Do security engineers dream of firewall logs…
I know I’m starting to. And I haven’t consciously recalled a dream since about 18 years ago.
My head is filling up with terminology and jargon, from both the Checkpoint Firewall-1 side of things and our own internally developed monitoring systems that we deploy at client sites.
This morning, I woke up, with the word “CACT’s” on my mind… Complex ACTions. Packets being dropped by the firewall. My staple diet of support tickets, these days. And something that is often difficult to interpret. I sometimes spend an hour or two to retrieve the logs, format them in Excel and Access, then do SQL queries to filter out the “trash” data to determine the culprits. And even then, I cannot always be sure of my analysis until I verify some facts with the network diagram or ask a colleague to double check my findings.
Thus far, I’ve found some DDOS attacks, some portscans, a virus infection, peer to peer software abuse and some really dodgy DNS systems.
Anyway… this weekend is rAge. First one that I will be attending. Looking forward to see what we here in South Africa call a gaming expo, seeing as we always see coverage of the overseas expo’s but never our own.
Hope you all have a good weekend. See you on the other side.
