Collaborate Disseminate
I started appearing in media reports in 2000. I used to provide this information on my Web site, but since I don’t keep that page up-to-date anymore, I decided to publish it here. As of 2017, Mr. Bejtlich generally declines press inquiries on cybersec… Continue reading Reference: TaoSecurity Press
At the end of the 1973 Clint Eastwood movie Magnum Force, after Dirty Harry watches his corrupt police captain explode in a car, he says “a man’s got to know his limitations.”I thought of this quote today as the debate rages about compromising municipa… Continue reading Know Your Limitations
Recently I’ve been reading about cloud security and security with respect to DevOps. I’ll say more about the excellent book I’m reading, but I had a moment of déjà vu during one section.The book described how cloud security is a big change from enterpr… Continue reading Thoughts on Cloud Security
Jack Crook pointed me toward a story by Christopher Burgess about intellectual property theft by “Hongjin Tan, a 35 year old Chinese national and U.S. legal permanent resident… [who] was arrested on December 20 and charged with theft o… Continue reading Forcing the Adversary to Pursue Insider Theft
In this post I would like to share a few thoughts on self-publishing a book, in case anyone is considering that option.As I mentioned in my post on burnout, one of my goals was to publish a book on a subject other than cyber security. A friend fro… Continue reading Notes on Self-Publishing a Book
This is not strictly an information security post, but the topic likely affects a decent proportion of my readership.Within the last few years I experienced a profound professional “burnout.” I’ve privately mentioned this to colleagues in the industry,… Continue reading Managing Burnout
While listening to a webcast this morning, I heard the speaker mentionThere are two types of companies: those who have been hacked, and those who don’t yet know they have been hacked.He credited Cisco CEO John Chambers but didn’t provide any source.Tha… Continue reading The Origin of the Quote "There Are Two Types of Companies"
I am an historian. I practice digital security, but I earned a bachelor’s of science degree in history from the United States Air Force Academy. (1)Historians create products by analyzing artifacts, among which the most significant is the written word…. Continue reading The Origin of the Term Indicators of Compromise (IOCs)
In response to my post More on Threat Hunting, Rob Lee asked:[D]o you consider detection through ID’ing/“matching” TTPs not hunting?To answer this question, we must begin by clarifying “TTPs.” Most readers know TTPs to mean tactics, techniques and proc… Continue reading Even More on Threat Hunting
Earlier this week hellor00t asked via Twitter:Where would you place your security researchers/hunt team?I replied:For me, “hunt” is just a form of detection. I don’t see the need to build a “hunt” team. IR teams detect intruders using two major modes: … Continue reading More on Threat Hunting