Mauro

Mauro: I'm a network plumber, an opensource enthusiast and cybersec addicted.

Do I need SSL inspection?

di

TL;DR – how to Yes, you do. In order to do that you’ve to generate an RSA key with $ openssl genrsa -aes256 -out private-key.pem 2048 and, when prompted, enter a passphrase for encrypting the private key. $ openssl req -new -x509 -days 3650 -extensions v3_ca -key private-key.pem -out certificate.pem and, when prompted, type the … Leggi tutto

Log4Shell

di

Preambolo In data 10 Dicembre 2021 in Apache Log4j2 è apparsa una vulnerabilità di tipo RCE (Remote Code Execution).Grazie a questa vulnerabilità classificata come 0-day un utente malintenzionato può inviare una richiesta HTTP, modificando opportunamente lo user-agent (AGGIORNAMENTO del 12-12-2021: o qualsiasi altro verbo HTTP) della stessa, al fine di eseguire codice arbitrario caricato su … Leggi tutto

~/docs/SIEM.log

di

Prefazione SIEM è l’acronimo inglese di Security Information and Event Management ed ha lo scopo di collezionare, analizzare, correlare e visualizzare tutti gli eventi di sistema generati dalle varie piattaforme installate nel nostro parco macchine.Inoltre il SIEM aiuta a chi si occupa di sicurezza a mettere in evidenza gli ambiti nei quali è necessario intervenire … Leggi tutto

Security Posture Assessment

di

Security architecture reviews are non-disruptive studies that uncover systemic security issues in the assessed environment. They are ideally suited for organizations wanting to maximize their return on any security technology investment by evaluating their needs and validating the security of their existing deployments. The result is an actionable roadmap to help remediate identified security deficiencies. … Leggi tutto

Active Directory GPO auditing

di

Audit events in your environment is crucial for the discovery and investigation of security incidents: it is also important to know the best practice for configuring the Windows Server 2016/2019 policy.Here’s a list of my presonal tips which I normally implement in my organization.DISCLAIMER: images are not from my lab (except for the log view), … Leggi tutto

Active Directory GPO best practices

di

I wanted to write these tips to make all Microsoft system administrators aware of ten “tips” immediately applicable on their infrastructures to increase the security level in Active Directory.The list is obviously not exhaustive, the idea is to shed light on those less implemented but – in my opinion – important policies.Happy reading. 1. Prevent … Leggi tutto