Definition of an integrated NOC and SOC

NOTE: 99.99999 % of the credit for this post is the work of Nelson Hernandez, I am just trying to add enough whitespace to generate discussion for his SANS.EDU research project.
NOC: Network Operations Center
SOC: Security Operations Center

Integrating a NOC/SOC is convergence/integration at the:

- Organizational level, (i.e. common first level response) - triage, collaborate, cross correlate and potentially identify common patterns from NOC/SOC respective tools.

- System level: integrated ticketing and workflow - service level agreements, standard operating procedures, integrating processes and structures in place to allow operators to communicate and coordinate seamlessly

- Asset level. (shared sensors and event criticality information) - utilizing a common information aggregator that collects all the data required and then distributes it using integrated tools/dashboards. 

The integration should allow collaboration on:

- Event Management

- Security Management (antivirus, intrusion detection/prevention systems)

- Endpoint Management  

- Network Management (firewalls, router, switches, servers)

- Fault Management 

- Configuration Management 

- Performance Management. 

- Accounting (Administration and Identity Access Management systems) 

Complex issues are investigated by Level 2-3 SOC/NOC specialists to diagnose and pinpoint the nature of the infrastructure incidents more accurately. The integrated staff cross trains to expand their range of skills, adjust their mindsets and tap each other’s skillsets and experiences to identify, manage and resolve incidents effectively. 

Coaching to Improve Performance

According to Wikipedia, A coach is a person who enables clients to master specific skills, knowledges and develop abilities. Like counselors and mentor, coaches offer prescriptive advice, error analysis, expert opinions and "how to" guidance. Coaching is one of the keys to business execution. If an otherwise skilled employee is struggling with a particular skill or ability, coaching can help them get over the hump. Y Coach says, There are seven primary benefits a coach passes on to the client.

• Encourage Life Long Learning and that is Healthy!
• Promote Self Esteem
• Learn Goal Setting
• Encourage and Model Teamwork
• Develop Time Management Skills
• Learn About Dealing with Adversity
• Have Fun with the Task at Hand
  

Encourage Life Long Learning and that is Healthy!

Many people get comfortable with their abilities and cease to learn, or more commonly do all of their learning down one narrow subject area, i.e. willing to learn more about selling, but don't learn organizational skills. A coach can encourage and also help them get started to build new frames of references for learning in new areas. Success can lead to a greater willingness to continue life long learning. Consider this example from a life long learning blog about reading: Consider reading a book from your area of business. There are many great books related to your industry. Test drive one of them. Next, consider a web page on creative thinking or Kaizen.

Promote Self Esteem

A coach gives the client an opportunity to associate with positive, supportive people. When you are surrounded by negative people who constantly put you and your ideas down, your self-esteem is lowered. On the other hand, when you are accepted and encouraged, you feel better about yourself in the best possible environment to raise your self-esteem.

Learn Goal Setting

The majority of people seem to drift through life. A coach encourages a client to set goals and determine the steps to achieve those goals. A great coach goes beyond helping establish business or sports goals and also encourages life goals or major objectives. The goal setting guide points out that major goals can be specific or broad in scope, but they must always lead directly towards the Objective they support. They must also always have a deadline. A date you plan to accomplish the major goal by, a realistic date that not only motivates you into action but also ensures progress towards your Objective.
Here are some of our favorite tips for setting goals from mindtools:

• State each goal as a positive statement: Express your goals positively - 'Execute this technique well' is a much better goal than 'Don't make this stupid mistake'
• Set a precise goal, putting in dates, times and amounts so that you can measure achievement. If you do this, you will know exactly when you have achieved the goal, and can take complete satisfaction from having achieved it.
• Set priorities: When you have several goals, give each a priority. This helps you to avoid feeling overwhelmed by too many goals, and helps to direct your attention to the most important ones.
• Write goals down: this crystallizes them and gives them more force.
  

