Insights

Ransomware has made a resurgence and is impacting both IT service providers and the businesses they serve. What if you had insights into...

No matter what business you are in, it’s likely you view ransomware as one of the top cyber threats today. Adversaries are adapting...

Threat researchers detected threat group NOBELIUM conducting several waves of malicious spear phishing email campaigns. Each wave used...

Incomplete cybersecurity information visibility comes at a cost. Without real-time comprehensive visibility, organizations experience...

In 2020, we saw digital transformation accelerate along with rising ransomware, threats caused by human error and misconfigurations, and...

This holiday season will be like no other with the continued use of remote work, greater online sales, third-party sourcing from...

Businesses are always looking for ways to deliver increased value to clients while optimizing efficiency, and this year is no exception...

The threat landscape continues to accelerate, with sophisticated attacks becoming more commonplace as ransomware-as-a-service accelerates...

The rise in ransomware attack volume and sophistication is a wake-up call for executives and IT departments alike. Traditional perimeter...

The cybersecurity industry is notorious for coining terms and acronyms that rise and fall out of favor before they even have a chance to...

Business uncertainty has led to widespread adoption of working from home. Since most meaningful tasks in any organization require...

With most employees working from home amid COVID-19 (coronavirus) outbreak, VPN servers have now become paramount to a company's...

More Work-from-Home (WFH) scenarios due to COVID-19 present challenges as employees move from a trusted and secured office network to...

Maintaining strong cybersecurity is crucial as organizations make impromptu decisions to send more and more employees to work from home...

RSA Conference 2020 has come and gone. It still maintains its status as the largest security event in the world, although attendance...

A data breach today takes 127 days to detect, according to the Ponemon Institute. Comprehensive visibility and real-time analysis of...

Following many high-profile data breaches, consumers have elevated data privacy to front-page news and included it as criteria for brand...

Just like locking your front door is crucial to protect your house, monitoring account logins to organizational servers and workstations...

The holidays are a busy time for most business owners as they ramp up to serve consumers excited to find holiday specials, or even as...

Threats and threat actors continue to evolve and morph, creating advanced and even more dangerous tactics to mitigate. October is...

The ELK (Elasticsearch, Logstash, Kibana) stack is a popular open source log analysis and management platform. The collection, processing...

While nation-state threat actors and external hackers often garner the headlines, insider threats are an often-overlooked threat vector...

Black Hat 2019 was a learning experience and success for all. All of the hackers, presenters, vendors, and attendees have gone home, but...

At Black Hat 2019, Eric Doerr, GM of the Microsoft Security Response Center, reminded attendees of the interconnectedness of enterprise...

Just how much should you be spending on IT Security? It’s a vexing question to answer for many reasons as each situation has their...

Is your organization still using Windows 7? Microsoft support is coming to a close in a few short months. If you think end-of-support for...

Overwhelmed by the hype from security vendors in overdrive? Notice the innovation and trends and feel like jumping on the bandwagon? It...

Banks have always been a prime target for cybercriminals. With enormous stores of cash and consumer data, and the massive threat of...

Increasing complexity and frequency of attacks have escalated the need for detection of attacks and incident response. Endpoints are the...

For MSPs serving clients in the healthcare industry, protecting data can be complex. With compliance enforcement like HIPAA , for...

Did you know that Microsoft is a security vendor? No, it’s true. For years, the company was hammered by negative public perception...

Over 7 billion global devices in an always on and continuously connected world create a soft target for today’s attacker. Whether...

We recently released the findings of the Security Information and Event Management (SIEM) study conducted by Cybersecurity Insights. The...

If you think your organization is too small to be targeted by threat actors, think again. Over 60% of organizations have experienced an...

Protecting a business’ IT infrastructure and data can be difficult with the abundance of threats out there, the array of new data...

The year 2018 saw ransomware families such as CryptoLocker and variants like Locky continue to plague organizations as cybersecurity...

For cyber criminals, everyone’s a target. We must assume that, at some point, every organization’s IT infrastructure will be...

In simpler times, security technology approaches were clearly defined and primarily based on prevention with things like firewalls...

A hot trend in the Managed Service Provider (MSP) space is emerging, transforming from an MSP to a Managed Security Service Provider...

Advances in data analytics and increased connectivity have merged to create a powerful platform for change. Today, people, objects, and...

When it comes to selling security, one of the major challenges faced by managed services providers (MSPs) is changing the mind set of...

Breaches continue to be reported at a dizzying pace. In 2018 alone, a diverse range of companies — including Best Buy, Delta...

