• 0 Posts
  • 32 Comments
Joined 1 year ago
cake
Cake day: June 2nd, 2023

help-circle




  • CrowdStrike Falcon is XDR product, there is hundreds of similar products available.

    The role of XDR is to detect and block if some bad actor is trying to do something malicious in the machine. Old school virus signature detection is not enough anymore, you need pattern detection from network communication/DNS queries etc.

    When corporation has thousands of devices to monitor the OS each of those devices Is not relevant. You need to detect if some random user logs to some Linux info display thousand kilometers away, and starts scanning the network.

    Because the detection and response, needs to happen near realtime, for example Incase of cryptolockers, where all devices are encrypted within seconds, the software blocking this needs kernel level access.

    I work in critical infrastructure as IT, but luckily we did not use falcon











  • I would suggest more learn by doing approach. Learning OSI model etc is nice, but it is quite jargon :)

    Use some old PC as a server, and get some network cards into it, and use it as firewall/router. Route your home network/NAT/DNS/DCHP through it. Raspberry Pi’s are nice, but their hw is still bit limited.

    OPNSense is quite nice and easy free and open source firewall/router solution.

    If you want to add bit of flexibility, you can use some virtualization platform like VMware in to the machine, so that you can run OPNSense in it, with some other virtual servers.

    Then when you get things working, you can start looking in to VLAN’s, because they are quite important part of enterprise networking. Most cheap switches nowadays support VLAN’s out of the box.