Heartbleed and the Vulnerability Management Lifecycle
Heartbleed scores a 7.5 on CVSS, High and not Critical, yet it set off a global scramble. Here's how it moves through the vulnerability management lifecycle, from triage to verification.
Category: Field Notes
How to Lock Down SSH on a Public Server (and Waste a Bot's Time Doing It)
Keys, Fail2Ban, geo-filtering, and an SSH tarpit: how to harden a public-facing SSH server, and how to waste a brute-forcer's time while you're at it.
How Packet Sniffing Works on a Switched Network (and How to Shut It Down)
Switches stopped sniffing from being trivial, but they didn't end it. How passive and active sniffing work, how ARP spoofing and MAC flooding get around a switch, and what actually stops them.
I Wrote an Incident Response Plan for My Own Living Room
Most incident response plans are written for companies. Mine covers a house: virus, power failure, fire, flood, ISP outage, and the scenario most home plans skip, what happens if I'm not around.
The APT Lifecycle: How Attackers Lived Inside a Network for a Year (or Nearly Five)
One APT group sat inside victim networks for 356 days on average, and once for nearly five years. The six phases of the APT lifecycle, and where defenders get their best chance.
Cracking a Password-Protected Zip File Taught Me Patience
Two failed wordlists, a power outage mid-crack, and a lab file that wouldn't give up its password. My John the Ripper saga, and what it says about how long (and how weak) passwords can be.
What I (Unfortunately) Found When I Pointed Shodan at the Internet's Webcams
What Shodan's Webcam category reveals about unsecured internet-connected cameras, and the simple fixes that keep your own devices off a stranger's search results.
What Nmap and Nessus Found on My Own Network
A hands-on Nmap and Nessus vulnerability scan of a real home network, covering an outdated Node.js build, an open VNC service, and unauthenticated SMB shares.
Rolling Out Kerberos Without Active Directory
Told to roll out Kerberos with no Active Directory in sight? Here's the standalone-KDC path — what Linux, Windows, and macOS each actually need, and the one platform that needs nothing at all.
Field Notes: What "Computer Network Defense" Actually Means
CND sounds like a DoD acronym because it is one. A quick look at where the term came from, the NIST definition behind it, and the four-part structure — prevent, react, review, anticipate — worth using