Collaborate Disseminate
During my time in the industry, I’ve authored 9 books under three imprints, and co-authored a tenth.There, I said it. The first step in addressing a problem is admitting you have one. ;-)Seriously, though, this is simply to say that I have some experie… Continue reading On Writing DFIR Books, pt I
There’s been a lot of discussion on social media around how to “break into” the cybersecurity field, not only for folks just starting out but also for those looking for a career change. This is not unusual, given what we’ve seen in the public news medi… Continue reading Building a Career in CyberSecurity
Over the years as a DFIR analyst…first doing digital forensics analysis, and then incorporating that analysis as a component of IR activity…there have been some stunningly simple truths that I’ve learned, truths that I thought I’d share. Many of th… Continue reading Tips for DFIR Analysts
Okay, I think that we can all admit that ransomware has consumed the news cycle of late, thanks to high visibility attacks such as Colonial Pipeline and JBS. Interestingly enough, there wasn’t this sort of reaction the second time the City of Baltimore… Continue reading What We Know About The Ransomware Economy
I was reading this Splunk blog post recently, and I have to say up front, I was disappointed by the fact that the promise of the title (i.e., “Detecting Cl0p Ransomware”) was not delivered on by the remaining content of the post. Very early on in the b… Continue reading Thoughts on Assessing Threat Actor Intent & Sophistication
As most regular readers of this blog can tell you, I’m a bit of a fan of LNK files…a LNK-o-phile, if you will. I’m not only fascinated by the richness of the structure, but as I began writing a parser for LNK files, I began too see some interes… Continue reading Toolmarks: LNK Files in the news again
One of Shakespeare’s lines from Hamlet I remember from high school is, “…there are more things on heaven and earth, Horatio, than are dreamt of in your philosophy.” And that’s one of the great things about the #DFIR industry…there’s always somethin… Continue reading Testing, and taking DFIR a step further
One of Shakespeare’s lines from Hamlet I remember from high school is, “…there are more things on heaven and earth, Horatio, than are dreamt of in your philosophy.” And that’s one of the great things about the #DFIR industry…there’s always somethin… Continue reading Testing, and taking DFIR a step further
TL;DR: People keep questioning SIEM value, but cloud SIEM makes SIEM so much better. SIEM is now capable of delivering a lot of security value with far less effort from security teams.
The SIEM market is a US$5B market with a two-digit annual growth r… Continue reading The Bright Future of Cloud SIEM
In my previous post, I presented some of the basic design elements for a structured approach to describing artifact constellations, and leveraging them to further DFIR analysis. As much of this is new, I’m sure that this all sounds like a lot of … Continue reading On #DFIR Analysis, pt III – Benefits of a Structured Model