HolisticInfoSec

numbat - AI agent observability

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Thu, 03 Sep 2026 00:00:00 +0000

Enterprises face an unmanaged crisis of AI agent and MCP server sprawl, characterized by rapid, decentralized proliferation of autonomous agents, protocol connections operating with excessive privilege, opaque execution paths, and identity blind spots.
Absent agent-aware governance, modern enterprises struggle to prevent, detect, or contain multi-hop autonomous exploits, leaving environments vulnerable to lateral movement, shadow collaboration, and unauthorized data exfiltration.
More succinctly, in light of the recent OpenAI/Hugging Face incident, monitoring clearly lags behind agent capability. The tooling to observe what agents are actually doing, in real time, is not yet standard practice, even at the labs building the agents.
To that end, Perplexity AI’s open source numbat offers excellent observability and visibility to supported desktop, CLI, IDE, and gateway agents through local hooks and plugins, OTLP/HTTP logs, and on-disk session artifacts.[1]

AI-Powered Knowledge Graph Generator & APTs

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Tue, 10 Feb 2026 00:00:00 +0000

Courtesy of TLDR InfoSec Launches & Tools again, another fine discovery in Robert McDermott’s AI Powered Knowledge Graph Generator. Robert’s system takes unstructured text, uses your preferred LLM and extracts knowledge in the form of Subject-Predicate-Object (SPO) triplets, then visualizes the relationships as an interactive knowledge graph.[1]

OctoSQL & Vulnerability Data

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Thu, 05 Jun 2025 00:00:00 +0000

As an avid daily reader of TLDR Information Security I benefit twofold. First, I gain interesting insights and recommendations regarding launches and tools, where I first learned about OctoSQL. Second, concerning vulnerability details inevitably land in my inbox on a near daily basis. Aside from my recommendation to join the TLDR InfoSec mailing list, toolsmith readers also benefit twofold as, herein, I share the use of OctoSQL as a fast CLI interface to vulnerability data aggregated via CVE-Vulnerability-Information-Downloader. If ever you’ve wanted to join vulnerability data (CVE, CVSS, EPSS, etc) from disparate data sources and file types, this is the toolsmith for you.

toolsmith snapshot: Protect AI ModelScan

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Sun, 16 Feb 2025 00:00:00 +0000

Protect AI’s OSS portfolio includes tools aimed at improving security of AI/ML software. These tools are meant for a wide range of engineering, security and ML practitioners including developers, security engineers/researchers, ML engineers, LLM engineers and prompt engineers, and data scientists.
Of particular interest in light of model serialization attacks is ModelScan.

Sandfly Security

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Wed, 28 Jun 2023 00:00:00 +0000

Sandfly Security, headquartered in New Zealand (where they know sandflies all to well), refers to itself as such because they’re like sandflies: they relentlessly bug and discourage intruders, deploying like a swarm onto endpoints, then disappear only to return again and again. Theses swarms of checks make life miserable for hackers on Linux hosts while minimizing system impact. I’ve been following Sandfly’s Craig Rowland on Twitter for awhile with the intent of giving Sandlfy a look for toolsmith, and in the time I’ve kept watch, the offering has grown into a comprehensive and robust platform for Linux security.

EDA with CISSM

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Thu, 04 May 2023 00:00:00 +0000

Introduction

Exploratory data analysis (EDA) is a mission critical task underpinning the predominance of detection development and preparation for cybersecurity-centric machine learning. There are a number of actions that analysts can take to better understand a particular data set and ready it for more robust utilization. In the spirit of toolsmith, and celebration of this being the 150th issue since toolsmith’s inception in late 2006, consider what follows a collection of tools for your security data analytics tool kit.

Prowler v3 - AWS & Azure security assessments

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Thu, 12 Jan 2023 00:00:00 +0000

As a current Google Cloud Platform defender, and former Microsoft Azure defender, I appreciate any tool or capability intended to provide multi-cloud protection. As noted via LinkedIn, Toni announced the release of Prowler v3 just before Christmas. Prowler v3 is a complete overhaul of Prowler, fully rewritten it in Python. Prowler is an open source security tool to perform AWS and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. Prowler v3 is now multi-cloud with Azure added as the second supported cloud provider. Prowler is significantly faster as well, now able to scan an entire AWS account across all regions 37 times faster than before.

