Articles

Today everyone is talking about security automation. However, what are the right processes and actions to automate safely? What are the right processes and actions to automate that will actually achieve some security outcome, such as improving sec ops efficiency or reducing attacker dwell time? Just look in the latest industry report and you will find a statistic about how long attackers linger in a network without detection. It’s getting better, but the average is still heavily in favor of the…

To unleash creativity, my middle school art teacher occasionally offered up all the painting, woodcarving, pottery, and collage resources in the studio, with no guidelines or constraints other than our imaginations and the available class time. The results ranged from the mundane to the inspired. I carved a 3D lobster. (Sadly, no picture survives, but let’s pretend it is as wonderful as the one here carved by Ryousuke Ohtake). OpenDXL as a Blank Canvas As an open source integration framework,…

A fast-forward button for integration to a unified security architecture. One of the reasons why the Mission Impossible premise has resonated across the generations is that all of us, at one time or another, are handed projects that seem to come with that label. Unfortunately, if you’re like me, you feel more like Wile. E. Coyote holding that bomb as it explodes, rather than the cool Tom Cruise or unflappable Peter Graves if you are an old-school fan. It seems I am always searching for the…

Fifteen Easy Ways to Integrate, Orchestrate, and Expedite Security Operations

Every now and then I get into a debate about what constitutes a platform. To me, it means connecting functions and data easily and as directly as possible, balancing speed and simplicity and safety. While it’s nice to present this as an architectural stack, with open interfaces at the edges, modern software development is more complex. Programmable interfaces, both open and proprietary, sprout around each layer and module as new ideas, “shiny objects,” are brought to market in an increasingly…

You are not paranoid. They are out to get you. McAfee research showed that more than half (56%) of 2015 investigations resulted from a targeted activity by criminals, insiders, or nation states. This dominance increases the urgency to change our approach to security operations practices. The new book, The Second Economy, by McAfee CTO Steve Grobman and CMO Allison Cerra, documents the vulnerability of digital systems using parallels from physical systems and presents a call to action for the…