2007–2026
1,381 posts
2026 5
July 2026
- FreeBSD Released the Most Security Advisories in Project History in June 2026
- I Wrote a New Book for Corelight
June 2026
March 2026
January 2026
2025 8
November 2025
- We have achieved FreeBSD 15.0-REL with KDE Plasma
- I'm Hosting a New Podcast
- Creating a Linux Application Using VSCodium, Cline, OpenRouter, and Claude
October 2025
- Company Wrecked by Ransomware Only Spent 120,000 Pounds Per Year on Cyber Security
- Stop Shoddy Academic "Research"
April 2025
March 2025
January 2025
2024 3
October 2024
July 2024
May 2024
2023 6
June 2023
- My Last Email with W. Richard Stevens
- Bejtlich Skills and Interest Radar from July 2005
- Key Network Questions
- Cybersecurity Is a Social, Policy, and Wicked Problem
- Core Writing Word and Page Counts
January 2023
2022 3
November 2022
August 2022
2021 4
July 2021
April 2021
- New Book! The Best of TaoSecurity Blog, Volume 4
- The Origins of the Names TaoSecurity and the Unit Formerly Known as TAO
February 2021
2020 14
November 2020
October 2020
- Security and the One Percent: A Thought Exercise in Estimation and Consequences
- MITRE ATT&CK Tactics Are Not Tactics
- Greg Rattray Invented the Term Advanced Persistent Threat
September 2020
August 2020
July 2020
May 2020
April 2020
- If You Can't Patch Your Email Server, You Should Not Be Running It
- Seeing Book Shelves on Virtual Calls
March 2020
2019 15
November 2019
September 2019
July 2019
- Happy Birthday TaoSecurity.com
- Reference: TaoSecurity Press
- Reference: TaoSecurity Research
- Reference: TaoSecurity News
May 2019
April 2019
March 2019
February 2019
January 2019
2018 22
December 2018
- Notes on Self-Publishing a Book
- Managing Burnout
- The Origin of the Quote "There Are Two Types of Companies"
November 2018
- The Origin of the Term Indicators of Compromise (IOCs)
- Even More on Threat Hunting
- More on Threat Hunting
- Cybersecurity and Class M Planets
October 2018
September 2018
- Firewalls and the Need for Speed
- Twenty Years of Network Security Monitoring: From the AFCERT to Corelight
July 2018
June 2018
May 2018
February 2018
January 2018
2017 12
December 2017
October 2017
May 2017
March 2017
- Five Reasons I Want China Running Its Own Software
- Cybersecurity Domains Mind Map
- Bejtlich Moves On
- The Missing Trends in M-Trends 2017
- The Origin of Threat Hunting
February 2017
- Does Reliable Real Time Detection Demand Prevention?
- Guest Post: Bamm Visscher on Detection
- Bejtlich Books Explained
January 2017
2016 8
December 2016
October 2016
June 2016
January 2016
2015 55
December 2015
- A Brief History of the Internet in Northern Virginia
- Domain Creep? Maybe Not.
- Not So Fast! Boyd OODA Looping Is More Than Speed
November 2015
October 2015
- A Different Spin on the Air War Against IS
- South Korea Signs Up to Cyber Theft Pledge
- For the PLA, Cyber War is the Battle of Triangle Hill
- Personal Info Stolen? Seven Response Steps
September 2015
August 2015
July 2015
June 2015
- My Security Strategy: The "Third Way"
- My Prediction for Top Gun 2 Plot
- Hearing Witness Doesn't Understand CDM
- The Tragedy of the Bloomberg Code Issue
- Air Force Enlisted Ratings Remain Dysfunctional
- Redefining Breach Recovery
- My Federal Government Security Crash Program
- Continuous Diagnostic Monitoring Does Not Detect Hackers
May 2015
April 2015
- The Need for Test Data
- Will "Guaranteed Security" Save the Digital World?
- Example of Chinese Military Converging on US Military
- Network Security Monitoring Remains Relevant
- Please Support OpenNSM Group
March 2015
- The Attack on GitHub Must Stop
- Can Interrogators Teach Digital Security Pros?
- Why Would Iran Welcome Western Tech?
February 2015
- Boards Not Briefed on Strategy?
- Elevating the Discussion on Security Incidents
- Five Reasons Digital Security Is Like American Football
- Learning the Tufte Way to Present Information
- Focus on the Threat: Bank Heists
- Where Russia and North Korea Meet
- A Word of Caution on Fraudulent Routing
January 2015
- Suggestion for Interviewing Technical Hires
- Thoughts from Senate Testimony
- How to Answer the CEO and Board Attribution Question
- The Next Version of testmyids.com
- Is an Alert Review Time of Less than Five Hours Enough?
- Try the Critical Stack Intel Client
- Notes on Stewart Baker Podcast with David Sanger
- FBI Is Part of US Intelligence Community
- Cass Sunstein on Red Teaming
- Does This Sound Familiar?
- Edward Tufte ReTweeted My Blog Post
- Daniel Ellsberg on Secrets
- Attribution and Declassifying Current Satellite Imagery
- Incentives for Breaking Operational Security?
- Happy 12th Birthday TaoSecurity Blog
- Chinese Counterintelligence Doesn't Fool Around
2014 23
December 2014
- Five Reasons Attribution Matters
- Don't Envy the Offense
- What Does "Responsibility" Mean for Attribution?
- Nothing Is Perfectly Secure
- Bejtlich on Fox Business Discussing Recent Hacks
November 2014
- Response to "Can a CISO Serve Jail Time?"
- Thank You for the Review and Inclusion in Cybersecurity Canon
September 2014
- We Need More Than Penetration Testing
- A Brief History of Network Security Monitoring
- Bejtlich Teaching at Black Hat Trainings 8-9 Dec 2014
August 2014
June 2014
May 2014
April 2014
March 2014
- Are Nation States Responsible for Evil Traffic Leaving Their Networks?
- Five Thoughts from VADM Rogers Testimony
- Bejtlich Teaching at Black Hat USA 2014
February 2014
January 2014
2013 18
November 2013
October 2013
September 2013
August 2013
June 2013
- President Obama Is Right On US-China Hacking
- Pre-Order The Practice of Network Security Monitoring Before Price Hike
April 2013
- Practice of Network Security Monitoring Table of Contents
- Bejtlich Teaching New Class at Black Hat in July
March 2013
February 2013
- Recovering from Suricata Gone Wild
- Using Bro to Log SSL Certificates
- Practical Network Security Monitoring Book on Schedule
January 2013
2012 60
December 2012
- Best Book Bejtlich Read in 2012
- 2012: The Year I Changed What I Read
- Five No Starch Books for Kids, Reviewed by Kids
- The Value of Branding and Simplicity to Certifications
November 2012
- Why Collect Full Content Data?
- Spectrum of State Responsibility
- Recommended: The Great Courses "Art of War" Class
- Commander's Reading List
- Do Devs Care About Java (In)Security?
October 2012
- Review of Super Scratch Programming Adventure! Posted
- Washington National Guard: Model for Cyber Defense?
- Inside Saudi Aramco with 60 Minutes
September 2012
- Netanyahu Channels Tufte at United Nations
- Celebrate Packt Publishing's 1000th Title
- Top Ten Ways to Stir the Cyber Pot
- Unrealistic "Security Advice"
- To Be Hacked or Not To Be Hacked?
- Understanding Responsible Disclosure of Threat Intelligence
- Over Time, Intruders Improvise, Adapt, Overcome
- Does Anything Really "End" In Digital Security?
