Charles Herring's blog

Step Away from the PCAP!

Payload Hex

Great investigators know the importance of details but often we go too deep, too quickly. An organized approach to incident response will allow more actionable intelligence to be created in less time.

When DDoS Happens to Good Networks

DDoS Error

What distributed denial of service (DDoS) is and how NetFlow can give situational awareness when it happens to your network.

You Say Solution, I Say Problem

Solution

Vendors and Analysts want to have conversations around products. Organizations want to talk about their business problems. Vendors rename their products "solutions" and Organizations start evaluating the products and forget about their business problems. Here is an open letter to both sides.

Time to Hire a Security Team

Security Venn

An average organization will lose more than $10M to cyber crime this year in detectable losses and much more in un-quantifiable damages as trade secrets, customer data and financial records are stolen without detection. It's time to re-evaluate the need for advanced security teams in organizations that want to stay afloat in an age of rampant, sophisticated corporate espionage from attackers ranging from organized crime to nation-states.

Has APT1 Been Eating My Porridge?

Mandiant APT1 Report

NetFlow when effectively stored makes a great basis for analyzing indicators of compromise (IOC) like those provided in Mandiant's APT1 report.

APT Number One

Mandiant APT1

The systematic problems the Mandiant APT1 report revealed in enterprise surveillance efforts.

Before There Was a Great Wall

Great Wall of China

How the importance of physical surveillance throughout human history teaches us why we are failing at network security and how we can fix it.

Anatomy of an SQL Injection

SQL Injection

What SQL Injection is and how intelligent monitoring of NetFlow can detect and deter it.

Are My Computers for Rent?

Computers for Rent histogram

Using NetFlow to determine if network resources are being sold on the black market.

Day Zero Is How Long??!

We are taking a retarded amount of time to discover unknown (zero day) threats and how we can reduce that window.

Pages

About Charles Herring

Created and maintained by Charles Herring (Fish/F15hb0wn), this site provides an outlet for his ideas cybersecurity. SCUBA and other random musings.

Charles started his career in InfoSec in 2002 as a network security officer within the US Navy. He has labored as a network security product tester for InfoWorld Magazine, led a technology consulting firm, served as Consulting Security Architect for Lancope (now Cisco) and is now the co-Founder and CTO at WitFoo.

Charles spends most of his time working with organizations on maturing the craft of cyber security operations (SECOPS.) Work blogs are found at https://www.witfoo.com/blog.

When not working on cybersecurity, Charles enjoys SCUBA, Alabama football and travel.