In this case, it was the core banking server, the server where all banking transactions occur. We identified a large number of workstations connecting to one particular server.
Within minutes, we received 43 alerts which prompted us to dig a little deeper. Meaning that if I can capture this network traffic, I can capture all data being transmitted in a readable format….including usernames and passwords. Reason being, Telnet is a clear text protocol. This was alarming because we want to be aware of all Telnet connections in any network we manage.
When a model is breached, an alert is raised for us to investigate. If the appliance detects even the smallest transfer of data over the Telnet protocol, breach the model. While doing some model creation in the appliance, we discovered a preconfigured Telnet model was disabled. Let me tell you about how the Darktrace appliance allowed me to record a person’s username and password to a core banking system. My friends always ask me, so what the hell is your job exactly? Well, I am about to give you a better idea. These models are a construction of conditional statements using various operators and variables related to network activity. Tell me what other appliance can do something like that!Īt a fundamental level, the way Darktrace works is based off of models. The device has raised alerts that allowed us to pinpoint penetration testers in the act, identify the source of network reconnaissance activity, (which in each case so far has been one of my engineers) and catch a particular user using an unencrypted word document to store their passwords. Well, I can tell you from experience its pretty good at doing just that.
One security appliance I have become a big fan of is a product called Darktrace.ĭarktrace markets themselves as the “Enterprise Immune System” which is some fancy marketing jargon promoting that the device is designed to identify the abnormal behavior in your network. The Case for Monitoring Internal Network ActivityĪs a Security Engineer, you are always looking to get your hands on the best tools to defend your network.
0 kommentar(er)
