Language Selection

English French German Italian Portuguese Spanish

Detect insider threats with Linux auditing

Filed under
Security

Organizations of all sizes need to mitigate the risk of insider threats. Misconduct by authorized users represents a grave threat to an organization. According to the 2005 Computer Security Institute and Federal Bureau of Investigation Computer Crime and Security Survey, organizations reported that computer intrusions from inside sources accounted for nearly half of all incidents. You can secure your network perimeter with intrusion detection systems, firewalls, and virus scanners, but don't neglect to monitor authorized users. The Linux Audit daemon can help you detect violations of your security policies.

The term auditing has multiple meanings within the information security field. A security audit is a term used to describe the process of evaluating the security posture of an organization through penetration testing, review of security policies, and system configuration. At the system level, auditing refers to the logging of the actions of users and programs of a system. The latter form of auditing is the type of auditing implemented by the Linux Audit daemon. It is a passive security measure because it only detects violations of security policy, but does not enforce it. It is similar to network-based intrusion detection systems and host-based intrusion detection systems.

More Here




More in Tux Machines

Qiana Studio Complete Multimedia Production

​Qiana Studio is a Ubuntu and Linux Mint based system for multimedia productions. It comes with many powerful tools and applications that make it a media creation powerhouse. The developers seek to make a lightweight - but powerful A/V-distro basing on Linux Mint! Let us take a look at this distro if it's worth your time. Read more

Ubuntu 17.10 (Artful Aardvark) Daily Build ISO Images Now Available to Download

Canonical's Adam Conrad announced that Ubuntu 17.10 (Artful Aardvark) is officially open for development, and it looks like the first daily build ISO images are already available for download. Read more

Radeon RX 580: AMDGPU-PRO vs. DRM-Next + Mesa 17.2-dev

Last week I posted initial Radeon RX 580 Linux benchmarks and even AMDGPU overclocking results. That initial testing of this "Polaris Evolved" hardware was done with the fully-open Radeon driver stack that most Linux enthusiasts/gamers use these days. The AMDGPU-PRO driver wasn't tested for those initial articles as it seems to have a diminishing user-base and largely focused for workstation users. But for those wondering how AMDGPU-PRO runs with the Radeon RX 580, here are some comparison results to DRM-Next code for Linux 4.12 and Mesa 17.2-dev. Read more

Void GNU/Linux Operating System Adopts Flatpak for All Supported Architectures

Void Linux, an open-source, general-purpose GNU/Linux distribution based on the monolithic Linux kernel, is the latest operating system to adopt the Flatpak application sandboxing technologies. Read more