6 Signs of Successful Threat Hunting

When a threat hunting program is established by an organization, their goal is to proactively hunt threats, with a focus on newer, more sophisticated attacks for which reliable signatures or indicators are not yet available. Bonus: Check out the "Top 5 Threat Hunting Myths" However, without an...

5 (Not So) Scary Infosec Questions to Answer this Halloween

It’s Halloween. Time for candy checking, cavities and the start of the retail season. And while attacks will rise around the holidays, don't let the FUD machine get you too scared about things the go bump in the infosec night. Here are five things that should actually concern you. They were easil...

Threat Hunting: Adoption, Expertise Grow, but Work Remains

Threat hunting, an often misunderstood but powerful security practice, is gaining traction, as more organizations reap benefits from it and get better at it. However, there is still a lot of room for adoption to increase and for practices to improve. Those were key findings from the SANS...

Prolexic Platform Enhancements - New APJ Scrubbing Centers and More

by Don Ng and Greg Burns This October, Akamai is announcing the turn-up of two additional Prolexic DDoS mitigation scrubbing centers in Singapore and Osaka, building on the nine previous scrubbing centers turned up this year and adding to our existing APJ footprint in Sydney, Tokyo, and Hong Kong...

No Data is an Island: One Infosec Pro’s Experience As a Consumer Involved in a Data Breach

British Airways BA was hit by a major breach that resulted in a loss of customer records. I was notified promptly by BA. I thought their public response was timely. By the way, this breach was announced while I was about to board a BA flight to Heathrow. My credit card was used to purchase my...

Excerpts From “Why Companies Are Replacing AV with Advanced Endpoint Security”

Is legacy antivirus failing to keep your endpoints secure? In Carbon Black's recent webinar, Fulcanelli Chavez, Sr. Security Operations Analyst at D.A. Davidson, shared how switching from McAfee to Cb Defense has improved protection and simplified operations for his team. Below are excerpts from...

Partner Perspectives: VMRay + Carbon Black Bridge the Gap Between Threat Hunting & Incident Response

In 2016, Carbon Black and VMRay introduced an out-of-the-box integration combining the capabilities of two industry-best platforms: Cb Response and the VMRay Analyzer. Leveraging the threat hunting and incident response capabilities of Cb Response, alongside the malware analysis and detection...

Vulnerability hunting with Semmle QL, part 1

Previously on this blog, we’ve talked about how MSRC automates the root cause analysis of vulnerabilities reported and found. After doing this, our next step is variant analysis: finding and investigating any variants of the vulnerability. It’s important that we find all such variants and patch...

Black Hat 2018: Google’s Tabriz Talks Complex Security Landscapes

LAS VEGAS – The complexity of the cybersecurity landscape is at an all-time high, with security researchers, vendors, third-party ecosystems and even governments all trying to come to a consensus for making the cyber-world a safer place. For security experts, navigating these choppy and crowded...

Partner Perspectives: Security Orchestration as a Catalyst for Proactive Incident Response

Meny Har is the VP of Product for Siemplify. Benjamin Franklin famously advised the fire-threatened residents of Philadelphia, “An ounce of prevention is worth a pound of cure.” And while being proactive may have been effective for fire prevention, the approach does not translate into the impendi...

10 Endpoint Security Problems Solved by the Cloud – Managing Multiple Agents

So far in this blog series, we’ve discussed the state of endpoint security, and the challenges of keeping systems up to date and integrating multiple products. This installment will take a look at how the cloud solves our third challenge: managing multiple agents. Too Much To Keep Track Of A good...

QSC18 Virtual Edition: Vulnerability Risk Management

When vulnerability risk management is proactive, organizations don’t have to hurriedly react to attacks that exploit bugs for which patches are available, as happened with WannaCry. “The vast majority of WannaCry remediation took place as an emergency type process,” Jimmy Graham, a Qualys Directo...

A New Paradigm For Cyber Threat Hunting

It's no secret that expecting security controls to block every infection vector is unrealistic. For most organizations, the chances are very high that threats have already penetrated their defenses and are lurking in their network. Pinpointing such threats quickly is essential, but traditional...

Network Security Monitoring: Security Onion

Network Security Monitoring NSM is, put simply, monitoring your network for security related events. It might be proactive, when used to identify vulnerabilities or expiring SSL certificates, or it might be reactive, such as in incident response and network forensics. Whether you’re tracking an...

2018 Cyberthreat Defense Report: Where IT Security Is Going

What keeps you awake at night? We asked IT security professionals the same question and found that these issues are top of mind: malware and spear phishing, securing mobile devices, employee security awareness and new technologies that detect threats capable of bypassing traditional signature-bas...

Micropoint Proactive Defense Software Denial of Service Vulnerability (CNVD-2018-02956)

Micropoint proactive defense software is a set of third-generation anti-virus software from China's Oriental Micropoint Micropoint Company. The software uses proactive defense technology to analyze and judge to achieve the purpose of defense against viruses. A security vulnerability exists in the...

Micropoint Proactive Defense Software Denial of Service Vulnerability

Micropoint proactive defense software is a set of third-generation anti-virus software from China's Oriental Micropoint Micropoint Company. The software uses proactive defense technology to analyze and judge to achieve the purpose of defense against viruses. A security vulnerability exists in the...

Micropoint Proactive Defense Software Denial of Service Vulnerability (CNVD-2018-02978)

Micropoint proactive defense software is a set of third-generation anti-virus software from China's Oriental Micropoint Micropoint Company. The software uses proactive defense technology to analyze and judge to achieve the purpose of defense against viruses. A vulnerability exists in the...

Input validation

In Micropoint proactive defense software 2.0.20266.0146, the driver file mp110005.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000038...

Input validation

In Micropoint proactive defense software 2.0.20266.0146, the driver file mp110005.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000118...