Encourage and Model Teamwork

"Teamwork is the ability to work together toward a common vision. The ability to direct individual accomplishments toward organizational objectives. It is the fuel that allows common people to attain uncommon results." -Andrew Carnegie

A coach knows the importance of teamwork and models the behavior of teamwork and takes advantage of opportunities to get people to work together. A big part of this is getting people to work on plans together. One of the most important job satisfiers for people is that their opinion is considered important. If you can get the clients to plan together, you can get them to execute the plan together. A coach is a leader and knows that teamwork is only possible if the culture supports it; sometimes organizations have a competitive atmosphere and it is one employee against the other.

Teamwork starts at the top, or cannot be sustainable. Indicators of a teamwork culture include, clear expectations from management that teamwork is expected, leading by example and management being team members themselves. Teamwork has to be rewarded and mentioned multiple times per year, we have to keep the vision before the people.

Develop Time Management Skills

A good coach knows what the time wasters are and tries to focus the client on the shortcuts, the organizational skills to do the job. One industry that teaches this very well is food service. Great chefs teach their clients to do it right and know the speed will come later. This is one area where a coach may use negative coaching (Don't do that, that is the wrong way. No, listen and try to get it this time), because if the client gets comfortable with the time wasters they may never be able to increase their performance. A good coach helps the client rank activities using something like the MSC method to sort tasks into urgent and important:

• Must Do - Urgent tasks
• Should Do - Can be Urgent or Important
• Could Do - Can be Important if they lead to your ability to leave a legacy

Learn About Dealing with Adversity

Stuff happens! The question is what we do when it happens. Adversity builds character. The challenges we face teach us resourcefulness, self-reliance, courage, patience, perseverance, and self-discipline; and, struggles makes us heroic, for heroes and heroines are made by scaling mountains, not molehills. A coach knows that the client can only improve if they face adversity and therefore coaches are thankful for adversity and considers them opportunities for growth. We found this on the web, it seems like a nice way to view adversity: The PPPP program. First, don't PANIC, for all it does is immobilize you. To escape the clutches of fear, PLAN. That is, ask yourself what steps can be taken to improve the situation. Next, break down those steps into smaller tasks that are easier to carry out. Set a completion date for each task. Finally, work your plan by carrying out the action steps. As you do so, you will start making PROGESS. Keep building on your progress until you reach the level of PROSPERITY you desire.

Have Fun with the Task at Hand

Stuff happens, but there are rich moments too. A coach knows how to savor the moment, as the Wide World of Sports put it, the thrill of success and the agony of defeat. If the client has been cast into their role properly, they should be having a great time. A coach reinforces this (Isn't this great?, Life is good indeed, it doesn't get better than this).

Summary

A Better Perspective's survey of human resource and personnel specialists reported the top three main benefits of coaching to the organization as:

• Allows fuller use of individual's talents/potential 79%
• Demonstrates commitment to individuals and their development 69%
• Higher organizational performance/productivity 69%

Coaching helps employees trying to master a particular skill or ability get over the hump. Coaching is an important leadership skill. In our leadership course, we ask students to think about a coach that they still remember and to reflect on at least one of their coaching techniques. This would be a good exercise for you to go through right now to remember a coach that made an impact in your life. As a coach, you help your clients master specific skills, knowledges and develop abilities. To do this, you balance positive and negative reinforcement, offer prescriptive advice, error analysis, expert opinions and "how to" guidance.

Summary:
A coach is a person who enables clients to master specific skills and knowledge and to develop abilities. Like counselors and mentor, coaches offer prescriptive advice, error analysis, expert opinions and "how to" guidance. Coaching is one of the keys to business execution. If an otherwise skilled employee is struggling with a particular skill or ability, coaching can help them get over the hump. There are seven primary benefits a coach passes on to the client: Encourage Life Long Learning and that is Healthy!; Promote Self Esteem; Learn Goal Setting; Encourage and Model Teamwork; Develop Time Management Skills; Learn About Dealing with Adversity; and, Have Fun with the Task at Hand.

Updated: 11/29/17

CCleaner and bestill by beating heart.

