Consistent Event Management

The balance in handling incidents comes in at the analysis phase where you start out looking for anything, but even parts of this phase involve procedures – ensuring that triage is complete, the required level of system isolation or sandboxing is setup, backup copies are preserved, and other details. Up to that phase, where events are raised, reviewed, and escalated/closed requires a consistent approach, because during the event handling phase inconsistent handling could break down the whole basis for reporting the incident in the first place. Incidents require resources to review, analyze, report, and close, and most of those resources are not expected to handle incidents full-time. Continue reading Consistent Event Management

Human Intervention In Event Analysis

The argument on this subject consistently goes both ways. On one hand we have the machine learning and artificial intelligence technologists that would argue against human intervention. Then on the other hand, there are professionals that argue when machines handle event analysis alone, that too many false positives come forward (that is poor filtering, actually), or too many false negatives may consistently go undetected. The operational word in that last sentence meaning “consistently”. Consistency is where a machine outperforms the human counterpart, but the types of events is rather vast. Eventually, you could map out a massive logic flow but the more difficult challenge would be to update such a workflow for changing technology, processes, people, and attack vectors. Continue reading Human Intervention In Event Analysis

Getting In The Groove

As many of you know, I left Deloitte late last month and have moved onto a position within IT Audit at SMBC Nikko Securities. This new position puts me in the thick of a Japanese working environment, which is challenging on many levels – language being the least of which. I look forward to this career change since it pulls out of the rat race that Big Four job have turned into. Long gone are the days where Big Four managers could get regular work and charge exorbitant rates. The competition is stiff and the rates are falling through the … Continue reading Getting In The Groove

Playing With Python…. Trying To Get Back To Pictures

Over the last couple of months have really enjoyed studying, coding, debugging a bunch of Python code, but last weekend I got the photo bug again. Going to make it a point to pick up the cameras this weekend and organize photos and shoot a few. Stay tuned.If you are a WorkPapers user and are looking for a next release update, please visit that blog at http://workpapers.pro/blog.After BASIC, Pascal, C, C++, Perl, Objective-C, RealBASIC, and Java, I have found Python! For the cloudy world that we live in these days, with applications being split between the web and desktop (e.g., … Continue reading Playing With Python…. Trying To Get Back To Pictures

Addicted To Web Apps – 11 Services I Use

Posting this blog entry to inventory the web apps that I have signed up for over the past year, and to provide a brief commentary on what I think of them. 1) Google – excellent offering for the price. $50 a year amd you get just about everything to run a virtual office, including collaboration.2) Yahoo! – Premium email has undergone a major facelift and is a great location to integrate all thos ‘other’ email addresses one accumulates.3) .Mac or .Me…. whatever – a control freak rip-off. Don’t buy it.4) Salesforce – a great product, especially if you get the … Continue reading Addicted To Web Apps – 11 Services I Use

Is It Time To Start Blocking All China IPs?

And I’m not kidding…. I did a clean OS and web server install last week for the new web site on WorkPapers.Pro (getting ready for an upcoming software update and September 1 press release), so about one week later, like a good admin, I thought it was time to sip some coffee and go through the authorization logs.There was the usual Eastern European and former Soviet block IPs, so I blocked those, then there were a couple out of the US, so I blocked those IPs. You’d think that I would follow-up on the US IPs these days, but understanding … Continue reading Is It Time To Start Blocking All China IPs?

Accent Zip Password Recovery – A Career-Saver

The fine folks over at passwordrecoverytools.com sent a request for an evaluation about four months ago, and as I was ensconced in a plethora of security work and programming, I never had a chance to test the tool for a good writeup. That was, until I decided to go on vacation last week and a client sent a password protected zip file without forwarding the password! That same client has decided that since I am on vacation, that my emails are not worth responding to! Hmmm…. Hahhhh! (small bellows of smoke roll out from the ears)Well, the password was recovered … Continue reading Accent Zip Password Recovery – A Career-Saver

MySQL Setup On OS X 10.5x – The Missing Procedures

This posting is basically to document the procedure for setup, so others do not have to go through the ordeal that I went through. I am not sure why more explicit instructions are available , since when I Googled for the run-time errors that were produced as a result of using the MySQL DMG package, there were a myriad of comment postings and forum postings but very few solution. First, download the DMG package and the tar file (both) from MySQL download site. DO NOT INSTALL THE DMG INSTALL PACKAGE. Unpack the tarball and move to /usr/local/yourMySQLVersionFolder (<-substitute with your … Continue reading MySQL Setup On OS X 10.5x – The Missing Procedures

WorkPapers Software, Java, Google Web Toolkit, and DCMA

Hi All!! Still alive and kicking. Been a couple weeks since the last posting but have been hard at work putting together another platform iteration of WorkPapers software. So far, I have created the audit working papers management software solution in Cocoa and RealBasic, so this time around thought I would try one more iteration in Java and Ajax. For more information about WorkPapers, please see the projects page on this web site. This will give a cross-platform solution that will sync with a web-base Ajax interface… sexy! So now that I am in advanced stages of this programming iteration, … Continue reading WorkPapers Software, Java, Google Web Toolkit, and DCMA