This article walks you through the process of running Wazuh in Docker on your local systemn (or server) in about 5 minutes. It’s a simple process and a great tool. The official documentation is “https://wazuh.com/install/” but their instructions didn’t work. Hence this article. You can run the docker containers on
Read moreAuthor: Andrew Galdes | Principal Consultant
A Linux and Cybersecurity expert in Australia.
RHCE, Linux+, Sec+, CySA+, SecurityX, CISM, CRISC
Tools for doing a Basic Cybersecurity Assessment
Don’t get too excited, this is just me sharing some tools that you could use to review your website or exposes systems to see how they appear to the wider Internet. This is not an exhaustive list. To scan the network for ports, services, and TLS ciphersuites: nmap -sV -sC
Read moreReplacing Synology NAS Disks
In this article, we’re walking through the process for replacing a hard disk in a Synolgoy NAS. The NAS model for this walk-through is the “DS720+” running “DSM 7.2.2-72806 Update 5”. Our scenario is that we have 4TB of space in our RAID mirror, and we want to upgrade to
Read moreThe Log Life-Cycle In Todays Complex Environments
The risks associated with mismanaged logs is measured in financial costs, penalties for non-compliance, lost opportunities, and missed discovery of indicators of compromise that would otherwise have been detected. This article discusses the log life-cycle trend in todays complex computing environments. The log generators (the source system) we’d consider part
Read moreBlocking the Source or the Target – Attack Response Best Practices
This article discusses best practices for where to block an attack… the source or destination? Firewall administrators are taught to block nearest the source. System administrators are taught to block nearest the target. Let’s discuss this. Firewall administrators sensibly want to block an attack nearest the attacker. This limits the
Read moreThe Value in ISACA Certifications and Membership
I’ve thought long and hard about the value of certifications and memberships with organisations like Isaca and CompTIA and the others. My experience is limited to these two, but there’s obviously others like ISC2. So what value do we get from the certifications, what value do we get from the
Read moreSIEMs are not for Events
In this article, we’ll explore the use of a SIEM for it’s most optimal utility. To get the best value out of a SIEM, we need to ensure the logs ingested are high-value logs (explained below) SIEM: A SIEM (Security Information and Event Management) takes in logs, assesses them against
Read moreSecrets With Expiries
The idea of a secret is much like a password, it allows a service to authenticate without using keys or cryptography. It’s a simple comparison. “Does your secret match my secret?” When sent over encrypted channels, secrets can be a simple and effective means to provide authentication. Is PKI better?
Read moreJob Adverts Requiring Degrees vs Certifications
This article compares job adverts requiring either a university degree or industry certification. To clarify, the “required” and “ideal” (or similar words to that effect) are considered. The job adverts are limited to my Australian state (to ensure this investigation doesn’t turn into a thesis) and limited to the Cybersecurity
Read moreCybersecurity Frameworks and Capability Maturity Models (CMM) Worth Knowing
There are plenty of frameworks and CMMs (Capability Maturity Models) to choose from. In this article, we’ll explore a few of the more popular ones, and discuss their use in general, in terms of the value they add. This article has a strong Australian sway to it because that’s where
Read more