Threat Hunting

The numbers provide a needed counterweight to the argument that automated hacking (or defense) can be a tonic for everything in the cyber realm.

While they’re easy for attackers to set up, web shells can be difficult for defenders to detect, since they’re often targeted to specific servers and can hide in the noise of internet traffic, scanning, probing and unsuccessful attacks that most organizations see on a daily basis.

Walmart has been one of the leading pioneers in developing purple teams. Today’s columnists, Timothy Nary and Clayton Barlow-Wilcox of Booz Allen, offer insight into how purple teams can boost overall security efforts.

At the core of the document is this message: a threat model that can’t be understood outside of the security team doesn’t make any company safer.

Paul and I have talked a lot about his enchanted quadrants on the podcasts, but for those who haven’t watched, here’s a quick summary…  An effective security program requires the integration of four key data sources: Logs (firewall, network, application, etc.) Endpoint (files, processes, logs, etc.) Network (flow and packets) Threat Intelligence Most organizations build […]

The endpoint market has been hot for years.  At one point, there were over 80 new endpoint vendors trying to displace the traditional anti-virus vendors.  The endpoint security market was transitioning from endpoint protection to endpoint detection and response (EDR).  EDR is all the rage, but do you really need one? While the endpoint market […]

There are numerous security use cases where the integration of network packet data provides additional contextual information for better actionability.  Free and open source packet capture tools do a great job capturing packets, but how do you collect, aggregate, and analyze that data at scale? Let’s start with a quick review of packet capture tools, […]