Article Security best practices for git users In recent years git has become one of most popular SCM/Version Control systems. Usage in some high-profile open-source projects like Linux or…
Article Snort Covert Channels Lab 3: Covert Channels Covert channels are used by outside attackers to establish communications with the compromised system, or by malicious…
Article Security Awareness Course Design Best Practices A well-designed security awareness course on its own does not guarantee a success for your security awareness program. There are many other…
Article Snort Tracking Exploit Progress with Flowbits Lab 4: Tracking Exploit Progress with Flowbits So far in our exercises, we used individual rules against specific activities. The flowbits keyword…
Article Complete Tour of PE and ELF: Structure Since we have completed the PE structure, now it is time to look at the ELF structure which is somewhat easier to understand as compared to PE. For…
Article SAP Security – Think Different Today we will discuss how SAP Security differs from traditional IT security. While in most cases security is security, no matter what we discuss, in…
Article Complete Tour of PE and ELF: Section Headers In the previous part, we have discussed the ELF and Program Header. In this article, we will cover the remaining part i.e. section headers. We will…
Article Snort Session Sniping with FlexResp Exercise 1: Packet Sniping FlexResp is a keyword used within Snort to snipe or tear down existing connections. The resp keyword is used to close…
Article Important Code Constructs in Assembly Language: Basics This article represents a continuing of the malware analysis course we began with the complete structure of PE and ELF earlier. Another important…
Article Snort lab: Payload detection rules (PCRE) Until now, when we used Snort to look for certain content within the payload, we've always looked for some specific values. What if we wanted to…
Article Ransomware in the Wild: It’s an Emergency Every week, new ransomware-based attacks are in the headlines. Malware authors are implementing new threats and new features to make these malicious…
Article Important Code Constructs in Assembly Language: Advanced We have covered some basic operations and conditional statements in Part 1. In this article, we will cover some more complex data structures to…
Article Forensic investigation with Redline This lab covers how to conduct a Memory investigation of malware using Redline from FireEye. In our lab we will analyze the Biscuit malware which is…
Article Snort Lab: Custom SCADA Protocol IDS Signatures Hands-on lab: scan a Modbus/TCP PLC, explore insecure read/write access with ModScan32, then build & test custom Snort IDS signatures to detect…
Article Lessons from Writing Multiple-Choice Test InfoSec Questions Writing multiple-choice test questions for InfoSec certification exams is challenging. By multiple-choice, I mean those questions that ask students…
Article How to write Phishing templates that work Phish me once Phishing isn't hard. Despite all the frightening news reports about ransomware and millions of stolen dollars and identities, people…
Article Implementation of a Virtual IDS Device in Passive Mode The arrival of server, desktop and network virtualization has brought along enormous flexibility in configuration options and a huge drop in…
Article CISA 2016 - What's New ISACA just recently released the 26th Edition of the CISA Review Manual to recognize and map to the new task/knowledge statements which can about as…
Article Snort Lab: Blinding IDS IDSs and IPSs can be attacked by generating false positives. If you can generate enough false positives, you can potentially: Overwhelm the IDS…
Article Panama Papers - How Hackers Breached the Mossack Fonseca Firm Introduction The Panama Papers are a huge trove of high confidential documents stolen from the computer systems of the Panamanian law firm Mossack…
Article Encryption Everywhere? This article discusses opportunistic encryption (OE) and ways to set up systems so that they will automatically encrypt whenever they can, rather…
Article Cryptographic algorithms lab For this lab we'll be using GPG, OpenSSL to demonstrate symmetric and asymmetric encryption/decryption and MD5, SHA1 to demonstrate hash functions.…
Article Snort Lab: Rule Performance Analysis There are various for analyzing Snort rules performance. In this lab, we are going to focus on the one that directly applies to rules: Rule…
Article Android forensics labs Exercise 1: Getting started with ADB Objective: "adb" is an essential tool for interacting with Android devices. We use this utility in multiple…
