Collaborate Disseminate
While creating a recent presentation, I needed a slide on “threat detection is hard.” And it got me thinking, why is threat detection so hard for so many organizations today? We can trace the “cyber” threat detection to 1986 (“Cuckoo’s Egg”) and 1987 (… Continue reading Why is Threat Detection Hard?
I am cross-posting this question from Serverfault, because I am in doubt where it fits best.
Say I have a server set up for processing sensitive data. The few authorised users of the system are instructed not to copy any of the sensitive d… Continue reading Is it possible to ensure detection and logging of all attempts to copy data out of a system?
A lot of people ask me how Chronicle is doing inside Google Cloud (TLDR: doing well), and I wanted to share some good news. I also wanted to reveal some of our lessons building our threat detection capabilities (that we just released).
If you recall, w… Continue reading Chronicle Detect is Here
One more idea that has been bugging me for years is an idea of “detection as code.” Why is it bugging me and why should anybody else care?
First, is “detection as code” just a glamorous term for what you did when you loaded your Snort rules in cvs in, … Continue reading Can We Have “Detection as Code”?
There have been quite a lot of data breaches in the past and I wonder how the companies got to know them. Were they only finding it in the news? Did individuals inform them?
What about small data breaches, e.g. if you have a user who has a… Continue reading Are there services to detect data breaches?
As if they don’t already face enough challenges from bleaching, many of the world’s coral reefs are currently being eaten by the crown-of-thorns starfish. A simple new portable test kit, however, could detect their presence sooner than ever before.Cont… Continue reading Portable test kit quickly detects coral-eating starfish on reefs
I want to create reputation based detection system. For example I want to check Url addresses reputation. If reputation low, It should create an alarm.
I found this blog post close to what I want. (Reputation Based Detection with Python)
D… Continue reading How can I create reputation based detection system? [closed]
I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, we should detect attacks and prevent or… Continue reading Insider threats vs. insider attacks
Let’s imagine a data link layer level MITM attack. Is it possible to fulfill all of the following points?
you completely hide your identity by forging your own MAC address
you create malformed packets, so the router doesn’t even know you … Continue reading Is the perfect MITM attack possible?
I recently found that comment by a user on Stack Overflow, which got my interest:
Don’t use AV, it only makes it easier to actually get viruses.
Source: here
After the evidence request by another user for doing such statements, he actual… Continue reading Is having anti-virus software more dangerous than not having it? [duplicate]