July 21, 2015, meetup wrapup - OSSEC in the house!

At this weeks meeting we discussed the following news items:

Hacking Team hacked, attackers claim 400GB in dumped data - Steve Ragan - CSO Online

Flash. Must. Die - Brian Barrett - WIRED

OpenSSL patches critical certificate validation vulnerability - Michael Mimoso - Threatpost

And because it just came out the same day we also discussed the freshly new hacked Jeep news.

Hackers remotely kill a jeep on the highway -- with me in it - Andy Greenberg - WIRED

After the news, Robert Wilson gave an excellent talk on OSSEC. He showed us how to both set it up and use it to monitor for abnormal activity. It's really interesting stuff and only requires, as Robert put it, "nerd power" to get it up and running. Here are some links to get started with it:

Main OSSEC site

OSSEC on GitHub

Daniel Cid's OSSEC architecture presentation

OSSEC CON presentations

Vic Hargrave's ELK and OSSEC overview (somewhat outdated)

NSA Guidance on spotting the adversary

IAD GitHub

Thanks again to Robert for stepping up giving us an excellent presentation for our July meetup. It was very informative and fun as always hanging out with other infosec folks.

Our next meetup will be August 18. I will be presenting my Blue Team Starter Kit talk which I intend to use at BSides Augusta, September 12.

July 21, 2015, meetup agenda - OSSEC

Robert Wilson will be giving us a presentation on OSSEC host intrusion detection software and will be covering the following questions

• What is it?
• How do you get it?
• What exactly does it do?
• What does it NOT do?
• How do you use it?
• What are some real-world examples of using OSSEC
• What about querying? What about all of the chatter?

If you have any other questions about OSSEC be sure to bring to drop them on our listserv or bring them to the meeting next week.

I'll also be adding a new "The NEWS" segment to the meetup. We'll try it out and see how it goes.

Also, we are planning to go to Brew at the Zoo August 7, 2015, as a group. If you would like to commit to going to the event, let me know and bring some money or a checkbook to the meetup to pay for a ticket.