5.6.2. Security Diagnostic Tools
💡 First Principle: Security diagnostic tools reveal what is running, what is communicating, and whether files have been modified — the three questions that distinguish a security incident from a configuration problem. These tools are also used by attackers, which is why understanding them is dual-purpose: defensive investigation and understanding the attacker's toolkit.
Security Diagnostic Tool Reference
| Tool | Purpose | Key Output |
|---|---|---|
| Port scanners (nmap) | Identify open ports and services | Which ports are open, which services are running, OS fingerprint |
| Network sniffers (Wireshark, tcpdump) | Capture and analyze network traffic | Packet contents, protocol behavior, suspicious traffic patterns |
| Anti-malware scanners | Detect known malicious software | Identified threats, quarantined files |
| Antivirus | Signature-based malware detection | Known virus signatures matched |
| File integrity monitoring | Detect unauthorized file changes | Which files changed, when, what changed |
| Checksums (md5sum, sha256sum) | Verify file integrity | Hash comparison — matches baseline or doesn't |
| netstat | Show active connections and listening ports | Active sessions, listening ports, associated processes |
| Telnet/nc | Test port accessibility | Port open/closed/refused |
| SELinux tools (audit2allow, sealert) | Diagnose SELinux denials | Which operations are being blocked and why |
| UAC (User Account Control) | Windows elevation prompts | Privileged actions require explicit elevation |
File Integrity Monitoring
File integrity monitoring (FIM) maintains a baseline of file hashes for critical system files. When a file changes — whether from an update, configuration change, or attacker modification — the hash changes and the monitoring system alerts.
- Checksums: Hash functions (MD5, SHA-256) produce a fixed-length fingerprint of file contents. Any change to the file produces a different hash.
- Monitoring: Tools like Tripwire, OSSEC, or Windows File Server Resource Manager monitor for changes.
- Detection vs. enforcement: FIM detects changes; it doesn't prevent them. Combine with access controls to limit who can modify critical files.
User Access Controls
- SELinux (Security-Enhanced Linux): Mandatory access control for Linux. Applies per-process, per-file policies that restrict what even root can do. Labels files and processes with security contexts; denies operations that don't match policy.
- UAC (User Account Control): Windows mechanism that prompts for elevation when an action requires administrative rights. Prevents malware from silently performing privileged operations.
⚠️ Exam Trap: netstat shows connections and listening ports but does not show whether those connections are legitimate or malicious. A malware process can listen on a legitimate port. Cross-reference netstat output with process IDs, then verify process names and their file paths to confirm legitimacy.
Reflection Question: A security analyst notices unusual outbound traffic from a server. Using netstat, they see an established connection on port 443 to an external IP address. The process ID associated with the connection doesn't match any known application. What does this indicate, and what tool would you use next?
