The talk that I’ve presented during Infosec.my technical forum this year is Network Security: 3 Key Elements where the key elements are process, technology and Human. I have the idea to give presentation on that topic based on my observation and experience in this field (OK not that long though). Most of our competitor emphasis on how advance their technology is when managing their clients network security. Well I am from the old school in this field where I believe technology is only to assists human in performing their tasks. From the email that I received this morning, I know how right I am in this matter..

Category = Firewall

Severity = Medium

Events = Blocked event

Source IP = Local ISP

Destination IP = Web Server

Destination port = 22, 443

Impact = NetBIOS sharing and possible information disclosure and loss of data

Raw log :
Firewall: Firewall device_id=Firewall [No Name]system-notification-xxxx(traffic): start_time=”today early in the morning” duration=0 policy_id=xx service=https proto=6 src zone=Untrust dst zone=DMZ action=Deny sent=0 rcvd=0 src=(Local ISP) dst=(Web Server)src_port=11866 dst_port=443 session_id=0

Firewall: Firewall device_id=Firewall [No Name]system-notification-xxxx(traffic): start_time=”Few minutes after the first log” duration=0 policy_id=xx service=https proto=6 src zone=Untrust dst zone=DMZ action=Deny sent=0 rcvd=0 src=(Local ISP) dst=(Web Server) src_port=12243 dst_port=443 session_id=0

Can you spot the mistakes? Do you think this event should be escalated? Be my guest to comment  ;)

===============================================================

Update: Thanks for all of your comments.

Actually, this event should not reached the client. In other words, this is event does not require any escalation to be made. The firewall has done its job efficiently and port 22 (SSH) and 443 (HTTPS) has nothing to do with NetBIOS or any of its family. I guess the best comment is from ZiaSay’s (I know who you are hahaha)
———————————————————————————–
Apa la kowang merapu niiiii.. org tanya lain, lain plak kowang jawap yer… kang aku suruh “epul buka TOPENG” kang baru semua terkuzat..

Komen-komen anda semua boleh buat ramai “pecah kapla dan WET wooo uiiii dont make me honi laaa weii ” mehmehmeh..

ok lemme Ella_b0rit’s <– kena ado “aSS” sket

TuanRumah quote’s
“Can you spot the mistakes? Do you think this event should be escalated? Be my guest to comment”

ZiaSay’s
Category = Firewall <– Tak Mistake sbb dari fw event

Severity = “Medium” <– Sikit Mistake kot sbb event ni tak membawa apa-apa “kesan” pung sbb dah kena DENY la katakan.. mehmehmeh it should have been “LOW”.. anyway “wording Severity” tu ader dlm template kan.

Events = Blocked event <– Tak Mistake sbb dari fw rules

Source IP = Local ISP <– Tak Mistake sbb dari fw rules

Destination IP = Web Server <– Tak Mistake sbb dari fw rules

Destination port = 22 <– MISTAAAAAAAAAAAAAKE!!!!! SBBnya.. NTAH MANA-MANA DTG NTAH PORT NI!!!! WEIIIIIII TIDO KA!!! ITU “ssh” LAAAA ADER KER DARI DLM RAW-SYSLOG PAYLOAD TU EK :? YG AKU PERASAAN PAYLOAD TU SEMUA TUNJUK “https-443″ JERRR.. ISKKK…ISKKK

port = 443 <– Tak Mistake sbb dari fw rules

Impact = NetBIOS sharing and possible information disclosure and loss of data <– MISTAAAAAKEEEEEE.. HAHAHHAHAHAHAHA!!! APO KOJADAHNYA KOWANG BUAT KERJAAAA HAAAAAAA!!!!
AKU UMPAMAKAN “ORG” YG BUAT KERJA NI MCM :-
“BARU LEPAS CAPMELAN PASTU DIA TANYA DIRI DIA SENDIRI, HEHHH TADI AKU LUNCH-UP KER or AKU GI MAKAN EK???
PADAN LA IKAN BAKAR KAT KEDAI BASIKAL MOTEN BIKE ALI KOMPUETERRR TU VERY CHEAP-UP LERR…”"
BEST NYERRR!!! …DIA KATA”

HAHAHHAHAHAHA!!!! APOKOJADAHNYA netbios kena ngena gan https & ssh ni weiiii.. sakit “telo” aku gelak!!!!

MORAL OF THE STORY:
Kalau suka sgt guna mouse utk copy & paste pastu dan MALAS utk re-read or re-confirm or perasan “aku dah terrel” beginila jadi nya jon@@@@@@..

TuanRumah quote’s
“Do you think this event should be escalated?”

ZiaSay’s
HAHAHHAHA.. in da perst pelace i would say NO!!! and the one should be escalated and executed and should have been sent to ISA detention center was “mamat” yg buat anal_is_is dan JOKE of the year ni!!! hoiii kowang baru bgn tido kaaa atau mmg tgh tido masa buat kejadah ni..

adeh–adehhh..

ZiaSay’s.. Nyampah I..

You need a translator for this :) )