NukeNabber can be considered a personal host intrusion detector for stand-alone PC’s, which will notify you of attempted connections to user-defined ports. Legion can be quite hard to find. Most other vulnerability scanners also now look for unprotected shares. In the back of your materials are additional references. (Editor’s note: for students taking this course online, the Glossary is included as a separate download file. – JEK) | Intrusion Detection The Big Picture Stephen Northcutt Intrusion Detection - The Big Picture - SANS GIAC 2000 1 S. Northcutt - - Jul 2000 Edited by J. Kolde - - Aug 2000 1 Pagers and Cell Phones The high rate of slide delivery means that distractions will cause your fellow students to miss material. If you are a high interrupt person please consider moving to the back of the room or disabling your pagers and phones. Questions are fine anytime. Intrusion Detection - The Big Picture - SANS GIAC 2000 2 In this course we ll be covering the following types of security tools and countermeasures firewalls host-based intrusion detection network-based intrusion detection vulnerability scanners honeypots We ll also touch on incident response and discuss less technical issues of information security such as risk assessment and how to justify these tools to management. 2 Frequently Referred to URLs SANS - NSWC CD2S web page - ISSEC - click on forms to get the knowledge-based risk assessment forms for WinNT Unix Win95 Mac etc. Intrusion Detection - The Big Picture - SANS GIAC 2000 3 The SANS website is home to GIAC the Global Incident Analysis Center and to the SANS training materials with courses like this one available online.
