Network Security
system security Linux network
system security Linux network The romanticized image of the digital nomad – a laptop on a sun-drenched balcony – rarely accounts for the actual friction of maintaining a professional development environment on the move. . The friction is amplified with Linux. We are looking for a setup that respects our kernel configurations, handles volatile network handovers, and maintains a strict security posture without the hand-holding of a consumer-grade OS – so, put simply, more than just a laptop and a sunny deck. The hardware is...
May 26, 2026
Server Securityopen-source Linux administration
open-source Linux administration Cron has existed in Unix and Linux environments for decades, handling backups, cleanup scripts, patching jobs, log rotation, monitoring tasks, and other maintenance work that administrators do not want to run manually. Most Linux servers rely on it constantly, which is exactly why attackers continue abusing it for persistence after a system has already been compromised. . Persistence through cron is not complicated. Attackers do not need a rootkit or advanced malware framework to maintain...
May 25, 2026
Vendors/Productssecurity breach linux
security breach linux A major internal repository breach at GitHub has exposed a critical and overlooked blind spot in Linux supply chain security. Kernel exploits, exposed SSH services, weak firewall rules, and vulnerable daemons dominated the Linux threat model for years, and in many environments, they still matter. But recent supply-chain incidents involving GitHub ecosystems, npm packages, and malicious developer tooling point somewhere else entirely: the developer workstation. . The breach matters because...
May 21, 2026
Security Trends access control multi-tenant
access control multi-tenant Linux administrators often face an ugly choice in the cloud: prioritize convenience and cost-efficiency by sharing infrastructure, or sacrifice those benefits for the sake of total isolation. Most modern Linux workloads don't live on their own private servers anymore. They live in shared environments like Kubernetes clusters, where multiple teams and services run side-by-side. It sounds efficient, and it usually is. . But cloud isolation isn't as ironclad as it looks on the diagram. If you...
May 21, 2026
Vendors/Productsincident response cloud security
incident response cloud security Managed Extended Detection and Response (MXDR) has become one of the most sought-after security services in the enterprise market — and with good reason. It promises the holy grail: broad visibility across endpoints, network, cloud, email, and identity, combined with the 24/7 human expertise most organizations simply cannot build in-house. . However, the rapid growth of the market has produced a wide range of providers whose capabilities vary considerably beneath the surface. Choosing the...
May 19, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security news
We found -1 articles for you...
83
cyber threatssecurity practicesnetwork monitoringSalt Typhoon Threat: Credential Management and Network Defense Strategies
Recent reports have revealed a sophisticated intrusion campaign conducted by Salt Typhoon, targeting major U.S. telecommunications providers. To safeguard against this emerging threat, Linux admins must understand Salt Typhoon's malicious methods: using stolen credentials, living-off-the-land techniques, and consistently changing network configurations to avoid detection while expanding access. . These tactics stress the importance of rigorous credential management practices, such as disabling unnecessary utilities and conducting regular configuration audits to protect networks against Salt Typhoon. Let's examine Salt Typhoon's attack methods in greater depth and discuss practical detection and prevention measures you can implement to safeguard your Linux environment. Credential Use and Expansion The Salt Typhoon group's recent increase in cyber intrusion activity has been a cause of alarm among the cybersecurity community and U.S. telecommunications providers. This threat actor excels at using valid stolen credentials to gain entry to key network infrastructure, further expanding their reach by gathering more credentials from network configurations. Doing so helps solidify their hold on networks once an initial breach occurs, making extrication increasingly difficult. To prevent credential management abuse and to mitigate this particular threat, it is vitally important that security admins engage in reliable credential management practices. This includes creating and using strong, unique passwords across users and systems, as well as updating them regularly and adding multi-factor authentication whenever feasible to add another layer of protection. Furthermore, consistent and proactive monitoring for unauthorized access attempts is imperative. Monitoring access logs and setting alerts can quickly identify and isolate potential breaches before they escalate further. Living-off-the-Land (LOTL) Techniques Salt Typhoon stands out by using living-off-the-land (LOTL) techniques toexploit existing