TaoSecurity 2000th Post

This is the 2000th TaoSecurity Blog post. The 1000th Post appeared roughly two years ago. I started the blog on 8 January 2003, so in four months it will be five years old.

For roughly five years I've used this blog as a personal yet technical forum, but intentionally did not write about my workplace. I've blogged while working as an incident response consultant for Foundstone, a technical director for ManTech's Computer Forensics and Intrusion Analysis division, an independent consultant with TaoSecurity, and now director of incident response for General Electric.

I plan to continue blogging as a way for me to record my thoughts on various security subjects. I detest bookmarks since they quickly become unmanageable, lack context, and do not include my reaction or synthesis of the subject at hand. Since opening the blog to comments several years ago I've enjoyed hearing from blog regulars and plan to continue reading your replies to my posts.

Please note that I hardly ever engage in back-channel discussions regarding anything I post here. If you would like to interact with me regarding a post, please leave a comment with your thoughts, or a comment with a link to your own post on the subject. If you send me a question that requires any sort of thoughtful reply, I am most likely going to turn it into a blog post (with your permission to treat the matter anonymously). It's helpful to also remember my Personal LinkedIn Policy.

The only other forum in which I might engage in a running discussion is a mailing list. I mainly use email as a means of communication with family or coordination with colleagues. I do not debate over email.

The only blog-related issue you may notice in the coming months involves a review of old blog posts. I am considering revisiting all of my old posts for several reasons, so those of you who subscribe via RSS might see old posts republished. First, I'd like to remove or fix links to missing images. Second, I'd like to replace images hosted on my infrastructure with images posted at Blogger. Third, I'd like to add proper titles to old blog entries that lack that feature.

Thank you to those who have been reading for a while, and welcome to those who are newcomers. If you are not yet blogging, I highly recommend starting.

Comments

Marcin said…
Congrats Richard!! Your blog was one of the first security blogs I've started reading, and it's helped my learning exponentially, through reading your posts and discovering other blogs and articles you've linked too. Talk to you soon, -Marcin
8:14 PM
Anonymous said…
Congratulation. This is my daily reading :)
8:33 PM
Anonymous said…
I'm not absolutely certain, but I think you mean (in the 3rd paragraph) that you detest bookmarks, not that you detect bookmarks.:-)
2:05 PM
Richard Bejtlich said…
Colin, thanks!
4:40 PM
Anonymous said…
This is a great blog that provides a great service. Keep it up!
11:34 AM
Anonymous said…
A well-deserved congratulations Richard! This blog is a daily read for me as well.
1:25 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technical or pol
Read more