MozDef - Mozilla's Self Defence Kit
Written by Alex Denham   
Monday, 24 March 2014

Mozilla is working on a defense platform to automate the handling of security incidents, and to enable the use of incident handlers. Why not create tools for defence - the attackers have plenty!?

The Mozilla Defense Platform (MozDef) is still at the early proof of concept stage, according to the documentation, but you can check it out in its current form on GitHub.

The announcement about it in the Readme on Github says that “the inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time.” In contrast, defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.

mozillasecurity

 

When it is finalized, MozDef will provide a more automated platform. The goals of the team working on MozDef are that it will allow defenders to rapidly discover and respond to security incidents, and will also automate interfaces to other systems like bunker, banhammer, and mig. Incident handlers will be able to use it for real-time collaboration, and for repeatable, predictable processes for incident handling. The platform is designed to go beyond traditional SIEM systems in automating incident handling, information sharing, workflow, metrics and response automation.

In order to do this it will provide traditional SIEM functionality including:

  • Accepting events/logs from your systems
  • Storing the events/logs
  • Facilitating searches
  • Facilitating alerting
  • Facilitating log management (archiving,restoration)

 

In technical terms, input will be in JSON format, and you’ll have open access to your data. It will integrate with a variety of log shippers including heka, logstash, beaver, nxlog and any shipper that can send JSON to either rabbit-mq or an HTTP endpoint.

The developers plan to provide easy python plugins to manipulate your data in transit, and to give real-time access to teams of incident responders to allow each other to see their work simultaneously.

This is a good idea. Why not weaponize the defence in response to the attack? The only question is will this be another Mozilla project that fades way and does it go far enough?

 

mozillasecurity

 

More Information

MozDef documentation

MozDef on GitHub

Related Articles

Record Payouts At Hacking Contests

Is Exploiting A Bug Hacking?

The Computer Science of Insecurity

Cyber Attacks and Holidays

 

To be informed about new articles on I Programmer, install the I Programmer Toolbar, subscribe to the RSS feed, follow us on, Twitter, FacebookGoogle+ or Linkedin,  or sign up for our weekly newsletter.

 

blog comments powered by Disqus

 

Banner


Firefox OS Comes To Raspberry Pi
28/10/2014

Firefox OS hasn't taken over the world yet despite its promise. Now we have a small effort from Mozilla to make it run on one of the most successful budget devices in the world - the Raspberry Pi.



Learning To Be A Computer
29/10/2014

We have recently seen how much neural networks can learn, but the latest example is very strange. Google has succeeded in teaching a neural network to be a computer simply by showing it programs and w [ ... ]


More News

Last Updated ( Tuesday, 25 March 2014 )
 
 

   
RSS feed of news items only
I Programmer News
Copyright © 2014 i-programmer.info. All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.