- Encryption Is Not the Answer to Security Problems
- Bejtlich Interviewed on This Week in Defense News
August 2012
- My Role in Information Warfare during the Yugoslav Wars
- DOJ National Security Division Pursuing Cyber Espionage
July 2012
- Israeli Agents Steal Korean Tech for Chinese Customer
- Impressions: Three "Internals" Books for Security
- Not Just Clowns, But Criminals
- How to Kill Teams Through "Stack Ranking"
- Thoughts on Lessons from Our Cyber Past: The First Cyber Cops
- Thoughts on Air-Sea Battle Briefing at Brookings
June 2012
- China's High-Tech Military Threat and Air Sea Battle
- Bejtlich's Thoughts on "Why Our Best Officers Are Leaving"
- More Disclosure of Vulnerabilities in Attacker Tools
- What Gets Measured, Matters
- Flame Hypocrisy
- Whither United States Air Force Academy?
- 5000th Tweet
May 2012
- Whistleblowers: The Approaching Storm for Digital Security
- Comparing IEDs and Digital Threats
- SEC Guidance Is a Really Big Deal
April 2012
March 2012
- Inside a Commission Hearing on the Chinese Threat
- Impressions: Fuzzing
- Impressions: Hunting Security Bugs
- Impressions: The Web Application Hacker's Handbook, 2nd Ed
- Impressions: Web Application Security: A Beginner's Guide
- Review of SSH Mastery Posted
- Bejtlich's Take on RSA 2012
- Keep CIRT and Internal Investigations Separate
- TaoSecurity Blog Wins Most Educational Security Blog
February 2012
- Practical Malware Analysis Book Promotion
- I Want to Detect and Respond to Intruders But I Don't Know Where to Start!
- Impressions: Network Warrior, 2nd Ed
- Impressions: Windows Sysinternals Administrator's Reference
- Impressions: The Tangled Web
- The Toughest Question in Digital Security
January 2012
2011 110
December 2011
- Mandiant Webinar Wednesday; Help Us Break a Record!
- Tripwire Names Bejtlich #1 of "Top 25 Influencers in Security"
- Become a Hunter
November 2011
- National Public Radio Talks Chinese Digital Espionage
- Dustin Webber Creates Network Security Monitoring with Siri
- Trying NetworkMiner Professional 1.2
- Thoughts on 2011 ONCIX Report
- Tao of Network Security Monitoring, Kindle Edition
- Why DIARMF, "Continuous Monitoring," and other FISMA-isms Fail
- SEC Guidance Emphasizes Materiality for Cyber Incidents
October 2011
- MANDIANT Webinar Friday
- Review of America the Vulnerable Posted
- Republican Presidential Candidates on China
- Bejtlich in "The expanding cyber industrial complex"
- Computer Incident Response Team Organizational Survey, 2011
- Interview with One of My Three Wise Men
- Russia v China -- Sound Familiar?
- It's All About the Engines
- House Cybersecurity Task Force Report Released
- C-SPAN Posts Video of Tuesday Hearing
- Inside a Congressional Hearing on Digital Threats
September 2011
- Chinese Espionage in Five Minutes
- Review of Robust Control System Networks Posted
- Impressions: The Art of Software Security Testing
- Impressions: The Art of Software Security Assessment
- Impressions: Tiger Trap
- Bejtlich Cited in Chinese Article on APT
- Classic Chinese Defensive Propaganda
- Government Takeover of Compromised Digital Infrastructure Provider
- Watch National Geographic Channel's The Liquid Bomb Plot
August 2011
- TaoSecurity Security Effectiveness Model
- TCP/IP Weapons School 3.0 in McLean, VA 26-27 Oct
- Jaime Metzl Describes "China's Threat to World Order"
- Expect to Hear "IDS Is Dead" (Again)
- Bejtlich Leading Session at IANS
- Check Out MANDIANT Job Postings
- Tao of NSM Errata and Possible Book Plans
- Bejtlich Webinar for Dark Reading and InformationWeek
- Bejtlich Keynote at Hawaiian Telcom Conference
- Feedback from Latest TCP/IP Weapons School 3.0 Class
- Impressions: Android Forensics
- Impressions: iPhone and iOS Forensics
- Impressions: XBox 360 Forensics
- Impressions: Digital Forensics with Open Source Tools
- Impressions: The Shellcoder's Handbook, 2nd Ed
- Impressions: Reversing: Secrets of Reverse Engineering
- Impressions: The IDA Pro Book, 2nd Ed
- Book Reviews vs Impressions
July 2011
- Review of Metasploit: The Penetration Tester's Guide Posted
- Review of Hacking: The Art of Exploitation, 2nd Ed Posted
- Review of Gray Hat Hacking, 3rd Ed Posted
- Review of Ninja Hacking Posted
- Review of Managed Code Rootkits Posted
- Review of Buffer Overflow Attacks Posted
- Risk Modeling, not "Threat Modeling"
- Noah Shachtman’s Pirates of the ISPs
- SQL Injection Challenge and Time-Based Security
- Bejtlich Teaching in Abu Dhabi in December
June 2011
- Why Business Methods Are as Important as IP to China
- With "Cyber" Attacks, Effects Matter More Than Means
- THEY DID IT
- Security Conference Recommendations
- China's View Is More Important Than Yours
May 2011
- Five Qualities of Real Leadership
- CIO Magazine Realizes "IT Alignment" Is Dead
- Bejtlich Teaching at USENIX Security in San Francisco 8-9 Aug
- America the Vulnerable Arrives This Fall
- Early Review of Ghost in the Wires
- Review of Windows Internals, 5th Ed Posted
- Review of Windows System Programming, 4th Ed Posted
- Review of Windows via C/C++, 5th Ed Posted
- Review of Beginning Visual C++ 2010 Posted
- Review of Beginning C Posted
- Review of Programming Amazon EC2 Posted
April 2011
- UBM Cancels GTEC, Bejtlich Considers Alternatives
- Cooking the Cuckoo's Egg
- APT Drives Up Bomber Cost
- Aviation Week on China's Military Capabilities
- Answering Questions on Reading Tips
- Review of Web Application Obfuscation Posted
- All Reading Is Not Equal or Fast
- Review of Hacking Exposed: Web Applications, 3rd Ed
- Review of iOS Forensic Analysis Posted
March 2011
- Review of Computer Incident Response and Product Security Posted
- Review of pfSense: The Definitive Guide Posted
- Mini-Review of The Book of Pf Posted
- Review of Kingpin Posted
- Report on Declarations of War
- Requesting Comments on Open Information Security Foundation
- Initial Thoughts on RSA "APT" Announcement
- Bejtlich Joining MANDIANT as CSO and Security Services Architect
- Report on Instances of US Forces Abroad
- Bejtlich Teaching Special Session of TCP/IP Weapons School at GTEC DC
- Experts Talk US-China Security Issues, Part 2
- Experts Talk US-China Security Issues, Part 1
- Review of Cyber Attacks Posted
- Bejtlich Teaching Two Sessions at Black Hat USA 2011
February 2011
January 2011
- Wanted: Incident Handler in Michigan
- Seven Cool Open Source Projects for Defenders
- More on Chinese Stealth Fighter and APT
- Happy 8th Birthday TaoSecurity Blog
- The "IT as a Business" Train Wreck
- To Those Who Want Tim Thomas Books
- TaoSecurity Lab
- VizSec 2011 Call for Papers Open
- Starting the New Year Right
- Best Book Bejtlich Read in 2010
- Reflections on Four Tufte Books
2010 192
December 2010
- Review of The Dragon's Quantum Leap Posted
- Review of Decoding the Virtual Dragon Posted
- Review of Dragon Bytes Posted
- Steve Jobs Understands Team Building
- Trying PC-BSD 8.2-BETA1
- Trying VirtualBSD 8.1
- FreeBSD on Amazon EC2
- Bejtlich Teaching at Black Hat DC 2011
- Speaking at RSA 2011
- Courtesy of APT
- Splunk 4.x on FreeBSD 8.x using compat6x Libraries
- Bruce Schneier, Cyber Warrior?
