Cybersecurity – Training your staff.
In cybersecurity, training staff is of paramount importance. There are a lot of ways so do this and some are better than others. In this article we look at how you can find the path that works best for you.
Reflective Code Injection Attacks – An Overview for Incident Responders
Reflective code injection lets attackers execute code directly in process memory, leaving minimal file-system traces. This overview explains the technique on Windows and Linux, then covers detection methods for incident responders: VAD tree inspection, /proc analysis, RWX memory anomalies, suspicious system calls, and tools such as MemProcFS, Volatility and YARA.
PICERL - Common incident response process / framework
Incident Response Phases – Lessons Learned
Lessons Learned is the final phase of the incident response cycle. This is where you identify the root cause of the incident and any problems or issues you faced with the response. Your findings should always feed back into the planning phase. This keeps the cycle working and improving.
PICERL - Common incident response process / framework
Incident Response Phases – Recovery
Recovery is the fifth phase of the incident response cycle. This is the time to bring your services back online and restore normal business operations. Just make sure you do it in a secure manner.
PICERL - Common incident response process / framework
Incident Response Phases – Eradication
Eradication is the fourth phase of the incident response cycle. This is the implementation of more permanent measures to get the attacker out of the network and keep them out.
PICERL - Common incident response process / framework
Incident Response Phases – Containment
Containment is the third phase of the IR Cycle. You investigate what happened and implement measures to stop the attack spreading or doing more harm than you are prepared to accept.
PICERL - Common incident response process / framework
Incident Response Phases – Identification
Identification is the second phase of the IR Cycle. This is where you determine if an incident has happened, what type of incident and how important it is to your business.
PICERL - Common incident response process / framework
Incident Response Phases – Preparation
Preparation is the first phase of the IR Cycle. Doing well here is the difference between good incident response and dealing with a breach or crisis.
PICERL - Common incident response process / framework
Incident Response – Process Matters
Breaches are pretty much inevitable. Having good incident response processes can be the difference between it being painful and it being catastrophic to your organisation.
Memory analysis supports incident response in ways people never consider
Memory analysis in incident response – never leave home without it
Incident response is often a stressful, high-pressure situation. Responders are desperately trying to claw together information. All around them the world is collapsing. Furthermore, everything important seems to be deleted…
Checklists support your memory.
Checklist or your memory, is one better?
No matter how much expert knowledge you have, how good you think your memory is, using a checklist is simply good security practice.
Threat Hunting - Do it right
Threat Hunting – essential for every business
Lots of articles, blog posts and webcasts talk about threat hunting. Despite this few, if any, organisations do it. This is a mistake. Security hit the headlines again recently, when…