Richard Bejtlich

@[email protected]
3K Followers
79 Following
782 Posts
I was a captain in the United States Air Force who formally trained as an intelligence officer. I later worked in information warfare. I promoted the concept that "prevention eventually fails" in my first book (2004) and developed tactics, operations, and strategy to detect and respond to nation-state and criminal computer intrusions. I wrote about cybersecurity from 2001 to 2021. I created the GE-CIRT and was Mandiant's first CISO. I currently advocate #NetworkSecurityMonitoring for @corelight. My latest books are here #ad https://amzn.to/3B2AcMc
TaoSecurityhttps://www.taosecurity.com/index.html
Bloghttps://taosecurity.blogspot.com/
LinkedInhttps://www.linkedin.com/in/richardbejtlich/
Amazonhttps://www.amazon.com/-/e/B001IR3KOW
Richard Bejtlich4h ago

Episode 16 of the Corelight podcast is live. Dave Getman and I discuss the evolution of Corelight Investigator, the role of agentic triage in security operations, and how Corelight brings receipts to intrusion analysis.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Richard Bejtlich19h ago

RE: https://infosec.exchange/@briankrebs/116661298779426573

I’m not surprised at all. This has always sounded like a personal vendetta by a former employee or contractor. I don’t buy the “mistreated independent genius researcher” angle either. This person is probably leaking the MS internal vuln catalog. Unfortunately the “infosec community” is dominated by vocal fans of offense, who earn their living by breaking things, proving my 2021 proposition that “Digital offense capabilities are currently net negative for the security ecosystem.”

https://taosecurity.blogspot.com/2021/02/digital-offense-capabilities-are.html

Richard BejtlichMay 21

Episode 15 of the Corelight podcast is live. Greg Bell and I talk about Mythos and AI-accelerated vulnerability discovery and remediation. This was one of my favorite discussions thus far!

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Richard BejtlichMay 7

Episode 14 of the Corelight podcast is live. I speak with Vince Stoffer on post-quantum cryptography. We discuss how network security monitoring can help defensive teams understand and manage this technology.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Richard BejtlichMay 6
Here's another incident where checking your NSM data would tell you if you were compromised, assuming you're collecting and storing the right evidence for a sufficient duration. https://www.techspot.com/news/112318-hackers-used-daemon-tools-own-website-silently-install.html
Hackers used Daemon Tools' own website to silently install backdoors on thousands of PCs for nearly a month

Cybersecurity researchers at Kaspersky found that the attack compromised multiple versions of Daemon Tools, from 12.5.0.2421 through 12.5.0.2434. What made the campaign particularly difficult to detect was...

TechSpot
Richard BejtlichApr 26
This is really interesting, and although there are no network IOCs in the post, this malware was active on target networks: https://hackingpassion.com/fast16-pre-stuxnet-cyber-sabotage/
Fast16: The Cyberweapon That Predates Stuxnet by Five Years

For 21 years, fast16 corrupted nuclear research calculations without anyone noticing. It predates Stuxnet by five years. The math was always wrong.

HackingPassion.com : [email protected][~]
Richard BejtlichApr 23

Episode 13 of the Corelight podcast is live. I speak with our VP of research, Ali Islam. We discuss how a research lab functions within a modern security company. Ali has advice for anyone who wants to get into this fun technical field.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Richard BejtlichApr 21

Mythos has definitively disproven this: “Given enough eyeballs, all bugs are shallow," known as Linus's Law, asserts that with a large enough base of beta-testers and co-developers, almost every software problem will be identified and fixed quickly. Coined by Eric S. Raymond in The Cathedral and the Bazaar (1999) to describe open-source development, it suggests collective scrutiny makes bugs easier to find.”

https://arstechnica.com/ai/2026/04/mozilla-anthropics-mythos-found-271-zero-day-vulnerabilities-in-firefox-150/

Mozilla: Anthropic's Mythos found 271 security vulnerabilities in Firefox 150

CTO says new AI model is "every bit as capable" as world's best security researchers.

Ars Technica
Richard BejtlichApr 19
"Those two words which the writer set together have produced an effect which will never die, as long as [people] can read with understanding." - Shelby Foote, The Correspondence of Shelby Foote and Walker Percy
Richard BejtlichApr 15
Who else is glad to see that Windows Smart App Control can now be enabled and disabled as needed without a Windows reinstall? Now I just need a way to whitelist select apps. For example, I vibe coded my own screencap program, but it has triggered SAC in the past because it’s not signed.