I was working on NewsBites upcoming story:

CCleaner Utility Was Infected with Malware (September 18, 2017)

Researchers at Cisco’s Talos have found that download servers used to distribute the CCleaner utility were also surreptitiously delivering malware along with the software. The legitimate, signed version of CCleaner, 5.53, included malware that gathered user information and sent it to a third party. Avast, which distributed CCleaner, estimated that the infected version of the utility had been downloaded by 2.27 million users. The infected version of CCleaner is no longer available for download.

Read more in:
Cisco Talos: CCleanup: A Vast Number of Machines at Risk
http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html

So I clicked on the link and:

Now you know and I know it had to be coincidence, but I run CCleaner so this one took a few deep breaths.

Rest in Peace Jerry Pournelle

Sci-Fi author, Byte magazine product review columnist, (Chaos Manner), but also many early pertinent observations about cybersecurity. He will be remembered as a good guy, knew how to work a party. He gets credit for one of the best tall tales, (young guy on a farm for the summer, playing with explosives, pretty much emptied the pond, that last being the part that suspended belief), I ever heard.

My copy of Footfall is in Hawaii, guess it is time for a re-read. Best obit I have seen is here.

ISE ISM 5600 Grading Tips (yes, this one is real)

The purpose of this blog post is to provide guidance and coaching to STI students writing their leadership essay.

When the paper is submitted, the FIRST thing I do is run it through Grammarly. As a graduate student at SANS.EDU you have access to the tool; use it. As a grammar checker it is not perfect, but it can find and point out avoidable errors.

Writing mechanics is the last item on the rubric, but if your writing is sloppy, that impacts several other dimensions of the assignment. Clean and concise are two keys to victory.   If you use Microsoft Word, the green and red squiggles can also alert you to writing that can be improved.

If the submission scores below 90 on Grammarly, I tend to stop and pour a mug of hot green tea and settle in; this paper is probably going to take a while. Marginal papers require more effort to grade than exemplars.

A final note on writing quality, several of the rubric items require the reader/grader to understand what the author intended. Slapdash writing does not achieve that goal.

The assignment asks for a single aspect of transformational leadership. Rehashing the definition detracts from your message. If we ask for a focused exposition of “something”, we probably already know what that “something” is. Try to break new ground instead of repeating the fundamentals.

Your grader will also look at the literature research, or, references. The key to winning is quality. If you have thirty ill-chosen, vaguely related references you can expect a low appraisal. There is nothing wrong with using printed literature, but your grader may not have access to those items, consider at least a few Internet references that can be validated.

Speaking only for myself, I tend to grade style gently, (8.0 is neutral), If it is extraordinary, I will mark the paper higher, if it is painful to read, I choose a lower evaluation, but I am not a literary critic and know it. That said, when the rubric mentions transitional sentences at multiple scoring levels, take the time to put a few in! 

Finally, your graders are rooting for you. We want you to succeed. A day where we get to nominate a paper as an exemplar is a good day indeed. Please take the time to give this your best effort. If you shoot for the minimum passing score and miss, nobody wins.

How I grade ISE/M 5600 Leadership Essays (parody)

NOTE: this document is an attempt at humor after a long day. There is a serious version of the same basic topic on my blog.

After a string of either failing, falling, low, or lower grades, We thought it might be helpful to offer a peek behind the curtains. This is how we, at the great and powerful Oz really grade Leadership Essays.

When the paper comes in, the FIRST thing we do is flip a coin, you can check the blockchain. Heads, we run it through Grammerly. As a graduate student at SANS.EDU you have access to Grammerly; think about using it, (it even checkz spellin). It is the last item on the rubric, we do that to trick you into thinking it is not important. But if the truth be told, if your writing is sloppy, that impacts several other dimensions of the assignment such as time, height and weight. Crisp and clear are too keys two victory.  If the paper scores 95 or higher on Grammerly, I usually don't take a break, I dive right in and fill in the rubric without reading it.

If the paper scores below 90 on Grammarly, I tend to stop and pour a mug of cold beer; this one is going to take a while. Marginal papers require actual work on the part of the instructor. That is a bad situation for both you, the student and the economy, please avoid it.

A final word on writing quality. Several of the rubric items require the reader/grader to understand what the author intended. It would help if you actually intend something.

