The moment I graduated from school and received my diploma in accountancy, I received a job offer to start as a junior system and network administrator. Simultaneously I got introduced to the world of cybersecurity. However, back then things were not as complicated as they are today. Like any other…

A team within your security department is frequently running vulnerability scans. The results are being picked up by the resolver teams. Therefore, you think you don’t have the conduct penetration tests. Wrong. A vulnerability scan will only discover a vulnerability if there is a signature defined. If there are no signatures defined for a product, it does not mean the product is secure. And this is where penetration tests come into the picture. A penetration test is most of the time focused on those areas where the vulnerability scanning solution doesn’t work.

Every Security Operation Center depends upon the SIEM solution’s detection capabilities. But it is based upon an antiquated principle. The same antiquated principle is why the traditional antimalware solutions have failed — signature-based detection. The industry knows this and they responded by adding machine learning capabilities to the SIEM platform. On top of the antiquated base. And those machine learning capabilities sometimes also follow the principles. Do they really want you to fail and become a victim of a major security incident?

IDS/IPS are great but they only generate events when captured traffic matches a configured rule. And therefore valuable data is lost. META data. Every time you use an application; the underlying protocol is generous with META data. Agent strings, Source and Destination IP addresses, etc., etc. But how can you harvest this valuable data? One answer is to implement the Zeek software. Let’s dive into this.

Some security incidents end up in court. But when you claim something in Court, you need to prove beyond doubt something has happened and the other party caused the damages. In other words, the non-repudiation check. This may sound simple, but is it really simple? Let’s explore this topic and examine some of the things you need to be aware of. — Point of origin where event/flow data is generated When a flow or event data is generated, how certain are you that the data is correctly generated? And how certain are you that the generated data is not altered between the point of origin and the centralized security solution?

Dealing with security incidents is not something that only the security department should be focused on. It is a combined effort of multiple teams and departments. But the issue is that not every team/department is constantly involved in a security incident. Each category of security incidents most likely has its own run/playbook and therefore most likely different teams are involved. But how can you ensure everybody recalls what to do when a major security incident occurs? Running a periodic tabletop exercise is one way of resolving this.

Suricata is a Network Intrusion Detection/Protection System. IDS/IPS for short. When performing research having visibility of the network traffic can be extremely valuable. Therefore, what does it take to install such a solution on a Debian host? — In my lab environment, I created a virtual machine called ‘NetworkMonitor’. I will be using this machine to analyze all network traffic of my virtual network and my host computer. I downloaded the network installer ISO file from debian.org and attached it to my virtual machine to install the Debian…

As we are getting closer to the summer holiday season, we recognize most employees will be traveling and some do take their office equipment with them along the journey. But also employees can be traveling for business reasons. But once an employee is traveling, the device (smartphone, laptop) is outside the corporate network. How can you keep these devices secure? And how do you know it is safe to reconnect a device to the corporate network after the user has returned from traveling?

People will frequently think when they hear the word security incident, about incident response. And that is accurate. And while many incident response plans undoubtedly provide guidance on what to do when why and sometimes also how, they often overlook a really critical element. Where and how to store the data, you are collecting during a security incident? Yes, I am talking about security incident case management.