Dr Anton Chuvakin Blog (Original)

Security writing since the mid-2000s. New posts are mirrored from Anton on Security on Medium.

Read on Medium LinkedIn X RSS

5:17 PM

Metricon 1.0 Call For Papers (CFP)

By Anton Chuvakin

First ever convention on security metrics ... presenting Metricon!
Emergent Chaos: Metricon 1.0 Call For Papers

Conceived by the SecurityMetrics.org team during RSA 2006 (with yours truly involved a bit as well...)

New posts appear first on Anton on Security on Medium. This blog keeps a copy, plus the archive going back to the mid-2000s.

Comments

Dr. Anton Chuvakin

Security at Cisco. Before that: Google Cloud Office of the CISO, eight years as a Gartner analyst, and a long run in SIEM and log management. Author of Security Warrior, PCI Compliance, and Logging and Log Management.

Dr Anton Chuvakin Blog (Original)

This is Anton Chuvakin original blog (pre-Gartner) that I will now use to backup my Medium blog content (2023+)

Top Popular Posts

The Last Blog Post!

This is my last blog post –for the foreseeable future. It is dated 7/31/2011 at 11:59PM. What happens tomorrow? A new life, of course! As only very few of you know, I have accepted a position of Research Director with Gartner, Inc . Tomorrow I am joining a stellar team lead by Phil Schacter , formerly from Burton Group . I spent two VERY successful years consulting , working with companies like Novell, RSA, LogLogic, NitroSecurity, eGestalt, ObserveIT, Tripwire, AlienVault, “Big MSSP”, “Big Insurance Company”, “SaaS Log Management Company”, “IT Management Software Company”, “SMB Security Company”, “Big Networking Equipment Company” and others. I defined, built, deployed, and marketed security products, mostly in the area of SIEM and log management . I helped organizations with security and PCI DSS strategy. I advised security vendor management on compliance strategy for their products. I have spoken at clients’ events and have written more whitepapers than I care to ...

Simple Log Review Checklist Released!

Today, many people are looking for very simple solutions to big and complex problems – and the area of logging and log management is no exception. Following that theme, we have created a " Critical Log Review Checklist for Security Incidents " which is released to the world today. In addition to HTML , PDF or DOC versions are available as well (alternative hosting location is here ). Feel free to modify the checklist for your own purposes or for internal distribution in your organization - but please keep the attribution to the authors. The log cheat sheet presents a checklist for reviewing critical system, network and security logs when responding to a security incident. It can also be used for routine periodic log review. It was authored by Dr. Anton Chuvakin and Lenny Zeltser (BTW, Lenny has other useful security cheat sheets on malware analysis, security architecture, DDoS, etc here ) Here is the embedded version from DocStoc: Critical Log Review C...

Why No Open Source SIEM, EVER?

Here is a perfect weekend post – on SIEM :-) Ok, all this Google web traffic of people searching for “ open source SIEM ” (sometimes “ open source SIM ”, almost never “open source SEM” {Is SEM .. dead? :-)}) continues to fill my web server logs and it finally prompted me to write this post, rather than simply whine about, like I was doing for 3 years :-) It all started here when Matasano folks (sockpuppet.org at the time), in a rare bout of punditry proclaimed back in 2005 (!): “A Credible Open-Source SIM I predicted that, just as SourceFire commoditized and co-opted the IDS market, a nascent open source project would challenge SIM products like ArcSight and Cisco MARS. Result: No Credit [A.C. – this is a later addition to their post when their scored their 2006 predictions] What’s taking you guys so long? Getting spooked that all the money seems to be going to log management? That’s exactly the dynamic Snort charged in to! Get with the program!” or in anothe...