November 2010
- Trying Ubuntu 10.10 in AWS Free Usage Tier
- 60 Free Minutes with Ubuntu 10.10 in Amazon EC2
- Stop Killing Innovation
- The Problem Is with Gmail
- FreeBSD Sendmail Problem
- Thanks for Help with Startup Scripts
- Calling FreeBSD Startup Script Experts
- Two New Tools in Snort
- Using Git with FreeBSD Sguil Scripts
- Updates to Sguil on FreeBSD Scripts
- Collage: Defeating Censorship [aka Security] with User-Generated Content
October 2010
- Does This Sound Familiar?
- What Do You Investigate First?
- FIRST Technical Colloquium Tue 2 Nov in NoVA
- Resources for Building Incident Response Teams
- Review of Professional Assembly Language Posted
- Review of Cyber War Posted
September 2010
- Why Neither the US Nor China Admits Cyberwar
- On the Other Side of an Advanced Persistent Threat
- Why Russia and China Think We're Fighting Cyberwar Now
- Kundra IPv6 Memo
- Five Reasons "dot-secure" Will Fail
- Thoughts on "Cyber Weapons"
- Bejtlich Speaking at TechTarget Emerging Threats Events in Seattle and New York
- NYCBSDCon 2010 Registration Open
- Someone Is Not Paying Attention
- NetWitness Minidecoder in Action
- DualComm Port Mirroring Switch
- A Book for the Korean Cyber Armies
- India v China
- One Page to Share with Your Management
- The Inside Scoop on DoD Thinking
- Review of Hacking Exposed: Wireless, 2nd Ed Posted
August 2010
- GE Looking for Business Response Team Leader
- Bejtlich on Silver Bullet Podcast
- Review of Least Privilege Security Posted
- Bejtlich Teaching at Black Hat Abu Dhabi 2010
- Review of IT Security Metrics Posted
- Review of Practical Lock Picking Posted
- Consider Reading Network Flow Analysis
- World's Worst Security Visualization?
- Do You Use Visualization in Production?
- Review of Wireshark Network Analysis Posted
- Hexcompare and Finding New Tools
- Conti and Easterly on Cyber Warriors
- August 2010 Digital Forensics Magazine Published
- July 2010 Hakin9 Magazine Published
- Project Vigilant Is a Publicity Stunt
July 2010
- Time Issues in Libpcap Traces
- Review of Digital Forensics for Network, Internet, and Cloud Computing Posted
- Review of Virtualization and Forensics Posted
- Review of Digital Triage Forensics Posted
- Dell Needs a PSIRT
- Review of The Watchman Posted
- Review of The Fugitive Game Posted
- Review of At Large Posted
- Review of The Cuckoo's Egg Posted
- Review of Code Version 2.0 Posted
- Review of Crypto Posted
- Review of The Illusion of Due Diligence Posted
- Human Language as the New Programming Language
- Brief Thoughts on WEIS 2010
- Brief Thoughts on SANS WhatWorks Summit in Forensics and Incident Response 2010
- Network Forensics Vendors: Get in the Cloud!
- Gartner on CSIRTs
- My Article on Advanced Persistent Threat Posted
- A Little More on Cyberwar, from Joint Pub 1
- Thoughts on "Application SOC" and New MSSPs
- Ponemon Institute Misses the Mark
- Joint Strike Fighter -- Face of Cyberwar?
- Cyberwar Is Real
- Security Is Never Free -- Ask DNSSEC
- Lessons from NETOPS vs CND
- Secunia Survey of DEP and ASLR
- Digital Forensics Magazine
June 2010
- Comments on Sharkfest Presentation Materials
- Dealing with Security Instrumentation Failures
- CloudShark, Another Packet Repository in the Cloud
- All Aboard the NSM Train?
- Mike Cloppert on Defining APT Campaigns
- Full Disclosure for Attacker Tools
- Can Someone Do the Afghanistan Math?
- Light Bulbs Slowly Illuminating at NASA?
- NITRD: "You're going the wrong way!"
- June 2010 Hakin9 Magazine Published
- "Untrained" or Uncertified IT Workers Are Not the Primary Security Problem
- Publicly Traded Companies Read This Blog
- Simple Questions, Difficult Answers
- Reminder for Incident Responders
May 2010
- National Security Strategy is Empty on "Cyberspace"
- Digital Security Is Not Just an Engineering Problem
- "Privacy" vs "Security" or Privacy AND Security
- More Evidence Military Will Eventually Defend Civilian Networks
- SANS WhatWorks Summit in Forensics and Incident Response
- Forget Pre-Incident Cost, How Much Did Your Last Incident Cost?
- More on Black Hat Costs
- Watch Your WHOIS Entries
- Review of Masters of Deception Posted
- Review of Cyberpunk Posted
- Review of The Hacker Crackdown Posted
- Everything I Need to Know About Leadership I Learned as a Patrol Leader
- Papers Not PowerPoint, Plus Tips for Improvement
- Bejtlich to Speak at SANS Forensics and Incident Response 2010
- The Face of Information Warfare
April 2010
- Blame the Bullets, not PowerPoint
- Review of The Rootkit Arsenal Posted
- Snort Near Real Time Detection Project
- Thoughts on New OMB FISMA Memo
- Still Looking for Infrastructure Administrator for GE-CIRT
- Review of Handbook of Digital Forensics and Investigation Posted
- Review of The Victorian Internet Posted
- Measurement Over Models
- Vulnerable Sites Database: More Intrusion as a Service
- "Cyber insecurity is the paramount national security risk."
- Response to Dan Geer Article on APT
- Last Chance for TCP/IP Weapons School 2.0 in Las Vegas
- Bejtlich on Visible Risk Podcast
- Defense Security Service Publishes 2009 Report on "Targeting U.S. Technologies"
- BeyondTrust Report on Removing Administrator: Correct?
March 2010
- GE-CIRT Joins FIRST
- Bejtlich in April Wired Magazine
- Bejtlich Returns to PaulDotCom Podcast
- Ways to Justify Security Programs: 13 Cs
- Forget ROI and Risk. Consider Competitive Advantage
- Time and Cost to Defend the Town
- Guest Post on SecureThinking about Cyber Shockwave
- Verizon Incident Sharing Framework
- Bejtlich Keynote at VizSec 2010
- Bejtlich OWASP Podcast Posted
- Traffic Talk 10 Posted
- Einstein 3 Coming to a Private Network Near You?
- Making a Point with Pressure Points
- Keeping FreeBSD Applications Up-to-Date in BSD Magazine
- Bejtlich Teaching at Black Hat EU and USA 2010
- Bejtlich to Speak at FIRST 2010
February 2010
- Information Security Jobs in GE-CIRT and Other GE Teams
- Reaction to Cyber Shockwave
- Review of Intelligence, 4th Ed Posted
- Offshoring Incident Response
- Advice for Academic Researchers
- Answers Regarding Military Service
- Max Ray Butler Sentenced (Again)
- Get the Divers Out of the Water
- A Hacker in Charge of Your Tax Dollars?