The assignment asks for a single aspect of transitional leadership. A rehash of what transitional leadership is probably detracts from your message. We have all been through re-organizations, job creation, abolishment and economic restatements. Try to break new ground instead of repeating the fundamentals.

Your grader probably won't look at the literature research, or, references. The key to winning is quantity. If you have thirty ill-chosen, vaguely related references you can expect a high score, because they don't know. One or two references is, however, a losing proposition; this isn't a book report. There is nothing wrong with using printed literature, your grader may not have access to that, consider at least a few Internet references that can be validated in the unlikely event they check.

Most graders are fairly neutral about style, 8.0 is fairly neutral and that is what you should expect to receive. If it is extraordinary, they may go higher, if it is painful too read, they may score lower, but they are not movie critics, hence, the neutral score on style. That said, HINT, when the rubric mentions transitional sentences at multiple score levels, put a few in! The key is to repeat the same word in the last sentence of one section, then use it again in the next. Consider, putting these repeated words in bold for ease of grading, as well as to make grading easier.

Finally, your graders are routing for you. We want you to succeed. We get a dollar bonus if a paper we nominate as an exemplar is approved as a nominated exemplar and posted on the nominated exemplar section of the web page.

Senior Enterprise Architect Wanted - I think this is in the Washington DC area

(Please forgive the grey shading, this is what I got from the recruiter)

For further info, please call:
Gregory Price
Vice President of Defense Programs
Trowbridge & Trowbridge, LLC

Cell: 815.531.9667
1430 Spring Hill Road, Suite 200, McLean, VA  22102 |  www.tt-llc.com  |  O: 571-298-8478 | F: 571-499-4153


= = = = =
Senior Enterprise Architect 

Work Experience, min 12 years:
5+ years primary role operating, troubleshooting, installing network routers and switches
5+ years primary role designing, architecting routed and switched networks
2+ years as senior or lead network architect in multi-tenant network
2+ years as senior or lead network architect in planning, designing, and building software defined networks 3+ years DoD environment
Certifications:
At least two nationally recognized certifications for senior network administrators/engineers/architects, and one of these certifications must be tied to the proposed solution’s routers and switches.
IAT Level III in accordance with DoD 8570.01-M http://iase.disa.mil/iawip/Pages/iabaseline.aspx
Education:
Bachelor’s degree in Information Systems, Engineering or Equivalent; Master’s degree preferred
Demonstrated Skills:
Ability to analyze requirements; plan and develop technical solutions and frameworks; develop test and implementation plans, analyze and evaluate networks,
Use of current and emergent network design principles and protocols
Experience with network virtualization technologies and vendors
Experience with multi-tenant network architectures
Experience with specific designing and modernize a complex network to separate control from data planes. Familiarity with a width variety network routing and switching equipment devices from multiple vendors Scripting languages such as Pearl, Python.
Awareness of DoD JIE-JRSS architecture, and design experience for a DoD network within the last 3 years.
Clearance:
Active or current Top Secret clearance, SCI eligible, adjudicated through DoD Central Adjudicative Facility (CAF).

67 of 79 SDN Solution Final PWS v1.0 As Of: 23May17_1700hours 

Cybersecurity research: What and How

Friday July 7, 2017, I was asked by the folks at SANS.EDU to help the graduate students submit research proposals to be evaluated by the STI research committee. It was fun work, and a glimpse at a new, (to me), part of the research process at STI.

In the first batch there were a number of potentially great proposals, but only one student took the time to clearly articulate what she was going to do and how she was going to do it. Not surprisingly, when this proposal reached the committee for a go/no go decision, the answer was go, (approved), and several faculty members volunteered to be the advisor on the project.

The experience led me to wonder, "what is the difference between the successful project proposals and the ones we evaluate as not yet ready?" From the title of the blog post you can probably guess the answer is the successful students clearly articulate what they are going to do and how they are going to do it. Before we examine that, let's take a minute to define a Cybersecurity Research Proposal. There are, amazingly, three key words to consider:

    Cybersecurity: all of the proposals fell into the realm of computer security, so we don't need to belabor this point. We can leave Better methods of picking daisies to some other worthy institution.

