Security

“Kill chain,” a cybersecurity term coined by Lockheed Martin, is shorthand for how cyber criminals target, recon, develop, and eventually penetrate their targets.  It’s among the hottest buzzwords in the cybersecurity industry right now, with many security products talking about how they address the…

This blog was authored by Ben Baker, Edmund Brumaghin, and Jonah Samost. Executive Summary GozNym is the combination of features from two previously identified families of malware, Gozi and Nymaim. Gozi was a widely distributed banking trojan with a known Domain Generation Algorithm (DGA) and also c…

Forrester Consulting recently conducted an analysis of customers using TrustSec software-defined segmentation in production networks and deduced the following: This matters today as network segmentation in the branch, campus and data center is a critical foundation for any network defense. Effectiv…

This blog post was authored by Jaeson Schultz. For the past five years we have enjoyed a relatively calm period with respect to spam volumes. Back at the turn of the decade the world was experiencing record-high volumes of spam. However, with the evolution of new anti-spam technologies, combined wit…

The Enterprise Strategy Group (ESG) conducted research into how cybersecurity professionals view network security monitoring and how they use it in their organization. The report Network Security Monitoring Trends surveyed 200 IT and cybersecurity professionals who have a knowledge of or responsibil…

This post was authored by Veronica Valeros, Petr Somol, Martin Rehak and Martin Grill, on behalf of the whole CTA team. Some of us still intuitively believe that our extensively safeguarded corporate networks are safe from the risks we are exposed to when connecting directly to public Internet. Yet,…

This is the third and final installment in our technical analysis of the H1N1 loader. In case you missed it, my colleague Josh Reynolds peeled apart the latest variant of H1N1 and analyzed its obfuscation tactics and techniques in the first blog, and in the second blog provides deep technical analys…

This is the second blog in a 3 part series that provides an in-depth technical analysis on the H1N1 malware. You can read the first entry here where I covered the evolution of H1N1, its infection vector and obfuscation techniques. This blog will provide an overview of its execution. H1N1 Execution E…

Once an organization has deployed technology infrastructure that enables visibility into the network (discussed in the first part of this blog), that organization now requires the properly trained security personnel to bring that time to detection (TTD) down to acceptable levels and to respond appro…