cones688
Joined 14 years ago
Joined 14 years ago
How do you balance/deal with "security shaming", which is proven to put you further at risk as an organization?
There is some interesting research from the UK Government in this space - https://www.ncsc.gov.uk/blog-post/trouble-phishing#section_3
The relevant bit:
"If just one user reports a phish, you can get a head start on defending your company against that phishing campaign and every spotted email is one less opportunity for attackers...but phishing your own users isn't your only option.
Try being more creative; some companies have had a lot of success with training that gets the participants to craft their own phishing email, giving them a much richer view of the influence techniques used. Others are experimenting with gamification, making a friendly competition between peers, rather than an 'us vs them' situation with security."
I pay something like 20GBP a month during football season and get every game live in HD via chromecast, iOS, Web or Android plus redzone. They evidently have the chops and infrastructure to do it but its all a question of running the oligolpoly with the broadcasting services in the US.
http://sitereview.bluecoat.com/sitereview.jsp#/?search=submi...
our product stores all the logs raw in flats files on the file system, we don't use databases for keeping the logs in, this allows you to scale massively (ingestion limit is that of the correlation engine and disk bandwidth). You then just need an efficient search crawler and use of metadata so search performance is good too.
Issue is if you every need to pull the logs for court and you have messed with them (i.e. normalized them and stuffed them into a DB) then your chain of custody is broken.
Best of both worlds means parsed out normalisation so I don't have to remember that Juniper calls source ip srcIP and Cisco SourceIP, but the original logs under the covers for grepping if you need.
Pfsense is such a great piece of software, DNS forwarder and build in OpenVPN.
I don't think people appreciate the size and breadth of IT IBM does, my "tiny" division of security if an independent company would be the 3rd biggest Security vendor in the market.
http://www.standard.co.uk/news/london/pull-over-all-range-ro...
> IBM Hursley laboratory director Rob Lamb says: “There are 6,900 tweets, 30,000 Facebook likes and 60,000 Google searches per second." The mainframe CICS runs 1.1m transactions per second, which equates to 10bn per day [0]
[0] http://www.computerweekly.com/feature/Can-the-mainframe-rema...
To be fair this kind of technology has been on top end Mercedes for a while (10yrs plus) https://www.youtube.com/watch?v=eU83G3OaJuU#t=115
I drove one a few summers ago as a chauffeur for Farmers Classic, it was all in/around LA so was incredible on jammed freeways, It's nothing new though or Tesla specific.
Edit: Looks like Regexr can be run locally with node https://github.com/gskinner/regexr/
It also very much changed the officer handling us behaviour I would imagine, as usually in such brawls they detain everyone then get he said/she said stories. Instead he knew the guy had run across the street after we hadn't even acknowledged him, so knew my friend was the "victim".
Having been part of and designed these campaigns before (with open source options like https://getgophish.com/), there is no way to report as phishing or reward users who detected but therefore didn't interact with it. This means in your example - did the other 81% just not open it, ignored it, or actively thought it was phishing? These are key metrics a company needs to know their potential attack surface.