Author - Elvis

Cybersecurity Ethics: Establishing a Code for Your SOC

Since security intersects so much with privacy, cybersecurity ethics decisions should be on your mind at work. Being part of a high-performing computer security incident response team (CSIRT) or security operations center (SOC) involves making big, intentional decisions. Increasing the maturity of your team is more than dropping a bag of shiny new tools and technology and then hoping for the best. One of the crucial components to building a successful CSIRT team or SOC are the people pulling the levers [...]

Modbus Traffic Analysis (ICS)

Intro to PLCs, ICS and SCADA

ICS Industrial Control Systems or ICS have received a lot of attention lately. In the US the ICS-CERT was established and ENISA has a whole unit devoted to Industrial Control Systems/SCADA. But for most people working in IT it is still a relatively new playing field. Because every area in technology has its own specific vocabulary I wrote a small intro to PLCs, ICS and SCADA of the different components that play in the ICS field. This summary is based on a [...]

The State of Digital Forensics

Digital forensics is an important tool in the fight against crime in the current digital age. It is also a rapidly evolving field, with new technologies and techniques being developed all the time. In this blog post, we will take a look at the state of digital forensics, and how it is being used to combat crime and solve digital investigations. One area where digital forensics is playing an increasingly important role is in the fight against child sexual abuse [...]

DFIR Briefly Expained – Part 2

Before we begin with learning how to collect digital evidence we first need to talk about “scope.” Scoping is a very selective process by which we narrow our investigation to the most important evidence to be collected and analyzed first. We want to narrow our focus to only those system(s) with the highest probability of collecting the evidence we need in our incident. Initial reporting of an incident or suspected incident usually occurs in one of two ways: Information provided [...]