APT Number One
Charles Herring
21 February 2013
The systematic problems the Mandiant APT1 report revealed in enterprise surveillance efforts.
Step Away from the PCAP!
Charles Herring
Great investigators know the importance of details but often we go too deep, too quickly. An organized approach to incident response will allow more actionable intelligence to be created in less time.
When DDoS Happens to Good Networks
Charles Herring
What distributed denial of service (DDoS) is and how NetFlow can give situational awareness when it happens to your network.
You Say Solution, I Say Problem
Charles Herring
Vendors and Analysts want to have conversations around products. Organizations want to talk about their business problems. Vendors rename their products "solutions" and Organizations start evaluating the products and forget about their business problems. Here is an open letter to both sides.
Time to Hire a Security Team
Charles Herring
An average organization will lose more than $10M to cyber crime this year in detectable losses and much more in un-quantifiable damages as trade secrets, customer data and financial records are stolen without detection. It's time to re-evaluate the need for advanced security teams in organizations that want to stay afloat in an age of rampant, sophisticated corporate espionage from attackers ranging from organized crime to nation-states.
Has APT1 Been Eating My Porridge?
Charles Herring
NetFlow when effectively stored makes a great basis for analyzing indicators of compromise (IOC) like those provided in Mandiant's APT1 report.
Before There Was a Great Wall
Charles Herring
23 January 2013
How the importance of physical surveillance throughout human history teaches us why we are failing at network security and how we can fix it.
Anatomy of an SQL Injection
Charles Herring
19 November 2012
What SQL Injection is and how intelligent monitoring of NetFlow can detect and deter it.
Are My Computers for Rent?
Charles Herring
7 November 2012
Using NetFlow to determine if network resources are being sold on the black market.
Day Zero Is How Long??!
Charles Herring
18 October 2012
We are taking a retarded amount of time to discover unknown (zero day) threats and how we can reduce that window.
Network Security School of Ft. Knox
Charles Herring
Summary of the "Network Security School of Ft. Knox" series I penned and the webinar accompanying it.
Network Security School of Fort Knox: Part 6
Charles Herring
14 September 2012
The last installment explains the importance of knowing what to do when a breach is detected.
Network Security School of Fort Knox: Part 5
Charles Herring
5 September 2012
InfoSec attackers are not created equal. They range from punk kids to nation states. It's important to know who is coming after your protected assets.
Keeping a Windows Laptop Healthy for $0
Charles Herring
Some easy and free steps to keeping a Windows laptop free of viruses and other nasties.
Network Security School of Fort Knox: Part 4
Charles Herring
30 August 2012
Figuring out what data sources are best suited for pervasive network surviellance can be tricky. In this fifth installment, we look at the pros and cons of packet capture and NetFlow.
Network Security School of Fort Knox: Part 3
Charles Herring
28 August 2012
Not all types of cyber attacks are the same. In this third installment we look at different exploit types and their delivered payloads.
Securing Websites
Charles Herring
25 August 2012
Some steps that can be taken to make your web site a tougher target for hackers to exploit and use against your visitors.
Network Security School of Fort Knox: Part 2
Charles Herring
23 August 2012
In this second installment we look at the difference between signature and behavioral detection schools.
Network Security School of Fort Knox
Charles Herring
20 August 2012
The beginning of a six part series on how to approach network security. This installment covers the importance of perimeter defense.
Read this Blog and Get a Virus (Statistically Speaking)
Charles Herring
18 August 2012
Pornographic and piracy sites are no longer the haven for malware they once were. You might be surprised to learn that blogs (like this one) are where you are most likely to get infected.
Why People Make Viruses
Charles Herring
17 August 2012
Offense as Defense
Charles Herring
When rules restrain retaliation against inappropriate behavior lesser men are able to gain an advantage over greater men. I retell a story of how I tormented an honorable Marine that was ham-stringed by regulation and how the lessons I learned that night in a New Orleans bar can teach us something on when we should strike back against cybercriminals and state sponsored attacks.The Pentagon is currently seeking permission to strike against attackers and I explain why I support the proposal.
Password Day
Charles Herring
Subscribe to Newest Content
Password Day comes but twice a year and this year I've added a couple of new traditions to the celebration. I've crumbled and started using password management and am giving SMS authentication a whirl.
