MozDef - Mozilla's Self Defence Kit
Written by Alex Denham   
Monday, 24 March 2014

Mozilla is working on a defense platform to automate the handling of security incidents, and to enable the use of incident handlers. Why not create tools for defence - the attackers have plenty!?

The Mozilla Defense Platform (MozDef) is still at the early proof of concept stage, according to the documentation, but you can check it out in its current form on GitHub.

The announcement about it in the Readme on Github says that “the inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time.” In contrast, defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.

mozillasecurity

 

When it is finalized, MozDef will provide a more automated platform. The goals of the team working on MozDef are that it will allow defenders to rapidly discover and respond to security incidents, and will also automate interfaces to other systems like bunker, banhammer, and mig. Incident handlers will be able to use it for real-time collaboration, and for repeatable, predictable processes for incident handling. The platform is designed to go beyond traditional SIEM systems in automating incident handling, information sharing, workflow, metrics and response automation.

In order to do this it will provide traditional SIEM functionality including:

  • Accepting events/logs from your systems
  • Storing the events/logs
  • Facilitating searches
  • Facilitating alerting
  • Facilitating log management (archiving,restoration)

 

In technical terms, input will be in JSON format, and you’ll have open access to your data. It will integrate with a variety of log shippers including heka, logstash, beaver, nxlog and any shipper that can send JSON to either rabbit-mq or an HTTP endpoint.

The developers plan to provide easy python plugins to manipulate your data in transit, and to give real-time access to teams of incident responders to allow each other to see their work simultaneously.

This is a good idea. Why not weaponize the defence in response to the attack? The only question is will this be another Mozilla project that fades way and does it go far enough?

 

mozillasecurity

 

More Information

MozDef documentation

MozDef on GitHub

Related Articles

Record Payouts At Hacking Contests

Is Exploiting A Bug Hacking?

The Computer Science of Insecurity

Cyber Attacks and Holidays

 

To be informed about new articles on I Programmer, install the I Programmer Toolbar, subscribe to the RSS feed, follow us on, Twitter, FacebookGoogle+ or Linkedin,  or sign up for our weekly newsletter.

 

espbook

 

Comments




or email your comment to: comments@i-programmer.info

 

Banner


AI Breakthrough For Robot Surgery
17/11/2024

Using imitation learning, a robot has learned to perform surgical procedures as skillfully as human surgeons, bringing the field of robotic surgery closer to true autonomy.



Remembering Grace Hopper On Her 114th Anniversary
09/12/2024

Today sees the start of Computer Science Education Week and  the 2024 Hour of Code. These educational event are timed to coincide with Grace Hopper's birthday on January 9th, 1906 due to her conc [ ... ]


More News

Last Updated ( Tuesday, 25 March 2014 )