Monthly Blog Round-Up – May 2017

Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts/topics this month: “New SIEM Whitepaper on Use Cases In-Depth OUT!” (dated 2010) presents a whitepaper on select SIEM use cases described in depth with rules and reports [using now-defunct SIEM product]; also see this SIEM use case in depth and this for a more current list of popular SIEM use cases. Finally, see our 2016 research on developing security monitoring use cases here ! “ Simple Log Review Checklist Released! ” is often at the top of this list – this aging checklist is still a very useful tool for many people. “ On Free Log Management Tools ” (also aged a bit by now) is a companion to the checklist ( updated version ) “ Why No Open Source SIEM, EVER? ” contains some of my SIEM thinking from 2009. Is it relevant now? You be the judge. Succeeding with SIEM requires a lot of work, whether you paid for the software, or not. BTW, this post has an amazing “staying power” that is h...

Monthly Blog Round-Up – January 2018

Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts based on last month’s visitor data (excluding other monthly or annual round-ups): “New SIEM Whitepaper on Use Cases In-Depth OUT!” (dated 2010) presents a whitepaper on select SIEM use cases described in depth with rules and reports [using now-defunct SIEM product]; also see this SIEM use case in depth and this for a more current list of popular SIEM use cases. Finally, see our 2016 research on developing security monitoring use cases here – and we just UPDATED IT FOR 2018 . “ Why No Open Source SIEM, EVER? ” contains some of my SIEM thinking from 2009 (oh, wow, ancient history!). Is it relevant now? You be the judge. Succeeding with SIEM requires a lot of work, whether you paid for the software, or not. BTW, this post has an amazing “staying power” that is hard to explain – I suspect it has to do with people wanting “free stuff” and googling for “open source SIEM ” … A...

Topics

security1152 medium363 log management340 logging329 compliance239 PCI187 logs176 security management129 SIEM126 reading121 Monthly119 conference118 personal95 blogging92 Information Security91 trends91 humor86 musings83 presentation75 Gartner Archive74 SIM67 SEM64 monitoring58 future48 news46 malware42 stupidity40 analytics38 intrusion37 predictions36 chuvakin35 standards34 poll31 RSA30 book29 market29 incident28 SANS27 paper27 Medium26 loglogic26 Security Operations25 risk24 tips23 warfare23 cloud21 philosophy21 CEE19 PCI_Log_Review19 marketing19 incident response18 TysonRhame17 big data17 vendors17 research16 vulnerability16 ROI15 DLP14 honeynet14 privacy14 201013 book review13 forensics13 metrics12 vulnerability management12 Annual11 jobs11 threat intelligence11 review10 TysonRhame9 20099 MSSP9 Medium Backup9 data protection9 podcast9 websec9 Gartner8 application8 business8 economics8 saas8 strategy8 webinar8 awareness7 career7 insiders7 legal7 network forensics7 20086 BlackHat6 Detection Engineering6 attack6 policy6 soc6 LogChat5 consulting5 data5 database5 endpoint5 haiku5 myth5 patching5 product management5 qualys5 security theater5 software5 virtual5 20074 FAIL4 encryption4 incident-response4 mistakes4 search4 soar4 travel4 virtualization4 visualization4 vulnerability-management4 web logs4 windows4 20113 DRM3 GRC3 NIST3 ai3 ai-soc3 audit3 awesomeness3 correlation3 government3 interview3 intrusion detection3 open source3 opsec3 orchestration3 perimeter3 politics3 pontification3 questions3 security-operations3 siem3 20122 20202 HIPAA2 SOC2 ShmooCon2 Threat Intelligence2 access2 ai-security2 best practices2 collective2 competitive2 cybercrime2 e-discovery2 evangelism2 glossary2 keynote2 knowledge management2 mssp2 network-forensics2 new2 rootkit2 security-operation-center2 stratfor2 tools2 twitter2 ueba2 0day1 20131 20191 Android1 Artificial Intelligence1 Career1 Cloud Security1 Cloud Threats1 EMAP1 Future Trends1 IANS1 IPv61 Incident Response1 Security Monitoring1 Uncategorized1 analogy1 announcement1 announcements1 architecture1 authentication1 blo1 comments1 computers1 controversy1 cool1 current1 data mining1 data-and-analytics-strategies1 data-security1 deception1 detection1 discovered-link1 dlp1 fraud1 gartner1 geopolitics1 guest post1 identity1 innovation1 linux1 mobile1 network1 nta1 obvious1 patch-management1 platform1 quarterly-blogging1 reflections1 related-blog1 security-basics1 semantic1 sharing1 storage1 threat-intelligence1 video1 vulnmgt1 vulnops1 whitepaper1

