TaoSecurity Blog

I was looking for resources on campus network design and found these slides  (pdf) from a 2011 Network Startup Resource Center presentation. These two caught my attention: This bothered me, so I Tweeted about it. This started some discussion, and prompted me to see what NSRC suggests for architecture these days. You can find the latest, from April 2018, here . Here is the bottom line for their suggested architecture: What do you think of this architecture? My Tweet has attracted some attention from the high speed network researcher community, some of whom assume I must be a junior security apprentice who equates "firewall" with "security." Long-time blog readers will laugh at that, like I did. So what was my problem with the original recommendation, and what problems do I have (if any) with the 2018 version? First, let's be clear that I have always differentiated between  visibility and control . A firewall is a poor visibility too...

When I begin receiving multiple questions on a topic, it's a signal that I should write a blog post. Several of you have asked me about my experience as a PhD candidate in the King's College London Department of War Studies . In this post I will try to answer your questions by explaining how I got to this point and my overall impressions about the program. My Academic Background I have bachelor's of science degrees in history and political science from the US Air Force Academy, and a master's degree in public policy from the Harvard Kennedy School. My last formal academic training ended in 1997 when I graduated from the Air Force Intelligence Officers Training Course. Why a PhD? I seriously began considering working on my PhD in 2006, when I was an independent consultant. I've guest lectured at dozens of schools over the years, and taught hundreds of students through my Black Hat courses. I thought the PhD experience would open more doors for future acad...

This week, FireEye released a report titled  The Numbers Game: How Many Alerts are too Many to Handle?  FireEye hired IDC to survey "over 500 large enterprises in North America, Latin America, Europe, and Asia" and asked director-level and higher IT security practitioners a variety of questions about how they manage alerts from security tools. In my opinion, the following graphic was the most interesting: As you can see in the far right column, 75% of respondents report reviewing critical alerts in "less than 5 hours." I'm not sure if that is really "less than 6 hours," because the next value is "6-12 hours." In any case, is it sufficient for organizations to have this level of performance for critical alerts? In my last large enterprise job, as director of incident response for General Electric, our CIO demanded 1 hour or less for critical alerts, from time of discovery to time of threat mitigation . This means we had to do more tha...

From this article : Scientists at the San Diego Supercomputer Center (SDSC) at UCSD analyzing traffic to one of the 13 Domain Name System (DNS) “root” servers at the heart of the Internet found that the server spends the majority of its time dealing with unnecessary queries. The paper explains what is happening and offers recommendations. Observations made at one server for one day don't conform to rigorous statistical norms, but the findings are interesting nevertheless. slashdot is discussing the findings .