Abstract: A Next Generation Firewall is a system aimed at providing network level controls to application data. Since all traffic is going through 80 we need deeper insight into that traffic than a traditional packet filter provides. An NGFW allows control at the application layer, providing the means to block applications as well as profile the applications that are in use on that network.

This talk will demonstrate the newest addition to Snort – the open source intrusion detection system. The new addition, OpenAppID, releases application detection as an open source project for the entire community to use. I will show how to get it up and running, what kind of application data we can collect, and how to write simple Snort rules to block unwanted applications.

Author Bio: Adam Hogan got his start in security by learning Snort and other open source tools instead of attending class, and has been snorting fort the past decade. Sourcefire eventually hired him to write their training manuals and classes. He now works as a Consulting Security Engineer for Sourcefire (now part of Cisco). Adam lives in Columbus spends his free time using video games to avoid working on his dissertation.

Back to Circle City Con 2014 Videos list