ISC2 Blog

Detection Theory: Signature Versus Anomaly Detection

Detection experts understand that the optimal detection design and architecture is generally a combination of both signature and anomaly detection engines. In event processing, signature detection involves the real-time pattern matching analysis of events. A core advantage of signature detection is that basic pattern matching models are easy to understand and develop when you know exactly what pattern you are looking for. Designers then use a pattern, often called a signature, that searches for exact strings within an event object to detect, track, or observe an object of interest. Pattern matching can be executed very quickly, efficiently and inexpensively on... Read more →

Data Loss Prevention: Is really necessary to record all IP Traffic?

Due to Data Loss Prevention (aka DLP) some companies are requested to keep records of the traffic that enters and leaves his networks. The main issue nowdays is that is almost impossible to store all this traffic, per example lets assume a scenario of a 1Gigabit of inbound/outbound traffic link. This will generate something like 6.000 Terabytes of data. Obviously a very expensive storage is necessary. The point is: Is really necessary to store all IP Traffic? I don't think so. The main point here is to extract only the valuable information from the traffic and then storage it. Some... Read more →

Proxy Caches and Web Application Security

Following up on my earlier post, Proxy Caches are a Challenging Threat to Internet Security, here is my October 21, 2008 presentation at OWASP AppSec Asia 2008, Taiwan. View SlideShare presentation or Upload your own. (tags: security cache) PS: I highly recommend SlideShare for sharing presentations. Read more →

Process Coloring

There is a game called de Blob that has a pretty simple concept: move a blob around a city, run into a puddle of paint, and you turn into that color (or have that color mixed in with your current color.) Then when you run into a building, that building assumes the same color. So you're spreading different colors throughout a city, resulting in buildings and blocks hued red, orange, blue, green, etc. Simple but addictive, at least this is how the free version goes. I thought about this game after attending a presentation at my local OWASP chapter that... Read more →

Each One, Teach One

Information security profession is a growing field these days, as revealed in many surveys like the one by IDC/ ISC2. (I am tempted to quote these surveys, but here I am holding back the researcher within me and bringing to bear the teacher with a specific cause). Such surveys have pointed to the need of information security professionals in large numbers across all continents. Well, this is being tackled on various fronts like academic dimension with university programs at undergraduate or postgraduate level, corporate dimension having focused, need-based programs and professional dimension offering various security certifications, both vendor-neutral and brand-specific.... Read more →

AMTSO: Testing Standards Revisited

It's been a long hard few months in the anti-malware industry (which is why I haven't blogged outside work for a while): for some reason, all our conferences, workshops etc. all seem to be jammed into the last few months of the year. One event I'm always glad to get to is Virus Bulletin, the premier conference and networking opportunity for people in my speciality, but that was a month ago, so I guess it's a bit late to blog about it. I've just got back, though, from a meeting of AMTSO (Anti-Malware Testing Standards Organization), and that has me... Read more →