legitimate tools and utilities within compromised networks, such as command line utilities, network management tools, or scripting environments already present on these systems. By doing this, they can minimize their footprint while remaining undetected by traditional detection mechanisms, allowing them to conduct malicious activities without raising immediate red flags. Administrators can counter these tactics by regularly reviewing and updating their network configurations, with an eye toward disabling unnecessary tools or services that could be exploited. Understanding which tools should run on each network device and then disabling or removing those that are unnecessary is key. Regular audits of system configurations and real-time monitoring will assist administrators in detecting and preventing LOTL techniques used in campaigns like Salt Typhoon. Infrastructure Pivoting and Persistence One of the hallmarks of the Salt Typhoon campaign is its persistent movement through compromised infrastructure. Once inside a network, an attacker meticulously modifies configurations and creates multiple access points to maintain control for extended periods. This technique allows the attackers to operate undetected, continuously siphoning data or planning new exploits. Implementing stringent network segmentation measures is key to mitigating persistent threats. like Salt Typhoon. breaking up a large network into separate and isolated segments, security teams can limit an attacker's lateral movement. Conducting thorough configuration audits regularly is also necessary. These audits should identify any unauthorized changes that might signal an attacker's presence on your network. Monitoring devices for sudden configuration changes can detect malicious activities quickly and respond swiftly to these activities. Recommendations for Detection and Prevention Protecting network infrastructure against sophisticated threat actors like Salt Typhoon requires an aggressive and comprehensiveapproach. Our recommendations for detection and prevention include robust configuration management, enhanced monitoring, and in-depth traffic analysis, as these are designed to detect early signs of compromise and stop attackers from reaching their goals. Robust Configuration Management and Auditing Security teams should undertake network device configuration audits regularly. They should check for unapproved changes such as AAA (Authentication, Authorization, and Accounting) configurations, loopback IP addresses, or newly created local accounts that could serve as targets for attackers looking to penetrate networks further. Adopting the principle of least privilege is also an integral security practice. Only users who need access to critical network devices should have it, minimizing opportunities for compromised accounts to be exploited by threat actors. Strong password policies and widespread multifactor authentication measures will significantly increase threat actors' difficulty in gaining and maintaining access. Enhanced Monitoring and Logging Effective detection relies on closely monitoring the syslog and AAA logs for any unusual activities or configuration changes that could indicate potential attacks and log changes. Modifying bash_history, auth.log, lastlog, wtmp, or btmp could indicate an attacker's attempt to cover up their tracks. Integrity logging across all network devices is vitally important. Automated systems can detect log tampering or gaps in logging data - often signs of malicious activity - while regularly checking for non-empty or unusually large.bash_history files may reveal evidence of illicit scripts being run. Network Traffic Analysis Establishing visibility of network traffic is essential to identifying and mitigating network threats. Utilizing tools like NetFlow for traffic analysis, port scanning, and monitoring for unusual volumetric changes are all helpful in pinpointing suspicious network activities. Profiling network devices to detect any changes,such as new ports opening, closing, or traffic patterns, could give early indications of breaches in security systems. Implementing stringent Access Control Lists (ACLs) is crucial to restricting unauthorized access and movement within a network, with regular monitoring for violations helping identify security gaps and address them quickly. Network segmentation helps contain threats more effectively by compartmentalizing potentially compromised sections into separate segments. Patching known vulnerabilities is also key to maintaining an effective security posture against threats like Salt Typhoon. Our Final Thoughts on Mitigating Salt Typhoon's Threat to Your Linux Environment Salt Typhoon's tactics demonstrate the necessity of adopting an integrated network security approach. From advanced credential management and disabling unneeded tools to network segmentation and ongoing configuration audits, Linux security administrators possess several strategies to prevent sophisticated intrusions from taking hold. By prioritizing such actions and cultivating a culture dedicated to security, network defenders can gain the upper hand against even persistent and skilled threat actors. Ultimately, vigilance, continuous improvement, and proactive mitigation are key in protecting critical network infrastructures from stealthy cyber threats like Salt Typhoon. . To combat threats like Salt Typhoon effectively, organizations should implement strong credential management, robust activity monitoring, and proper network segmentation to enhance security.. Cyber Intrusion Detection, Credential Management Techniques, Network Security Practices, Salt Typhoon Threat, LOtl Mitigation Techniques. . Brittany Day
