Blog

Recently the Computer Security and Industrial Cryptography (COSIC) research group at KU Leuven, a research university in Belgium, did a neat trick. In seconds they cloned a key fob and used it to enter and drive away with a Tesla Model S. The video, which shows the proof of concept attach in…

Organizations everywhere are moving pieces, if not all, of their workloads to public clouds. This is understandable as there are some clear benefits to this strategy. At the same, a public cloud instance does not work the same way as a physical on-premises network does. This means that when you…

In my previous posts in this series, I laid out my plan to enable Threat Hunting in a scalable way for a cloud environment by integrating Bro IDS with CloudLens, hosted on Kubernetes, with Elasticsearch and Kibana as the user interface. I also gave brief overviews of the key components, and how to…

Here at the Application and Threat Intelligence (ATI) Research Center, our team analyzes current security threats captured in the wild by our honeypots to determine the malicious actors’ weapons and strategies. The result of such research is usually a strike, which is a set of directives that the…

In my previous posts in this series, I laid out my plan to enable Threat Hunting in a scalable way for a cloud environment by integrating Bro IDS with CloudLens, hosted on Kubernetes, with Elasticsearch and Kibana as the user interface. I also gave brief overviews of the key components. In this…

In the previous post, I discussed why the need for IDS and how you can go about it with a lift-and-shift strategy.  This second part of the series will focus on an alternate visibility architecture that is cloud native. I will go through the key characteristics this architecture has that is…

Introduction For years, one of the most popular vectors for malware and attackers has been the humble PDF. There are a number of reasons for this, including the relative sophistication of the format and the capabilities it has for scripting as well as its cross-platform ubiquity. Indeed, Google…

In my previous posts in this series, I laid out my plan to enable Threat Hunting in a scalable way for a cloud environment by integrating Bro IDS with CloudLens, hosted on Kubernetes, with Elasticsearch and Kibana as the user interface. I then explained why Bro will serve as the intrusion detection…