TF-CSIRT Tools and Software for Intrusion Detection and System Security

• TF-CSIRT Clearinghouse of Incident Handling Tools (CHIHT): Pilot implementation at DFN-CERT
• Security Focus HOME Tools Archive - The bigest searchable collection of the security tools
• Free Incident Management Software: Symantec DeepSight™ Analyzer
• CERT/CC System Security tools
• CERT® Security Improvement Modules
• Each CERT Security Improvement module addresses an important but narrowly defined problem in network security. It provides guidance to help organizations improve the security of their networked computer systems.

Each module page links to a series of practices and implementations. Practices describe the choices and issues that must be addressed to solve a network security problem. Implementations describe tasks that implement recommendations described in the practices.
• FedCIRC Security Tools Collection

Extensive list and collection of Security Tools with short description and classification table
• CIAC Security Tools

CIAC and CSTC Tools and pointers to public domain tools
• Security Administrator's Integrated Network Tool (SAINT)
• Texas A&M Network Security Package

Tools and related documents, as well as other security information
• Top 50 Security Tools

IDMEF tools for Intrusion Detection Systems

• IDMEF XML plugin for the Snort IDS
• LIBIDMEF by Silicon Defence - Requirements:
• Libxml 2.3.7 or greater (Download the latest stable libxml from http://www.xmlsoft.org/)
• Gnome XML Library Reference Manual - http://www.xmlsoft.org/html/book1.html
• NTP 4.0.x or greater (Download ntp from http://www.eecis.udel.edu/~ntp/)
• JavaIDMEF
• SPICE (The Stealthy Portscan and Intrusion Correlation Engine)
• Practical Automated Detection of Stealthy Portscans by S. Staniford, J. Hoagland, J. McAlerney
• IDWG homepage at Silicon Defence

Security BCP, Risk Assessment and Security Policy Management
 

• The ISO 17799 Service & Software Directory - http://www.iso17799software.com/
• Internet Security Auditing Class - http://www.porcupine.org/auditing/

On April 30th, 1996, Dan Farmer (Sun Microsystems) and Wietse Venema (Eindhoven University) presented a full-day free class on security auditing before an audience of 200 in Santa Clara (CA).
• RUSecure™ - Information Security Officer's Manual - the ISO Manual - http://www.eon-commerce.com/rusecure

Evaluation download - http://www.computer-security-policies.com/download.htm
• The Security Audit and Internal Audit Shop - http://www.security-audit-internal-audit.com/
• IBM Security Solutions -  http://www-3.ibm.com/security/index.shtml
• IBM Security Planner for  AIX, Linux, OS/400, Windows 2000, z/OS or OS/390 - http://www-1.ibm.com/servers/security/planner/
• IBM Tivoli Risk Manager - http://www.tivoli.com/products/index/risk-mgr/
• Monitor, view, and manage security alerts across your organization with an easy-to-use console
• Integrate the management of perimeter security
• Reduce and classify security alerts to help quickly identify and address real threats
• Utilize predefined tasks to quickly resolve denial-of-service attacks, viruses, or unauthorized access
• Microsoft Security webpage - http://www.microsoft.com/technet/security/

Microsoft Security BCP -  http://www.microsoft.com/technet/security/bestprac/bpent/
• Cisco Security components - http://www.cisco.com/warp/public/44/jump/secure.shtml

Security Technical Tips - http://www.cisco.com/warp/public/707/
• @stake Security Vulnerability Reporting Policy - http://www.atstake.com/research/policy/index.html

Software Security Audit tools

• Linux Security Audit Project - http://lsap.org/

Security-Audit's FAQ - http://lsap.org/faq.txt
• @Stake Secureity Tools archive - http://www.atstake.com/research/tools/index.html

@Stake LC4 - The Password Auditing and Recovery Application - http://www.atstake.com/research/lc/index.html
• LC4 helps administrators secure Windows-authenticated networks through comprehensive auditing of Windows NT and Windows 2000 user account passwords
• LC4 recovers Windows user account passwords to streamline migration of users to another authentication system or to access accounts whose passwords are lost.
• Security Code Review Guidelines - http://www.homeport.org/~adam/review.html
• How to Find Security Holes - http://www.canonical.org/~kragen/security-holes.html
• Dmalloc - Debug Malloc Library - http://dmalloc.com/

The debug memory allocation or dmalloc library has been designed as a drop in replacement for the system's malloc, realloc, calloc, free and other memory management routines while providing powerful debugging facilities configurable at runtime. These facilities include such things as memory-leak tracking, fence-post write detection, file/line number reporting, and general logging of statistics.
• Sun Software Security Audit page - http://wwws.sun.com/software/security/audit/
• Microsoft .NET Framework Security - http://msdn.microsoft.com/vstudio/techinfo/articles/developerproductivity/frameworksec.asp

| Home | Information | Conferences | Innovation | Technical | Library | News |