Chainsaw

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Mon, 05 Sep 2022 00:00:00 +0000

I first spotted Chainsaw courtesy of Florian Roth’s Twitter feed given that Chainsaw favors using Sigma as one of its rule engines. Chainsaw is a standalone tools that provides a simple and fast method to triage Windows event logs and identify interesting elements within the logs while applying detection logic (Sigma and Chainsaw) to detect malicious activity. Chainsaw’s powerful ‘first-response’ capability offers a generic and fast method of searching through event logs for keywords (Kornitzer & D, 2022).

EPSScall - An Exploit Prediction Scoring System App

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 10 Jun 2022 00:00:00 +0000

If you follow Cyentia Institute’s Jay Jacobs via social media you may FIRST ;-) have learned about the Exploit Prediction Scoring System (EPSS) from him, as I did. I quickly learned that FIRST offers an API for the EPSS Model, which immediately piqued my interest. Per FIRST, EPSS provides a fundamentally new capability for efficient, data-driven vulnerability management. While EPSS predicts the probability (threat) of a specific vulnerability being exploited, it can scale to estimate the threat for multiple vulnerabilities on a server, a subnet, mobile device, or at an enterprise level (Jacobs, 2022).
“The (EPSS) is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. By collecting and analyzing these data, EPSS seeks to improve vulnerability prioritization by estimating the likelihood that a vulnerability will be exploited. The EPSS model produces a probability score between 0 and 1 (0% and 100%). The higher the score, the greater the probability that a vulnerability will be exploited (in the next 30 days)” (Jacobs, 2022).
As of February 2022, EPSS version 2 is available; give Jay’s write-up a good read before proceeding. EPSS v2 is preceded by EPSS v1 and CVSS v3. Note the significant increase in model coverage and efficiency per Figure 1.

Figure 1: EPSS Comparison by Effort

LotL Classifier tests for shells, exfil, and miners

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 24 Dec 2021 00:00:00 +0000

Happy Holidays, readers!
First, a relevant quote from a preeminent author in the realm of intelligence analysis, Richards J. Heuer, Jr.:
“When inferring the causes of behavior, too much weight is accorded to personal qualities and dispositions of the actor and not enough to situational determinants of the actor’s behavior.”
Please consider Mr. Heuer’s Psychology of Intelligence Analysis required reading.
The security intelligence team from Adobe’s Security Coordination Center (SCC) have sought to apply deeper analysis of situational determinants per adversary behaviors as they pertain to living-off-the-land (LotL) techniques. As the authors indicate, “bad actors have been using legitimate software and functions to target systems and carry out malicious attacks for many years…LotL is still one of the preferred approaches even for highly skilled attackers.” While we, as security analysts, are party to adversary and actor group qualities and dispositions, the use of LotL techniques (situational determinants) proffer challenges for us. Given that classic LotL detection is rife with false positives, Adobe’s SI team used open source and representative incident data to develop a dynamic and high-confidence LotL Classifier, and open-sourced it. Please treat their Medium post, Living off the Land (LotL) Classifier Open-Source Project and related GitHub repo as mandatory reading before proceeding here. I’ll not repeat what they’ve quite capably already documented.

Zircolite vs Defense Evasion & Nobellium FoggyWeb

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Tue, 28 Sep 2021 00:00:00 +0000

I’m pleased to be back sharing outstanding tools for security practitioners with you after an extended time out to finish my Ph.D.
Here now, in our 145th installment of toolsmith, we discuss Zircolite, a standalone and fast SIGMA-based detection tool for EVTX or JSON, a fine tool brought to us courtesy of @waggabat. Zircolite’s GitHub repo tells you absolutely everything you need to know, and the documentation is more than adequate, so I’ll repeat only this:

Zircolite is a standalone tool written in Python 3 allowing to use SIGMA rules on Windows event logs
Zircolite can be used directly on the investigated endpoint or in your favorite forensic/detection lab
Zircolite is fast and can parse large datasets in just seconds
Zircolite can handle EVTX files and JSON files as long as they are in JSONL/NDJSON format
Zircolite can be used directly in Python or you can use the binaries provided in releases

Abstract: Improved Security Detection & Response Via Optimized Alert Output - A Usability Study

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 20 Aug 2021 00:00:00 +0000

Once in a while, you get shown the light in the strangest of places if you look at it right ~Garcia/Hunter

