Endace Packet Forensics Files: Episode #57

Original Entry by : Michael Morris

Michael talks to Ryan Chapman about the growing complexity of ransomware – how to prepare, investigate and respond.

By Michael Morris, Director of Global Business Development, Endace


Michael Morris, Director of Global Business Development, Endace

Ransomware has shifted from simple, isolated attacks to coordinated, human-operated campaigns that target entire organizations.  

In this episode of the Endace Packet Forensics FilesI talk with Ryan Chapman, SANS Instructor and expert in Digital Forensic and Incident Response (DFIR) about these evolving threats.  

Ryan explains how attackers are becoming more methodical and sophisticated, focusing on disabling EDR/XDR solutions to evade detection and leaving organizations vulnerable to advanced attacks.  

One of the key challenges Ryan highlights is visibility. Without robust logging, packet capture, and monitoring tools, it’s nearly impossible to understand how an attack happened fully. Even encrypted traffic can reveal critical patterns if analyzed properly.   

Ryan shares examples of organizations that suffered reinfections because they rushed to restore systems without identifying the original entry point. Packet capture data plays a vital role in pinpointing when and how attackers infiltrated, ensuring a safe recovery and minimizing disruption.  

As ransomware tactics evolve, adopting a Zero-Trust approach is essential. Ryan discusses how limiting permissions and avoiding overly trusting software configurations can help prevent breaches. He cites the Kaseya attack, where some organizations avoided compromise by not blindly whitelisting trusted directories. As attackers increasingly use legitimate tools, verifying all network activity and following least privilege principles are critical defenses.   

Don’t miss this insightful episode, where Ryan provides actionable advice for preparing your organization against today’s ransomware threats.  

Follow Ryan on Linkedin

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.


Endace Packet Forensics Files: Episode #56

Original Entry by : Michael Morris

Michael talks to Cary Wright about why security certifications such as FIPS, NIAP, and DoD APL are important across industries.

By Michael Morris, Director of Global Business Development, Endace


Michael Morris, Director of Global Business Development, Endace

In this episode of the Endace Packet Forensics Files, I talk with Cary Wright, VP, Product at Endace about the importance and impact of Federal security certifications such as FIPS, NIAP, and DoD APL  to ensure the robust security of cybersecurity tools.

Although these standards are primarily applied in Federal Government, the rigorous testing that products must undergo to be compliant is extensive.  Regardless of your industry, you can be confident that products certified to these standards are robust and have been thoroughly tested and scrutinized.

Cary explores the detailed testing procedures these certifications entail and their role in enhancing network device security. The standards are continuously updated to ensure that they continue to address new cybersecurity challenges that emerge. We discuss the relevance of these standards for Government and Defense sectors as well as how they can provide surety for large enterprises looking to improve their security measures.

Cary explains what these certifications test in order to validate cybersecurity tools’ encryption strength and overall security robustness. He also talks about the challenges and costs to manufacturers of achieving these standards, and the real-world benefits this testing delivers – such as improved protocol security.

Don’t miss this episode as Cary provides valuable insights into the impact of Federal security certifications and the critical role they play in helping ensure best practices in  cybersecurity.

Follow Cary on Linkedin

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.


Endace Packet Forensics Files: Episode #55

Original Entry by : Michael Morris

Michael talks to Taran Singh about network observability.

By Michael Morris, Director of Global Business Development, Endace


Michael Morris, Director of Global Business Development, Endace

In this episode of the Endace Packet Forensics Files, I talk with Taran Singh, VP, Product Management at Keysight Technologies.

Taran sheds light on how network observability differs from traditional network monitoring by consolidating data sources to provide a comprehensive view of network activity.  This is crucial when it comes to validating zero-trust architectures.  

We talk about the challenges organizations face in achieving clear network visibility amidst complex IT environments and evolving threats. Taran emphasizes the pivotal role of network visibility in incident response and investigation, particularly for thoroughly verifying network activity. He stresses the importance of historical lookback and analyzing packet-level data for incident response and cybersecurity investigations, highlighting the value of packet evidence.  

Taran also explains how scalability and historical data-analysis significantly improve cybersecurity posture. He talks about Keysight’s strategy for network visibility, emphasizing reliability and scalability tailored to the demands of sizable corporations and hybrid-cloud setups. 

Finally, Taran talks about the escalating threat landscape, discussing recent cyberattacks and ransomware incidents, and emphasizing the importance of prioritizing network security measures. By treating networks as valuable assets, leveraging enriched data, analytics, and advanced tools, and adopting proactive approaches, organizations can enhance their readiness to combat cyberthreats more effectively.  

Don’t miss this informative episode as Taran shares his invaluable insights into network observability and its critical role in modern cybersecurity practices. 

Follow Taran on Linkedin 

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.


Why everyone should care about FIPS 140, NIAP NDcPP, and DoDIN APL.

