News for hackers. Stuff that matters.

A comment on Hackers went undetected in Citrix’s internal network for six months. Parent comment

Re:Hackers went undetected in Citrix’s internal network for ... by rando444 on Wednesday May 01, 2019 @04:22AM (#19795395)
For some clients we use tools that alert if large amounts of data are transferred outside the network in a single flow.

So even if it's someone with valid access, it would be investigated immediately.

[ Parent | on HN ]
Re:Hackers went undetected in Citrix’s internal network for ... by jftuga on Wednesday May 01, 2019 @05:41AM (#19795702)
Which tools do you use? I have been looking for something that does this.
[ Parent | on HN ]
Re:Hackers went undetected in Citrix’s internal network for ... by kylel on Wednesday May 01, 2019 @07:34AM (#19796151)
In the Marriot hack post-mortem, they shared that one of the tools they used (which successfully identified the attack) was IBM Guardium.

> Accenture told Marriott's IT staff that one of their security products, a database monitoring system called IBM Guardium, had detected an anomaly on the Starwood guest reservation database

https://www.zdnet.com/article/marriott-ceo-shares-post-morte...

[ Parent | on HN ]
Re:Hackers went undetected in Citrix’s internal network for ... by pnutjam on Wednesday May 01, 2019 @07:35AM (#19796156)
I'm guessing snort or one on the similar products.
[ Parent | on HN ]