- Thor vs Clown
- Making Progress Matters Most
- So Much for China's "Peaceful Rise"
- APT Presentation from July 2008
- Review of The Book of Xen Posted
- Answering APT Misconceptions
- DFRWS, VizSec, and RAID 2010 Calls for Papers
- Google and NSA Fulfilling 2008 Predictions
- DNI Blair Leads with APT as a "Wake-Up Call"
- Traffic Talk 9 Posted
January 2010
- Two Dimensional Thinking and APT
- Example of Threat-Centric Security
- Mandiant M-Trends on APT
- Review of Professional Penetration Testing Posted
- Energy Sector v China
- Look Beyond the Exploit
- Review of Network Maintenance and Troubleshooting Guide, 2nd Ed Posted
- Submit Questions for OWASP Podcast
- Sguil 0.7.0 on Ubuntu 9.10
- Attribution Using 20 Characteristics
- Help Bro Project with Short Survey
- Attribution Is Not Just Malware Analysis
- Is APT After You?
- Review of Inside Cyber Warfare Posted
- Bejtlich Teaching at Black Hat EU 2010
- What Is APT and What Does It Want?
- Why Google v China is Different
- Security Team Permissions
- Friday is Last Day to Register for Black Hat DC at Reduced Rate
- Why Would APT Exploit Adobe?
- Has China Crossed a Line?
- Mechagodzilla v Godzilla
- Google v China
- Happy 7th Birthday TaoSecurity Blog
- Excerpts from Randy George's "Dark Side of DLP"
- Best Book Bejtlich Read in 2009
2009 213
December 2009
- Every Software Vendor Must Read and Heed
- Difference Between Bejtlich Class and SANS Class
- Reminder: Bejtlich Teaching at Black Hat DC 2010
- Favorite Speaker Quotes from SANS Incident Detection Summit
- Notes from Tony Sager Keynote at SANS
- Keeping FreeBSD Up-to-Date in BSD Magazine
- Thanks for a Great Incident Detection Summit
- Troubleshooting FreeBSD Wireless Problem
- Let a Hundred Flowers Blossom
- Real Security Is Threat-Centric
November 2009
- Celebrate FreeBSD 8.0 Release with Donation
- Historical Video on AFCERT circa 2000
- Tort Law on Negligence
- Review of Martin Libicki's Cyberdeterrence and Cyberwar
- Shodan: Another Step Towards Intrusion as a Service
- I'm Surprised That Your Kung Fu Is So Expert
- Control "Monitoring" is Not Threat Monitoring
- Audio of Bejtlich Presentation on Network Security Monitoring
- Traffic Talk 8 Posted
- Extending Security Event Correlation
- Embedded Hardware and Software Pen Tester Positions in GE Smart Grid
- Reaction to 60 Minutes Story
- Notes from Talk by Michael Hayden
- Bejtlich on Security Justice Podcast
- DojoCon Videos Online
- Tentative Speaker List for SANS Incident Detection Summit
October 2009
- Bejtlich and Bradley on SANS Webcast Monday 2 Nov
- Partnerships and Procurement Are Not the Answer
- Initial Thoughts on Cloud A6
- Wednesday is Last Day for Discounted SANS Registration
- Review of Hacking Exposed: Web 2.0 Posted
- Review of Web Security Testing Cookbook Posted
- Review of SQL Injection Attacks and Defense Posted
- Review of The Web Application Hacker's Handbook Posted
- "Protect the Data" from the Evil Maid
- Report on Chinese Government Sponsored Cyber Activities
- DojoCon to Stream Talks Live
- Bejtlich Teaching at Black Hat DC 2010
- "Protect the Data" -- What Data?
- "Protect the Data" Where?
- "Protect the Data" from Whom?
- "Protect the Data" Idiot!
- NSM in Products
- Technical Visibility Levels
- Hakin9 5/2009 Issue
- Incident Handler, Incident Analyst, Threat Analyst, and Developer Positions in GE-CIRT
- Traffic Talk 7 Posted
September 2009
- 6th Issue of BSD Magazine
- Hakin9 Extended Edition in Stores
- Security Information and Event Management (SIEM) Position in GE-CIRT
- Information Security Position in GE Aviation
- Open Source Vulnerability Disclosure with FreeBSD
- Microsoft Updates MS09-048 to Show XP Vulnerable to 2 of 3 CVEs
- MS09-048 on Windows XP: Too Hard to Fix
- MS09-048 is Microsoft's Revenge Against XP in the Enterprise
- Review of Windows Forensic Analysis 2nd Ed Posted
- Bejtlich Speaking at Information Security Summit
- Bejtlich Speaking at DojoCon
- Extreme Asymmetry in Network Attack and Defense
- Registration for VizSec 2009 Open
August 2009
- Draft Version of New Keeping FreeBSD Applications Up-To-Date
- SANS WhatWorks in Incident Detection Summit 2009 Web Site Active
- Draft Version of New Keeping FreeBSD Up-To-Date
- Renesys Blog on Routing Vulnerabilities
- New Must-Read Blog Series from Mike Cloppert
- Updating FreeBSD Using CVSup through HTTP Proxy
- Three Free Issues of BSD Magazine in .pdf Format
- Hakin9 04/2009 Issue
- Manga Guide to Statistics vs Statistics in a Nutshell
- GE Is Hiring in Michigan
- Attack Models in the Physical World
- Review of The Myths of Security Posted
- Incident Detection Mindset
- Build Visibility In
- Question on NSM Scaling
- Thoughts on Security Careers
- 2009 CDX Data Sets Posted
- SANS Incident Detection Summit in DC in December
- Review of IPv6 Security Posted
- Blast from the Past
July 2009
- Thoughts from Black Hat USA 2009
- What is Cloud?
- Notes from OISF Meeting in DC
- Guest Post at Fudsec.com
- Review of Voice over IP Security Posted
- Direct Financial Cost of Intrusions
- SANS Forensics and Incident Response 2009 Summit Round-Up
- Free Issue of Linux+ Magazine Posted
- Review of vi(1) Tips Posted
- Cisco Routers for the Desperate, 2nd Ed
- White Hat Budgeting
- FreeBSD Pf and Tftp-proxy
- Review of Practical Intrusion Analysis Posted
- Must-Read Verizon Post Demolishes More Myths
- Review of Security Monitoring Posted
- You Down with APT?
- Traffic Talk 6 Posted
- Still Blogging
- Bejtlich on Black Hat Briefings Panel
- Review of Hacking Exposed: Windows, 3rd Ed Posted
- NSA to "Screen" .gov Now, I Predict .com Later
June 2009
- Simpler IP Range Matching with Tshark Display Filters
- Effective Digital Security Preserves Long-Term Competitiveness
- Posts to Read Elsewhere
- Black Hat Budgeting
- Being a Critic Is Easy, So What Would I Do?
- Ugly Security
- SANS Forensics and Incident Response 2009
- DoD Creates USCYBERCOM
- Free .pdf Issue of BSD Magazine Available
- The Problem with Automated Defenses
- You Know You're Important When...