I’ve been absent here for many months, but it has been with purpose. My dissertation, Improved Security Detection & Response via Optimized Alert Output: A Usability Study, is complete, and I’ve successfully defended it; pursuit of my PhD is complete, a new journey begins. I’ll begin with posting the abstract here. I’m in the midst of the dissertation publishing process, but once ready, it will be available in a fully open source capacity, no paywalls or subscription required. I’ll also share all the data (fully anonymized) as well as statistical routines and analysis in R. I’ll continue to post the related artifacts, including to full dissertation in via the R bookdown and thesisdown packages. I look forward to sharing this research with you while discussing it in a variety of forums and extending it to additional research opportunities. Stay tuned here for more.

toolsmith snapshot: Adversary Simulation with Sim

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Sun, 21 Feb 2021 00:00:00 +0000

Art by Juan Casini

I spotted Sim via Twitter and was immediately intrigued as I advocate strongly for any tools and features that enable configurable adversary emulation. Adversary emulation enables blue teams to validate and optimize their detection portfolio and thus determine the true efficacy of their detective capabilities. I do not consider any detection that has not been tested via direct purple or red team engagement, or via automated adversary emulation, as production ready. Per her GitHub repo, Hope Walker’s Sim is a C# application, configured via an XML file, that performs tasks based on the configuration to resemble user actions on a system in order to facilitate training and education. As a long time SOC and DFIR manager, training for me includes “training” detection and models to ensure optimal performance. IceMoonHSV’s projects appear to be fairly recent contributions to our community, I applaud Hope’s work here and offer a hearty welcome.

Security Detection and Response Alert Output Usability Survey

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Mon, 18 Jan 2021 00:00:00 +0000

As a PhD candidate at Capitol Technology University I’m conducting a scenario-based security detection & response alert output usability survey for cybersecurity analysts and managers in Security Operation Center (SOC), Digital Forensic and Incident Response (DFIR), Detection and Response Team (DART) & Threat Intelligence (TI) roles. These roles often make use of output from detection methods including machine learning & data science. Individual contributors & managers alike are welcome.
The purpose of the research is to determine if there is a statistically significant difference in security analysts’ preference and acceptance between text alert output (TAO) and visual alert output (VAO) derived by these methods.
The survey should take 20 minutes.
https://www.surveymonkey.com/r/TAOvsVAO

toolsmith snapshot: Gordon - cyber reputation checks

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Mon, 04 Jan 2021 00:00:00 +0000

Happy New Year! Here’s to 2021 being less of a dumpster fire than 2020. I’ve been really lagging in between posts, apologies for that. Between working on my dissertation, and current events courtesy of brown bears and SolarWinds, I’ve been a bit busy. ;-) That said, even if they’re just quick snapshots like this one, I’ll resume posting with more regularity.

Gordon is a great website for security analysis and threat intelligence practitioners courtesy of Marc-Henry Geay of France.
It’s a fine offering that quickly provides threat and risk information about observables such as IPv4 addresses, URLs, Domains/FQDNs, MD5, SHA-1, SHA-256 hashes, or email addresses.

toolsmith snapshot: Sooty - SOC Analyst's All-in-One Tool

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Tue, 13 Oct 2020 00:00:00 +0000

It’s been a bit longer than I like between posts, it’s definitely been busy here in the Pacific Northwest. I like to keep a running list of possible toolsmith topics, and I spotted Sooty back in December 2019, back in the good old days before our current pandemic and political mayhem. Sooty was developed with the intent of helping SOC analysts automate parts of their work flow. Sooty serves to perform the more mundane and routine checks SOC analysts typically undertake with the hope of freeing the analyst to conduct deeper analysis in a more efficient and timely manner.

To the Brim at the Gates of Mordor

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Mon, 03 Aug 2020 00:00:00 +0000

Herein lies an opportunity to explore the dark in the name of light.
“Some believe that it is only great power that can hold evil in check. But that is not what I’ve found. I found it is the small things. Every day deeds by ordinary folk that keeps the darkness at bay.” ~Gandalf
These words ring ever true in the every day fight we face combatting cyber crime and Internet malfeasance. Two offerings come forth to join this fight and converge here to create ample learning opportunities.
Brim offers a new way to browse, store, and archive logs with their free and open source Brim Desktop app, as well as the ZQ command line execution engine and query language.
The Mordor project provides pre-recorded security events generated by simulated adversarial techniques, categorized by platforms, adversary groups, tactics and techniques defined by the MITRE ATT&CK Framework, Evaluations, and Arsenal. MITRE really is the third protaganist in our epic, we owe them much as defenders of the realm.