Feb 24, 2025
•
Hacks/Cracks
81
data privacymonitoring practicesbanking securityNSA Monitoring of Global Banking and Credit Transactions via Edward Snowden
The NSA has been widely monitoring international banking and credit card transactions, a new report says referencing Edward Snowden. Referring to information leaked by Edward Snowden, a former CIA employee and NSA contractor, German Der Spiegel reports that the surveillance was carried out by a branch called "Follow the Money" (FTM). The link for this article located at RT is no longer available. . Daniel Ellsberg's released documents expose Pentagon's comprehensive oversight of military operations and strategies.. banking security, data privacy, credit transactions, monitoring practices, international finance. . LinuxSecurity.com Team
Sep 17, 2013
•
Privacy
81
email privacylegal implicationsmonitoring practicesEmail Privacy Rights and Monitoring Practices in the Workplace
Let's suppose you are an employer. You have a well-written and well distributed policy on privacy in the workplace. You expressly state that employees have NO expectation of privacy in ANYTHING they do. You own the hardware, you own the software, you own the network. You reserve the right to monitor every keystroke, every website, every e-mail, every IM session, every chat discussion, and even monitor the lyrics to any song they happen to be listening to on their iPods (sounds like a fun place to work, doesn't it?). You have your employees acknowledge that you have the right to do such monitoring, and they even swear that they consent to such monitoring. . Your lawyers examine the caselaw and find that, in every single case where an employer has attempted to monitor the electronic communications of employees (where there was a stated policy that this would occur) the courts have held that the employee has no reasonable expectation of privacy in the contents of their corporate e-mail. As former CIA Director George Tenet would say, that's a "slam dunk." Right? Well, my magic 8-ball tells me, "situation murky, try again later." The link for this article located at is no longer available. . Explore the legal aspects of email privacy and monitoring in the workplace for employers and employees alike.. Email Privacy, Monitoring Practices, Employee Consent, Workplace Ethics, Legal Considerations. . LinuxSecurity.com Team
Aug 03, 2006
•
Privacy
81
data privacyinformation sharingmonitoring practicesExploring Monitoring, Privacy, And Data Sharing In Today’s Environment
We give out personal information every day. Between our birth and death records, we dispense an avalanche of information to the government, businesses and other organizations in return for employment or services. For example, we provide detailed information to schools, banks, . . . . We give out personal information every day. Between our birth and death records, we dispense an avalanche of information to the government, businesses and other organizations in return for employment or services. For example, we provide detailed information to schools, banks, state departments of motor vehicles, health providers and insurers, and in return we receive an education, bank accounts, a driver's license and health care. We also establish relationships and accounts with vendors and service providers in exchange for discounts and promotions. Businesses thrive on having such customer information. In turn, we are observed and monitored every day. Only the high cost of persistent, systematic surveillance systems prohibits their widespread use in public places today. And without the aid of machines, the observers quickly forget what they saw and rarely collect and correlate data for later use. In the future, security checks like the one at Super Bowl XXXV -- in which hidden cameras scanned the faces of arriving spectators and compared their portraits with photos of alleged criminals -- may be commonplace. When the setting changes from the public to the private-sector workplace, however, monitoring takes on a different significance. Enterprises can and often should monitor their employees in the ordinary course of business. The link for this article located at Network Computing is no longer available. . We give out personal information every day. Between our birth and death records, we dispense an aval. personal, information, every, between, birth, death, records, dispense. . LinuxSecurity.com Team
Jun 18, 2001
•
Privacy
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
Discover faster search, smarter navigation, and deeper Linux security insights. Read More