    Research: we ran into some problems here.  Research is studious inquiry. Research is not regurgitation of already published information, or an opportunity to recount one's personal experience.

    Proposal: this is where the student defines what they are going to do and how they are going to do it.

As mentioned, most of the proposals had potential in the sense that the topics were timely and interesting. So where did so many miss the mark?  There seemed to be two major pitfalls, overly broad topics, (failure to succinctly define "what") and research process that cannot be practically accomplished, (failure to pragmatically understand/define how).

Since it is frustrating to be sent "back to the drawing board", here are a couple suggestions for success the first time through the process.

1) Know what you want to do. Ideally, your topic will be something that you want to learn more about, or that will benefit your employer. In the best of all possible worlds your topic will satisfy both conditions. If you do not know what you want to do, you will not be able to explain it in the proposal. That results in "fuzzy writing" which ends up frustrating all parties, student and advisor. Only you can know what you want to do.

2) Use the literature search part of the process to explore the uniqueness of your proposal. If there are lots of papers, tutorials, YouTube videos, etc on "Using Wireshark to monitor the TCP/IP 3 Way Handshake", it could be an indication that ground has already been covered. However, keep in mind that just about everything you can imagine has been published on the Internet in one form or fashion. The published material may not be supported by studious inquiry and/or empirical results. In that case, you may still have a valid topic and this is a discussion you should have with your advisor.

Summary: if your research proposal: reflects studious inquiry, covers new ground and adds to the body of knowledge, clearly explains what you intend to do and how you intend to do it, then the odds are better than average it will be accepted the first time.

Guy Bruneau Commendation

No one can remember a time when this was issued to a civilian, (maybe Guy has a uniform stashed away in a closet somewhere, eh).

What Are Your Data Protection Best Practices? Please take our SANS Survey

From Deb Radcliff

Editor-in-Chief

SANS Analyst Program

For years, cradle-to-grave data protection has been a pipe dream, but today it’s even more important because data moves into and out of the cloud, onto mobile devices and elsewhere outside the perimeter. That’s why SANS is now conducting its first survey on Data Protection Best Practices and we’re asking for you to take the survey and share your experience and knowledge.

In the survey, we want to find out who holds responsibility for data security, what type of sensitive data (and associated regulations) organizations are handling, and how well their security programs keep up with agile development, DevOps, containerization and other contemporary development methodologies.

Results and advice will be shared in a SANS community whitepaper developed by SANS Analyst Program research director, Barb Filkins, who specializes in healthcare and data privacy laws. The paper will be provided to the community during a live webcast and also presented at the SANS Data Breach Summit in September. 

The goal is to get the dialog moving on cradle-to-grave data protection, identify weak links, improve data protection practices, and raise awareness at the highest levels of the organization.

“From a legal and regulatory viewpoint, management is very often the responsible party for setting policy around the protection, privacy and security of data held by the organization,” says Filkins. “Yet they are often unaware of the risks involved in protecting the actual data and information. The results of this survey will help managers and their IT staffs identify and remediate these risks.”

We call upon your experiences: Please take the survey (and in the process you may also enter to win a $400 Amazon Gift Card OR a free pass to the SANS Data Breach Summit). Survey will be removed June 26.

Improving phishing detection methods

We all know detecting things we do not know exist such as a zero day attack is hard if not downright impossible. However, that does not mean that the occasional joust at a windmill is off the table.

Early this morning, (my time), a member of the GIAC Advisory Board, Kevin Holleran posted a comment that maybe if we could categorize types of phishing that would give us some traction. His original list was:

- Call to Action from a Position of Trust (i.e. CEO Fraud)

- Offers / Products

- Trusted Services (masquerading as Dropbox, Office, etc.)

- Targeted / Spear

- Spoofed Insider

- Credential Harvesting

- Simple (sentence) vs. Complex (HTML)

If you have suggestions on:

- Additional categories

- Keywords or phrases to identify those categories

Please add them to the comments field on this post or the Linkedin announcement. I realize there are a number of scholarly papers on automated phishing detection and over the weekend I will pour through a few, but I am interested in ideas from the people in the trenches. 

