Discrete Recovery

 In 2017 I worked at an electrical distribution company as a security guy and eventually got to focus on ICS again. During this time I was very fortunate to be working for the right people in the right company to take and get the SANS GISCP, GRID and GCIP courses and certifications. I was physically at the 2019 SANS ICS Summit in Florida to take the GCIP, where I got to meet more than a few ICS legends. Not just the ones teaching, but this applied to most of the students and alot of the Summit attendees I met. I love taking remote classes; but nothing beats a live class. Traveling  post plague has lost a lot of the interest for me and I just do not enjoy it any more. I just renewed these ICS certifications earlier this year; thanks to SANS for making an updated copy available for a modest renewal fee.  Now I just wish we could buy the new ICS kit offered at the live courses, apparently supply chain problems are making that impossible for SANS. Some courses have been cance...

I am a big fan of continuing education and have been fortunate to have worked for companies that have provided me with the chance to attend relevant courses and achieve some certifications to supplement my job experience.  Over the last 30+ years, I have taken a decent amount on courses. Over the next few blog entries, I will share some of these experiences. Course material aside, what makes a course go from "good" to excellent is, of course,  the instructor. I have been fortunate to have learned from some of the very best over the years. I only wish I could have been a better pupil. My "career" in IT is all due to a former boss, Lloyd Wiebe, who changed the work schedule around so I could take a 1 year college entry level programming course back in the mid 1980's. After graduating from the course on a Friday, I started teaching it in another town the following Monday...no kidding. That is all it took back in the day. Thank you Lloyd for your kindness. During th...

More online training and books...and a GREAT new job ! :) Hey ! The interval between the last entry is due to my starting a new job and all the extra activities that goes with such a change. Very nice to again be feeling like a valued team member. There is an update to the Tony Robinson’s most excellent book, “ Building Virtual Machine Labs: A Hands-on Guide (Second Edition) “ I really appreciate when the author takes the time to update sections of their work and allows you to download the refreshed copy. Leanpub rocks…. The next online training – a refresher on malware analysis from TCM-SEC Very much looking forward to what Matt ( @HuskyHacksMK ) has to say. Based on one of my current focus area, I and reading three books this month – all from No Starch Press: https://nostarch.com/black-hat-python2E https://nostarch.com/automatestuff2 https://nostarch.com/beyond-basic-stuff-python

TRAINING : Awareness, CTI, Cyber Threat Hunting, Practical Ethical Hacking, HoneyPots August is drawing to a close and has been an interesting month for many reasons. I am starting a new job Sept 1st and the other is due to some great training I took. While I finish off   Building Intrusion Detection Honeypots with Chris Sanders (Applied Network Defense) https://www.networkdefense.io/library/building-intrusion-detection-honeypots/about/ Awareness SANS Awareness Summit https://www.sans.org/cyber-security-summit/#agenda The past year or so, SANS has provided a steady stream of excellent free virtual Summits for everyone to enjoy. Appreciated and amazing!   Windows I took Windows Post Exploitation with Kyle Avery and was impressed, Kyle is enthusiastic, highly skilled and explains things at the right level – at least for me ! I know very little about this area and as a blue team defender, I wanted to know a bit more of how some of the magic happens. This is a longer...

Volatilty, Linux, Hashing, OSINT, forensic images I had a need to examine a memory dump a while back and I used Volatility https://www.volatilityfoundation.org/  Normally I use both versions 2.6 and 3. Depending on the memory sample and what you are looking for, you might prefer one to the other. There are many great sites out there on how to use Volatility, but I wanted to mention a very useful site, https://unminioncurioso.blogspot.com/2019/03/dfir-first-steps-with-volatility.htm l from Marcos (@_N4rr34n6) because it reinforces a need to understand what you are looking for and he shared his thoughts with a number of good examples on how to get there – using grep and egrep. You can not be a modern day forensicator with out knowledge of the basic Linux commands. Another useful tool is Bulk Extractor, which also is often overlooked: https://fwhibbit.es/en/who-is-mr-x-lets-find-out-it-with-bulkextractor-egrep-patterns-we-are-what-we-browser Another essential it...

In the beginning... The first computer incident I was involved in was the ILOVEYOU virus in May 2000 and that directly lead me into forensics, with my first investigation being in 2004.  I started out with a script from a book called “Windows Forensics and Incident Recovery” written by Harlan Carvey (@keydet89) https://windowsir.blogspot.com/   Thank you Harlan for all the books since and creating RegRipper https://github.com/keydet89/RegRipper3.0 While I started out with a humble script, the modern forensicator/Incident Responder has a huge variety of FOSS tools to choose from. The need for Windows deadbox forensics still exists, but the focus has shifted to incident response (IR), with the need for speedy accurate triage, to stop Ransomware. Given the rise in ransomware, data breaches and malware attacks, the need for IR is only increasing. The good news is the basics for Forensics and IR fields (DFIR) are basically the same – paraphrasing the experts...