- The Centrality of Red Teaming
- Offense and Defense Inform Each Other
- Response to the Möbius Defense
- How Much to Spend on Digital Security
- Counterintelligence Options for Digital Security
- Crisis 0: Game Over
- Extending the Information Security Incident Classification with Crisis Levels
- Department of Defense Digital Security Job Opportunities
- Digital Situational Awareness Methods
- Incident Detection Paradigms
- Incident Phases of Compromise
- Information Security Incident Classification
- Cyber Security Coordinator
May 2009
- Information Security Incident Rating
- President Obama's Real Speech on Cyber Security
- Defender's Dilemma vs Intruder's Dilemma
- Publication Notice: The Rootkit Arsenal
- Response for Daily Dave
- Cheap IT Is Ultimately Expensive
- Check Out Hakin9
- Harlan Carvey on Talk Forensics
- The Real Deal on Kylin
- PSIRT Equals Getting Serious About Product Security
- 24th Air Force to be Headquartered at Lackland AFB
- Insider Threat Myth Documentation
- Highlights from 2009 Verizon Data Breach Report
- Logs from the Cloud
- Thoughts on Cyber Command
- OSVDB on Problems with Identifying Vulnerabilities
- Lessons from CDX
- Risk Assessment, Physics Envy, and False Precision
- Dan Geer on Marcus Ranum's 5th Rearguard Security Podcast
- Thoughts on 2009 CDX
- Black Hat Class Outline Posted
- Review of Chained Exploits Posted
April 2009
- Review of Crimeware Posted
- Traffic Talk 5 Posted
- TaoSecurity Blog Wins Best Non-Technical Blog at RSA
- 4th Issue of BSD Magazine
- Elvis Presents IDS vs NSM
- Speaking of Incident Response
- Bejtlich to Keynote at SANS Forensics and Incident Response 2009
March 2009
- Scalable Infrastructure vs Large Problems, or OpenDNS vs Conficker
- NSM vs The Cloud
- Response to 60 Minutes Story "The Internet Is Infected"
- Network Security Monitoring Lives
- NSM on Cisco AXP?
- Association of Former Information Warriors
- More PowerPoint Woes
- Thoughts on Latest Government Focus on Digital Security
- The Security World Is Not Just a Webbed, Virtual, Fluffy Cloud
- Building Security In Maturity Model Partly Applies to Detection and Response
- Thoughts on Technology Careers for the Next Generation
- Requirements for Defensible Network Architecture: Monitored
- Using Forensic Tools Offensively
- Recoverable Network Architecture
- Steve Liesman on Inputs vs Outputs
- Cyber Stress Cases
- Bejtlich Teaching at Black Hat USA 2009
- Bro SSL Certificate Details
- Using Responsible Person Records for Asset Management
February 2009
- Sample Lab from TCP/IP Weapons School 2.0 Posted
- Inputs vs Outputs, or Why Controls Are Not Sufficient
- Consensus Audit Guidelines Are Still Controls
- Asset Management Assistance via Custom DNS Records
- HD Moore on the Necessity of Disclosure
- Buck Surdu and Greg Conti Ask "Is It Time for a Cyberwarfare Branch?"
- More Information on CNCI
- VirtualBSD: FreeBSD 7.1 Desktop in a VM
- Black Hat Briefings Justify Supporting Retrospective Security Analysis
- Black Hat DC 2009 Wrap-Up, Day 2
- Black Hat DC 2009 Wrap-Up, Day 1
- Thoughts on Air Force Blocking Internet Access
- Back from Bro Workshop
- Last Day to Register Online for TCP/IP Weapons School 2.0 in DC
- New Online Packet Repository
- Benefits of Removing Administrator Access in Windows
- More on Weaknesses of Models
- Notes on Installing Sguil Using FreeBSD 7.1 Packages
- Data Leakage Protection Thoughts
- Humans, Not Computers, Are Intrusion Tolerant
- Upgrading FreeBSD Packages
- Upgrading FreeBSD 7.0 to 7.1
January 2009
- Advice to Bloggers
- Northrop Grumman's Timothy McKnight on Security
- Virtualized Network Security Monitoring Platforms
- Raffy Marty Teaching Security Visualization
- Why Network Taps
- DC BSDCon 2009 Registration Reminder
- Reader Questions: Internal or External MSSP
- Reader Questions on Network Security Monitoring
- Contract BSD Associate-or-better FreeBSD Sys Admin
- Integrity Attacks Begin as Mistakes
- Happy 6th Birthday TaoSecurity Blog
- Metasploit 3.2 on Windows XP
- Recommendation for an Introduction to Unix
- IPv6 Tunnel on Windows XP Using Freenet6
- BGPMon On Illegitimate Route Announcement
- Predictions for 2009
- Predictions for 2008 in Hindsight
- Best Book Bejtlich Read in 2008
2008 255
December 2008
- Bejtlich Speaking at DC BSDCon 2009
- Installing Sguil Using NSMNow
- NSM-Friendly VMWare Lab Setup
- Snort Report 22 Posted
- OSSEC and Pf on FreeBSD to Limit SSH Brute Forcing
- Traffic for Revoked TLSv1 Certificate
- Physical Security Lessons for Digital Security
- Download Free Hakin9 Issue
- Justifying National Security Spending
- Command Information Securing, Hacking and Defending IPv6
- Traffic Talk 4 Posted
- Colin Percival and Craig Balding on Amazon Cloud Security
- You Get What You Inspect
- Traffic Talk 3 Posted
- Indian Navy Demonstrates that Offense Stops Pirates
- Supporting FreeBSD
- Jeremiah Grossman on Justifying Security Spending
- 3rd Issue of BSD Magazine
- Review of Nmap Network Scanning Posted
- Review of Googling Security Posted
- Review of Software Security Engineering Posted
- Bejtlich Cited in Economist
- BPF for IP or VLAN Traffic
- Letters You Will Need to Know: 201 CMR 17.00
- Craig Balding Podcast on Cloud Security
November 2008
- Splunk on FreeBSD 7.0
- Defining the Win
- Live Incident Map
- Digital Asset Scorecards
- Reading on Justifying Security Operations
- NASA v China
- Don't Fight the Future
- Managing Security in Economic Downturns
- Tips for PSIRTs
- Snort Report 21 Posted
- Intellectual Property: Develop or Steal
- Laid-off Sys Admin Story Makes My Point
- Marcus Ranum on Network Security
- BGPMon on BGP Table Leak by Companhia de Telecomunicacoes do Brasil Central
- Bejtlich Teaching at Black Hat Europe 2009
- Bejtlich Teaching at Black Hat DC 2009 Training
- Securix-NSM 1.0 Released
- 2nd Issue of BSD Magazine
- Fast Money's Transparency and Digital Security
- Current and Future White House v China
- Defining Security Event Correlation
- Response to Marcus Ranum HITB Cyberwar Talk
- Response to "Air Force Aims to 'Rewrite Laws of Cyberspace'"
- The Best Cyber-Defense...
- Snort Report 20 Posted
- Review of Malware Forensics Posted
- DC BSDCon 2009 Call for Papers Open
October 2008
- Vulnerabilities and Exploits Are Mindless
- Unify Against Threats
- Trying Secunia Vulnerability Scanning
- Review of OSSEC HIDS Guide Posted
- Comment on New Amazon Reviewer Ranking System
- Security Event Correlation: Looking Back, Part 3
- Security Event Correlation: Looking Back, Part 2
- Security Event Correlation: Looking Back, Part 1
- Thoughts on Security Engineering, 2nd Ed
- Security Book Publishing Woes
- Review of Applied Security Visualization Posted
- Windows Syslog Agents Plus Splunk
- CWSandbox Offers Pcaps
- What To Do on Windows
- Trying Firefox with CMU Perspectives
- Thoughts on 2008 SANS Forensics and IR Summit
- Hop-by-Hop Encryption: Needed?
