gdp's Comments

Anton Chuvakin Blog : An Open Letter to Android or “Android, You Are Shit!”

Fri, 30 Dec 2016 23:40:08 +0000

Thanks a lot for the comment. Still, I am planning to give them another chance before taking an iPlunge :-)

Anton Chuvakin Blog : Monthly Blog Round-Up – June 2014

Wed, 2 Jul 2014 16:54:02 +0000

I have no idea what HTTPA stands for -- sorry. I can google, sure, but it won't be my opinion :-)

Anton Chuvakin Blog : Simple Log Review Checklist Released!

Wed, 19 Feb 2014 00:05:49 +0000

>Each modern OS should have a clearly defined, specific set of logging instructions to ensure that >Security can hand a checklist to the admins and say "we need this". Agreed, but sadly, such per-OS checklists don't exist in one place. In the good old times (mid-1990s) some people maintained them, but this effort is kinda ... not alive now.

Anton Chuvakin Blog : On Choosing SIEM

Wed, 22 Jan 2014 15:54:29 +0000

SIEM installations supporting 100,000 EPS do exist, but they are definitely on the complex and expensive side, and in most cases involve multiple, sometimes dozens, of servers.

Anton Chuvakin Blog : SANS Top 6 Log Reports Reborn!

Wed, 18 Dec 2013 19:44:00 +0000

Thanks for the comment. This was literally years in the making :-)

Anton Chuvakin Blog : Monthly Blog Round-Up – February 2013

Tue, 5 Mar 2013 19:35:04 +0000

Thanks for the comment and for the idea. It does seem like a great case for using game theory indeed. Let me think of how I can do it

Anton Chuvakin Blog : Top 10 Criteria for a SIEM?

Wed, 9 Jan 2013 20:30:08 +0000

Agreed, the initial integration and operational process is what hinders many SIEM projects. On-site log integration tools have been known since the early days of SIEM (2002-2003), but not every log can be quickly parsed., even with the best tools..

Anton Chuvakin Blog : Proactive and Continuous Compliance? For Real?

Thu, 3 Jan 2013 18:34:28 +0000

Sorry, this conversation is a bit too involved to have in comments. I'd love to see more information about your continuous compliance platform

Anton Chuvakin Blog : PCI Compliance Book Giveaway!

Fri, 16 Nov 2012 18:14:49 +0000

Received via G+ https://plus.google.com/104051623244958334514/pos... Jeff Hall 3:55 AM Here's my entry. And since it involves log management and analysis, it should be an automagic winner. LOL A very large retailer decides to reorganize their IT department to be more responsive and reactive. As part of that reorganization, they create a group titled 'Enterprise Monitoring' that is responsible for the care/feeding of the log management and analysis solutions. Centralized personnel that actually do the monitoring are pushed out to the business units where, according to IT management, the actual monitoring belongs. Everyone at the meeting announcing this decision says that the name. Enterprise Monitoring, needs to be changed because it gives the impression that the group does the monitoring, but they are over ruled. Spin ahead almost a year later to their PCI assessment. The monitoring personnel that were pushed out to the business units were, surprise/surprise, were seen as new bodies that could be used for everything BUT monitoring. So, we have great log management and analysis solutions running, but no one has been monitoring anything for almost a year! When asked, the business units point to the Enterprise Monitoring group and say that it is their responsibility because they are 'Enterprise Monitoring'. DUH!

Anton Chuvakin Blog : New SIEM Whitepaper on Use Cases In-Depth OUT!

Thu, 15 Nov 2012 23:36:06 +0000

Hmmm, I was able to find a copy in Google cache as per above. I do have a copy, but I am not sure I can release it. Maybe I can toss it online some time later after I am sure its original publisher no longer cares...

Anton Chuvakin Blog : Do You Enjoy Searching?

Mon, 29 Oct 2012 15:18:04 +0000

Well, I like to say that I was a bit ahead of the time, yes. Most of my work in this area (e.g. see http://www.slideshare.net/anton_chuvakin/baselini... was many year ago and I've been looking to see how it evolves into products.

Anton Chuvakin Blog : On Free Log Management Tools

Wed, 10 Oct 2012 17:40:44 +0000

Hmm, I somehow thought that for smaller envs "free splunk (i.e. < 500MB) is still king. Are you talking about the large envs?

Anton Chuvakin Blog : New SIEM Whitepaper on Use Cases In-Depth OUT!

Fri, 10 Aug 2012 15:08:36 +0000

http://rsa-securecloud.com/download/SIEM_Moving_B... or in Google cache (last resort) http://webcache.googleusercontent.com/search?q=ca...

Anton Chuvakin Blog : New SIEM Whitepaper on Use Cases In-Depth OUT!

Fri, 10 Aug 2012 15:05:33 +0000

Hmmm, RSA "owns" it and I am not sure I am allowed to just send it. Let me try to find a link fort you.

Anton Chuvakin Blog : New SIEM Whitepaper on Use Cases In-Depth OUT!

Thu, 9 Aug 2012 16:45:04 +0000

It takes work to find it :-( RSA guys are notorious for hiding good resources...

Anton Chuvakin Blog : Why No Open Source SIEM, EVER?

Thu, 14 Jun 2012 00:06:51 +0000

Response to above: yes, indeed. However, my current employment status prevents further comments on vendors, including AlienVault , the developer of OSSIM

Anton Chuvakin Blog : Why No Open Source SIEM, EVER?

Thu, 14 Jun 2012 00:06:05 +0000

Thru other channels: Any thoughts on OSSIM as things stand today? It seems like there are very few products (open or closed source) that are trying to do what OSSIM is trying to do

Anton Chuvakin Blog : On Free Log Management Tools

Mon, 14 May 2012 15:17:33 +0000

Look thru some of my presentations (www.slideshare.net/anton_chuvakin), I define both there

Anton Chuvakin Blog : The Log Book Needs YOUR Help!

Fri, 9 Mar 2012 17:39:03 +0000

Yes, I will do that - I just wanted to judge the level of interest first. If I toss a list of basic/less-exciting chapters up, there might be no takers :-)

Anton Chuvakin Blog : See You At RSA 2012!

Wed, 7 Mar 2012 15:24:31 +0000

Thanks for the comment - I still have not recovered from RSA and I am already at another conference. I may post something in the next week or so. Yes, I felt the same about the mobile, but I also saw insufficient or naive vendor focus to the whole mobile mess :-(