What's changed: Initial version (topic 2.12, subtopics 2.12.1–2.12.4)
6.4Security Operations
Learn the tools of day-to-day security operations: connectivity/scanning with netcat(nc/ncat) and nmap, packet filtering with iptables/firewalld, vulnerability advisory sources Bugtraq, CERT, and CIAC, intrusion prevention with fail2ban, the intrusion detection system (IDS) snort, and vulnerability scanners OpenVAS/OpenSCAP.
Configuring a firewall and SSH is not the end of the story. Day-to-day security operations involve continuously checking your own attack surface, detecting signs of intrusion, and tracking the latest vulnerability information. This section surveys the tools used in that ongoing work.
6.4.1Connectivity checks and port scanning
- netcat (nc, or its successor ncat) is a general-purpose tool that easily connects to or listens on any TCP/UDP port—useful for a quick open-port check or as an ad hoc file transfer / listener.
- nmap is a full-featured port scanner that surveys a target host's open ports, running services, and OS fingerprint—used for audits that visualize your own organization's attack surface (running it against another organization without authorization can constitute unauthorized access).
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.