- BGPMon.net Watches BGP Announcements for Free
- DHS to Fund Open Source Next Generation IDS/IPS
- Traffic Talk 2 Posted
- Whither Air Force Cyber?
- FCW on Comprehensive National Cybersecurity Initiative
- Insider Threat Prediction Materializing
- Attacks Upon Integrity
- DoS Me Like It's 1996
September 2008
- Wanted: Incident Handler with Mentoring Skills
- Snort Report 19 Posted
- Why Blog?
- Is Experience the Only Teacher in Security?
- Security vs IT at Computerworld
- VizSec and RAID Wrap-Up
- CERIAS to CAE: We're Not a Lemon
- Cost of Intellectual Property Theft
- On Breakership
- Wanted: Incident Handler with Reverse Engineering/Malware Analysis Skills
- Bejtlich to Judge NYU-Poly CSAW Forensics Challenge
- Internal Security Staff Matters
- The Analyzer Charged Again
- Bejtlich Keynote at 1st ACM Workshop on Network Data Anonymization
- Request for Feedback on Deny by Default
- Bejtlich Keynote at SANS Forensics Summit
- Microsoft Network Monitor 3.2 Beta for Tracking Traffic Origination
- Schneier Agrees: Security ROI is "Mostly Bunk"
- Enterprise Users Should Not Be Records Managers
- Standards for System Administration
- NetworkMiner
August 2008
- General Chilton on the Cyber Fight
- Splunk on Ubuntu 8.04
- SecureWorks on Building and Sustaining a Security Operations Center
- Renesys on Threats to Internet Routing and Global Connectivity
- Thoughts on OMFW and DFRWS 2008
- Getting the Job Done
- Microsecurity vs Macrosecurity
- The Limits of Running IT Like a Business
- Is This You Too?
- Is This You?
- Reaction to Air Force Cyber Command Announcement
- More Threat Reduction, Not Just Vulnerability Reduction
- Snort Report 18 Posted
- Black Hat USA 2008 Wrap-Up: Day 2
- Black Hat USA 2008 Wrap-Up: Day 1
- Traffic Talk 1 Posted
July 2008
- Snort Report 17 Posted
- Counterintelligence: Worse than Security?
- Security Operations: Do You CAER?
- Notes for Black Hat Students
- Review of The New School of Information Security Posted
- Review of Nmap Network Scanning
- Dark Visitor Podcast: Real "Truth About Chinese Hackers"
- DNS and the Cyber TARDIS Problem
- What Should Dan Have Done?
- Vulnerabilities in Perspective
- Packet Anonymization with PktAnon
- Robert Graham on TurboCap
- Hint of Visibility in the Cloud
- Proposed Air Force Cyber Badge
- Thoughts on Latest Kaminsky DNS Issue
- Reviews of FreeBSD Books Posted
- Air Force Cyber Panel
- Making Decisions Using Randomized Evaluations
- Green Security
June 2008
- Pascal Meunier Is Right About Virtualization
- Verizon Study Continues to Demolish Myths
- Logging Web Traffic with Httpry
- Sourcefire Best of Open Source Security Conference
- Verizon Business Report Speaks Volumes
- House of Representatives v China
- Publicity: BSD Associate Examinations
- The Best Single Day Class Ever
- NoVA Sec Meeting Memory Analysis Notes
- Recycling Security Technology
- Intel Premier IT Magazine on "War Gaming"
- Review of Nmap in the Enterprise Posted
- Review of No Tech Hacking Posted
- Review of Botnets Posted
- Review of Building a Server with FreeBSD 7
- FX on Cisco IOS Rootkits
- A Clueful Interview
- NSM vs Encrypted Traffic Revisited
- What Would Galileo Think
- Phone Book Full Disclosure
- Old School Layer 2 Hacking
- Snort Report 16 Posted
May 2008
- Snort Evasion Vulnerability in Frag3
- Excellent Schneier Article on Selling Security
- NSM vs Encrypted Traffic, Plus Virtualization
- Response to Is Vulnerability Research Ethical?
- Bankers: Welcome to Our World
- FISMA 2007 Scores
- Trying Gigamon
- "Security": Whose Responsibility?
- MySQL Bug Fix Pace Impresses Me
- Mutually Assured DDoS
- Seats Filling for Black Hat and One Week Left for Techno
- Answering Reader Questions
- Offense Kills Pirates
- Snort Report 15 Posted
- Traveling Wilbury Security
- Reminder: Bejtlich Teaching at Techno Security 2008
April 2008
- Tactical Forensics Platform
- New Hakin9 Released
- First Issue of BSD Magazine Released
- NoVA Sec Meeting 1930 Thursday 24 April 2008
- CloudSecurity.org
- Looking for Security-Assesor Friendly, Debian Dedicated Server
- Run Apps on Cisco ISR Routers
- Remote Installation of the FreeBSD Operating System without a Remote Console
- Aaron Turner and Michael Assante on Freedom of the Cyber Seas
- Solera V2P Tap
- More Aggressive Network Self-Defense
- Argus 3.0 Released
- Snort Report 14 Posted
- BusinessWeek on The New E-spionage Threat
- OpenPacket.org 1.0 Is Live
- Review of Visible Ops Security Posted
- Review of Economics and Strategies of Data Security
- Detection, Response, and Forensics Article in CSO
- Sguil Project Acquired by Cisco
March 2008
- Wireshark 1.0.0 Released
- Practical Data Analysis and Reporting with BIRT
- Two Studies on Security Spending
- Sguil 0.7.0 Released
- Implementing Enterprise Visibility by Leading Change
- E-discovery Is an Information Lifecycle Management Problem, Not a Security Problem
- Justifying Digital Security via 10-K Risk Factors
- Ten Themes from Recent Conferences
- CIO Magazine 20 Minute Miracles and Real Risks
- The Data Center in a Switch
- Black Hat DC 2008 Wrap-Up
- Thoughts from Several Conferences
- How Many Burning Homes
- Reactions to Latest Schneier Thoughts on Security Industry
- Bejtlich Teaching at Black Hat USA Training 2008
- Bejtlich Teaching at Techno Security 2008
- Bejtlich in Access Control and Security Solutions Magazine
- Review of Professional Xen Virtualization Posted
- Network Security Monitoring for Fraud, Waste, and Abuse
- Matt Jonkman and Endace on Accelerating Snort
- New Hakin9 Released
- Common Interface to Packets
- Infrastructure Protection in the Ancient World
- Must-Read Blog for Networkers
- Best. Quote. Ever.
- This Network Is Maintained as a Weapon System
February 2008
- Microsoft Protocols Programs
- First They Came for Bandwidth...
- Three Capabilities, Three Companies
- Snort Report 13 Posted
- Review of The Dark Visitor
- ShmooCon Ticket on eBay
- Review of Router Security Strategies Posted
- Wired on Air Force Cyber Command
- Reminder: Last Day for Web Registration for Bejtlich's Black Hat DC 2008 Training
- NSM at the Endpoint
- Review of Beginning Perl, 2nd Ed Posted
January 2008
- TSA Lessons for Security Analysts
- From Linux to FreeBSD with Depenguinator 2.0
- NoVA Sec Meeting 1930 Thu 31 Jan 08
- Is Jerome Kerviel Hacking?
