Stop running security in passive mode

As we begin a new year, we wanted to address one of the biggest issues we consistently see in our investigations: passive security. 

Incident response engagements are an important part of our work and the intelligence-gathering process and their associated reports can be a treasure trove of tactics, techniques and procedures (TTPs) for adversaries, but also expose common gaps and mistakes organizations make. 

When we’re fighting state-sponsored groups and cartels with millions in revenue to support their attacks, trying to …

address adversaries can gathering important incident incident response intelligence investigations mode new year passive procedures process reports response running security tactics techniques techniques and procedures ttps work