Just after a new security vulnerability surfaced Wednesday, many tech outlets started comparing it with HeartBleed, the serious security...

Implement a Central Collection System Microsoft has made some considerable changes to event management in Windows Vista. But are these...

There are five different ways you can log on in Windows called “logon types.” The Windows Security Log lists the logon type...

With data breaches and Snowden-like information grabs, I’m getting increased requests for how to track data moving to and from...

DNS is an attractive mechanism for performing malicious activities like network reconnaissance, malware downloads, or communication with...

Now that advanced cybersecurity protections are a must-have in today’s landscape, organizations of all sizes are increasingly...

Office 365 (O365) is immensely popular across all industry verticals in the small and medium enterprise space. It is often the killer app...

It continues to be challenging being a Chief Information Security Officer (CISO) today – and this year promises no rest. As high...

What's the cost of securing your network from a cyber attack? According to Precision Analytics and The CAP Group, many companies are...

The technological revolution has introduced a plethora of advanced solutions to help identify and stop intrusions. There is no...

The cybersecurity threat landscape is in constant motion – ever evolving. According to Kaspersky Labs, 323,000 new malware strains...

The FBI estimates that more than 4,000 ransomware attacks have occurred daily since the beginning of 2016. That...

Can you simply buy a “SIEM solution”? Turns out you really cannot, no matter how hard you try nor how passionately the vendor...

Security is an ever-escalating arms race. The good guys have gotten better about monitoring the file system for artifacts of advanced...

The argument is an old one; are you better off with a network-based detector, assuming all hosts will eventually communicate, or should...

It doesn't rhyme and it's not what Whittier said but it's true. If you don't log it when it happens, the evidence is gone...

As I reflect on this year, a Shakespearean quote plays out in my mind – when King Henry the Fifth is rallying his troops to attack...

The Cisco Annual Cybersecurity Report provides insights based on threat intelligence gathered by Cisco's security experts, combined...

In 2005, the Department of Homeland Security commissioned Livermore National Labs to produce a kind of pre-emptive post-mortem report.

Does this sound familiar? You have no control of your environment and most of your efforts are diverted into understanding what happened,...

The cybersecurity market is loaded with ambiguous buzzwords and competing acronyms that make it very difficult to clearly distinguish one...

Imagine dealing with a silent, but mentally grating barrage of security alerts every day. The security analyst’s dilemma?

‘Twas the night before Christmas and all through HQ Not a creature was stirring, except greedy Lou – An insider thief who had...

Regulatory compliance is a necessary step for IT leaders, but it’s not sufficient enough to reduce residual IT security...

Log collection, SIEM and security monitoring are the journey not the destination.  Unfortunately, the destination is often a false...

Are you feverishly working to patch your systems today with the latest available patches? Or are you spending your time unfriending...

We have been implementing Security Information and Event Management (SIEM) solutions for more than 10 years. We serve hundreds of active...

We are delighted that EventTracker is now part of the Netsurion family. On October 13, 2016 we announced our merger with managed security...

How do you figure out when someone was actually logged onto their PC? The data is there in the security log, but it’s so much...

​The presidential debate, as entertaining as it was for many, was a great place to hear about the focus needed on cybersecurity issues in...

Persistent threats affecting businesses of all sizes and in all verticals are becoming more consistent and hitting more frequently. The...

A common hacking method is to steal information by first gaining lower-level access to your network. This can happen in a variety of ways...

Cyber criminals are constantly developing increasingly sophisticated and dangerous malware programs. Statistics for the first quarter of...

The event, aimed at connecting the point-of-sale (POS) technology ecosystem, was extremely successful...

Windows gives you several ways to control which computers can be logged onto with a given account.  Leveraging these features is a...

Ideas to Retire is a TechTank series of blog posts that identify outdated practices in public sector IT management and suggest new ideas...

There’s a wealth of intelligence available in your DNS logs that can help you detect persistent threats. So how can you use them to...

In this fifth article of the series, we continue to explore the basic ways businesses can keep their networks safer. These include tools...

Analytics is an essential component of a modern SIEM solution. The ability to crunch large volumes of log and security data in order to...

Detecting virus signatures is so last year. Creating a virus with a unique signature or hash is quite literally child’s play, and...

In a recent webinar, we demonstrated techniques by which EventTracker monitors DNS logs to uncover attempts by malware to communicate...

In this entry we discuss the topic of anti-virus protection. There are many questions that come up when we talk about this topic. So here...