Before you say, "that will never work". Let me remind us of a similar field, in fact, I should check they may have already solved this and that is SPAM in general.

A long time ago, my employer, SANS, was a LAMP shop. Our SPAM tool was Spam Assassin. Yes, it had to be configured weekly and yes, there were leakers, (SPAM that got through the filter). As the company grew, they started looking a commercial software and suggested Barracuda. People loved it. SPAM never bothered me, I just deleted it, but the improved solution meant a lot to a lot of people. Here are a few words from Barracuda on how they did it: 

A message "is scored for spam probability. This score ranges from 0 (definitely not spam) to 10 or higher (definitely spam). Based on this score, the Barracuda Email Security Gateway either tags (inbound messages only), quarantines, blocks or allows (or sends, for outbound) the message."

Kevin, Lance and I would love your ideas please post them in a comment field, the occasional snarky remark is fine as well, but go for humor. I used Kevin's ideas with permission:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Absolutely, I am very interested in feedback from the community.

I also agree with Lance's assessment as far as the focus on training, but I believe there is considerable value in being able to focus on realizable threats to a specific organization.  We are not going to be able to get 100% coverage of every threat out there in our programs, so let's work to drive the most value.

Thanks.

--

Kevin Holleran

Master of Science, Computer Information Systems

Grand Valley State University

Master of Business Administration

Western Michigan University

ISC2 CISSP, ISACA CISM, COBIT, GISP, GLEG, GCCC, GASF, GAWN, GMOB, GXPN, GCFA, GCFE, CCPA, CCLO, PCIP, PCI ISA

"Do today what others won't, do tomorrow what others can't" - Smokejumpers Creed

Where are all these people coming from, (cybersecurity experts)?

In 1997 I knew about half the packet ninjas in the world and if I needed an insight from someone I did not know I could get an introduction. As the security world grew and my focus started to change to general cybersecurity, I was able to track the majority of the folks with the time, talent, knowledge and name recognition to be a SANS Instructor. I even managed to keep up with things for a while as we started to break into disciplines, forensics, pen-testing etc.

I joined Linkedin in 2007 and soon worked my way up to about 200 connections. Fast forward 10 years and it is 11,337 according to the website. Do I actually know 11k people? I don't think so. When I read about conferences other than SANS, it is common for me to not recognize a single name. But if I look them up on Linkedin or some other source they are all world renowned experts in whatever cybersecurity field grabs their fancy.

One of the few things from my Virginia Tech Artificial Intelligence class in 1997, that is still with me, "The problem with expert systems is there aren't many actual experts to build them". Exactly.

Trying to keep up in this field is hard. You post a few packet decodes, marvel at some of the Wannacry decodes, even build a chatbot in case that is the new, new thing. But nobody on this planet is going to stay current in all the cyber disciplines.

Which brings us to the core issue of this post. How do you tell real balanced news from biased news from "fake news". It is a very hard problem. How can you identify a competent doctor from an incompetent one? Thank heavens it was a minor problem, but I visited three podiatrists in a row that did not appear to know a foot is the thing inside of a shoe. How can you tell a competent cybersecurity practitioner from the "fake news" version. Let me illustrate with a simple example. When Wannacry came out, everyone that was switched on was sharing information and had a pretty good idea of how it worked and what was vulnerable. Three days later you started seeing every security vendor posting a webcast, document, you name it. And the titles, some were straight out of the marketing department.

We have some tools to separate the cybersecurity wheat from the chaff. There are respected certifications, look for specifics on resumes like tools, publications and presentations certainly help. But it is tricky. Anyone that has been in the field for a while has had the unpleasant experience of interviewing someone for a job that sounded great and after onboarding couldn't even find the bathroom. I thank the Lord the first one of those I experienced happened three weeks after I took on a management role; I have been gun-shy ever since. I have also found some of the MSSP sales presentations to be jaw droppers. This is another case of being lucky over smart, one of my friends was director of operations for one of the first MSSPs. The would literally take people off the street, (with aptitude), give them three weeks training and shop them as experts.

