Cyberspace and Great Power Competition

This is an hour symposium at the Council on Foreign Relations in which a panel of experts from Fireeye, Recorded Future and Johns Hopkins University discuss the last developments in threat operations by actors such as China, Iran, North Korea and Russia. The discussion is strategic in nature and it discloses the different interests of…

Defensible architectures

Defensible architectures are those that follow a set of specific practices oriented to avoid the shortcomings of classic security architecture. In a classical security architecture, systems are hardened during the design stage and they continue like this thorough the whole life-cycle thus assuming the threat’s modus operandi is constant unlike in a defensible architecture in…

Threat oriented cyber strategy with Cyber Prep

Cyber Prep is a preparedness methodology that aligns with a Multi-tier approach to Risk Management as defined in NIST SP 800-39. Cyber Prep supports the first step of this multi-tier approach which is Risk Framing. Risk framing pertains to the organizational level and from there it cascades all down to Mission / Business and Systems…

Understanding the threat for Organizational Cyber Preparedness

I have spent some time working in the threat industry and through my own experience, I started getting interested in looking at things from a different perspective. There are great professionals and researchers in this area of cyber security however, it lacks cohesion. A higher degree of cohesion within as well as in other areas,…

Network attacks and exploitation: a framework

There is no other book like this one, indeed I would say this is the only book I have read of this nature. It has been written and edited by Matthew Monte and Dave Aitel two experts in the field. The main focus of the book is Computer Network Exploitation (CNE) from a strategic point…

How They Rule the World: The 22 Secret Strategies of Global Power

This a short review of a geostrategy book written by Pedro Baños, Pedro is a colonel of the Spanish Army and a specialist in geostrategy, defense, security, and jihadist terrorism and he held different positions during his career from Lieutenant to Head of Counterintelligence and Security for Europe in Strasbourg. I initially got interested in this…

Russian disinformation operations for the masses

This a very good, short and to the point documentary on how Russia has been developing their disinformation operations. Having researched this field through papers and doctrine; I recommend watching this video. It is very succinct with real examples from the past and present in which the objectives and impact of these operations in western…

Free cyber intelligence courses from Augusta university

By chance, a few days ago I came across three free courses from the University of Augusta. These courses have been recognized by the NSA’s cybersecurity curriculum program. http://jagwire.augusta.edu/prestigious-nsa-recognition-for-augusta-university-cyber-security-instruction/ The courses are the following: The Global Cyber Threat Environment Cyber Conflict Strategic Cybersecurity I have not had time to go through all the courses however…

Enterprise Threat Modeling and ATT&CK

After spending some time working with the ATT&CK threat model, which is primarily aimed at modeling threats from a systems perspective, I have been wondering what other frameworks are available to model threats from an organisational or business unit perspective and that can also support the integration with ATT&CK. The following document: Enterprise Threat Model…

Cyber Intelligence Tradecraft Report by Carnegie Mellon University

A few days ago through my network of contacts, I found this report about Cyber Intelligence trade-craft and its evolution in the United States. This report is absolutely mind-blowing with its 176 pages of research on the evolution, challenges and best practices in the evolving field of Cyber Intelligence. The recommended audience as defined by…

Active Cyber Defence: deception and attacker control (2)

Let’s assume that until now, we have been applying active cyber defence in our environment. We are consuming intelligence, creating intelligence and working in tandem with our security operations teams to outmaneuver the adversary. We have also adopted the cyber kill chain model and other models to integrate intelligence within operations. Also, we are updating…

Active Cyber Defence: The need for an active cyber defence model (1)

It’s been some time since the first honeypots were developed and the concept of deception contemplated as a potential mechanism to detect, slow down and counter-attack the opponent. We are looking at 15 to 20 years of attempts to embrace cyber deception, almost in parallel in the same amount of time the threat has evolved…