topics of information security and information assurance with emphasis on personal security and privacy

I’ve slacked off the past two weeks after the written test. Between end of semester and taking the GSE written I felt like I had earned some time off. I may not get started this weekend, but I do want to formulate my plan of attack for the lab in March.

I have Kali 1.0, but needed Fedora 20 (torrent link HERE: https://torrents.fedoraproject.org/).

I’ve started trolling through the giac-study Google group e-mails I’ve collected for GSE lab tips and tricks – there is some good (dated, but good) stuff in there. A notable quote: “If you don’t do IR as a day job , then continuous hands-on practice is the only way to pass the two day exam. Practice all the hands-on labs until you can do them without the books”. Another suggests making sure you are especially familiar with Wireshark (including extended features, analysis and extraction abilities), Metasploit (including the tasks performed in the lab sessions of GCIH), and command line tools. Suggestions for practice from various sources; the below is mostly packet analysis/network forensics based, the topic I feel weakest on:

Puzzles/challenges:

• http://digital-forensics.sans.org/community/challenges/
• https://pen-testing.sans.org/holiday-challenge/2013
• http://forensicscontest.com/puzzles
• http://www.wiresharktraining.com/sharkfest2013challenge.html (don’t bother with challenge #7)
• http://www.wiresharktraining.com/sharkfest2014/
• https://enterprise.cloudshark.org/categories/capture-challenge/
• http://digital-forensics.sans.org/blog/2014/12/05/dfir-monterey-2015-network-forensics-challenge-released (solutions: https://digital-forensics.sans.org/blog/2015/02/08/2015-network-challenge-results)

A big list of pcap files to look at/ analyze from CTF events, honeypots, etc: http://www.netresec.com/?page=PcapFiles

Cheat sheets:

• http://packetlife.net/media/library/12/tcpdump.pdf
• http://packetlife.net/media/library/13/Wireshark_Display_Filters.pdf

additional education training/videos:

• http://securityxploded.com/security-presentations.php
• http://www.windowsecurity.com/articles-tutorials/viruses_trojans_malware/Hunt-Down-Kill-Malware-Sysinternals-Tools-Part1.html

additional challenges, including walkthroughs (not free, don’t know much about this other than they run a contest at DefCon):

http://bytepuzzles.com/

My first order of business is to improve my packet analysis skills. I can do some generic BPF filtering, but the additional features of wireshark and tshark I’m still fuzzy on. . . I also need to get SiLK and BRO better in my head – specifically when, where, and how to use them.