Dr Anton Chuvakin Blog (Original)

Security writing since the mid-2000s. New posts are mirrored from Anton on Security on Medium.

Read on Medium LinkedIn X RSS

7:21 AM

Winning, Losing - Ah, Come on!

By Anton Chuvakin

Misc useless and somewhat funny discussion on "winning the war against hackers", whatever that means (Answer: it means nothing! :-))

Network Security Blog: We're not winning the war against hackers: "The Register is running an article that called

New posts appear first on Anton on Security on Medium. This blog keeps a copy, plus the archive going back to the mid-2000s.

Comments

Dr. Anton Chuvakin

Security at Cisco. Before that: Google Cloud Office of the CISO, eight years as a Gartner analyst, and a long run in SIEM and log management. Author of Security Warrior, PCI Compliance, and Logging and Log Management.

Dr Anton Chuvakin Blog (Original)

This is Anton Chuvakin original blog (pre-Gartner) that I will now use to backup my Medium blog content (2023+)

Top Popular Posts

The Last Blog Post!

This is my last blog post –for the foreseeable future. It is dated 7/31/2011 at 11:59PM. What happens tomorrow? A new life, of course! As only very few of you know, I have accepted a position of Research Director with Gartner, Inc . Tomorrow I am joining a stellar team lead by Phil Schacter , formerly from Burton Group . I spent two VERY successful years consulting , working with companies like Novell, RSA, LogLogic, NitroSecurity, eGestalt, ObserveIT, Tripwire, AlienVault, “Big MSSP”, “Big Insurance Company”, “SaaS Log Management Company”, “IT Management Software Company”, “SMB Security Company”, “Big Networking Equipment Company” and others. I defined, built, deployed, and marketed security products, mostly in the area of SIEM and log management . I helped organizations with security and PCI DSS strategy. I advised security vendor management on compliance strategy for their products. I have spoken at clients’ events and have written more whitepapers than I care to ...

Simple Log Review Checklist Released!

Today, many people are looking for very simple solutions to big and complex problems – and the area of logging and log management is no exception. Following that theme, we have created a " Critical Log Review Checklist for Security Incidents " which is released to the world today. In addition to HTML , PDF or DOC versions are available as well (alternative hosting location is here ). Feel free to modify the checklist for your own purposes or for internal distribution in your organization - but please keep the attribution to the authors. The log cheat sheet presents a checklist for reviewing critical system, network and security logs when responding to a security incident. It can also be used for routine periodic log review. It was authored by Dr. Anton Chuvakin and Lenny Zeltser (BTW, Lenny has other useful security cheat sheets on malware analysis, security architecture, DDoS, etc here ) Here is the embedded version from DocStoc: Critical Log Review C...

Why No Open Source SIEM, EVER?

Here is a perfect weekend post – on SIEM :-) Ok, all this Google web traffic of people searching for “ open source SIEM ” (sometimes “ open source SIM ”, almost never “open source SEM” {Is SEM .. dead? :-)}) continues to fill my web server logs and it finally prompted me to write this post, rather than simply whine about, like I was doing for 3 years :-) It all started here when Matasano folks (sockpuppet.org at the time), in a rare bout of punditry proclaimed back in 2005 (!): “A Credible Open-Source SIM I predicted that, just as SourceFire commoditized and co-opted the IDS market, a nascent open source project would challenge SIM products like ArcSight and Cisco MARS. Result: No Credit [A.C. – this is a later addition to their post when their scored their 2006 predictions] What’s taking you guys so long? Getting spooked that all the money seems to be going to log management? That’s exactly the dynamic Snort charged in to! Get with the program!” or in anothe...

Monthly Blog Round-Up – May 2017

Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts/topics this month: “New SIEM Whitepaper on Use Cases In-Depth OUT!” (dated 2010) presents a whitepaper on select SIEM use cases described in depth with rules and reports [using now-defunct SIEM product]; also see this SIEM use case in depth and this for a more current list of popular SIEM use cases. Finally, see our 2016 research on developing security monitoring use cases here ! “ Simple Log Review Checklist Released! ” is often at the top of this list – this aging checklist is still a very useful tool for many people. “ On Free Log Management Tools ” (also aged a bit by now) is a companion to the checklist ( updated version ) “ Why No Open Source SIEM, EVER? ” contains some of my SIEM thinking from 2009. Is it relevant now? You be the judge. Succeeding with SIEM requires a lot of work, whether you paid for the software, or not. BTW, this post has an amazing “staying power” that is h...

Monthly Blog Round-Up – January 2018

Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts based on last month’s visitor data (excluding other monthly or annual round-ups): “New SIEM Whitepaper on Use Cases In-Depth OUT!” (dated 2010) presents a whitepaper on select SIEM use cases described in depth with rules and reports [using now-defunct SIEM product]; also see this SIEM use case in depth and this for a more current list of popular SIEM use cases. Finally, see our 2016 research on developing security monitoring use cases here – and we just UPDATED IT FOR 2018 . “ Why No Open Source SIEM, EVER? ” contains some of my SIEM thinking from 2009 (oh, wow, ancient history!). Is it relevant now? You be the judge. Succeeding with SIEM requires a lot of work, whether you paid for the software, or not. BTW, this post has an amazing “staying power” that is hard to explain – I suspect it has to do with people wanting “free stuff” and googling for “open source SIEM ” … A...

