Tracking users with privileged access is a critical task in your security policy (SANS Critical Security Control #12). If the key point is to restrict the number of “power users” to the lowest, it’s not always easy. Most of them will argue that they need administrator rights “to be able to
Good IOC VS. Bad IOC: When Automation Fails…
A few days ago, I wrote a diary on the SANS ISC website about automating the search for IOC’s (“Indicator of Compromise“). The use of tools to collect such information (IP addresses, domains, hashes, …) is very useful to build a list of interesting IOC’s … or not! Today, I wrote another diary
Hack.lu Is Coming…
The next edition of the hack.lu conference is coming soon! In approximatively one month, many infosec professionals will join Luxembourg to attend this event and I’ll also be there! I’m attending Hack.lu since 2008 and it remains one of my preferred event. What can we expect from the 2015 edition?
How to Kick-Out the Bad Guy?
A quick blog post about an issue I faced this morning. While drinking my morning coffee and reviewing what happened during the last night in my logs, I detected that one of my website (leakedin.com) was entirely mirrored by a guy from Brazil. I’m not against sharing information but in this case,
Sending Windows Event Logs to Logstash
This topic is not brand new, there exists plenty of solutions to forward Windows event logs to Logstash (OSSEC, Snare or NXlog amongst many others). They perform a decent job to collect events on running systems but they need to deploy extra piece of software on the target operating systems. For a specific
Integrating VirusTotal within ELK
[This blogpost has also been published as a guest diary on isc.sans.org] Visualisation is a key when you need to keep control of what’s happening on networks which carry daily tons of malicious files. virustotal.com is a key player in fighting malwares on a daily basis. Not only, you can submit
The Rough Life of Defenders VS. Attackers
Yesterday, It was the first time that I heard the expression “Social Engineering” in Belgian public media! If this topic came in the news, you can imagine that something weird (or juicy from a journalist perspective) happened. The Flemish administration had the good idea to test the resistance of their 15K officials
Don’t (always) blame the user!
Often, as security professionals, we tend to blame our users. Not all people are security aware and take the right decision when facing a potential security issue. Yes, we know: they click, they open, they answer questions, they trust, …
$HOME Sweet $HOME
Yesterday, I talked at RMLL (“Rencontres Mondiales du Logiciel Libre“) or LSM in English (“Libre Sofware Meeting“) held in Beauvais, France. The presentation title was “$HOME Sweet $HOME” and covered the security of our home networks regarding the invasion of connected gadgets also known as the Internet of Things. I gave
BSidesLisbon 2015 Wrap-Up
Here is a quick wrap-up about the just-ended BSidesLisbon event. This is the second edition of this BSides event organized in Portugal. The philosophy of those events is well known: organized by and for the community, free, open and creating a lot of opportunities to meet peers. A classic but