Technical Whitepapers and Publications

Whitepapers & Publications
If you find any mistakes or have any suggestions, PLEASE email me at lance@spitzner.net
Thanks!

--- Whitepapers ---
Feel free to copy / link / distribute any of my whitepapers listed below. Don't have time to read the papers online? Now you can download all the whitepapers from here and read them offline (updated weekly). Foreign language speakers, you can find translations here (Francais, Deutsch, suomi)

Know Your Enemy - 18 February, 2000

The tools and methodology of the most common black-hat threat on the Internet, the Script Kiddie. By understanding how they attack and what they are looking for, you can better protect your systems and network.

Know Your Enemy: II - 18 June, 1999

How to determine what the enemy is doing by analyzing your system log files. Includes examples based on two of the most commonly used scanning tools on the Internet, sscan and nmap.

Know Your Enemy: III - 27 March, 2000

What happens after the script kiddie gains root. Specifically, how they cover their tracks while they monitor your system. The paper goes through step by step on a system that was recently compromised, with system logs and keystrokes to verify each step.

To Build a Honeypot - 7 April, 2000

One method of building your own honeypot to learn more about the black-hat community. The tools and methods discussed are how I did my research for the "Know Your Enemy" series.

Armoring Linux - 10 April, 2000

How to armor the Linux operating system. This article presents a systematic method to prepare your system for the Internet. The article is based on Redhat 6.0, but should apply to most distributions of Linux.

Armoring Solaris - 7 April, 2000

How to armor the Solaris operating system. This article presents a systematic method to prepare for a firewall installation. Also included is a downloadable shell script that will armor your system.

Armoring NT - 16 April, 2000

How to armor the NT 4.0 operating system. This article presents a systematic method to prepare for a firewall installation, specifically Check Point Firewall 1

Intrusion Detection for Check Point FireWall-1 - 4 April, 2000

How to implement intrusion detection for Checkpoint Firewall 1. Also included is a downloadble script that does all IDS functionality for you. Please give this page a minute to download, I used several images for the page, totaling 225K. Thanks!

Understanding the FireWall-1 State Table - 19 March, 2000

Stateful inspection is one of FW-1's claim to fame. This whitepaper covers how it works, and how stateful it really is. Included is a PERL script that helps you read and understand your own FW-1 state table. This paper is a work in progress.

Building Your Firewall Rulebase - 26 January, 2000

Misconfigured firewalls are one of the biggest risks security admins face. This paper describes in a step-by-step fasion how to build a secure firewall rulebase.

Auditing Your Firewall Setup - 26 March, 2000

How to audit your firewall setup. The purpose of this paper is to help you verify your firewall is correctly implemented and behaves as you expect it.

FW-1 Troubleshooting Tips - 15 December, 1999

Advance Troubleshooting tips for CheckPoint FW-1.

--- Publications ---
As published in "Inside Solaris"

The Secrets of Snoop

How to best leverage the network sniffer snoop, with various command line examples. Included are examples on how to analyze network traffic and improve your network security.

Routing With Solaris - 9 March, 2000

How to configure a static routing table for a Solaris gateway. Also covers what VLSM is and how to leverage it. Included are examples of real routing situations, to include command syntax and routing table configuration. Also included is an excellent windows tool to calculate all your subnetting and CIDR aggregation.

Configuring Network Interface Cards

How to install, configure, and troubleshoot your NICs for the Solaris operating system. Included are examples of command syntax and interface configuration.

Watching Your Logs

How to plan and implement an automated filter for your logs utilizing swatch. Includes examples on configuration and implementation.

Intrusion Detection.

How to build and implement a simple intrusion detection system using TCP Wrappers and other tools. Also, recommendations on how to react and NOT react once you detect an intrusion attempt.

--- Other Goodies ---

The What and How of Information Technology

The result of a graduate school project, I propose a theory on how management can apply Information Technology in a Two Part Process. Linked to this is an interactive website demonstrating my theory.

Digital Certificates

In-depth Whitepaper on what Digital Certificates are and how they work.

Logger for Checkpoint Firewall 1

Access database that queries Checkpoint Firewall 1 logs. Please give this page a minute to download, I used several images for the instructions, totaling 159K. Thanks!!

Author's bio
Lance Spitzner enjoys learning by blowing up his Unix systems at home. Before this, he was an Officer in the Rapid Deployment Force, where he blew up things of a different nature. You can reach him at lance@spitzner.net .

Check out my bio