Topics

security1015 log management340 logging308 medium307 compliance235 PCI188 logs176 security management129 reading121 Monthly119 conference117 personal95 blogging92 trends91 SIEM89 humor86 musings83 presentation75 SIM67 SEM64 future46 news46 malware40 stupidity40 intrusion37 predictions36 chuvakin35 poll31 RSA30 standards30 book29 market29 incident28 SANS27 paper27 Medium26 loglogic26 risk24 tips23 warfare23 CEE19 PCI_Log_Review19 marketing19 TysonRhame17 vendors17 research16 ROI15 cloud15 vulnerability15 honeynet14 privacy14 201013 book review13 forensics13 metrics12 Annual11 jobs11 review10 TysonRhame9 20099 DLP9 Medium Backup9 data protection9 podcast9 websec9 Gartner8 business8 economics8 saas8 strategy8 webinar8 awareness7 insiders7 legal7 20086 BlackHat6 Detection Engineering6 attack6 career6 Gartner Archive5 LogChat5 consulting5 database5 haiku5 myth5 product management5 qualys5 security theater5 software5 virtual5 20074 FAIL4 Information Security4 application4 encryption4 incident response4 mistakes4 search4 soc4 travel4 virtualization4 visualization4 web logs4 windows4 20113 DRM3 GRC3 NIST3 ai-soc3 audit3 awesomeness3 correlation3 government3 interview3 intrusion detection3 open source3 opsec3 perimeter3 philosophy3 politics3 pontification3 questions3 security-operations3 siem3 vulnerability management3 20122 HIPAA2 ShmooCon2 access2 ai2 ai-security2 best practices2 competitive2 cybercrime2 e-discovery2 evangelism2 glossary2 keynote2 knowledge management2 new2 rootkit2 security-operation-center2 stratfor2 tools2 twitter2 0day1 20131 20191 20201 Android1 Cloud Threats1 EMAP1 IANS1 IPv61 SOC1 Security Operations1 analogy1 announcements1 architecture1 authentication1 blo1 cloud-security1 comments1 computers1 controversy1 cool1 current1 data mining1 fraud1 geopolitics1 guest post1 identity1 innovation1 linux1 mobile1 obvious1 pci-compliance1 pci-dss1 platform1 policy1 reflections1 security-basics1 semantic1 storage1 video1 vulnerability-management1 whitepaper1

2026 10
2025 16
- December 2
- November 1
- September 5
- July 1
- March 1
- February 1
- January 5
2024 49
- December 4
- November 1
- October 5
- September 1
- August 3
- July 6
- June 3
- May 3
- April 6
- March 8
- February 7
- January 2
2023 50
- December 4
- November 4
- October 8
- September 5
- August 6
- June 3
- May 9
- April 1
- March 6
- February 2
- January 2
2022 55
- December 2
- November 5
- October 5
- September 1
- August 4
- July 3
- June 9
- May 3
- April 10
- March 3
- February 3
- January 7
2021 42
- December 3
- October 1
- September 3
- August 3
- July 2
- June 1
- May 4
- April 9
- March 9
- February 4
- January 3
2020 87
- December 5
- November 7
- October 6
- September 16
- August 7
- July 4
- June 4
- May 9
- April 7
- March 6
- February 9
- January 7
2019 35
- December 11
- November 2
- October 3
- September 2
- August 5
- July 6
- June 4
- May 2
2018 8
- August 2
- July 1
- June 1
- May 1
- March 1
- February 1
- January 1
2017 12
- November 1
- October 1
- September 1
- August 1
- July 1
- June 1
- May 1
- April 1
- March 1
- February 1
- January 2
2016 15
- December 2
- November 1
- October 1
- September 1
- August 1
- July 1
- June 1
- May 1
- April 1
- March 1
- February 2
- January 2
2015 15
- December 1
- November 1
- October 1
- September 1
- August 3
- July 1
- June 1
- May 1
- April 1
- March 1
- February 1
- January 2
2014 15
- December 1
- November 1
- October 1
- September 1
- August 1
- July 1
- June 1
- May 1
- April 1
- March 4
- February 1
- January 1
2013 21
- December 2
- November 1
- October 2
- September 1
- August 1
- July 2
- June 1
- May 1
- April 4
- March 1
- February 3
- January 2
2012 26
- December 3
- November 2
- October 1
- September 2
- August 2
- July 3
- June 2
- May 2
- April 2
- March 3
- February 2
- January 2
2011 68
- December 1
- November 1
- October 1
- September 2
- August 2
- July 12
- June 4
- May 8
- April 6
- March 10
- February 8
- January 13
2010 137
- December 22
- November 12
- October 6
- September 11
- August 15
- July 7
- June 6
- May 10
- April 10
- March 14
- February 15
- January 9
2009 193
- December 11
- November 12
- October 23
- September 16
- August 15
- July 13
- June 18
- May 11
- April 20
- March 19
- February 14
- January 21
2008 311
- December 18
- November 20
- October 23
- September 15
- August 19
- July 19
- June 22
- May 28
- April 45
- March 27
- February 33
- January 42
2007 479
- December 21
- November 44
- October 57
- September 57
- August 51
- July 49
- June 34
- May 39
- April 21
- March 30
- February 30
- January 46
2006 370
2005 34
- December 34

My Links

"PCI Compliance" book site
My website
My old presentations
My old portal Info-Secure.org
Old "Security Warrior" Book Site

Powered by Blogger

Copyright Anton Chuvakin

© Anton Chuvakin. Opinions are my own. Anton on Security · Atom feed