- Corporate Digital Responsibility
- Review of The Best of FreeBSD Basics Posted
- Review of Time Based Security Posted
- More on 2008 Predictions
- Thoughts on Oracle Non-Patching
- Is This For Real?
- 2008 Predictions Panning Out
- Review of Security Power Tools Posted
- Reminder: Bejtlich Teaching at Black Hat DC 2008 Training
- Snort Frequently Asked Questions Podcast Posted
- Unposted Review: Network Security Assessment 2nd Ed
- Defensible Network Architecture 2.0
- How can a blog reader find competent operations personnel?
- Happy 5th Birthday TaoSecurity Blog
- Sussy McBride Shouts: I got hacked
- Review of Virtual Honeypots Posted
- Snort Report 12 Posted
- Bejtlich Interviews
- No More Tiger Team?
- Reminder: Bejtlich Teaching at Black Hat DC 2008 Training
- Private Eyes Again
- Sguil Status
- Last Book Reviews of 2007 Posted
- Best Book Bejtlich Read in 2007
2007 355
December 2007
- Long Live Emerging Threats
- Snort Report 11 Posted
- Predictions for 2008
- Two Book Reviews Posted
- Make Cleaning Awesome
- After Five Years, NSM Is Still More Than IDS
- Does Failure Sell?
- Feds Plan to Reduce, Then Monitor
- Incident Severity Ratings
- Expert Commentary on SPAN and RSPAN Weaknesses
November 2007
- Controls Are Not the Solution to Our Problem
- MPAA University Toolkit Phone Home
- Examining the MPAA University Toolkit
- Tap vs Lightning Strike
- Updating FreeBSD 7.0-BETA2 to 7.0-BETA3
- Network Monitoring: How Far?
- Analyzing Protocol Hopping Covert Channel Tool
- Great Papers from Honeynet Project
- FreeBSD Binary Upgrade News
- Impact of NetFlow on Routers
- Must-Read Snort 3.0 Post
- More Unpredictable Intruders
- Deflect Silver Bullets
- Bejtlich Teaching at Black Hat DC 2008 Training
- Russ McRee on Argus and NSM
- Snort Report 10 Posted
- A Plea to the Worthies
October 2007
- Wake Up Corporate America
- Are You Secure? Prove It.
- Microsoft, Explain Threats to Microsoft
- FreeBSD 7.0 Developments
- Counterintelligence and the Cyber Threat
- Russian Business Network
- Review of LAN Switch Security Posted
- CSI Annual 2007 Contest
- Air Force Cyberspace Report
- Alternatives to "Expert Opinions"
- The Doomsday Clock
- Be the Caveman Lawyer
- One Review and One Prereview
- Intruders Continue to Be Unpredictable
- NSM and Sguil in October InfoSecMag
- Someone Please Explain Threats to Microsoft
September 2007
- Three Prereviews
- Cyberinsurance in IT Security Management
- Security Staff as Ultimate Insurance
- Visibility, Visibility, Visibility
- Excerpts from Ross Anderson / Tyler Moore Paper
- Microsoft's Anemone Project
- Be the Caveman
- Snort Report 9 Posted
- DHS Debacle
- Review of Snort IDS and IPS Toolkit and One Prereview
- Pescatore on Security Trends
- Tactical Network Security Monitoring Platform
- Security Jersey Colors
- Tactical Traffic Assessment
- Wisdom from Ranum
- TFTPgrab
- Radiation Detection Mirrors Intrusion Detection
- The Academic Trap
- Anton Chuvakin's Age of Compliance Reports
- Hoff Interviews Andy Jaquith
- China Cyberwar, or Not?
- US Needs Cyber NORAD
- Australia v China
- Air Force Cyber Command Provisionally at Barksdale
- China as Victim
- Canada v China
- New Zealand v China
- Blocking Port 53 TCP
- NSA IAM and IEM Summary
- Max Ray Butler in Trouble Again
- Example of Security Product Introducing Vulnerabilities
- Comment on NetWitness Article
- France v China
- TaoSecurity 2000th Post
- Hardware-Assisted Virtual Machine Rootkits
- United Kingdom v China
- Using VMware for Network Security Monitoring
- Hacker Is Not a Dirty Word
- Final Question on FAIR
- Is Digital Security "Risk" a Knightian Uncertainty?
- Wall Street Clowns and Their Models
- Japan v China
- Lessons from the Military
- Economist on Models
August 2007
- More Thoughts on FAIR
- DoD Digital Security Spending
- Germany v China
- Thoughts on FAIR
- Economist on the Peril of Models
- Experts: IDS is here to stay
- What Hackers Learn that the Rest of Us Don't
- Abe Singer Highlights from USENIX Class
- Marcus Ranum Highlights from USENIX Class
- Breach Pain
- Speaking of Bad Guys
- Loving the SSH
- Change the Plane
- Scanning with Flash
- Note from Black Hat on ARP Spoofing Malware
- Reviews on Managing Cybersecurity Resources and Security Metrics Posted
- Must-Read Post on Virtualized Switches
- Human Weapon
- CIO Magazine on IP Theft
- Pervasive Security Monitoring
- Minneapolis Bridge Lessons for Digital Security
- Kung Fu Wisdom on Threats
- Black Hat Final Thoughts
- Snort Report 8 Posted
- Black Hat USA 2007 Round-Up Part 2
- Black Hat USA 2007 Round-Up Part 1
July 2007
- Goodbye AIA
- Bejtlich Interviewed by TSSCI Blog
- Enterprise Visibility Architect
- Recent CVS Changes
- Review of XSS Attacks Posted
- Glutton for ROI Punishment
- Managing and Monetizing Victims
- NoVA Sec and NoVA BUG
- Review Posted Plus NAC
- No Undetectable Breaches
- NORAD-Inspired Security Metrics
- Another Review, Another Pre-Review
- Security ROI Revisited
- No ROI? No Problem
- Bank Robber Demonstrates Threat Models
- Thanks for the Memories Sys Admin Magazine
- Ivan Voras FreeBSD 7 Live CD
- Disk Usage Pages Added to NSM Wiki
- Snort Report 7 Posted
- Are the Questions Sound?
- Network Security Monitoring Case Study
- More Engineering Disasters
- Yet Another Review and Pre-Review
- ARP Spoofing in Real Life
- Another Review, Another Pre-Review
- One Review, One Pre-Review
- OpenPacket.org Developments
- Asset-Centric vs Threat-Centric Digital Situational Awareness
June 2007
- Bejtlich Teaching at Forensec Canada 2007
- Three Reviews Posted
- Internet Traffic Study
- Frame Check Sequence Recorded in STP
- Open Source Initiative Stands Up
- Latest Plane Reading
- More on Enterprise Data Centralization
- Hired Gun No More
- Web-Centric Short-Term Incident Containment
- Enterprise Data Centralization
- DHS Einstein Demonstrates Value of Session Data
- Hope for Air Force Cyberoperators
- Seats for Bejtlich at Black Hat 2007 Filling
- Why Digital Security?
