News flash – IP addresses aren’t computers

Crazy thought I know but it isn’t hard not to get caught up in that mentality. I was trying to think of a way to tell the story of resources/logs needed to be able to be able to identify sources of badness in incident response of one flavor or another. Visually I was drawing that out somewhat like IP ~ Computer Name ~ User Name all at the top level and branching under that you have various logs like DNS, DHCP, asset management, authentication, etc. All of which play a part in being able to answer questions related to what computers are infected and which users are doing ‘bad things.’ Anyway, it wasn’t until I put that down on the whiteboard that the thought hit me in that IP addresses are a supporting factor in identifying a particular computer and not equal to it. Funny what tool limitations will do to your thinking.

If none of that makes sense to anyone other than me I blame the Nyquil.

The unrecognized APT story....

2 hobbits sneaking into Mordor.


Somehow I don't see me using that analogy in the executive boardroom though.

What's in a name?.....Strategy

Follow me for a moment on a random thought. If vision begets strategy and strategy begets roadmaps and on down we go; wouldn’t common language and labels be a byproduct of that activity? If that is true, would it be somewhat safe to say if you don’t have common language and labels for groups or efforts it indicates a breakdown further up the chain?

The trick is identifying where the chain is broken....and fixing it.

International Conference on Cyber Security 2012 and "hunters"

Overall impression….meh. It was decent for a first year conference. Oh wait this is its 3rd. That there was a Cyber Security Tutorial before the first actual day of the conference should have been a little telling. Presenters were also only given 30 minutes so not much ability to dive deeply. I think there was more of a focus on law enforcement cyber concepts and general cyber research than anything else which absolutely has a place…..but not for where I am and what I’m doing. If it required a clearance it would probably be a conference I’d like to have happen twice a year given the areas the speakers came from. Ah well. I also hate to knock presenters as on some level it takes some stones to stand up before folks and speak. At one point I did see someone take their iPad, take a picture of one of the presenters as they droned on and on and used some movie special effects app to blow them up. Indeed sir, indeed.

One thing I did find myself thinking about at the airport was the idea of a Cyber Warfighter

Oh the pain of marketing material

Ok I can’t resist. I tried but I can’t. Let’s just get it out of the way that I’m a big ArcSight fanboi. Does it have it’s faults, bugs, and places that could use some TLC work/rework?; you bet. What software doesn’t though? Is it a powerful platform that can act as a force multiplier when it comes to your InfoSec program?; absolutely! Does it do stuff natively that other products haven’t even thought of?; only in ways I didn’t fully realize until using other products that leave me scratching my head in wonderment. Would I like to work at ArcSight if the right position came up that didn’t require a ton of travel?; yup. Might this post kill that chance?; doh – maybe.


So I’m reading the July/August Information Security magazine (pdf link) and I come across a full page ArcSight ad with a line that reads “Finely tuned to combat cybertheft and cyberfraud, the ArcSight ETRM (Enterprise Threat and Risk Management Platform) gives you better visibility of real-time events and better context for risk assessment, resulting in reduced response time and costs.”