Security Training for Incident Handling: What Else Is Out There?

I had a guest post published on Security Training for Incident Handling: What Else Is Out There?.

This post is a follow-up to an earlier post (Security Training for Incident Handlers: What’s Out There?) that points out some alternatives for training for incident handlers.

Using Geolocation Data to Benefit Security

I had a guest post published on Using Geolocation Data to Benefit Security.

This post lists how you can enrich your information with geolocation data.

Sharing Encryption Keys: A Practical Example With GPG

I had a guest post published on Sharing Encryption Keys: A Practical Example With GPG.

Stay Up-to-Date on Security News with OPML feeds

In 2015 I did a posting on the Security Intelligence blog on How to Stay Up-to-Date on Security Trends. The post describes how you can streamline the process of following different news and threat information channels, classify them and bring them to good use.

One of the tools that you can use is RSS feeds. I personally use a setup of fever to grab different RSS feeds and then have them delivered in one centralRead more.

Using open source intelligence feeds, OSINT, with MISP

I love MISP, Malware Information Sharing Platform & Threat Sharing. I did three earlier posts on how to use and setup MISP. part 1, part 2 and part 3.

One of the nice new features by MISP is including feeds from different open source intelligence feed providers.

How does it work? Basically the feeds are provided as a JSON feed, you can browse them within MISP, import them individually or subscribe to the feed toRead more.

The New Glibc Getaddrinfo Vulnerability: Is It GHOST 2.0?

I had a guest post published on Security Training for Incident Handlers: The New Glibc Getaddrinfo Vulnerability: Is It GHOST 2.0?.

The post describes the critical issue found in glibc getaddrinfo (CVE-2015-7547) and gives you advice on patch management to deal with current (and future) issues in glibc.

Security Training for Incident Handlers: What’s Out There?

I had a guest post published on Security Training for Incident Handlers: What’s Out There? on the blog of IBM’s Security Intelligence.

The post describes the different types of security trainings that are available for incident handlers, including vendor-specific training, general training and community driven training.

Using Passive DNS for Incident Response

According to isc.org “Passive DNS” or “passive DNS replication” is a technique invented by Florian Weimer in 2004 to opportunistically reconstruct a partial view of the data available in the global Domain Name System into a central database where it can be indexed and queried.

In practical terms passive DNS describes an historical database of DNS resolutions. What does this all mean? It means that you can lookup to what IP address a domain resolvedRead more.

DDoS Protection by country based filtering

DDoS prevention is a hot topic. DDoS attacks have become a weapon of choice for malicious actors to conduct cyberattacks. I did a posting on Defending Against Apache Web Server DDoS Attacks and contributed to a DDoS: Proactive and reactive measures document from CERT.be.

One of the mitigation measures that you can apply is doing country based IP filtering. This basically limits access to your network from a limited set of prefixes. I consider thisRead more.

Secure Communication

I recently had a presentation and information session for human right activists on how to secure their group communication and data sharing.

The target audience was non-technical using different operating systems (Windows, Linux and OSX) and using both default laptops and mobile devices (primarily Android based).

I uploaded the presentation to SlideShare.

Secure Communication from Koen Van Impe