Last week I looked at some creative uses of log analysis for detecting malware, and ways to acquire Windows physical memory for analysis. What I've seen time and time again is where those in charge of security don't even bother to log information from their systems and applications, leading them to a much larger incident response scenario than if they could detect it sooner.

It was a busy week. Some of you made the annual trek out to San Francisco, while the rest of you were stuck working diligently in your office. Me...well, I'm in the latter group.

Cyberwar and advanced persistent threats (APT) are fun terms thrown around a lot lately. Everyone seems to have their own slightly varied opinion on what they each mean. Personally, I don't care all that much what the different nuances of each are as long as I can understand the associated threats and deal with them appropriately.

Good news for Department of Defense folks. They can now start using USB flash drives again -- provided there's absolutely no other way to transfer the data from point A to point B. OK, so maybe it isn't time to rejoice just yet.

The average computer user (a.k.a. most of my family) doesn't have a fighting chance. I hate to say it, but the malware we're seeing on a daily basis makes this scary fact evermore true. There is absolutely no way that most home users are going to be able to protect themselves against modern malware like Zeus. Malware authors have become extremely good and proficient at what they do because it's making them money.

The buzz generated from Core Security's move to integrate with the Metasploit Framework has left me a little puzzled. Don't get me wrong: I love Metasploit. It's a fantastic tool that has certainly been put through its paces as a pen-testing tool -- it's free, open source, and extremely accessible to aspiring security professionals. And, of course, I've heard great things about Core's flagship product, Impact Pro. But the deal just seems like an odd move.

Advanced persistent threat: I like the term -- it sounds evil, and it is...well, at least I think it is. There has been a lot of news, opinions, and genuine FUD on APT since Google went public with news of its breach several weeks ago. Until then, I really don't think anyone ever paid much attention to what APT was, even though well-respected people, like Richard Bejtlich and the folks at Mandiant, have been talking about it for a while.

Security issues surrounding social networking sites make me cringe. I understand their practical applications, but they are also the platform for easy delivery of exploits through social engineering. I've seen many systems compromised by the unconscious click on a Facebook link that users' nonchalance on similar sites and their trust in the Internet frustrates me to no end.

Hearing about how many companies were hacked during the Aurora attacks due to a software vulnerability in Microsoft's Internet Explorer (IE) is frustrating. Now another attack is ready to be unveiled at Black Hat DC that also uses an IE "feature." The thought of what can and has happened because of these flaws is scary -- theft of personal information, espionage, identity theft, etc. -- but what happens when software glitches lead to death?

I've heard of the idea of operating day-to-day with the assumption that your organization is already compromised, and I just saw it reiterated in the Tenable Security Blog, but I think it's a tough one to swallow for most organizations. There has to be some level of trust within an organization, otherwise, how could you get any business done. But as tough as it is to accept, there is value in taking this approach.

Last week's news about the Google hack has really raised some eyebrows. Doe-eyed users have learned the harsh truth that anyone can be hacked. The news of 20 or more other companies also being targeted along with Google made the impact that much worse.

A co-worker forwarded me an e-mail in which the original sender was asking about running vulnerability scans on his own and stated he was concerned about the scans causing downtime while the servers were being tested.

It's getting harder to protect our users from threats coming at them from seemingly trusted places. The Websites they've been using for years are suddenly the source of attacks through malicious advertisements being pushed to the "trusted" site by a third-party advertising service. File format attacks against Adobe's Flash and Acrobat are becoming the exploit du jour for attackers.

Last year saw a slew of different DNS attacks. The most recent incident was the hijacking of Twitter's DNS records to redirect to a Website stating, "This site has been hacked by the Iranian Cyber Army." Though the impact to a company's public image can be large, DNS redirection attacks have the potential to be even more devastating than a tarnished image.

A disconnect often exits between security teams and the population they service. I'm not referring to just users -- of course, you'll pretty much always find a rift between security and users -- but instead I mean the disconnect that often occurs among network groups, system administrators, developers, and similar groups.

