BSIT380-T302

 Withing chapter nine there is many items that stood out to me, most interesting to me was reverse engineering. Reverse engineering is a method that is used to "undo" a completed software, program, or virus to see what is under the hood. The goal is to reverse the steps taken during the creation of the original program. Many security engineers are required to know the basics of programs and how it relates to the OSI model. The first hurle is to replicate the software in a safe environment  if the software is unrepariable the environment can be reverted to the previous compiled state. When I was working at a former employer we were a target for a phishing scam, after downloading the email and disconnecting the device from the primary network we were able to put on a private network and Wireshark. The traffic was pinpointed and an attack was blocked based on the return address and port. 

SIEM is a system whose goal is to collect and centralize information from multiple systems to give a “heart beat” or the overall status of the network and security posture. When a security information and event management system or SIEM is setup the data should always be one-way traffic in UDP format, if each SIEM had direct access to each system this could cause a whole new security vulnerability from a system designed to protect a network. SIEM uses multiple input sources and types of data depending on the centralized system, some of the protocols that are used are as follows: SysLog, SNMP, NetFlow, Windows Event Log and Common Event Format(CEF) . Any company that uses multiple systems that are hard to keep track of or hard to keep eyes on a SIEM should be implemented, from basic network load to servers that are pegged due to a DDoS attack, SIEMs can help administrators see more info in a domain.

 This week’s blog will cover week 3 for BSIT380, within this week IDS and IPS were covered on how they work and are different from each other. IPS or Intrusion Protection System will locate traffic and will use predefined rules to try to block or redirect attacks to a DMZ. With IDS or Intrusion Detection System an alert goes off and the alert is typically passed to either a log or a person, a IDS works best when manual intervention is typically required or in test environments to just get a better picture of the network. In chapter 6 host-based security was covered as well as device hardening, patch management, antivirus, anti-malware, and HIDS. With anything when it comes to changes it is a good idea to log and set a procedure for said changes. 

  Network security is a growing concern for organizations of all sizes as attackers become more sophisticated and determined to get into a restricted network . While virtual ized and appliance-based tools can provide security for most applications and services , it is important to remember that no single tool can protect against all known threats . It is essential that organizations have a multi-layer security plan that is tested and checked annually. Networks that is deemed secured should still include regular monitoring , management , and updates . This week 's chapters provide an excellent overview of the tools and policies needed to respond to potential network security threats . It is important to remember , t hat security is an ongoing process and regular updates to tools and policies are necessary in order continuously secure an organization 's structure network . With the ...

 Hello! My name is Jake and I am a transfer student from Southeast Tech located in Sioux Falls, SD. I have my associates in IT security and am interested in going further with Bellevue. I have worked with system hardening during my time in the US Department of Defense as a Cyber Systems Operator and a Cyber Defense Operator. During my time in the Air Force, I worked with a program called Stigs and stig viewers. https://public.cyber.mil/stigs/srg-stig-tools/ is a good site to see what the US DoD thinks is a vulnerability and should be changed, the list is not all-encompassing to prevent attackers from knowing what systems were changed and what portion was changed.  I am eager to get started and share what lessons I will learn this semester.