While software that can be installed on your PC and used to remotely connect when you are away from your home office can be very handy...

Far too many SIEM implementations are considered to be catastrophes. Having implemented hundreds of such projects, here are the three...

If you are not keeping up with regular patching of your computer and the programs that run on it – then you are simply asking for...

Ransomware burst onto the scene with high profile attacks against hospitals, law firms and other organizations.  What is it and how...

2016 Verizon Breach Investigations Report (Part 3 of 3)
We've covered the 4 patterns of attack used by hackers, expanded on...

2016 Verizon Breach Investigations Report (Part 2 of 3)
In our previous post we showed you that regardless of the business&rsquo...

SC Magazine released the results of a research survey focused on the rising acceptance of SIEM-as-a-Service for the small and medium...

Yet another recent report confirms the obvious, that SMBs in general do not take security seriously enough. The truth is a bit more...

While your business’ data security program should consist of many components, perhaps the most effective defense to ransomware is...

Traditional areas of risk — financial risk, operational risk, geopolitical risk, risk of natural disasters — have been part...

Ransomware is a business’ worst nightmare. This malware infects computers and restricts the users from accessing any of their data...

Do you embrace the matrix? The fact is, once networks get to a certain size, IT organizations begin to specialize and small kingdoms emerge.

Cloud security is getting attention and that’s as it should be.  But before you get hung up on techie security details, like...

The range of threats included trojans, worms, trojan downloaders and droppers, exploits and bots (backdoor trojans), among others. When...

Windows supports the digitally signing of EXEs and other application files so that you can verify the provenance of software before it...

Here’s our list of the Top 5 SIEM complaints:1) We bought a security information and event management (SIEM) system, but it...

Think about the burglar alarm systems that are common in residential neighborhoods. In the eye of the passive observer, an alarm system...

Winning a marathon requires dedication and preparation. Over long periods of time. A sprint requires intense energy but for a short...

It’s understandable that the primary goal of any healthcare practice is to keep their patients healthy and safe. But what about...

Given today’s threat landscape, let’s acknowledge that a breach has either already occurred within our network or that it...

2015 was a tough year for the healthcare industry. Some are even calling 2015 “the year of...

The traditional method for calculating standard Return on Investment (RoI) is that it equals the gain minus the cost, divided by the...

Here we are going to look for Event ID 4740. This is the security event that is logged whenever an account gets locked. “User X...

2015 has been a year of healthcare data breaches. But why are hackers going after healthcare records now?

Many small businesses believe only the "big guys" will suffer a data breach. But did you know that 90% of data breaches impact...

As data breaches occur more and more, it is no secret that the market needs more cybersecurity professionals. Here are a few statistics...

Security Subsistence Syndrome (SSS) is defined as a mindset in an organization that believes it has no security choices and is...

Technology keeps improving, as do hackers. Hackers have been around for years and years; from exploiting the vulnerabilities of telephone...

If attackers can deploy a remote administration tool (RAT) on your network, it makes it so much easier for them. RATs make it luxurious...

EventTracker users know that one of its primary functions is to apply built-in knowledge to reduce the flood of all security/log data to...

Passwords keep your accounts and network safe but may also be a gateway for hackers. Here are some quick tips we recommend when creating...

We hear a lot about tracking privileged access today because privileged users like Domain Admins can do a lot of damage. But more...

The number of data breaches continues to increase. Cybercrime affects your brand, your customers and your employees in ways that are...

The CDC estimates that close to 80% of office-based physicians use some form of electronic medical records. This increase, coupled with...

What is the true cost of a data breach? A data breach affects your business, brand, and reputation. But it can be prevented.

For many years now, the security industry has become somewhat reliant on ‘indicators of compromise’ (IoC) to act as clues...

There’s plenty of interest in all kinds of advanced security technologies like threat intelligence, strong/dynamic authentication...

The gap between the ‘time to compromise’ and the ‘time to discover’ is the detection deficit. According to...

In the wake of BackOff, and numerous other data breaches, consumers are demanding answers into the how and why surrounding companies who...

It’s clear that we are now working under the assumption of a breach. The challenge is to find the attacker before they cause damage...

Six ways to shoot yourself with SIEM technology: 1) Dont plan; just jump in 2) Have no defined scope or use cases; whatever 3) Confuse...

A data breach has serious consequences both directly and indirectly. Lost revenue and a tarnished brand reputation both inflict harm...

This fundamental tradeoff between security, usability, and cost is critical. Yes, it is possible to have both security and usability...

