The computers on your network are protected from malware right? If you are
operating an environment based largely on Windows based PCs you likely have
some kind of anti-virus installed and centrally managed. If you have
purchased a more complete desktop protection suite, you probably even have a
Host Based IDS/IPS protecting your machine from incoming malicious TCP scans,
or possible outbound connections to known malicious sites (like google.com
occasionally). Operating system firewall activated? Yep! AV signatures
current? Check! Global Threat Intelligence updated? Uh, yeah....sure. Then
you should be covered against threats targeting your organization, right?
Most likely not, and at times these tools actually mask intrusions as they
provide a false sense of security and protection.
The Trouble with Reactionary Behavior
The problem with these tools, all of them, is ... (more)
In almost all professions, report writing is a requirement. Typically,
reports document the success and failures of a particular action. While it
may not be your favorite part of the job, report writing does validate your
work to the customer. In our profession, Cyber Security, we have the unique
challenge of communicating highly technical information in a non-technical
format, so that the impact of our efforts can be understood.
Early in my career I hated writing reports. Back then, I had a hard time
understanding why reports were so important. Little did I know that the
When I was working on a network assessment team for one of my customers, I
would routinely hear upset voices when we would present our findings. The
most common thing that the executives would say was, “Wait a minute,
aren’t we current on our updates? I saw the compliance report, and we were
all green right?”
“All green right?”
What that Information Security Officer was referring to was a slide that was
presented to him showing the level of compliance that the hosts on his
network were currently reporting. To him, this meant secure. It meant that
all of his systems were patche... (more)
To some of us, seeing an email with malware embedded in a PDF, Word or Excel
attachment is common. In fact, it has become the new norm for malware
delivery to use file types that are not obviously malicious (versus something
like a .exe). Gone are the days of wide-open acceptance of all file
extensions for attachments within an email. In today's network
defense-in-depth techniques, one of the layers is naturally email security.
This includes the scrutinizing of emails for embedded links or attachments
that could be potentially malicious, scanning attachments for possible
Malware analysis can be a time consuming process, especially when dealing
with a sample from skilled attackers with time and money on their side .
There is no doubt that fully reversing malware and finding out how it works
is the most effective way to learn how to defend against it, but most
businesses don't have the time or the professional resources to do it.
There are ways in which you, a Computer Network Defender, can glean enough
information from malware to be used in IDS and AV signature creation, DNS
poisoning and blocking as well as sharing with the CND community. This can... (more)