Incident Respond

By cliangNo Comments
Organizations usually invest substantially to manage and mitigate cyber attack with the detection technologies like log correlation and SOC (Security Operation Center) establishment plus comprehensive process of detailed respond to cyber threat scenarios with surprised drills etc. Not doubt, this will uplift the organization capacity and demonstrate due diligence has been exercised to deal with cyber attacks to stakeholders. On the other hand, cyber is just one of the failure or attack scenarios.  Like fire incident, it might be due to human negligence (left burning cigarette unattended), natural disaster (strike by lightning) or cyber attack (S01E04 Fire Code - vulnerable printer firmware).  No matter how, isolation to contain threat and promptly recovery to resume are required whether cyber or not. Resource (both skill set and manpower) in real life is always limited and should be put on recovery then drive from this end what is required for service resumption meeting recovery time objective.  And don't forget the TCO (Total Cost Ownership) involved to sustain...
Read More

Router or DPI?

By cliangNo Comments
One of the roles in cybersecurity practitioner is to share threat intelligence with internal stakeholders to enhance the situation awareness. If you are doing this, don't just share the links of the news. You need to analyze the published threat: Assess the credibility of the threat source Explore what are protection currently deployed in your organization How to avoid similar issues in your organization Prioritize protection investment if not yet deployed with applicable work around to reduce likelihood Essentially, it's WIIFM (What's In It For Me?). If you don't, you don't add value to sharing the threat intelligence. Sadly just a router rather than a smart Deep Packet Inspection....
Read More