Collaborate Disseminate
What are the origins of the names TaoSecurity and the unit formerly known as TAO? IntroductionI’ve been reading Nicole Perlroth’s new book This Is How They Tell Me the World Ends. Her discussion of the group formerly known as Tailored Access… Continue reading The Origins of the Names TaoSecurity and the Unit Formerly Known as TAO
There’s a good chance that if you’re reading this post, you’re the member of an exclusive club. I call it the security one percent, or the security 1% or #securityonepercent on Twitter. This is shorthand for the assortment of people and organizations w… Continue reading Security and the One Percent: A Thought Exercise in Estimation and Consequences
Just what are “tactics”?IntroductionMITRE ATT&CK is a great resource, but something about it has bothered me since I first heard about it several years ago. It’s a minor point, but I wanted to document it in case it confuses anyone else.The MI… Continue reading MITRE ATT&CK Tactics Are Not Tactics
The FBI intrusion notification program is one of the most important developments in cyber security during the last 15 years. This program achieved mainstream recognition on 24 March 2014 when Ellen Nakashima reported on it for the Washington Post … Continue reading The FBI Intrusion Notification Program
CVE-2020-0688 Scan Results, per Rapid7tl;dr — it’s the title of the post: “If You Can’t Patch Your Email Server, You Should Not Be Running It.”I read a disturbing story today with the following news:”Starting March 24, Rapid7 used its Project Sonar in… Continue reading If You Can’t Patch Your Email Server, You Should Not Be Running It
I saw my like-minded, friend-that-I’ve-never-met Andrew Thompson Tweet a poll, posted above.I was about to reply with the following Tweet:”If I’m struggling to figure out how to capture a thought in just 1 Tweet, that’s a sign that a blog post might be… Continue reading When You Should Blog and When You Should Tweet
Malware Jake Tweeted a poll last night which asked the following:”I have an interesting ethical quandary. Is it ethically okay to use COVID-19 themed phishing emails for assessments and user awareness training right now? Please read the thread before r… Continue reading COVID-19 Phishing Tests: WRONG
This is the sort of story that starts as a comment on Twitter, then becomes a blog post when I realize I can’t fit all the ideas into one or two Tweets. (You know how much I hate Tweet threads, and how I encourage everyone to capture deep thoughts in b… Continue reading Seven Security Strategies, Summarized
I started publishing my thoughts and findings on digital security in 1999. I used to provide this information on my Web site, but since I don’t keep that page up-to-date anymore, I decided to publish it here.2015 and later: Please visit Academia.edu f… Continue reading Reference: TaoSecurity Research
I started speaking publicly about digital security in 2000. I used to provide this information on my Web site, but since I don’t keep that page up-to-date anymore, I decided to publish it here.2017 Mr. Bejtlich led a podcast titled Threat Hunt… Continue reading Reference: TaoSecurity News