Collaborate Disseminate
On October 4, 2018, Bloomberg published a story titled “The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies,” with a subtitle “The attack by Chinese spies reached almost 30 U.S. companies, including Amazon and Apple, by compromising A… Continue reading Network Security Monitoring vs Supply Chain Backdoors
I was looking for resources on campus network design and found these slides (pdf) from a 2011 Network Startup Resource Center presentation. These two caught my attention:This bothered me, so I Tweeted about it.This started some discussion, and pro… Continue reading Firewalls and the Need for Speed
I am really fired up to join Corelight. I’ve had to keep my involvement with the team a secret since officially starting on July 20th. Why was I so excited about this company? Let me step backwards to help explain my present situation, and forecast the… Continue reading Twenty Years of Network Security Monitoring: From the AFCERT to Corelight
All of our previous workshop and presentation slides and materials are available in one location, from Google Drive.
From now on, we are only going to keep the latest-greatest version of each talk/workshop and announce changes on Twitter.
The pos… Continue reading Workshop and Presentation Slides and Materials
Within the last week, Doug Burks of Security Onion (SO) added a new script that revolutionizes the use case for his amazing open source network security monitoring platform.I have always used SO in a live production mode, meaning I deploy a SO sen… Continue reading Importing Pcap into Security Onion
My TaoSecurity News page says I taught 41 classes lasting a day or more, from 2002 to 2014. All of these involved some aspect of network security monitoring (NSM). Many times students would ask me when I would create the “advanced” version of the class… Continue reading On "Advanced" Network Security Monitoring
Thursday evening Mrs B and I were pleased to attend an awards seminar for the Cybersecurity Canon. This is a project sponsored by Palo Alto Networks and led by Rick Howard. The goal is “identify a list of must-read books for all cybersecurity practitio… Continue reading Latest Book Inducted into Cybersecurity Canon
Dripcap is a modern, graphical packet analyzer based on Electron. Electron, you say? “Electron is a framework for creating native applications with web technologies like JavaScript, HTML, and CSS. It takes care of the hard parts so you can focus on the… Continue reading Toolsmith #124: Dripcap – Caffeinated Packet Analyzer
In continuation of observations from my GIAC Security Expert re-certification process, I’ll focus here on a GCIA-centric topic: Scapy. Scapy is essential to the packet analyst skill set on so many levels. For your convenience, the Packetrix VM comes pr… Continue reading Toolsmith – GSE Edition: Scapy vs CozyDuke
In continuation of observations from my GIAC Security Expert re-certification process, I’ll focus here on a GCIA-centric topic: Scapy. Scapy is essential to the packet analyst skill set on so many levels. For your convenience, the Packetrix VM comes pr… Continue reading Toolsmith – GSE Edition: Scapy vs CozyDuke