- Two Pre-Reviews
- Security Application Instrumentation
- Threat Model vs Attack Model
- I'm Not Dead
- One for Ken Belva
- Cisco Router as DNS Server Demonstrates Functional Aggregation
- Bejtlich Joining General Electric as Director of Incident Response
- Triple-Boot Thinkpad x60s
- PowerLite S4 Multimedia Projector
- I Have Seen the Future, and It Is Monitored
- Interview with Designing BSD Rootkits Author
May 2007
- Owning the Platform
- Electronic Discovery Resources
- MRAPs Lose to Arms Race
- Review of Inside the Machine Posted
- Clueless Consultants
- Bejtlich on Sites Collide Podcast
- Security Language
- The Peril of Speaker-Sponsors
- Attacker 3.0
- Prof Starbird Mathematics Courses
- Brief Thought on FreeBSD X.org Update
- Another Anti-Virus Problem, Again
- Reminder: Time Running Out for Bejtlich at GFIRST
- Reminder: Early Registration Ends Soon for Bejtlich at SANSFIRE 2007
- Bejtlich Teaching Network Security Operations in Chicago
- Bejtlich Teaching Network Security Operations in Cincinnati
- 4000 Helpful Votes at Amazon.com
- Bejtlich Teaching at USENIX Security
- Snort Report 6 Posted
- Heading Home from Australia
- Latest Plane Reading
- It's Only a Flesh Wound
- Thoughts on Latest CISSP Requirements Change
- Database Forensics
- Third of the Three Wise Men
- Second of the Three Wise Men
- RFC 4890: Recommendations for Filtering ICMPv6 Messages in Firewalls
- CONFidence Wrap-Up
- Thoughts on Rear Guard Security Podcast
- LBNL/ICSI Enterprise Tracing Project
- Vulnerability-Centric Security
- USENIX Santa Clara Update
- Web Application Security Consortium Publishes Honeypot Report
- Metasploit 3 on FreeBSD
- Freenet6 on FreeBSD
- Bejtlich on Extrusion for SearchSecurity.com
- Reviews of IT Auditing, Hacking Exposed: VoIP, and Hacking Exposed: Wireless Posted
- Response to Bruce Schneier Wired Story
April 2007
- Help SANS with Security Career Stories
- Open Source Training
- What Should the Feds Do
- Two Pre-reviews
- Initial Thoughts on Digital Security Hearing
- Pirates in the Malacca Strait
- CALEA Mania
- War in the Third Domain
- Why UTM Will Win
- Threat Advantages
- USENIX HotBots Papers Posted
- Fight to Your Strengths
- When FISMA Bites
- Management by Fact: Flight Data Recorder for Windows
- Exaggerated Insider Threats
- Bejtlich Teaching at USENIX Annual
- It Takes a Thief
- Brief Thoughts on Security Education
- FISMA Dogfights
- Month of Owned Corporations
- FISMA 2006 Scores
- Bejtlich Speaking at Secure Development World
- Training an IDS
- Burning CDs on Ubuntu
- Network Security Monitoring History
- Bejtlich Speaking at Telestrategies ISS World
- Three Pre-Reviews
- Bejtlich Teaching, Speaking at GFIRST
- Bro Basics Follow-Up
- Bro Basics
- Daemonlogger in Ring Buffer Mode
- Snort 3.0 Alpha and IPv6
- Monitoring and Investigation Lessons
- Taking the Fight to the Enemy Revisited
- Snort Report 5 Posted
- Real Open Source
- Robert Graham on IDS and .ani Detection
- Best April Fool's Joke
- Help Johnny Long Go to Uganda
March 2007
- Full Content Monitoring as a Wiretap
- Threat Deterrence, Mitigation, and Elimination
- Remember that TJX Is a Victim
- VMware Server 1.0.2 on Ubuntu 6.10
- Mesh vs Chain
- Security Operations Fundamentals
- Ayoi on the Importance of NSM Data
- SANS Software Security Institute
- Manipulating Packet Captures
- ShmooCon 2007 Wrap-Up
- Blogging from ShmooCon Hack or Halo
- Taking the Fight to the Enemy
- Wireless Ubuntu on Thinkpad x60s
- Committing Changes to CVS
- TaoSecurity CVS at Sourceforge
- Gconcat on FreeBSD
- Recovering from Corrupted MySQL Database
- Backscatter Detected
- When Lawsuits Attack
- Ubiquitous Monitoring on the Horizon
- Wine on Ubuntu
- ShmooCon Talk
- Proactive vs Reactive Security
- Security Bloggers Network
- Programming and Digital Security
- Bejtlich Teaching in Krakow, Poland at CONFidence 2007
- Bejtlich Teaching at Sys Admin Magazine Conference in Baltimore
- Bejtlich at AusCERT and Secure Agility/Sydney
- Symantec Internet Security Threat Report Volume XI
- NSM and Intrusion Detection Differences
- Nail in the TCP Options Coffin
- Intrusion Detection RFCs
- Instrumentation is the Next Internet Explorer
- Criminal Intent
- USB to Serial Adapter
- Way to Go Joanna
- Incident Response Clarifications
- Cisco's Secure Routers Are Winning
- Someone Likes This Blog
- Five Thoughts on Incident Response
- Keith Jones on Incident Preparation
- Preview of IPv6 Problems
- Reviews of FISMA and Wireshark Posted
- Sourcefire Is Now FIRE
- Bejtlich Teaching at Black Hat Las Vegas 2007 Training
- Bejtlich Teaching at SANSFIRE 2007
- Snort Report 4 Posted
- Cigital Starts Blogging
- Nothing to See Here
- Full Content
- Printing to Lexmark from Ubuntu
- External Monitor on X60s
- Security Mentoring
- Sguil Client on Ubuntu
February 2007
- New Laptop Configuration
- Jose Nazario on Botnets
- Snort DCE/RPC Vulnerability Thoughts
- Bejtlich Teaching at Techno Security 2007
- Combat Insider Threats with Nontechnical Means
- Shawn Carpenter Vindicated
- Open Source Winners
- February 2007 (IN)SECURE Magazine
- Binary Upgrade of FreeBSD 6.1 to 6.2
- Another Anti-Virus Problem
- FISMA Redux
- Earth to MARS
- Not Your Father's TCP/IP Stack
- I See You
- Arbor Launches ATLAS
- NoVA BUG Founded
- Snort Report 3 Posted
- Single-Digit Security Service Providers
- Consider This Scenario
- TaoSecurity 2007 Training Schedule
- Enemy-Centric vs Population-Centric Security
- Keith Jones on Forensics
January 2007
- I Am Not Anti-Log
- NoVA Sec Meeting 1900 Mon 29 Jan 07 at Getronics
- The Self-Defeating Network
- Is It NSM If...
- Wireshark Display Filters and SSL
- What Do I Want
- TaoSecurity Enterprise Trust Pyramid
- My Investigative Process Using NSM
- Thoughts on December 2006 USENIX Login
- Snort Report 2 Posted
- Monitor Your Routers
- Review of The Pragmatic CSO
- Security Responsibilities
- Latest Laptop Recommendations
- FreeBSD VMware Interfaces
- FreeBSD News
- Brief Response to Marty's Post
- Comments on ISSA Journal Article
- Intel Premier IT Security Graphic
- Operational Traffic Intelligence System Woes
- Certified Malware Removal Expert
- Thoughts on Cisco Self-Defending Network Book
- The Revolution Will Be Monitored
- New Laser Printer
- Many Intruders Remain Unpredictable
- And Another Thing... More NSM Thoughts
- Brothers in Risk
- Security in the Real World
- Happy 4th Birthday TaoSecurity Blog
- Hawke vs the Machine
- Brian Krebs on Internet Explorer Vulnerability Window
- More FreeBSD Package Issues
- Rose Bowl Parade
- Recovering from a Bad FreeBSD Package
- Easy Sguil Client
- Reading Tips