How to protect your network from web shell malware

The video discusses the threat of web shell malware on web servers and provides guidance from the NSA and ASD on detecting and preventing such attacks. It covers methods like file comparison using hash values and logging, configuring web server logging, and the importance of using universal time for log consistency. The video also introduces the zero trust security model, emphasizing identity tracking and access control. Additional security measures like intrusion prevention systems, web application firewalls, and tools like Sysmon and Microsoft Sentinel are recommended to enhance security and prevent attacks.

What is one method mentioned for detecting changes in files to identify potential web shell attacks?

• Checking file hash values

• Running a firewall scan

• Using antivirus software

• Performing a system reboot

Why is it important to set a universal time for server logs?

• To save storage space

• To ensure consistent event tracking across servers

• To comply with local regulations

• To improve server performance

What is a key focus of the zero trust security model?

• Data backup

• Device encryption

• Network segmentation

• Identity tracking

What should be implemented if old-fashioned servers cannot be restricted from writing to web-accessible directories?

• User access reviews

• Antivirus scanning

• Regular system updates

• File integrity monitoring

Which tool is recommended for logging process creation to help identify attacks?

• Metasploit

• Nmap

• Wireshark

• Sysmon

What is a common method attackers use to gain access to web servers?

• Brute force password attacks

• SQL injections

• Phishing emails

• Denial of service attacks

What is the purpose of using intrusion prevention systems (IPS) and web application firewalls?

• To simplify network architecture

• To reduce server costs

• To add layers of defense against attacks

• To enhance server speed