Raiders of the Lost ARP

Amateur Security Archaeologists, trying not to break things.

Tag: Defensive Security (Page 2 of 4)

AI-generated image of a hacker in an aloha shirt trying like crazy to put together a very complex puzzle of all of MITRE ATT&CK's related projects.
MITRE sent me an easy puzzle, but the community blew up the piece count!

Power-up your security: Mapping ATT&CK’s massive ecosystem

January 14, 2024 /

If you are a security professional, MITRE’s ATT&CK is everywhere these days. Even in places it does not belong! That being said, there are a ton of tools, projects, and extensions to ATT&CK. Some are fundamental (like Navigator) while others are niche. How do we tell what is right for us? What projects are essential to power up your security program? For my upcoming Cisco Live presentation in February, I take a crack at mapping ATT&CK’s massive ecosystem to roles and functions. Am I off to a good start? Let’s me share how I tackled this and you can let me know!

Continue reading
AI-generated image of a hacker in a hoodie playing an upright bass
Something about that bass-player's groove was just off...

Friend or foe? How killer baselines improve security outcomes

January 8, 2024 /

A month ago, we talked about how visibility can make us more frustrating victims to our adversaries. It makes sense – easy marks are those who don’t see that they are victims in the first place! Take victims of physical (traditional) crime. Burglers love a target who isn’t using alarm systems, cameras, or even their own eyes and ears to actively detect incursions. But having eyes and ears isn’t what makes you formidable. It is that you have those sensory inputs AND you know how to interpret what they are saying and how they respond. Do you know how to discern bad behavior from the norm and know how to tell between friend and foe? And do you know what the right response is based on that proper interpretation? We’re going to tackle the first question here today as we discuss how killer baselines improve security outcomes.

Continue reading
AI generated art of a valiant defender holding off a massive adversary at the gates.
Not for nothing, but you aren't sneaking up on anyone with that bright, clanking armor!

How visibility makes you the most frustrating victim

December 10, 2023 /

Who hasn’t hear this one: “the attacker only need to be right once, and they are a success”. Indeed, the corollary is said just as often: “you only need to be wrong once and you’re screwed!” All of that makes you feel a little helpless, right? Helpless folks give up – and good luck getting them to deal with the myriad of issues that are inherent to securing their environments! We’re going to see how we can turn the tables here, and the first step is to see how visibility makes you a most frustrating victim for adversaries!

Continue reading

Worry less and know your enemy with MITRE ATT&CK!

November 5, 2023 /
AI depiction of barbarians waiting at the fiery gates of something ominous
Our last penetration test was a little too obvious – maybe we should specify “don’t burn it all down”?

If you’ve known me for a while, you know I love talking about MITRE’s ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge). I probably have an unhealthy addiction to discussing it, but I do think it is helpful to understand why it is both cool and has limits. So let’s discuss!

Continue reading

Don’t worry, AppDev can Threat Model like a champ!

November 2, 2023 /
A bunch of WASPs trying to penetrate a laptop's screen because they are after the web application
What some call a penetration test, others call a bug scrub…

If you are landing here after reading earlier posts, you might be thinking “this is great, but what I REALLY need is to avoid being the next <insert bad breach company here>. Well, our friends at OWASP (Open Web Application Security Project) are an organization that focuses on improving the security of software. Like any good David Letterman fan, they are famous for their Top 10 list of web application threats, and have followed that up with an API version! Threat modeling for software applications are essential not only to the end customers, but with the sheer complexity of today’s typical environments, the legal ramifications of a breach or attack can spell disaster for the hosting company, the software vendor, business partners, ecosystem partners, and the end users alike. It should be no surprise then that OWASP has its own approach to application threat modeling.

Continue reading
« Older posts Newer posts »

© 2025 Raiders of the Lost ARP

Theme by Anders Noren — Up ↑

Verified by MonsterInsights