TaoSecurity Blog

  Happy birthday TaoSecurity Blog, born on this day in 2003! The best way to digest the key lessons from this site is to browse my four volume Best of TaoSecurity Blog book series , published in 2020. It's available in print as seen here, or as a properly formatted HTML-based digital book -- none of that PDF-based fixed format nonsense. Each book is a theme-centric collection of posts with new commentary for each entry. Some of what I wrote stood the test of time, and some did not. See what you think. Or, just scroll backwards through this site. Thank you to Blogspot and Google for hosting this blog for the last 23 years! This is post number 3,094 by the way.    

Today, 8 January 2019, is TaoSecurity Blog's 16th birthday! This is also my 3,041st blog post. I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. Here are a few statistics on the blog. Blogger started providing statistics in May 2010, so these apply to roughly the past 9 years only. As of today, since May 2010 the blog has nearly 9.4 million all time page views, up from 7.7 million a year ago. Here are the most popular posts of the last 9 years, as of today: I'm blogging a bit more recently, with 22 posts in 2018 -- more than my total for 2016 and 2017 combined, but still not half as much as 2015, which saw 55 posts. Twitter continues to play a role in the way I communicate. Last year  @taosecurity  had nearly 49,000 followers with less than 18,000 Tweets. Today I have nearly 53,000 followers with 19,000 Tweets. My rule is generally this: if I start wondering how to fit an idea in 280 characters on Twitt...

Today, 8 January 2018, is the 15th birthday of TaoSecurity Blog! This is also my 3,020th blog post. I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. I don't believe I've released statistics for the blog before, so here are a few. Blogger started providing statistics in May 2010, so these apply to roughly the past 8 years only! As of today, since May 2010 the blog has nearly 7.7 million all time page views. Here are the most popular posts as of today: Twitter continues to play a role in the way I communicate. When I last reported on a blog birthday two years ago, I said that I had nearly 36,000 Twitter followers for  @taosecurity , with roughly 16,000 Tweets. Today I have nearly 49,000 followers with less than 18,000 Tweets. As with most people on social media, blogging has taken a back seat to more instant forms of communication. These days I am active on Instagram as  @taosecurity as well. That account ...

Today, 8 January 2016, is the 13th birthday of  TaoSecurity Blog ! This is also my 3,000th blog post. I wrote my  first post  on 8 January 2003 while working as an incident response consultant for Foundstone. Kevin Mandia was my boss. Today I am starting my third year as Chief Security Strategist at  FireEye , still working for Kevin Mandia. (It's a small world. In April I will hit my five year anniversary with the Mandiant part of FireEye.) In 2015 my blogging frequency increased dramatically, with 55 posts, more than double my 2014 total of 23 and triple my 2013 output of 18. In 2012 I posted 60 stories, so I was close to that level in 2015. It's still nothing like my writing from 2003-2011 however! Why the drop over the years? I "blame" my  @taosecurity  Twitter account. With almost 36,000 followers, easy posting from mobile devices, and greater interactivity, Twitter is an addictive platform. I have authored roughly 16,000 Tweets since first posti...

Today, 8 January 2015, is the 12th birthday of  TaoSecurity Blog ! I wrote my  first post  on 8 January 2003 while working as an incident response consultant for Foundstone. Kevin Mandia was my boss. Today I am Chief Security Strategist at  FireEye , still working for Kevin Mandia. (It's a small world.) With 2945 posts published, I am still blogging -- but much less. Why the drop over the years? I "blame" my  @taosecurity  Twitter account. With almost 30,000 followers, easy posting from mobile devices, and greater interactivity, Twitter is an addictive platform. Second, blogging used to be the primary way I could share my ideas with the community. These days, speaking and writing are a big part of my professional duties. I try to track these reports here . Third, time is precious, and blogging often takes a back seat. I'd rather spend time with my family, research my PhD, work with start-ups, collaborate with think tanks, and so on. However, I s...

Today, 8 January 2013, is the 10th birthday of TaoSecurity Blog ! I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone working for Kevin Mandia. Today I am Chief Security Officer at Mandiant , back working for Kevin Mandia. (It's a small world.) With 2905 posts published over these 10 years, I am still blogging -- but much less. Looking at all 10 years of blogging, I averaged 290 per year, but in the age of Twitter (2009-2012) I averaged only 144 blog posts per year. Last year I wrote 60 times. Why the drop over the years? First, I "blame" my @taosecurity Twitter account. With over 15,000 followers, easy posting from mobile devices, and greater interactivity, Twitter is an addictive platform. However, I really enjoy Twitter and make the trade-off gladly. It would be nice to become a verified user though, with access to two-factor or two-step authentication. Second, blogging used to be the primary way I could s...

Today, 8 January 2012, is the 9th birthday of TaoSecurity Blog . I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. 2843 posts later, I am still blogging. Looking at all 9 years of blogging, I averaged 315 per year, but in the age of Twitter (2009-2011) I averaged only 171 blog posts per year. I plan to continue blogging, but I expect around the same number as last year -- somewhere in the 60 to 100 post range. I spend a lot more time expressing my views to the press and market researchers and analysts, so I'm often less inclined to do more of that in my free time through this blog. I plan to devote any decent chunks of free time to more traditional writing. I love to use Twitter for quick commentary. Thanks for joining me these 9 years -- I hope to have a 10 year post in 2013! If you're a security blogger, and you like this blog, please consider voting for me via the 2012 Social Security Bloggers Awards . I'm n...