IT tends to forget about things that aren't electronic. But you remember that stuff called paper, right? Have you considered that printed documents are just as damaging to a company's reputation should they get into the wrong hands as electronic data stored in an Excel spreadsheet or database server?

Talk to anyone who knows anything about running an intrusion detection system (IDS), and he will tell you one of the most important processes during the initial deployment is tuning. It's also one of the important operational tasks that go on as new rules are released to make sure they are relevant to the environment you're tasked to protect.

Christmas is next week, and if I were putting together a wish list of things to help lock down my enterprises, I'd have to put patch management and application whitelisting at the top. Why? It's simple. The two together could deliver the one-two punch to knockout the majority of compromises I've been seeing lately.

I'm one of those people who takes extensive notes but rarely goes back and read them. Today was one of those exceptions: I was looking through Evernote for something, and a statement I'd copied some time ago stuck out.

Persistence is something that malware strives to achieve. If malware cannot survive the monthly reboot due to the Microsoft patch cycle or the usual Windows troubleshooting process (reboot first!), then it's going to have a short lifetime and little effectiveness. There are a few exceptions to the rule in terms of persistence.

Capture the flag (CTF) competitions and similarly organized scenario-based "games" can be a great learning experience for security professionals of all experience levels. Contestants are typically forced to work under pressure and in scenarios that range from real-world situations to extreme, all-out cyber-warfare.

Rapid7's acquisition of the Metasploit Project caused a lot of heads to turn. Concerns were raised about the project's future, specifically that of the Metasploit Framework. I held back from saying anything at the time because I was hoping for the best. Yesterday marked the first Metasploit Framework release that shows promise of the future by including integration with Rapid7's NeXpose vulnerability scanner.

Even the most stringent security procedures have failures. That fact was evident when the U.S. Secret Service learned a Virginia couple slipped into last week's state dinner at the White House.

F-Response TACTICAL will be released on Thanksgiving Day, with the promise of a plug-and-play ease to help cyber investigators quickly get the evidence they need from live systems.

Microsoft has always overlooked centralized logging in Windows. To date, the most effective way to centralize Windows Event Logs has been through event log to syslog tools and custom agents for the various SIEM solutions. But now there's a new kid on the block with a full-featured agent that goes beyond what's previously been offered for free.

Digital forensics, computer forensics, or whatever you want to call the investigation and analysis of computer systems and digital media, is a challenging field that requires deep knowledge of the systems being analyzed. There is a push, however, to lower the barrier to entry for lesser skilled analysts to perform digital forensics using modern forensic tools.

I have a love/hate relationship with Twitter. Sometimes it seems like there's nothing but garbage on there. But on other days, the wealth of information is so much better than what's in my RSS reader.

Knowing when you're in over your head is important. In the world of the IT security professional, it is especially critical given your knowledge and experience will determine your actions and influence your reports to management. Those reports will, in turn, impact their decisions (or at least they should).

Last month's "Using USBs For Incident Response" blog garnered a lot of e-mail responses asking about what tools are available, free or commercial, and how easy they were to use. While there isn't an "EASY" button that makes incident response and digital forensics easy for the layperson, there are tools that enable first responders to arrive on scene, pop a USB flash drive (or hard drive), grab volatile data, and get out with minimal impact to the system.

Dealing with malware-infected computer systems can be time-consuming. If the compromised system has sensitive information, then often digital forensics will be employed to see whether the data was or could have been accessed by the malware. With the hit-or-miss performance of antivirus solutions and craftiness of malware authors, determining whether a computer system is infected is getting harder.

We've heard the stories and seen the statistics about insider attacks and how devastating they are to enterprises and their data. However, we've heard little about the underlying causes for many of the insider attacks other than it's the user's fault and the incident could have been avoided if proper precautions were in place. A recent article over at CSO Online sheds light on one of the causes and how it's due in large part to a generation gap and a need to stay connected.

Ever have one of those days where nothing really seems to go right? You're working on something that should be simple and it ends up throwing seemingly unexplainable errors back at you no matter what you try? Then when it does work, you're not sure what you changed that fixed it. Yeah -- me, too.

