Step-by-step guides, field reports and open source tooling for day-to-day security. Hardening Linux, NGINX and Postfix servers, honeypots and Fail2Ban, MISP, TheHive and GLPI, bash and Python scripts for incident response, encrypted backups and monitoring.
CISA justifies its new directive and its three-day deadline by pointing to AI-accelerated exploitation. Tested against the two public datasets available, that justification holds on one indicator and gives way on the others.
Eighteen Active Directory compromise techniques, their Windows event identifiers, and the logging plan that has to come first.
Executive Summary In a coordinated international initiative, the ASD, CISA, FBI, and their partners released the “Bulletproof Defense” guide. This document goes beyond simple warnings; it provides a technical methodology to dismantle the tactical advantage of Bulletproof Hosting (BPH) providers. These actors are not merely lax hosts; they are architects of cybercrime, providing infrastructure resilient…
In this article, I present a summary of the security best practices for Microsoft Exchange Server, directly inspired by the recommendations published by the NSA and CISA. These guidelines aim to strengthen the resilience of Exchange environments hosted in data centers — whether on-premises or hybrid — against current threats, including email account compromises and…
Example of a high-tech digital forensics workspace: multiple monitors, specialized equipment (write-blockers, duplicators), and secure storage, all isolated from the corporate network. This article is an essay with a personal perspective. There are undoubtedly errors and strong positions, but I stand by them. Within a Computer Emergency Response Team (CERT), analysts are tasked with…
In July 2024, a U.S. federal civilian agency experienced a sophisticated cyber intrusion that would later provide valuable lessons for defenders. The Cybersecurity and Infrastructure Security Agency (CISA) was called in to assist with incident response after the agency’s endpoint detection and response (EDR) system alerted to potential malicious activity. CISA’s investigation of the incident…
