 |
| One team. |
Earlier this week I had referred a friend to my own work about understanding
how timestamps in packets work and various command line options for working with them. I had also admired the length, ingenuity, and clarity of a recent post by my friend Carrie about
cracking passwords with special characters. Those moments were inspiring enough that I knew it was finally time to share something more than a
tweet's length about what I'd been up to for the last months. So in tribute to my no frills blog title "Computer Forensics blog - Searching to find what's really going on...," here is "what's been going on." The goal is just to briefly shout-out some projects I've been working on, and introduce several upcoming diaries that I've drafted over this past year and will share soon.
I'm focusing professionally at the moment on the relationship between "advanced defense" strategies (the first couple that come to mind would be
threat-hunting and
deception tactics) and live detection and response. How far should we take
defense-in-depth at the expense of having overlapping
signatures? How can we decrease detection times? In an
up-coming post later this week, you'll see that when
Peter Kim (innovative red-teamer and author of
The Hacker Playbook series of books) came live onto our
Brakeing Down Security [sic] Book Club call for an interview and discussion, he said that an ideal maximum detection time for blue-teamers would be somewhere around 4 minutes for an initial access or specific action of an adversary. Beyond that a skilled technician would be long gone, pivoted on to the next box, or gone forever, tracks-covered and all.
Speaking of threat-hunting, I had the opportunity to volunteer a few weeks ago at the Sans
Threat-Hunting and Incidence Response Summit in New Orleans, which was a really intense experience. I worked at the summit, made a lot of new friends, and as well helped-out with
Matt Bromiley's FOR508 class, which I had never attended before; and as well there my team won the FOR508 Challenge Coin, which was a very powerful experience because of the huge amount of competition in the room. We found a lot of forensic data early on in the event, but kept working hard and fast until the very last minute of the challenge. A lot of our success was due to the experienced forensicators on our team, but none of us would have won alone. So much more could be said about team-work, diligence, and humility! Although there was no
hidden message to decrypt though on the coin, like on my SEC503 coin. You should expect to read a few reports from me eventually about things I've learned at the summit.
I relocated my whole family in the past year, all the way from Berlin (you may have noticed the "Molecule Man" sculpture staring cameo in some of my
past posts) back to the USA, because of an amazing work opportunity. As you can imagine this has brought also a lot of excitement to our lives, so the past year was heavily focused on family as well.
I do still have interest in OSX (and unix in general), as well as the (
gentoo-based) ChromeOS platform, which with the beta "
Linux mode" is arguably the first affordable,
ready-to-go Linux laptop anyone around the world can grab for even less than $100. The up-coming post I mentioned above with Peter Kim will launch the publication of a
co-author/guest-series of blogs which I've worked on over the past year, but never published. There will be another post co-authored by a special guest, about using Linux on ChromeOS. There have also been a couple of other topics I've researched, for example the evolution of the packet filtering on OSX, which I found so much public information readily available on, that I don't need to blog about, but I'd love to share some of my favorite other-folks'-work on it soon. I've been also generally supporting the efforts of
Mental Health Hackers.
Hudson Harris gave a great, related talk at
Sp4rkCon By the Bay last week--including a section about procrastination and anxiety--which was targeted at security professionals.
I started up a
Lean-In Circle at work, called the
InfoSec Book Club. It's open to everyone, but the mission is to help
fight anything that remains of gender-bias in InfoSec. This is based on the BrakeSec Book club, which I co-lead with
David Cybuck. We're about to finish up Attacking Network Protocols there (we also just finished also an awesome "Summer Reading Series" led my David, including some author interviews, it was amazing to get to know Mastermind author
Evan Ratliff as well). I've enjoyed contributing to the
Atomic Red Team Project with several friends, thanks again to
Carrie Roberts to introducing me to this project. It's been cool to also meet a few members of the Red Canary team, such great folks. I continue to remain active in the
DShield/Internet Storm Center community and manage some
honeypots. My goal this year for this blog is actually to migrate slowly out of these guest posts and catch-ups, and over the next year or so
release more diaries about threat-hunting and other forensic investigations, getting back to the roots of why I started blogging. Additionally I've recently been trying to spread the word about Roberto and Jose Rodriguez's new efforts on building a community around their
awesome open-source tools: many of which are now collected in a single place,
The Hunters' Forge; I met them at the summit a few weeks ago, and I'm excited to see where that goes.
I'm gearing-up to take the
GCFA and another test over the next weeks, so that is my very short-term focus, and of course, adjusting to the season and the holidays with my family. Contact me
on Twitter or leave a comment below if any of this has given you an idea or inspiration in any way, or if you're working on any of the same topics. I look forward to learning with you, as well.