To summarize. Not everyone in cybersecurity that claims to be an expert actually is, but hey, you already knew that. You also know one are more people in the field that have expertise, (at least in some aspect of security). Hang on to those connections, stay in touch, once or twice a year is plenty. Then, when you need information, use a validated source. You are going to pay either way, might as well get something useful for your money.

Honeypots and the French election

NOTE: this post is primarily a reprint of other sources. I credit them of course. I just wanted to get the information in one place for quick reference. The main points that cannot be reasonable disputed are:
- There was some sort of attack on the Macron presidential election campaign targeting email and documents.
- The tech savvy Macron folks had prepared in advance with a honeypot strategy that was at least partially effective
- Many indicators are Russian in nature with Fancy Bear/APT28 at the top of the list, however, Forbes was wise to bring attribution into question. I have worked on attribution in one manner or another for fifteen years and there is a real risk of drawing an incorrect conclusion.

An article published by Ars Technica describes the Russian attempt to influence the French presidential election. "The failed effort by Russian attackers to influence the outcome of the French presidential campaign in its final hours was in part a forced error, thanks to an active defense by the digital team of French president-elect Emmanuel Macron's campaign organization, the digital director of the campaign has claimed. Campaign team members told the New York Times that as the phishing attacks mounted, they created a collection of fake e-mail accounts seeded with false information.
"We created false accounts, with false content, as traps," Macron campaign digital director Mounir Mahjoubi told the Times. "We did this massively, to create the obligation for them to verify, to determine whether it was a real account."

In their haste, they left tailtale signs of their identity, "According to a Trend Micro report on April 25, the Macron campaign was targeted by the Pawn Storm threat group (also known as "Fancy Bear" or APT28) in a March 15 "phishing" campaign using the domain onedrive-en-marche.fr. The domain was registered by a "Johny Pinch" using a Mail.com webmail address. The same threat group's infrastructure and malware was found to be used in the breach of the Democratic National Committee in 2016, in the phishing attack targeting members of the presidential campaign of former Secretary of State Hillary Clinton, and in a number of other campaigns against political targets in the US and Germany over the past year."

Forbes, however cautions the evidence is not conclusive, "And, Doman told me, he had not seen "anything definitive" linking the two phishing domains found by Trend Micro and the Macron dump, "though it seemed likely."
Muddying the waters even further is the fact that En Marche's digital lead Mounir Mahjoubi indicated to French press Macron's campaign may have put its own fake data on its servers as part of a "honeypot," set up to attract hackers and trick them into pilfering tagged data. Typically, honeypots are used as traps to track attackers' activities."

Attribution is, and will always be, one of the most challenging problems of cybersecurity response. The folks that are willing to say "probably" as opposed to "surely" are to be congratulated.

This operation will certainly add credibility to Macron's emphasis on cybersecurity and tech for France and his efforts to combat extremism. "French presidential candidate and frontrunner Emmanuel Macron said on Monday he would step up efforts to get technology firms such as Google or Facebook to share encrypted content from messaging services with authorities."

"With an eye on the Elysée Palace, Mr Macron has been only too happy to associate himself with France’s burgeoning tech scene, hoping its open-mindedness and can-do attitude would reflect back on him. When he was economy minister he hastily organised a glitzy reception for him and French entrepreneurs at the Consumer Electronics Show in Las Vegas in 2016. Prosecutors are probing irregularities in the way the party was organised, although the investigation does not involve him.
As economy minister in a socialist government he enthusiastically backed a government initiative to promote the country’s tech ecosystem under a single brand at home and abroad. “Macron has been a strong advocate for the French tech scene,” says Frederic Mazzella, co-founder of ride-sharing company BlaBlaCar."

Brett Whittaker - looking for cyber job Augusta GA Area

Brett Scott Whittaker

                                                               529 Waterford Dr    

Evans, GA 30809

(410) 979-9493 (410) 672-0637

brett@brettwhittaker.com

---

OBJECTIVE:  Seeking a position within the Development or Computer Network Operations (CNO) communities that is commensurate with my experience, challenging in scope, and dynamic in opportunity.