Toolsmith Snapshot: SpectX IP Hitcount Query

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Wed, 10 Jun 2020 00:00:00 +0000

Apologies for the lag between posts, dear reader. I’m in the midst of a doctoral dissertation, almost finished my second chapter, and it doesn’t leave a lot of room for additional writing. Treat this entry as a stop gap, courtesy of Raido, from SpectX, the subject of our last toolsmith #143 on SpectX4DFIR. Herein, Raido provides us with a SpectX query to count hits from IPs during different time intervals.

SpectX: Log Parser for DFIR

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 10 Apr 2020 00:00:00 +0000

Welcome to the first COVID edition of toolsmith, I do hope this finds you all safe, healthy, and sheltered to the best of your ability.
In February I received a DM via Twitter from Liisa at SpectX regarding my interest in checking out SpectX. Never one to shy away from a tool review offer, I accepted. SpectX, available in a free, community desktop version, is a log parser and query engine that enables you to investigate incidents via log files from multiple sources such as log servers, AWS, Azure, Google Storage, Hadoop, ELK and SQL-databases. Actions include:

Large-scale log review
Root cause analysis (RCA) during incidents
Historical log analysis
Virtual SQL joins across multiple sources of raw data
Ad hoc queries on data dumps

SpectX architecture differs from other log analyzers in that it queries raw data without indexing directly from storage. SpectX runs on Windows, Linux or OSX, in the cloud, or an offline on-prem server.

Chain Reactor: Simulate Adversary Behaviors on Linux

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Mon, 24 Feb 2020 00:00:00 +0000

I am an advocate for the practice of adversary emulation to ensure detection efficacy. Candidly, I don’t consider a detection production-ready until it has been validated with appropriate adversary emulation to ensure the required triggers, alerts, and escalations are met. In many cases, basic human interaction can simulate the adversary per specific scenarios, but this doesn’t scale well. Applications and services to aid in this cause are essential. A couple of years ago I discussed APTSimulator as a means by which to test and simulate the HELK, but I haven’t given proper attention to adversary emulation on Linux. To that end, Chain Reactor “is an open source framework for composing executables that can simulate adversary behaviors and techniques on Linux endpoints. Executables can perform sequences of actions like process creation, network connections and more, through the simple configuration of a JSON file.”

DeepBlueCLI: Powershell Threat Hunting

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Mon, 13 Jan 2020 00:00:00 +0000

Happy New Year! Those among you who participated in the SANS Holiday Hack Challenge, also known as Kringlecon 2, this holiday season may have found themselves exposed to new tools or the opportunity to utilize one or two that had not hit your radar prior. Such was the case for me with DeepBlueCLI, a PowerShell module for threat hunting via Windows Event Logs.

Toolsmith Snapshot: Search with SauronEye

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Sat, 23 Nov 2019 00:00:00 +0000

If you’ve ever conducted a penetration test or a red/purples team engagement, you’ve been there. You’re staring at the target agency’s SharePoints and file shares and have recognized the bloody gold mine of pwnzorship it represents. Yet, as well we know, the search features in these scenarios are less than optimal. Maybe you’ve written scripts to help with this and batched up something useful, or cranked it out in PowerShell. @_vivami’s SauronEye is here to help. SauronEye is a “search tool to find specific files containing specific words, i.e. files containing passwords.”

DFIR Redefined Part 3: visNetwork for Network Data

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Tue, 24 Sep 2019 00:00:00 +0000

In keeping with pending presentations for the Secure Iowa Conference and [ISC2 Security Congress](https://www.eventscribe.com/2019/ISC2/agenda.asp?pfp=days&day=10/28/2019&theday=Monday&h=Monday October 28&BCFO=P|G), I’m continuing the DFIR Redefined: Deeper Functionality for Investigators with R series (see Part 1 and Part 2). Incident responders and investigators, faced with an inundation of data and ever-evolving threat vectors, require skills enhancements and analytics optimization. DFIR Redefined is intended to explore such opportunities to create efficiencies and help the blue team cause. visNetwork represents another fine example of visualizing datasets in a manner that analysts can naturally gravitate towards.

KAPE: Kroll Artifact Parser and Extractor

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Sun, 18 Aug 2019 00:00:00 +0000

Once in awhile the Twittersphere really sends me signal regarding content opportunities and potential research areas. If you follow any Blue Team aficionados, as I do, you’ll likely have seen the same level of chatter and excitement I have regarding Eric Zimmerman’s KAPE, the Kroll Artifact Parser and Extractor. In short, KAPE is a triage program to target devices or storage locations, find forensic artifacts, and parse them.