Today, 8 January 2011, is the 8th birthday of TaoSecurity Blog . I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. 2739 posts (averaging 342 per year) later, I am still blogging. I don't have any changes planned here. I plan to continue blogging, especially with respect to network security monitoring, incident detection and response, network forensics, threat-centric security, and FreeBSD when appropriate. I especially enjoy reading your comments and engaging in informed dialogues. Thanks for joining me these 8 years -- I hope to have a ten year post in 2013! Don't forget -- today is Elvis Presley 's birthday. Coincidence? You decide. The image shows Elvis training with Ed Parker , founder of American Kenpo . As I like to tell my students, Elvis' stance is so wide it would take him a week to react to an attack. Then again, he's Elvis . I studied Kenpo in San Antonio, TX and would like to return to p...

Today, 8 January 2010, is the 7th birthday of TaoSecurity Blog . I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. 2542 posts (averaging 363 per year) later, I am still blogging. I don't have any changes planned here. I plan to continue blogging, especially with respect to network security monitoring, incident detection and response, network forensics, and FreeBSD when appropriate. I especially enjoy reading your comments and engaging in informed dialogues. Thanks for joining me these 7 years -- I hope to have a ten year post in 2013! Don't forget -- today is Elvis Presley 's birthday. Coincidence? You decide. The image shows Elvis training with Ed Parker , founder of American Kenpo . As I like to tell my students, Elvis' stance is so wide it would take him a week to react to an attack. Then again, he's Elvis . I studied Kenpo in San Antonio, TX and would like to return to practicing, along with ice...

Today, 8 January 2009, is the 6th birthday of TaoSecurity Blog . I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. 2339 posts (averaging 390 per year) later, I am still blogging. I don't have any changes planned here. I plan to continue blogging, especially with respect to network security monitoring, incident detection and response, network forensics, and FreeBSD when appropriate. I especially enjoy reading your comments and engaging in informed dialogues. Thanks for joining me these 6 years -- I hope to have a ten year post in 2013! Don't forget -- today is Elvis Presley 's birthday. Coincidence? You decide. The image shows Elvis training with Ed Parker , founder of American Kenpo . As I like to tell my students, Elvis' stance is so wide it would take him a week to react to an attack. Then again, he's Elvis . I studied Kenpo in San Antonio, TX and would like to return to practicing, along with ice...

Today, 8 January 2008, is the fifth birthday of TaoSecurity Blog . I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. 2087 posts (averaging 417 per year !?!) later, I am still blogging. My pace has slowed during the last few months, mainly because I have been spending more time reading in my off hours. I have also found less really gripping security events to report. I try not to jump on the bandwagon, so if you see a lot of coverage for a certain event I will probably not report it. I might chime in if there's an uncovered angle or I particularly want to record my thoughts on the issue. I plan to continue blogging, especially with respect to network security monitoring, incident detection and response, network forensics, and FreeBSD when appropriate. I especially enjoy reading your comments and engaging in informed dialogues. Thanks for joining me these five years -- I hope to have a ten year post in 2013! Don't fo...

Today TaoSecurity Blog is four years old. In my first post I emphasized the role that book reviews would play and didn't envision broader topics. As I mentioned in my one year birthday post , this blog is often used as a "hard drive for my brain," meaning I constantly refer to it for FreeBSD and other configuration details. I also share my thoughts on security in general and try to advance the theme of my TaoSecurity company motto: You may have noticed Elvis' image in my last post . In the sample slides from one of my training classes, Elvis represented the typical security analyst. As a final blog birthday note, today is Elvis' birthday too.

Today is the 3rd birthday of the TaoSecurity blog. I started this blog on 8 January 2003 as a "hard drive for my brain." I record how I accomplish certain tasks, or I put context around security events and related developments. I hope you find the content useful and relevant. I have a busy week ahead. I will deliver presentations on network incident response and network forensics at the 2006 DoD Cybercrime Conference in Palm Harbor, FL on Wednesday, 11 January 2006. Please stop by if you're at the conference. I will speak at ShmooCon 2006 in Washington, DC on Saturday, 14 January 2006 at 1600. David Bianco will join me. I hope to meet up with Sguil and FreeBSD users to discuss both projects.

Today is the 2nd birthday of the TaoSecurity blog. Thank you to all of my readers. The primary purpose of this blog is to be a "hard drive for my brain." In other words, I mainly record how I accomplish certain tasks, or I put context around security events and related developments. I hope you find the content useful and relevant.

Today this Blog is one year old. My first post was 8 Jan 03 . I started this Blog as a "hard drive for my brain," since I dislike keeping bookmarks and I prefer to place Internet links and news within context. I decided today to try to get VMWare 3.x working fully within FreeBSD, so I installed the VMWare3 port (version vmware3 3.2.1.2242-2) on my FreeBSD 4.9 STABLE system. First I made this change as recommended by the port install directions: janney# sysctl kern.ipc.shm_allow_removed=1 kern.ipc.shm_allow_removed: 0 -> 1 I then added this line to /etc/sysctl.conf to enable this at boot time: kern.ipc.shm_allow_removed=1 I then mounted linproc: janney# mount_linprocfs linproc /compat/linux/proc janney# mount /dev/amrd0s1a on / (ufs, NFS exported, local) /dev/amrd0s1h on /home (ufs, local, soft-updates) /dev/amrd0s1g on /tmp (ufs, local, soft-updates) /dev/amrd0s1e on /usr (ufs, local, soft-updates) /dev/amrd0s1f on /var (ufs, local, soft-updates) procfs on /proc (procf...