For my keynote at Operation WebLock, I was asked to include a demo or two that would leave attendees rethinking some of their current practices. It didn't take a long to come up with a few different possibilities, but I settled on one of my favorite attacks: wireless network- impersonation and connection hijacking.

I've written about the Samurai Web Testing Framework (WTF) LiveCD project and some of the Firefox Add-Ons that can be used to transform Firefox into a highly capable Web application penetration testing tool. Now the Add-Ons included in Samurai and a few others have been bundled together into the Samurai WTF Firefox Collection--essentially, a one-stop shop for Web browser weaponization.

I was honored to be the keynote speaker this week at Operation WebLock, a cyber incident response two-day seminar hosted by the Florida Department of Law Enforcement. The event focused on helping administrators and IT staff respond better to cyber-threats that could affect their networks and Florida's infrastructure -- a very worthwhile endeavor, and awesome that it was offered free to local business, government, and law enforcement.

Application whitelisting is beginning to look more and more appealing. Don't get me wrong. It has had its merits all along. But lately I've seen way too many failures of antivirus against bots, and that has me rethinking a few things.

Last week's 10th annual IT Security Awareness Day at the University of Florida had IT workers from all over the state in attendance to hear experts from InGuardians, F-Response, Sunbelt Software, and Microsoft. Though I enjoyed every presentation, I keep thinking about one in particular -- the future of forensics, by F-Response's Matt Shannon.

Snort is a powerful open source intrusion detection system (IDS). What surprises me is how many security people have never touched it to learn more about how IDS works -- or how easy it is to evade many IDS signatures that are designed to look for known bad traffic.

McAfee's recent report on malware has staggering numbers that are simply hard to believe, yet because I've been battling daily the very bots, Trojans, and scareware they researchers are talking about, I can't help but agree.

The upcoming stable release of Metasploit Framework version 3.3 is brimming with awesome new features that will make a lot of penetration testers happy. New features include the ability to take screenshots of exploited systems, while others add raw power, like being able to exploit the unpatched SMBv2 vulnerability in Windows Vista and Server 2008.

As I'm finishing another successful Web application penetration test, I'm kicking myself for not noticing a new release of one of my all-time favorite Web hacking tools, the Browser Exploitation Framework (BeEF). BeEFis a fantastic tool for getting across to developers and Web admins the seriousness of vulnerabilities like cross-site scripting (XSS).

Defense in depth is not a new idea in security, but the importance of taking a layered approach is more important than ever. The current rise in infections by bots and scareware, along with recent reports on anti-malware endpoint protection, demonstrate how we need to be doing more at every layer.

The recent New York Times malvertisement attack helped bring mainstream media attention to the problem of popular, legitimate Websites being compromised and used as the source of Web-based malware attacks. What would probably shock those same people is how often Websites are attacked.

A new report from the SANS Institute sheds light on some important attack trends that security professionals need to take action on immediately.

The New York Times Website became the victim of a malicious Internet-based advertisement over the weekend. Users of certain sections of NYTimes.com encountered notifications that they were infected with malware and needed to install the antivirus software linked from the notification. And if you've dealt with a user, friend, or family member who's fallen for this sort of ruse, then you know the AV software is really just malware posing as AV.

I've always had a predilection toward incident response and forensics. For some reason, I just like digging through a compromised system, network flow data, and unknown binaries to figure out what happened -- it gives me a rush.

I think most people would agree that Windows Millennium Edition (ME) was the bastard child Microsoft wanted to turn its back on. After yesterday's Patch Tuesday, I'm starting to think Windows XP and Windows 2000 have joined the ME ranks.

I was talking with someone about incident handling, and one of the points that came up was whether some standard sort of incident response questionnaire existed.

Determining who is "in the loop" during a penetration test is an important step not always properly planned during the beginning phases of an engagement. The recent media release from the National Credit Union Association (NCUA) provides an excellent example of what can go wrong.

In the security world, providing "what-if" scenarios can be good, but real-world examples are often required to get people to sit up and listen.