DEVEL
Features:
- 'dump' command added, you can now dump packet payloads into a binary file for later analysis
- Significant speedups in the harimau module and 'checkip' command if wget is installed
- tcpxtract configuration file changed to extract more types of files
- Added foremost module
- Added clamscan module (Thanks JohnQPublic)
- Argus and tcptrace have reverse dns turned off by default now, it was causing the module to hang for extremely large pcap files. Can be switched on by changed the module options
- rot13 encoding and decoding added :)
Bugfixes:
- alias command
- urlescape (en|de)coding
- file existence check
- many other things
All the other enhancements, bugfixes and additions since the 0.2 release (there have been many!)

New Application Packages:
- xplot
- uni2ascii
- vnc
- vsftpd
- samplicator
- sflowtool
- pmacct
- ming
- ploticus
- tcpick
- bvi
- elinks
- feh
- tftpgrab
- arpwatch

Misc:
- New wallpapers with different color schemes

Thanks to the whole HeX development team for continuous effort to make HeX possible! Download while it's hot now! On the other hand, download mirror and liveUSB will be up soon!

Main
- liveCD ISO
- MD5 sum
- SHA256 sum

Mirror
- liveCD ISO
- MD5 sum
- SHA256 sum

With the release of FreeBSD 7.0 RC2, we expect FreeBSD 7.0 Release is soon, therefore we are now moving to HeX 2.0 development completely.

Enjoy (;])

Happy Chinese New Year 2008

To everyone in da world, Happy Chinese New Year or Happy Holidays!

Wish you all have great performance in everything in the year of RAT!

Enjoy <^(, ,) ~

ISSA Journal Toolsmith: HeX System

Thanks to our friend - Russ McRee who has featured HeX System in February ISSA Journal under Toolsmith section. You can grab a copy of that particular section at -

http://holisticinfosec.org/toolsmith/docs/february2008.pdf

I don't want to talk much about the article as Spoonfork has covered the outline here.

If you want to know more about HeX, the easiest way is - download and try it out! Again if you have any question, feel free to shoot in mailing list or come to join us at Freenode IRC #rawpacket channel. By the way, HeX 1.0.3 is almost released.

Cheers ;]

The Harimau Watchlist

The other day Spoonfork and I have discussion about the Global Watchlist and we think that it can assist network security analyzt in certain way. Therefore Spoonfork started to work it out and here's the first alpha version of Global Watchlist -

http://watchlist.security.org.my/watchlist

So what's the function of this watchlist anyway, basically we pull the list of suspected malicous IPs/Net ranges from different sources such as Sans dshield, Arbor atlas and so forth, then putting all of them in one place. This can assist security analyzt during their operation especially when they need to determine certain suspected IP is doing what, they can just query the IP at the watchlist link and see if it matches and identify them quickly.

The reason why we put them together not because of eliminating the usefulness of the original site but making use of them efficiently(I don't think you will want to go to each original site and query the IP one by one) so it's best to have the global watchlist that pull everything together and this eases the job of the security analyzt. In fact all the credits goes to the original party as usual.

A lot of virus/malwares researchers rely on Virustotal and we think we should have something for network security analyzt, in fact dakrone will create the module for you to query the IP from NSM Console.

For the moment, you can also query the IP with command line -

shell>curl http://watchlist.security.org.my/watchlist/show?ip=131.247.1.101 | grep '131.247.1.101'

131.247.1.101,www.emergingthreats.net/rules/bleeding-botcc.rules,botcc,2008-01-31 17:15:55

You may notice that we name our global watchlist as The Harimau Watchlist . If you don't know what is Harimau, it means Tiger in Malay Language, thanks to Spoonfork for such creative name ;P

Enjoy ;]

Mumbling about Scope Detection Process

Putting aside the Firewall, IPS and H/N IDS technology, or better forget about it? But now there's one question in mind, what's your answer to detection process?

Mr.Hacko : No I don't need all those crappy technologies, what I need is my 1337 skill to hunt for the bugs and fix "all of them" if they introduces serious security flow. With that I don't need detection no more.

As we are living in the world of dynamic dimensions, security is not something as simple as 1+1. There are many things that we need to take into account aside from identifying vulnerabilities in the softwares, even a single misconfigured router or whatever application can introduce the hole in the network. On the other hand, people who work in large scale environment should know that deploying anything in critical networks requires set of procedures and efforts. As well we all know there are certain issues that can't be solved by technical mean.

To me, I advocate Network Security Monitoring(NSM) as it appreciates the value of data in process of detection and I believe in perimeter security. Forget about how effective it is your Firewall, IPS or IDS such as how well it can detect and block malicious traffics, but think of what they can do to assist you in detection process, the answer is pretty simple - scoping. With scoping it reduces the network traffics you need to examine, and it might as well give you the lead for what you need to look at. It's better than finding a noodle in the haystack without clue. On the other hand, vulnerability assessment and code auditing are important too because they eliminate the security hole in application layer but not all.

If you are following security scene, you may realize most of the successful intrusions/extrusions are using known attack techniques and usually it is driven by script kiddies. While targeted attack is totally different case, it mostly happens with co-operation of insiders with careful planning and the malicious party will choose not to leave the footprint(you can't do this without insider). They can either use 0 days, known vulnerabilities or even valid account in your network to hit you since they have full compromise of how things work in your network(remember the role of insider), it doesn't matter.

Attack techniques are getting complex and dynamic today and it evolves over time, we can't rely on single defensive technology to cover our ass anymore. Therefore if you think you don't need Firewall, IPS or IDS in place, you might as well throw away vulnerability assessment and code auditing because no matter what have you done, you will still be compromised. For better security, I still believe it requires combination of different components to make it harder for the threats, but ease our detection process.

I know there are people who think Firewall, IPS or IDS are useless because they can be bypassed, but have you questioned how many companies that having gone through vulnerabilities assessment and security code audit process but they are still being compromised, I'm really curious about this.

Play your own role!

Peace ;]