2026 28
- October 2
- September 3
- August 6
- July 3
- June 2
- May 4
- April 3
- March 4
- January 1
2025 37
- December 4
- November 2
- October 2
- September 12
- August 1
- July 4
- June 2
- May 1
- April 1
- March 2
- February 1
- January 5
2024 57
- December 4
- November 1
- October 5
- September 2
- August 3
- July 7
- June 3
- May 4
- April 7
- March 9
- February 9
- January 3
2023 58
- December 5
- November 5
- October 10
- September 6
- August 7
- June 3
- May 10
- April 2
- March 6
- February 2
- January 2
2022 55
- December 2
- November 5
- October 5
- September 1
- August 4
- July 3
- June 9
- May 3
- April 10
- March 3
- February 3
- January 7
2021 42
- December 3
- October 1
- September 3
- August 3
- July 2
- June 1
- May 4
- April 9
- March 9
- February 4
- January 3
2020 88
- December 5
- November 7
- October 6
- September 16
- August 7
- July 4
- June 4
- May 10
- April 7
- March 6
- February 9
- January 7
2019 51
- December 11
- November 2
- October 3
- September 2
- August 5
- July 6
- June 10
- May 6
- April 2
- March 3
- February 1
2018 37
- December 1
- November 3
- October 4
- September 3
- August 3
- July 4
- June 5
- May 4
- March 4
- February 5
- January 1
2017 30
- December 1
- November 3
- October 5
- September 2
- August 3
- July 2
- June 2
- May 2
- April 3
- March 1
- February 1
- January 5
2016 32
- December 4
- November 3
- October 2
- September 2
- August 1
- July 3
- June 1
- May 3
- April 2
- March 3
- February 3
- January 5
2015 38
- December 3
- November 1
- October 7
- September 1
- August 6
- July 3
- June 2
- May 1
- April 2
- March 4
- February 4
- January 4
2014 57
- December 5
- November 3
- October 6
- September 4
- August 1
- July 8
- June 6
- May 5
- April 3
- March 7
- February 4
- January 5
2013 65
- December 4
- November 4
- October 8
- September 7
- August 5
- July 11
- June 4
- May 2
- April 4
- March 5
- February 6
- January 5
2012 64
- December 8
- November 4
- October 2
- September 6
- August 7
- July 9
- June 3
- May 2
- April 3
- March 8
- February 7
- January 5
2011 73
- December 1
- November 2
- October 5
- September 2
- August 2
- July 12
- June 4
- May 8
- April 6
- March 10
- February 8
- January 13
2010 137
- December 22
- November 12
- October 6
- September 11
- August 15
- July 7
- June 6
- May 10
- April 10
- March 14
- February 15
- January 9
2009 193
- December 11
- November 12
- October 23
- September 16
- August 15
- July 13
- June 18
- May 11
- April 20
- March 19
- February 14
- January 21
2008 311
- December 18
- November 20
- October 23
- September 15
- August 19
- July 19
- June 22
- May 28
- April 45
- March 27
- February 33
- January 42
2007 479
- December 21
- November 44
- October 57
- September 57
- August 51
- July 49
- June 34
- May 39
- April 21
- March 30
- February 30
- January 46
2006 370
2005 34
- December 34

My Links

"PCI Compliance" book site
My website
My old presentations
My old portal Info-Secure.org
Old "Security Warrior" Book Site

Powered by Blogger

Copyright Anton Chuvakin

© Anton Chuvakin. Opinions are my own. Anton on Security · Atom feed