The group that developed OSSIM has released a VMWare appliance of OSSIM.
You can just boot it up, change the IP and other critical configurations
and get rolling with it right away.
The one draw back of ANY SEM (Security Events Manager) is that it is a
lot of work on a live network. Especially if you really don't have a
strong IDS and/or incident response background. I'm not saying this to
discourage you from playing with it, on the contrary - what better way
to get the experience.
Good luck..and I wish you all the best. Let me know if you need any help
with it.
Joe
On Tue, 2007-06-26 at 00:41 -0600, neil@horizontheory.com wrote:
Does anyone have any experience using OSSIM?
I'm looking to beef up security at a school having about a thousand
computers, about 800 of them laptops that students and staff take home
and bring back, and a bit over a dozen servers (many of which are
planned to be taken out of service). In addition, they have an open
wireless connection (though connectivity to the internet is restricted
via ISA). The school is rapidly growing, and while they've been lucky
to have mostly benign students, I think the security is inadequate.
(I'm looking at some other stuff too, like some firewalls to
compartmentalize the network.)
I'm looking to OSSIM to try to help bring a much greater insight into
what's travelling across the network. In particular, I like the sound
of anomaly detection, a consolidated place to view all events on the
network that can be filtered as needed (to isolate the behavior of a
particular box, and thus a user). Of course, these are imperfect
sciences, so I would love to hear how it fares for others.
Ideally, I would like to set up just one OSSIM box to have it monitor
the network, but it looks like it would really need agents,
particularly on the servers.
Naturaly, any other opinions, feedback, or advice would be great (even
if its not about OSSIM, as long as it helps me get to my goal).
Thanks.
--
Joe McCray
Toll Free: 1-866-892-2132
Email: joe@learnsecurityonline.com
Web: https://www.learnsecurityonline.com
Learn Security Online, Inc.
* Security Games * Simulators
* Challenge Servers * Courses
* Hacking Competitions * Hacklab Access
"The only thing worse than training good employees and losing them
is NOT training your employees and keeping them."
- Zig Ziglar
signature.asc
Description: This is a digitally signed message part
