Last Thursday DeMarc announced its acquisition of the Sentaurus IDS from Silicon Defense. In June I listed various companies selling Snort-based IDS appliances. It looks like Silicon Defense's support for its Windows version of Snort continues at WinSnort.com. This appears to be different from the binaries available at Snort.org. (I didn't check the WinSnort version because downloads there require registration.) DeMarc was famous for its GUI for Snort alerts, which no longer appears as a Snort add-on. However, it's now called PureSecure Personal and is free for "home use." Downloading it requires registration.
MITRE ATT&CK Tactics Are Not Tactics
Just what are "tactics"? Introduction MITRE ATT&CK is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