Original Entry by : Cary Wright

By Cary Wright, VP Product Management, Endace


Cary Wright, VP Product Management, Endace

Weak security plagues far too many of the IT products we use today. The problem is, there is no unified mandate to compel vendors to invest in security hardening their products. Vendors are free to choose how heavily to invest in security. So it’s no surprise that many vendors don’t invest heavily enough in thoroughly security hardening their products.
 
However, in many industries – such as Government, defense or critical infrastructure – the potential impact of a security vulnerability in a product is just too serious for organizations to leave it to vendors to decide how to secure their products. For this reason, organizations in many of these industries mandate that vendors must submit their products to rigorous testing and certification processes to ensure the security of their products is iron clad.
 
At Endace we found out first-hand how difficult and rigorous these standards are to comply with. The effort took us the better part of a year and significant investment in software development, testing and validation, and certification. Armor plated security is a good way to describe what these standards require. Our recent OSm 7.2.1 release includes everything we had to do to comply with these standards.
 
The good news for customers – regardless of the industry you are in – is that this rigorous testing and validation process doesn’t just benefit Government, Defense and critical infrastructure organizations. Any organization that adopts products that have passed these certification processes can be confident those products have been independently evaluated to minimize the risk of security vulnerabilities and are fit-for-purpose for deployment in high-security environments.
 
By selecting a product with DoD level security compliance you reap the benefit of millions of dollars of investment in security testing and hardening that goes way beyond standard penetration tests and security scans. The testing process for each of these certifications involves delving deep into the product – comprehensive testing, source code reviews, and independent validation that the security controls of the product are robust and well designed.
 
 

What are these standards, and what do they test?

Complying with FIPS 140-3 is the fundamental first step in certification. FIPS mandates that products must use robust and secure encryption. This is not a bolt-on. Products must implement a validated cryptography module as a central software pillar to ensure all encrypted communications meet the NIST standard for strong cryptography, including HTTPS, SSL, and SSH.
 
Just including encrypted HDDs in a system – as some vendors do to claim compliance with FIPS – is not sufficient. Every communication to and from the system must be secured with FIPS validated cryptography before the system can be FIPS certified. Independent testing confirms that products comply with the FIPS standards.
 
NIAP NDcPP 2.2e, also known as Common Criteria, is an international standard agreed by 18 nations. It builds on FIPS to define security requirements that are expected to be implemented by all network devices. It goes extremely deep to validate a product has robust security. By deep, I mean months of extensive testing, inspection, and independent code reviews, conducted and signed off by government signatories who are usually security experts in defense departments.
 
DoDIN APL stands for the US Department of Defense Information Network Approved Products List. With FIPS and NIAP certification in hand and a US DoD sponsor, a vendor’s final step is undergo product testing by a US DoD lab against DoD cybersecurity requirements. Being listed on the APL is the last big stage of a long and intensive project but it’s not the end of the story. Ongoing maintenance and revalidation ensures that a product remains secure throughout its life.

OSm 7.2.1 is released and available for download.

I am very proud of the team at Endace for having delivered a huge release with OSm 7.2.1 . This release has focused on meeting all the requirements for these intensive – but extremely valuable – security standards. And I am glad to say that every Endace customer will benefit from this huge investment in product security hardening.

Endace Packet Forensics Files: Episode #54

Original Entry by : Michael Morris

Michael talks to “Malware Jake” Williams, about the concept of Zero Trust and its implications for enhancing your security posture.

By Michael Morris, Director of Global Business Development, Endace


Michael Morris, Director of Global Business Development, Endace

In this episode of the Endace Packet Forensics Files, I talk with cybersecurity expert Jake Williams, aka ‘MalwareJake’,  IANS faculty member, former SANS educator, computer science and information security expert and U.S. Army veteran, about the concept of Zero Trust and its implications for organizations striving to enhance their security posture.

Zero Trust challenges traditional security models by advocating for a “deny all, permit by exception” approach. Jake describes it as a mindset—a philosophy focused on continuous verification and least privilege access. Despite its potential benefits, embracing Zero Trust can be challenging. Jake highlights obstacles such as defining and operationalizing Zero Trust, legacy system dependencies, and cultural shifts within organizations.

Continuous verification is crucial in Zero Trust environments. Jake provides examples of verification challenges, emphasizing the importance of network visibility and packet capture in incident response and threat detection. He emphasizes the interconnectedness of networking and cybersecurity, citing Managed File Transfer appliances, Citrix NetScalers, and SSL VPNs as examples. These network security appliances often have extensive technical depth and may harbour unpatched vulnerabilities, presenting significant risks to organizations. He predicts increased targeting of network security appliances by threat actors, underscoring the importance of Zero Trust principles and network visibility in mitigating such threats.

