Threat Detection and Response, Page 2

Calm the Churn with the RSA Archer Ignition program

If as a child you marveled at watching the simple, fascinating micro-example of physics of a pebble dropped into a puddle, you know what the results are. The pebble drops; the water’s surface is broken; ripples fan out from the point of impact… such an unassuming yet beautiful study of cause and effect.   Now, imagine…

Kingslayer – A Supply Chain Attack

Today, RSA is publishing new research on a sophisticated software supply-chain attack – dubbed “Kingslayer”. RSA Research investigated the source of suspicious, observed beaconing thought to be associated with targeted malware. In the course of their investigation, RSA discovered a sophisticated software supply-chain attack involving a Trojan inserted in otherwise legitimate software; software that is…

Schoolbell: Class is in Session

by Kent Backman and Kevin Stear, RSA Research Backstory If a sophisticated exploitation campaign is broad enough, it will attract the attention of multiple threat researchers. Such is the case of the malicious, multi-faceted exploitation campaign and botnet RSA Research has dubbed “Schoolbell.” In this blog, RSA will build on existing industry research and dig…

Are Software Supply Chain Attacks the New Norm?

How many of us stop to think about updating software we use every day? Do you think “maybe I should check for threats on this before I install it?” Or do you wait for it to automatically update? For many of us, we don’t consider the security of the everyday software we use. This is…

3 Steps to a Secure ICS Network

Industrial Control Systems (ICS) attacks have a direct impact on people’s lives. The consequences of these attacks can be unpredictable, which is why ICS protection is a hot topic in security right now. Defining the right protection layer and best approach to secure communications in this environment is crucial. Historically, ICS departments operated independently from…

“Up Your Game” to Close the Security Skills Gap

Ask any CISO to name the top challenges of the job, and their first response is likely to be the security “skills gap” – the inability to find enough skilled people to handle an organization’s security needs. With over 200,000 security jobs unfilled in the U.S. alone, organizations, especially security operations centers (SOCs), are continuously…

Mastering the implementation of a Threat Pattern

In previous posts we have discussed two of the most critical phases in the “The Lifecycle of a Threat Pattern”: analysis and design. In the analysis phase the objective is to fully understand the asset in scope by getting deeper into the context to formulate a set of residual risks to which the asset might be…

A New Cyber Mission Force

The context is something that could radically turn a bad event to something manageable or even interesting. If we consider how much the threat landscape changed, as did the context where security operates, we realize we are facing one of the most complex and articulated wars of the century – the Cyber War. As stated…

The Elephant in the Room for Endpoint Security

Stop me if you’ve heard this story before… Three blind men are traveling down the road to visit a friend.  On the way, they encounter an elephant.  Not being able to see it, they each stopped and felt the elephant to figure out what sort of creature it was.  The first one grabbed the trunk…

Engineering The Design Of A Threat Pattern

In our journey of developing and maintaining threat patterns, we have now arrived at a critical phase: the design. While the need of an implementation phase is immediate as well as the evaluation of the background analysis in order to build something meaningful (as explained by my colleague, Demetrio Milea) – the intermediate design phase is the…