Anton Chuvakin

3 weeks ago | securityboulevard.com | Anton Chuvakin

“Flickering screens, a sickly, yellow glow. Humming servers, a constant, low thrum of digital malaise. Alerts screamed into the void, a cacophony of meaningless noise, lost in the echoing expanse of our digital tomb. Playbooks, relics of a forgotten war, their pages yellowed and brittle, offered no solace, only a hollow echo of outdated procedures. We were digital ghosts, sorting through the digital detritus of a network that had long since abandoned us.

4 weeks ago | medium.com | Anton Chuvakin

Anton Chuvakin·FollowPublished inAnton on Security·5 min read·--“Flickering screens, a sickly, yellow glow. Humming servers, a constant, low thrum of digital malaise. Alerts screamed into the void, a cacophony of meaningless noise, lost in the echoing expanse of our digital tomb. Playbooks, relics of a forgotten war, their pages yellowed and brittle, offered no solace, only a hollow echo of outdated procedures.

1 month ago | securityboulevard.com | Anton Chuvakin

Do you have a fair-weather friend? Or two? OK, do you also have a fair-weather SOC? This train of thought was inspired by reading pilot forums about how some training approaches lead to “fair weather pilots” who perform well in all cases except real emergencies. Anyhow, let me stop with this because this is not my area; it only triggered the ideation process for me. So, what does fair-weather SOC look like?

1 month ago | medium.com | Anton Chuvakin

Anton Chuvakin·FollowPublished inAnton on Security·5 min read·--A fair-weather SOC by Meta AIDo you have a fair-weather friend? Or two? Fair weather friend (via Google)OK, do you also have a fair-weather SOC? This train of thought was inspired by reading pilot forums about how some training approaches lead to “fair weather pilots” who perform well in all cases except real emergencies. Anyhow, let me stop with this because this is not my area; it only triggered the ideation process for me.

2 months ago | medium.com | Anton Chuvakin

Anton Chuvakin·FollowPublished inAnton on Security·3 min read·--Unfortunately, I am old enough to remember how SIEM was done before the arrival of threat intelligence feeds. We had to write broad behavioral (well, “behavioral-ish”, if I am totally honest) rules without relying on any precise knowledge of attacker infrastructure and details of their operations (IF event_type=exploit FOLLOWED BY event_type=config_change ON the same machine THEN alert).