[Snort-users] Best Practices for external sensors
This is a discussion on [Snort-users] Best Practices for external sensors within the Snort forums, part of the System Security and Security Related category; This is a multi-part message in MIME format. ------=_NextPart_000_0005_01C45430.F99A2A10 Content-Type: text/plain; charset="iso-8859-1&...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
06-17-2004
|
|||
|
|||
[Snort-users] Best Practices for external sensors
This is a multi-part message in MIME format.
------=_NextPart_000_0005_01C45430.F99A2A10 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit I currently have a Snort infrastructure set up on my internal network with several sensors managed via SnortCenter, logging to a centralized MySQL DB. I am looking to deploy a sensor on our outside network (off of a mirrored port on a switch). There are several firewalls with outside interfaces on this switch. I'm trying to get an idea of the best/most secure way to funnel alerts/logs back into the network to our centralized logging server. I thought of some type of VPN tunnel inbound, but my concern is that if the sensor were to be compromised, there would be a direct path into the network. I obviously don't want to multi-home the sensor inside/outside. Is my best bet just to open up SQL connectivity from this external sensor to the inside DB on the firewall and stream the alerts that way? If so, does anybody know of a way of any type of wrapper that would encrypt these alerts? Thanks Brad ------=_NextPart_000_0005_01C45430.F99A2A10 Content-Type: text/html Content-Transfer-Encoding: 7bit <HTML> <BODY> I currently have a Snort infrastructure set up on my internal network with several sensors managed via SnortCenter, logging to a centralized MySQL DB. I am looking to deploy a sensor on our outside network (off of a mirrored port on a switch). There are several firewalls with outside interfaces on this switch. <br> <br> I'm trying to get an idea of the best/most secure way to funnel alerts/logs back into the network to our centralized logging server. I thought of some type of VPN tunnel inbound, but my concern is that if the sensor were to be compromised, there would be a direct path into the network. I obviously don't want to multi-home the sensor inside/outside. Is my best bet just to open up SQL connectivity from this external sensor to the inside DB on the firewall and stream the alerts that way? If so, does anybody know of a way of any type of wrapper that would encrypt these alerts?<br> <br> Thanks<br> Brad </BODY></HTML> ------=_NextPart_000_0005_01C45430.F99A2A10-- ------------------------------------------------------- This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND _______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/...fo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.p...st=snort-users 
|
Linear Mode