Is it possible to avoid security breaches? Judging from recent headlines, probably not. Victims range from startups like Kreditech, to...

You may recall that back in 2012, then Secretary of Defense Leon Panetta warned of “a cyber Pearl Harbor; an attack that would cause...

Sometimes we get hung up on event monitoring and forget about the “I” in SIEM which stands for information. Not forgetting...

There is great excitement amongst security technology and service providers about the intersection of global threat intelligence with...

Bad actors/actions are more and more prevalent on the Internet. Who are they? What are they up to? Are they prowling in your network...

Log monitoring is difficult for many reasons. For one thing there are not many events that unquestionably indicate an intrusion or...

Traditional threat models posit that it is necessary to protect against all attacks. While this may be true for a critical national...

We live in a brave new world where the spies of yesteryear, like James Bond and Jason Bourne, are truly falling away into the realm of...

You must have a heard light bulb jokes, for example: How many optimists does it take to screw in a light bulb? None, they’re...

In computer terminology, a honeypot is a computer system set to detect, deflect, or, in some manner, counteract attempts at...

Security Information and Event Management (SIEM) technology is an essential component in a modern defense-in-depth strategy for IT...

In the wake of Heartbleed, comes a new form of exposure that could potentially do much more damage than any other vulnerability of its...

If you manage any Linux machines, it is essential that you know where the log files are located, and what is contained in them. From a...

Every now and then hackers develop a piece of malware that is so insidious that it changes the landscape of computer security and...

I often get asked how to audit the deletion of objects in Active Directory. It’s pretty easy to do this with the Windows Security...

Return on investment (ROI) - it is the Achilles heel of IT management. Nobody minds spending money to avoid costs, prevent disasters, and...

Are you familiar with the Kübler-Ross 5 Stages of Grief model? SIEM implementation (and indeed most enterprise software installations...

Security Information and Event Management (SIEM) is a term coined by Gartner in 2005 to describe technology used to monitor and help...

Analyzing all the login and pre-authentication failures within your organization can be tedious. There are thousands of login failures...

In the wake of their breach, Target announced on March 5, 2014 that their CIO, Beth Jacob was announcing her resignation. This begs the...

Unstructured data access governance is a big compliance concern.  Unstructured data is difficult to secure because there’s so...

For the past several months, there have been numerous stories about major retailers that have been breached by hackers. The result is...

It was the fall of 2008. A variant of a three year old relatively benign worm began infecting U.S. military networks via thumb drives.

Over the years, security admins have repeatedly asked me how to audit file shares in Windows.  Until Windows Server 2008, there were...

What security events get logged when a user logs on to their workstation with a domain account and proceeds to run local applications and...

In the aftermath of the disclosure of the NSA program called PRISM by Edward Snowden to a reporter at The Guardian...

In the wake of the most recent terrorist bombing in Boston, it is easy to understand why some people...

One thing I always wished you could do in Windows auditing was mandate that access to an object be audited if the user was NOT a member...

When you think about electronic security, what comes to mind? Do you consider how vulnerable your...

I think one of the most underutilized features of Windows Auditing and the Security Log are Process Tracking events. In Windows 2003/XP...

I often encounter a dangerous misconception about the Windows Security Log: the idea that you only need to monitor domain controller...

The past year has been a hair-raising series of IT security breakdowns and headlining events reaching as high as RSA itself falling...

When we originally conceived the idea of SIEM and log management solution for IT managers many years ago, it was because of the...

There’s been a lot of recent hype about security risks with the rise of virtualization, but much of it is vague and short on...

Intrusion detection and compliance are the focus of log management, SIEM and security logging.  But security logs, when managed...

I am often asked that if Log Management is so important to the modern IT department, then how come more than 80% of the market that...

Despite the fact that security industry has been fighting malicious software – viruses, worms, spyware, bots and other malware...

Unfortunately, IT is not perfect; nothing in our world can be. Compounding the inevitable failures and weaknesses in any system designed...

No one needs to be convinced that monitoring Domain Controller security logs is important; member servers are equally as important: most...

An area of audit logging that is often confusing is the difference between two categories in the Windows security log: Account Logon...

Randy Franklin Smith compares methods for detecting malicious activity from logs including monitoring for high impact changes, setting up...

Often when I engage with a prospect their first question is “How many events per second (EPS) can EventTracker handle?&rdquo...

The 5 W’s of security management I’ve seen it happen about a thousand times if I’ve seen it once. A high profile...