Commando VM: The Complete Mandiant Offensive VM

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Wed, 03 Jul 2019 00:00:00 +0000

The good folks at Mandiant have created the Commando VM, a fully customized, Windows-based security distribution for penetration testing and red teaming.
From the project’s About Commando VM content:
“Penetration testers commonly use their own variants of Windows machines when assessing Active Directory environments. Commando VM was designed specifically to be the go-to platform for performing these internal penetration tests. The benefits of using a Windows machine include native support for Windows and Active Directory, using your VM as a staging area for C2 frameworks, browsing shares more easily (and interactively), and using tools such as PowerView and BloodHound without having to worry about placing output files on client assets.”

toolsmith snapshot: r-cyber with rud.is

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Tue, 14 May 2019 00:00:00 +0000

I recently delivered my DFIR Redefinded: Deeper Functionality for Investigators in R presentation at the Computer Technology Investigators Network (CTIN) Conference on the Microsoft campus. This is content I provide when and where I can with the hope of inspiring others to experience what happened for me as a direct result of reading Bob Rudis and Jay Jacobs Data-Driven Security. At the risk of being a bit of fan boy, I will tell you that my use of R as part of my information security and assurance practice came via this book and Bob’s rud.is blog.
Bob “has over 20 years of experience defending companies using data and is currently Chief Data Scientist at Rapid7, where he specializes in research on internet-scale exposure.” He embraces the “In God we trust. All others must bring data” approach to his craft, and it’s righteous. One on the products of this approach is r-cyber, a collection of “R packages for use in cybersecurity research, DFIR, risk analysis, metadata collection, document/data processing and more.”

Beagle: Graph transforms for DFIR data & logs

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Wed, 27 Mar 2019 00:00:00 +0000

From About Beagle:
“Beagle is an incident response and digital forensics tool which transforms data sources and logs into graphs. Supported data sources include FireEye HX Triages, Windows EVTX files, SysMon logs and Raw Windows memory images. The resulting Graphs can be sent to graph databases such as Neo4J or DGraph, or they can be kept locally as Python NetworkX objects.
Beagle can be used directly as a Python library, or through a provided Web interface.”
Our use here will be through the Web interface running from Docker.

Detection Development: The Research Cycle & NIST CSF

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Tue, 19 Feb 2019 00:00:00 +0000

Leedy and Ormrod’s Practical Research: Planning and Design serves as an ideal framework for the practice of blue team detection development, thus helping meet the guidelines prescribed in NIST’s Cybersecurity Framework, particularly as part of detection and response.

Toolsmith Snapshot: Ad Blocking With Pi Hole

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Wed, 13 Feb 2019 00:00:00 +0000

Pi-hole® is a DNS sinkhole that protects your devices from unwanted content, without installing any client-side software.

gganimate: Animate YouR Security Analysis

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 04 Jan 2019 00:00:00 +0000

I regularly challenge myself and others to visualize the results of their analysis, when and where the data permits it. The likes of ggplot2 enables this beautifully for R users. Then, in September 2018, gganimate hit my radar via R-bloggers and I had an epiphany.

ViperMonkey: VBA maldoc deobfuscation

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Sun, 18 Nov 2018 00:00:00 +0000

ViperMonkey: a VBA Emulation engine written in Python, designed to analyze and deobfuscate malicious VBA Macros contained in Microsoft Office files.

RedHunt Linux - Adversary Emulation & Threat Hunting

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Sun, 14 Oct 2018 00:00:00 +0000

Based on Lubuntu-18.04 x64, the RedHunt Linux virtual machine for adversary emulation and threat hunting is a “one stop shop for all your threat emulation and threat hunting needs. It integrates an attacker’s arsenal as well as defender’s toolkit to actively identify the threats in your environment.”

Toolsmith Snapshot: Bashark - Linux post-exploitation toolkit

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Sun, 02 Sep 2018 00:00:00 +0000

“Bashark aids pentesters and security researchers during the post-exploitation phase of security audits.”

Best Practices

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 03 Aug 2018 00:00:00 +0000

Kevin Mitnick, in his book The Art of Intrusion, offers sound and succinct advice:

Ensuring proper configuration management is a critical process that should not be ignored. Even if you properly configure all hardware and software at the time of installation and you keep up-to-date on all essential security patches, improperly configuring just a single item can create a crack in the wall.[1]

So what defines a "best practice"?

Processes and activities that have been shown in practice to be the most effective.[2]

Events

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 03 Aug 2018 00:00:00 +0000

HolisticInfoSec.io’s Russ McRee speaks regularly on information security topics in the hope of sharing knowledge and resources with a wide audience.

