Last fall we discussed what security data do I really need to collect and analyze. We know we don’t need it all, but this was only the sensor part of the discussion. Now that we have that data identified and those sensors in place, what brain do I need to collect and analyze it? There […]
There are a lot of endpoint security solutions on the market. How do you pick and choose which solution is right for you? The answer may depend on which endpoints you want to protect. Windows? MacOS? Linux? All of the above? What about containers and cloud infrastructure? When we think of traditional endpoints, we immediately […]
Paul and I have talked a lot about his enchanted quadrants on the podcasts, but for those who haven’t watched, here’s a quick summary… An effective security program requires the integration of four key data sources: Logs (firewall, network, application, etc.) Endpoint (files, processes, logs, etc.) Network (flow and packets) Threat Intelligence Most organizations build […]
The endpoint market has been hot for years. At one point, there were over 80 new endpoint vendors trying to displace the traditional anti-virus vendors. The endpoint security market was transitioning from endpoint protection to endpoint detection and response (EDR). EDR is all the rage, but do you really need one? While the endpoint market […]
We’ve been told for years that we don’t have enough data for security. Then we see the headlines and quotes… “Organizations must prepare for collecting, processing, analyzing, and acting upon terabytes of security data.” “All decisions about cybersecurity strategies, program priorities, investments, etc. should be made based upon analysis of real-time and historical data.” New […]
In the world of cybersecurity, we talk about a lot of capabilities and tools. But if we think about what the hackers want, it’s our data. Why do we focus so much time and effort on the network and endpoint, but not the data? I get it, data security is hard (or at least it […]
We’ve heard the same story for years. Antivirus software is not effective in stopping cyber-attacks, as hackers have adapted their techniques to evade signature-based detections. Even next generation antivirus, which apply techniques such as machine learning and behavioral analytics, is no more effective at protecting an organization than its older sibling. But why? The simple […]
I want to share a little file hiding technique with you. I have never found a practical use for this in a penetration test, but it is still pretty neat! This technique can be very useful when you are participating in red-team/blue-team exercises, and you need to make it difficult for the other team to […]
I encountered something on a penetration test today that I thought was kinda neat. I’m sure that others have encountered this before, but it was the first time I stumbled upon it and thought that this might be a good place to share the experience and keep notes for future use. The scenario goes like […]
Window 7 Symbolic file and directory links are pretty cool. Although the most common use of symbolic links is to make a folder or directory appear to exist someplace it does not, symbolic links can be used to take complex paths and filenames and make them simpler to understand. That’s good because some of our […]