Jake touches on the importance of tools like Wireshark for detailed analysis but also emphasises the need to understand the role network visibility plays and how it relates to business challenges. He recommends that analysts strengthen their networking fundamentals, while SOC directors should broaden their skill set by understanding business concepts for effective communication with stakeholders.

Finally, Jake suggests that embracing Zero Trust requires a holistic approach, encompassing technical ability, organizational buy-in, and a commitment to continuous improvement. His insights on this topic serve as valuable guidance on the path to cybersecurity resilience.

Follow Malware Jake on the below links. 

 

Also watch our series of Threat Investigation webinars with SANS and Jake Williams here – https://www2.endace.com/sans-webinar-series

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.


Endace Packet Forensics Files: Episode #53

Original Entry by : Michael Morris

Michael talks to Tanya Janca, Head of Education and Community at Semgrep, Founder of WehackPurple.

By Michael Morris, Director of Global Business Development, Endace


Michael Morris, Director of Global Business Development, Endace

In this episode of the Endace Packet Forensics Files, I talk with Tanya Janca, Head of Education and Community at Semgrep, Founder of WehackPurple, and renowned cybersecurity expert, author and RSA Speaker.

Tanya shares her journey from software developer to penetration tester to application security specialist, to cybersecurity education evangelist. She stresses the value of hands-on experience in cybersecurity education and urges universities and training programs to keep pace with evolving threats.

Tanya discusses the skills gap in cybersecurity, suggesting there is inadequate education in secure coding and design. She believes industry practitioners should be involved in teaching to ensure relevance. Tanya also highlights the need for affordable training options to connect theory with real-world practice.

Tanya underscores the importance of varied perspectives and real diversity and inclusion for organizations to understand and counter modern threats. She challenges the notion of diversity as a mere checkbox and calls for organizations to create inclusive environments to address the skill shortage effectively.

Tanya emphasizes the importance of continuous learning and adaptation as vital for cybersecurity professionals to navigate the changing landscape.

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.


Endace Packet Forensics Files: Episode #52

Original Entry by : Michael Morris

Michael talks to Tiktok influencer Caitlin Sarian, CEO of Cybersecurity Girl

By Michael Morris, Director of Global Business Development, Endace


Michael Morris, Director of Global Business Development, Endace

In this episode, I talk with to Tiktok and Instagram influencer Caitlin Sarian, CEO of Cybersecurity Girl, who discusses her journey into the cybersecurity field and her mission to break down stigmas surrounding the industry.

Emphasizing the importance of a love for learning and problem-solving over coding skills, Caitlin encourages individuals to explore diverse paths within cybersecurity, ranging from technical roles like ethical hacking to non-technical roles in data privacy.

The conversation highlights the need for continuous learning in the rapidly evolving cybersecurity landscape, with Caitlin recommending various channels for staying updated, including news alerts, newsletters, and professional groups. She addresses common misconceptions about coding requirements, debunking the idea that a specific educational background is essential, and stresses the value of gaining practical experience and obtaining certifications tailored to one’s chosen specialization.

Finally, Caitlin highlights the importance of advocating for diversity and inclusivity in cybersecurity. She emphasizes the need for mentorship, role models, and a supportive company culture to encourage women and minorities to enter and thrive in the industry. You won’t want to miss this episode if you’re looking for valuable insights about a career in cybersecurity. 

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.


Endace Packet Forensics Files: Episode #51

Original Entry by : Michael Morris

In this episode, Michael talks to Eric Buchaus, Director of Sales at Niagara Networks

By Michael Morris, Director of Global Business Development, Endace


Michael Morris, Director of Global Business Development, Endace

Are SPAN ports sufficient to provide network traffic visibility for high-quality security (NDR) and network (NPM) investigations? What about cloud workloads?  What do you need to gain insights into cloud network activity?

In this episode of the Endace Packet Forensic Files, I talk with Eric Buchaus, Director of Sales at Niagara Networks. Eric outlines potential pitfalls and challenges associated with SPAN ports and highlights situations where they may fall short for network and security analysts.

Eric walks us through some alternative options, discussing the merits of network TAPS, network packet brokers, and in-line bypass solutions which can offer NoC / SoC teams more reliable, efficient, and scalable ways to get network packet data to the right tools in large-scale and complex environments.  He discusses some of the specific challenges of network visibility in cloud infrastructures and suggests some practical ways to overcome these obstacles.

Eric suggests things organizations should consider when exploring different packet brokers or TAP vendors and outlines the management and scrutiny that needs to be applied to encrypted traffic to achieve in-depth visibility securely.

Finally, Eric talks about how TAPs and packet brokers can help in dynamic SDN environments with high traffic volumes. He emphasizes why they are important for organizations looking to implement zero-trust infrastructures – particularly environments with many walled gardens and lots of VLANs for IOT/IOTM devices and technologies.

Don’t miss this informative episode as Eric demystifies the complexities of network visibility and supplies some valuable guidance for navigating the challenges posed by evolving network landscapes.

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.