Dealing with security incidents is always a collaborative process, involving both your constituency and external players. There are a number of tools that help you with detecting (and preventing) incidents. One of those tools is for example the MISP – Malware Information Sharing Platform & Threat Sharing
But once you have an incident … how you deal with it? Everyone has (or should have) written their own incident response procedures but did you know that … Read more.
I recently had to handle a case where a website development company was hacked. This post describes some of my findings during the investigation.
All of the company websites were hosted on one virtual server running Linux. Most of these websites were WordPress powered. The management of the server was done via DirectAdmin, updating of the web files happened via FTP.
The incident was brought to the attention of the company because they received complaints … Read more.
I published an introduction article on exploit kits on the blog at Ipswitch : An Introduction To Exploit Kits
.
The article covers why attackers use exploit kits, how they can select their targets, how users get infected through exploit kits and what you can do to improve your resilience against exploit kits.
I did an earlier post on gathering open source intelligence with SpiderFoot. This post is a small update to incorporate the new version of Spiderfoot that was released recently.
A new version of Spiderfoot was recently released, including some extra modules. In my earlier post I described how I adjusted and added some modules. The new release of Spiderfoot contains part of my changes to the XForce module.
My initial change to Spiderfoot included a … Read more.
I had to brush up my knowledge on the blockchain technology and decided to write a piece about it on the SecurityIntelligence.com website : Will Blockchain Technology Replace Traditional Business Models?
The article contains a short introduction on what the blockchain technology is and how it works. I conclude with some remarks how blockchain technology could remove the middleman (banks, etc.) for financial transactions.
Recently I noticed that some of the MISP notification e-mails ended up in my spam folder. I use Gmail linked to my personal domain.
You might argue that processing MISP mails, potentially containing restricted information, via Gmail is a problem. The MISP notifications however are GPG-encrypted so this limits a potential problem.
Whitelisting e-mails in Gmail is not limited to MISP only but I cover this use-case as it caused me some annoyances.
The first … Read more.
This is a short post, put here as a “reminder to self” on browser caching.
A colleague recently set up an HTTP sinkhole with Apache. The setup redirected all the user requests to one specific resource.
When deploying the sinkhole, the web server logs showed that the first requests where logged with HTTP status code 200 (“OK”). The next requests however were logged with HTTP status code 304 (“Not Modified”).
The HTTP 304 code basically … Read more.
I had a guest post published on Security Training for Incident Handling: What Else Is Out There?.
This post is a follow-up to an earlier post (Security Training for Incident Handlers: What’s Out There?) that points out some alternatives for training for incident handlers.
I had a guest post published on Proper Script Management: A Practical Guide.
The post lists some best practices when developing your scripts and how to measure the performance of your scripts.
I had a guest post published on Using Geolocation Data to Benefit Security.
This post lists how you can enrich your information with geolocation data.
Graphs made with cudeso posts stats
By continuing to use the site, you agree to the use of cookies. more information
An HTTP cookie, is a small piece of text sent from a website and stored in your web browser. Cookies are a reliable mechanism for websites to remember your preferences and improve your browsing experience.
If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.