My take is federated with some teeth. I've run architecture both ways, and now I sit on an EA board that has to answer this question with actual budget and actual risk attached to it, not as some abstract debate you have over coffee. A pure central-authority model doesn't survive a modern delivery cadence, full stop. A pure distributed model quietly gives up the consistency that security, compliance, and cost control all depend on, and it does it fast. The fix isn't a philosophy. It's a short … [Read more...]
I Am Back For Round 2
New year, and I'm making myself an actual resolution instead of a vague one: write more, share more of what I'm actually seeing and thinking about. It's been a while since I posted here, so consider this the restart. Somewhere in the gap between my last post and this one, I had kids. Then more kids. I'm now outnumbered by four boys, all under ten, which is exactly as loud and chaotic as it sounds and I wouldn't trade it. Somewhere in that same stretch I moved from hands-on cybersecurity work … [Read more...]
FireEye Dashboards Replicated In Splunk
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. After installing the FireEye app for Spunk and having some issues with it, the app was uninstalled, which left a gap that needed to be filled. So off I went into Splunk land to see if I could scrounge together some decent "dashboard" worthy search queries that could help display important information. Below are a collection of the search queries I have built thus far. It … [Read more...]
FireEye Role Based Access Control (RBAC)
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. Regarding role based access control and Active Directory integration with FireEye back in FEOS versions 7.0.x (webmps), 6.3.2 (emailmps) and 6.4.1 (CMS), we only had the ability to map a single Active Directory group to a single FireEye "role". And most enterprises would probably have mapped that single group to the Admin role. Well..... Fast >> Forward >> … [Read more...]
Emergenetics Personality Profile Assessment
My Engineering Years: a personal post from the same era, not technical, kept for reference. See the rest of this era. Recently, I enrolled in an Emergenetics Personality Profile Assessment workshop, with a company I have worked with. To explain Emergenetics, the best thing to do here would be to just let the Emergenetics team explain their company , and mindset themselves, instead of me trying to explain it. … [Read more...]
BlueCoat Proxy Splash Page For FireEye Integration
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. Hello again. If you are here, you are probably looking for some HowTo help on FireEye Integration With BlueCoat Proxy, or perhaps you have already completed that and are looking for a good splash page to use for FireEye blocks. Either way, I thank you for stopping by, and hope to be of some assistance if possible. When I started working on the integration it was … [Read more...]
BlueCoat Proxy – Web URL Category Review / Best Practices
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. This page will attempt to assist you in building a Web URL Category review process, as well as provide best practice recommendations from BlueCoat and my own personal experience with BlueCoat. BlueCoat does not update their Web URL Categories very often, but it does happen about once every 12-18 months. In earlier times, they were not very helpful about this and … [Read more...]
Word To Enterprises… Update Your Security Kit Regularly
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. Often times when I come to a company it is to bolster, revamp or help them re-evaluate their web security posture, with a focus on data exfiltration investigations and outbound web proxy is a great place to start. 90% of the time, when I finally gain access to the management console, I am greeted by an appalling SGOS 5.4 or 5.5 header across the top... This is sad because … [Read more...]
Web Proxy And The Need For SSL Decryption
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. Most organizations will deploy a Web Proxy solution, but not intercept HTTPS traffic to do SSL decryption and inspection. This may be done for various reasons * Not yet having a PKI infrastructure to manage the SSL browser certificates * Perhaps the AD/GPO team doesn’t want to manage SSL certificate on the user PC * Security teams may be weary about man-in-the-middle … [Read more...]
BlueCoat Proxy – Log Injection For Rule Tracking
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. Unfortunately BlueCoat doesn't have a nice and fancy log tracker type utility like CheckPoint has in Smart Tracker, so the rules do not have numbers. However, you can work around this by using some log injection smoke and mirror tricks. There are a few unused (or not very often used) log variables that can be used in conjunction with a specific action on a rule, that … [Read more...]