Red Hat NETWORK 3.6 - Betriebsanweisung PDF herunterladen (Seite 45)

The following example shows how to create a custom plugin to detect users logging into

myspace.com accounts. First, a unique plugin ID is assigned, in this case “9000”. So, the

first line of our plugin will be:

id=9000

Next, we will want to have a description of what the vulnerability detects:

description=The remote client was observed logging into a myspace.com

account. You should ensure that such behavior is in alignment with corporate

policies and guidelines. For your information, the user account was logged

as:<br> %L

The “%L” will be the results of our regular expression statement that will be created later.

Basically, we want to log the source address of the offending computer as well as the user

ID that was used to log in. Next, we create a distinct name for our plugin.

name=POLICY - myspace usage detection

Note that the name begins with the string “POLICY”. This will make all POLICY violations

easily searchable from the SecurityCenter interface.

You could also define a SecurityCenter dynamic asset list that contains only POLICY

violators.

The next field defines a “family”. For this example, the application is a web browser, so the

family ID is defined as follows:

family=Web Clients

Since this is a web browser, a dependency can be assigned that will tell PVS to only look at

clients that have been observed surfing the web:

dependency=1735

Further, since we are looking at client traffic, we will define:

clientissue

Next, we assign a risk rating for the observed behavior:

risk=MEDIUM

In the final section we create “match” and “regex” statements that PVS will look for

passively. We want all of these statements to be true before the client is flagged for

inappropriate usage:

match=>POST /

The web request must begin with a POST verb. This will weed out all “GET” requests.

match=^Host: login.myspace.com

1 2 ... 40 41 42 43 44 45 46 47 48 49 50 ... 60 61

Keine Kommentare

Red Hat NETWORK 3.6 - Betriebsanweisung Seite 45