TaoSecurity Blog

Today I decided to install Suricata , the open source intrusion detection and prevention engine from the Open Information Security Foundation (OISF) , as an IPS. I've been running Suricata in IDS mode through Security Onion on and off for several years, but I never tried Suricata as an IPS. I decided I wanted to run Suricata as a bridging IPS, such that it did not route traffic. In other words, I could place a Suricata IPS between, say, a router and a firewall, or between a router and a host, and neither endpoint would know the IPS was present. Looking at available documentation across the Web, I did not see specific mention of this exact configuration. It's entirely possible I missed something useful, but most people running Linux as a bridge weren't using Suricata. Those running Linux as a bridge sometimes enabled an IP address for the bridge, which is something I didn't want to do. (True bridges should be invisible to endpoints.) Of course, to administer the ...

Thank you to anyone who voted for me to join the board of the Open Information Security Foundation . They are most famous for their Suricata intrusion detection engine, but I expect additional outputs as time passes. I appreciate those of you who supported my goal to join their board. I will try to provide fair and useful input to the project. I believe we will have our first board phone call next week. Are there any issues you would like me to raise, or consider for future meetings? I am personally interested in OISF because I think they bring a level of enthusiasm, openness, and innovation to the open source network security monitoring space, alongside tools like Bro and Snort and others I mentioned in my January post Seven Cool Open Source Projects for Defenders . OISF is also a US nonprofit, a 501c(3) group, so I like the idea of helping that sort of organization. Tweet

This month I was pleased to attend a public meeting of the Open Information Security Foundation in Washington, DC. I got a chance to meet several people I have known for many years through their work with Snort, such as Matt Jonkman , Will Metcalf , Victor Julien , Frank Knobbe , and two guys from a federal agency that have extended Sguil way beyond what I knew anyone was doing! The group posted DC Brainstorming Meeting Notes , but I wanted to record a few thoughts here. OISF is a US nonprofit, a 501c(3). Their goal is to produce a new network inspection and filtering engine (IDS/IPS) that will be released under GPLv2. They can not and will not commercialize, sell, patent, copyright, or profit from the engine. Rather, others who participate in the OISF Consortium (listed on their Web site) are donating coders, equipment, and financial support in exchange for the ability to commercialize the engine. OISF works with the Open Source Software Institute , famous for getting FIPS vali...