I'm sad and angry about the insurrection that took place in DC yesterday. I have a lot I want to say at some point, but for now I just want to say this in case anyone following me needs to hear it...
Free and fair elections are the bedrock of democracy. While more should be done to make access to elections easier, the presidential election was fair and the results are valid.
There has been no legitimate evidence that suggests any anomalies remotely close to a scale that would overturn a decisive election result. That's after 62 failed lawsuits and multiple recounts and audits.
In this country, the burden of proof is on the accuser. There is no proof because there was no large-scale wrongdoing in the election. The reason these lies don't make it to court is because if you lie in court, you go to jail.
Power is like the swinging pendulum of a clock. No matter which way it swings, it always swings back. If you push it too far one way, it swings back just as far the other way. Democracy exists to ensure the pendulum keeps swinging and ensure it never gets too far from you.
And trust me, history shows time and time again that if the pendulum stops swinging, it will eventually get very far away from you and the people you love. That is a place nobody wants to be.
If you're upset at the results of recent elections, you have your opportunity to be heard at the polls every couple of years. As an infosec professional and poll worker, I can assure you that there are many of us who work hard to make sure you can have confidence in that process.
I also want to take a moment and send my love to teachers around this country who have to walk into classrooms this morning and help young people make sense of what happened while still working through the raw emotion we're all feeling.
I made it a point to write and text several teachers I know this morning to tell them I love them, I support them, and let them know I'm here to help them in whatever way I can. I encourage you to do the same.
I'm also joining some classrooms over Zoom with teachers I know over the next few weeks to talk about the election process and my experience as a poll worker. It's a small thing, but that's one of the simple kinds of support teachers need right now.
β’ β’ β’
Missing some Tweet in this thread? You can try to
force a refresh
I think blue team work poses a greater number of challenges than red team work (there's just so much attack surface). However, I think writing a red team report is inherently harder than writing forensic reports. 1/
In a forensic report, a story already happened and you have to tell it. It takes practice and skill to do that well, but there is less of a creative element. The analyst's burden to elicit an emotional response is smaller. 2/
The events in the report themselves have evoked emotion... pain, sadness, etc. It's not as hard to get folks to take action because they've already felt these things. 3/
One of the things I do in my Investigation Theory course, for those willing, is work with students individually to help them learn to ask better investigative questions. For example, one student started with this Suricata rule:
1/
The task here is to start by asking a couple of investigative questions, assuming you have access to any evidence you might want. This student posed these two:
1. How long as this machine been infected? 2. How many beacons has the machine sent?
2/
In this case, the student is making some assumptions that the machine is already infected, but we donβt really know that for certain yet. The first goal should be proving or disproving the infection.
This was something I left intentionally vague in the poll to see how people interpreted it. Namely, some interpreted as competitive within your team, others as competitive in relation to a goal/adversary. Reveals some predispositions and bias, perhaps?
Consider the example of a wide receiver. They are internally competitive with their teammates because there are only so many spots on the team and passes to catch. At the same time, they are externally competitive towards the other team because they want to win the game.
In security, I observe that internal competitiveness is often over exhibited relative to the value and external competitiveness under exhibited relative to the value.
I mentioned that the idea for Intrusion Detection Honeypots #idhbook was floating around in my head for a long time. Something I didn't mention in the book, is that it was my time as a pen tester many years back that crystaized some key parts of the concept for me. π― 1/
As the attacker, it's all about iterative discovery. You access something, look around, and leverage your access to move on to the next thing. You do this until you reach a goal, whatever it may be. 2/
Good attackers exhibit some common traits -- seeking to decrease ambiguity, adaptability, and curiosity are big ones. You have to take what the network gives you and manipulate it. I really learned the value of these things in the offensive context at @inguardians. 3/
Let's talk about the differences between novices and experts. But, instead of cyber security, we'll use airport baggage screeners as an example. These are the folks who use the scanner screens to find forbidden items in luggage 1/
We all expect that experts are faster than novices. That's often correct, but WHY? 2/
Experts go through a few steps when looking at a bag image. First, they perceive the whole image quickly, looking for something to draw their attention. Maybe a dark spot or an unknown pattern. This holistic analysis is nearly automatic. 3/