Past Events

(ISC)2 Security Congress DFIR Redefined: Deeper Functionality for Investigators with R
October 29, 2019

Secure Iowa Conference 2019 Keynote
October 8, 2019

Derbycon 7 DFIR Redefined: Deeper Functionality for Investigators with R
September 2017

BSides Augusta 2017 Keynote
September 16, 2017

Emcee at Microsoft’s BlueHat v14, Redmond, WA, October 10, 2014

In The News

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 03 Aug 2018 00:00:00 +0000

Digital Guardian 08/5/2020 Top 50 InfoSec Blogs You Should Be Reading

JAGWIRE NEWS August University 08/25/2017 Augusta University to host cybersecurity conference

12 WRDW 07/03/2017 Organizers prepare for this year’s Augusta Cyber Week

Reciprocity Labs 04/25/2017 69 Information Security Blogs You Should Be Reading

E&E News 10/06/2015 GRID: Friendly hackers break into a utility and make a point

Idaho Statesman 11/18/2014 Hackers are having their way, nearly unchecked

Digital Guardian (Verdasys) 10/22/2014 Top 50 InfoSec Blogs You Should Be Reading

Publications

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 03 Aug 2018 00:00:00 +0000

HolisticInfoSec.org’s Russ McRee writes regularly regarding information security topics in the hope of sharing knowledge and resources with a wide audience.

February’s toolsmith snapshot focuses on network-wide ad blocking via your own Linux hardware with Pi-hole.
Older article copies, particularly from September 2015 through August 2018 are available here and older PDF copies prior to September 2015 are available here.
Award winning toolsmith offers insights on tools useful to the information security practitioner, typically open source and free.

Shodan As A Verb - Find The Fail Before It Finds You

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 03 Aug 2018 00:00:00 +0000

Shodan (noun): the world’s first search engine for Internet-connected devices.

Shodan (verb): To Shodan; I Shodan, You Shodan, We Shodan…do this, before an adversary does it for you.

Simplicity

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 03 Aug 2018 00:00:00 +0000

Employ simplicity as a tool used to keep your systems running securely and efficiently. Simplicity helps eliminate network clutter, performance issues, cost, and reduces risk. Give yourself the space to step back, analyze and test carefully to ensure all your systems and networks meet a secure standard. Streamlining processes greatly enhances uptime and quality of service, as well as aiding in secure systems.

Bruce Schneier, in 1999, wrote for Information Security, "You can't secure what you don't understand." His predictions hold true:

Templates

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Fri, 03 Aug 2018 00:00:00 +0000

Templates for your use in your organizations and endeavors to improve your security posture.

Incident Response Test Plan

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Mon, 01 Jan 0001 00:00:00 +0000

Presentations

HolisticInfoSec.org’s Russ McRee presents regularly regarding information security topics in the hope of sharing knowledge and resources with a wide audience.

Cloud Security Alliance Seattle Chapter: May 2016 Chapter Meeting Attack & Detect: Red vs. Blue PowerShell 25 MAY 2016

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Mon, 01 Jan 0001 00:00:00 +0000

Advisories

2008

HIO-2008-0228 Interspire Shopping Cart XSS

2009

HIO-2009-0305 e107 Multiple e107_admin CSRF & XSS Vulnerabilities

2010

HIO-2010-0223 Web Wiz Forums CSRF Vulnerabilities

HolisticInfoSec

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Mon, 01 Jan 0001 00:00:00 +0000

HolisticInfoSec.io is dedicated to sharing information security content and resources in an open, clear manner, with the hope of helping improve infosec for all who seek to do so. Information security is best broken down to the most simple components: best practices and common sense. The threat-scape facing an information security practitioner is perpetually dynamic; we must adapt and evolve as do those threats. Holisticinfosec.org endeavors to aid in that process through dynamic content and timely topics in toolsmith. As well we know, those who would do harm never rest: protect your own.

HolisticInfoSec

russ@holisticinfosec.io (Russ McRee, Ph.D.) — Mon, 01 Jan 0001 00:00:00 +0000

Russ McRee writes award-winning toolsmith, published ~~monthly~~ as often as possible. ;-)

As of August 2018, toolsmith is exclusively published via holisticinfosec.io.
From September 2015 through August 2018, toolsmith was exclusively published at the HolisticInfoSec blog.
From November 2006 through August 2015, toolsmith was published in the ISSA Journal.

Thank you for your continued patronage and support.