KEY QUALIFICATIONS

·      Software Development

·      Cyber Operation Instruction

·      Network Analysis

·      Network Operations

·      Intelligence Analysis

·      Digital Forensics

·      Training Management

·      Top Secret/SCI Clearance

                                                                                                                        

EXPERIENCE

Aug 2015 – Apr 2017: Exploit Development Instructor and Training Content Author

·      Professionally instructed hundreds of students in exploit development on linux and windows platforms so they may better defend against the techniques.

·      Authored & built Reverse Engineering courseware that demonstrated virtual memory, stack operations and registers to meet DoD Cyber contract demands.

·      Created professional training materials on modern & legacy encryption techniques for multi-million dollar government contract fulfillment.

·      Utilized gdb and Immunity debuggers to analyze software and develop buffer overflows to defeat ASLR, DEP, stack canaries & cookies for demonstration.

·      Crafted & taught Python scripts to automate analysis and launch remote exploits.

·      Built and demonstrated web exploits to include SQL Injection, Cross Site Scripting, Authentication and Session Management, and others.

·      Trained students on the Metasploit framework to enable exploit communications.

·      Educated DoD cyber warriors on basic/intermediate linux operating system skills.

·      Instructed automation techniques utilizing bash, batch and powershell scripting to survey remote network hosts, network devices and local computers.

·      Developed applications in C and Assembly to demonstrate stack overflow vulnerabilities and proper defensive coding practices.

·      Authored student evaluations based on in-class tasks, formal tests and hands-on performance in active networks for government job-role assessments.

·      Developed and built multiple web-based training modules that provided on-demand remote learning including narration, demonstration, labs and testing.

Dec 2011 - Jul 2015: Analysis Flight Chief, Operator, Planner, Network Warfare Unit

·      Conducted computer network exploitation operations to include characterization, vulnerability scanning, and exploitation to fulfill tailored intelligence needs.

·      Performed in-depth network analysis derived from multi-sourced data and authored operational cyber plans for execution organization-wide.

·      Created and managed the 105 Cyber Combat Mission Team (CCMT) training program that served dozens of members and instructed topics that included network analysis, intelligence, doctrine, operations and critical thinking.

·      Managed Joint Qualification Requirement program that ensured dozens of team members met and maintained qualifications, learned technical skills, and remained current on doctrine and regulations.

                                     

Oct 2006 - Nov 2011, Operations Section NCOIC & Operator

·      Performed vast numbers of real-world cyber operations that produced many intelligence products delivered to internal analysts and external customers to include multiple military services, intelligence agencies, the US State Department, and the President of the United States.

·      Performed digital forensics on vast numbers of computers and networking devices that ran numerous operating systems that included Windows 95, Windows 8, *NlX based platforms and various networking systems.

·      Trained dozens of network operators on tools, techniques and procedures for advanced network operations and operational security.

EDUCATION & VOCATIONAL TRAINING (partial list)

AS — Information Systems Technology, Community College of the Air Force, 2015

SANS Hacker Techniques, Exploits and Incident Handling, 40 hours, June 2014

SANS Security+, 40 hours, October 2013

SANS Reverse-Engineering Malware: Malware Analysis Tools/Techniques, June 2010

SANS Developing Exploits for Penetration Testers & Security Researchers, June 2009

Learning Tree International Certified Ethical Hacker, March 2009

Windermere Digital Interactive Network Operations Course, 480 hours, May 2007

Preliminary Tactical Digital Forensics: Section Zero, 1100 hours, Dec 2007

Prior Air Force Courses: Advanced C & Ada, Oracle 7, Object-Oriented Design, etc.

PRIOR POSITIONS

105 Combat Mission Team, Cyber Fires Planner, 2014

SIGDEV Strategy & Governance, Network Analyst, 2013

Requirements & Targeting, Exploitation Analyst, 2013

Operations Center, Interactive Operator, 2007

Communications Computer System Programmer, 1992-2006

CERTIFICATIONS

Certified CompTIA Security+, Oct 2013 - Present

Certified Information Systems Security Professional (CISSP), Apr 2009 – 2012 (expired)