Artificial Reality | The PatternEx Blog

Alerts Continue to Rise

Topics: InfoSec Professionals False Positives Threat Detection analytics

The Value of Threat Intelligence

I recently read through a report from a well known threat intelligence (TI) vendor that self-servingly claimed that TI programs “save businesses big money”. Would you really expect a vendor to say that their TI service is not worth the money that they are charging you? No, of course not. But, I was struck by the audacity of this vendor’s report, and specifically the unsubstantiated claims in it. Statements such as “Healthy organizations have threat intelligence infrastructure in place.” certainly don’t appear to be objective.

Topics: Artificial Intelligence Threat Detection SOC analytics

Detecting DNS Rebinding Attacks

Unless you have possibly been in North Korea since mid-July (working on denuclearization issues?), then you have by now heard about the DNS rebinding vulnerability that IoT devices are subject to (CVE-2018–11315). There are two aspects to this matter that are particularly noteworthy. First, DNS rebinding attacks are not new. In fact, the first such attack was reported over ten years ago (CVE-2007-5232)! Second, is the number of IoT devices potentially vulnerable in this latest CVE - half a billion devices. That is a lot of exposure sitting on your organization’s and your personal network at home. (BleepingComputer blog post, “Half a Billion IoT Devices Vulnerable to DNS Rebinding Attacks” from July 20th has a good breakdown on that number.)

Topics: Threat Detection AI SOC analytics SIEM

What to Look for in an MDR Provider

Book a Meeting

In my last blog posting, I talked about why you should consider moving to an MDR provider. In this post, I want to discuss what you should be looking for in an MDR provider. There are several factors that should be considered if you are going to have a successful partnership with an MDR provider. Leading research and advisory companies (and others) have written about such too, but I don’t charge vendors to say nice things about them. 😀

Topics: machine learning Threat Detection SOC analytics MSSP

Why move to MDR?

If you have been keeping up with your security reading recently, you might have noticed an uptick in the ‘noise’ level about MDR. A) Is that true? B) If so (true), then why?

Topics: AI SOC analytics MSSP

Is There a (MSSP) Bubble Coming?

As we approach the ten year anniversary of the subprime mortgage crisis, which precipitated a housing bubble collapse and contributed significantly to the Great Recession, I am wondering if another bubble is building?

Topics: Threat Detection SOC analytics MSSP

Changing Business Considerations for MSSPs: Saying Goodbye to Soda Straw Views

As the threat landscape has evolved (e.g., increased number and size of DDoS attacks), MSSPs are being forced by the market to evolve their service offerings. It simply is no longer acceptable for an MSSP to manage perimeter firewalls, a couple of Internet-facing applications, and perhaps a couple of important internal systems (e.g., Active Directory domain controllers). Why not? Because such (effectively) stand alone ‘soda straw’ views do not provide the MSSP (nor the customer) with the context needed to be able to detect today’s sophisticated attacks. For example, with that hypothetical monitoring scenario, it would be extremely difficult to detect lateral movement, let alone a compromise of individual systems.

Topics: Threat Detection AI analytics MSSP

Complementing Your Current SIEM Implementation

Most large organizations have already deployed a SIEM, and spent considerable money and effort doing so. While those organizations may be satisfied with their SIEM implementations, or possibly not, rip & replace for those not satisfied is almost certainly not an option—for two reasons.

Topics: AI SOC analytics SIEM

Why you need advanced analytics with your SIEM

Why do you possibly need an advanced analytics tool along with your SIEM?  Because your SIEM is not an advanced analytics platform. Your SIEM is an advanced search tool allowing you to search through your log data with sophisticated correlations.  But search advanced analytics.  Let’s dig deeper.

Topics: SOC analytics SIEM