The Pyramid of Pain

To illustrate this concept, I have created what I like to call the Pyramid of Pain.  This simple diagram shows the relationship between the types of indicators you might use to detect an adversary's activities and how much pain it will cause…

The Information Security Leader, Part 1: Two Distinct Roles, Four Fundamental Questions and Three Persistent Challenges

If you always do what you’ve always done, you’ll always get what you’ve always got.” This kernel of wisdom comes from a certain high-tech headhunter in the late 1980s, who passed it on as she was helping her candidates prepare…

The Security Cost of Free Smartphone Apps

There are hundreds of thousands of them to choose from now whether you have an iPhone, an Android or some other version of smartphone. Free mobile applications sound like a great bargain, but be aware that if you aren't careful,…

Russian Threat Group Targets Clinton Campaign

Governments like to know what the leaders of rival countries are really thinking. To answer these questions, they may turn to their spy agencies, tasking them with obtaining information on policy and strategy that other countries would rather keep secret.…

Best Practices for Confidence in the Cloud

Until recently, most cloud migration decisions were made without the benefit of the CISO's guidance. In an effort to take advantage of cloud efficiencies, line-of-business users have moved critical assets and confidential data to the cloud without an understanding of…

Malware Lingers with BITS

Threat actors leveraged a “notification” feature in the Windows Background Intelligent Transfer Service (BITS) to download malware. In May 2016, the SecureWorks® Incident Response (IR) Team conducted an engagement involving a malware compromise. Antivirus software had previously detected and remediated…