4Ws and An H

Rolling up what could have been February and March updates on courses I’m taking and how my organisations are going.

A few notes on my professional development activity in Jan 2026:

SecOps Resources Updated (late 2025): free and inexpensive resources for cybersecurity operations leaders

Flash talk idea: Filesystems in Cybesecurity Investigations

Here we are thinking by writing about past, current, and future roles and work. Feedback and questions always appreciated!

Some unfinished ideas and references about what’s useful to cybersecurity defense to and from CTI … leads into the infamous 127.0.0.1 story.

Here again** are some thoughts and links about some of the things we have planned for professional development and education for the year. Feedback appreciated or just share what you are learning!

Things I Learned (TIL) FOR508 Review 2024

How Not… talk: slides and links Herein are some books, articles, and people that we read, skimmed, or thought fondly of while preparing the “How Not to Have a Bad Time with Risky Data” talk seen at B-Sides Atlanta 2024

TIL DFIR Summit 2024 online

Here are some thoughts and links about some of the things I’m thinking about for professional development and education for the year. Update 1 in early July with some details and “how it’s going”. Update 2 in early Oct with more details and “how it’s going”.

What would make up the perfect cybersecurity threat intelligence (CTI) report to receive, ingest, automate around? Honestly, even any three of these things makes for a great report. More context and detail are better, if the report author / information sharing organisation can support it.

My recommendations to new folks, mentees, and several Lyft drivers in TL;DR or perhaps BLUF:

Collecting a number of questions that might be informative to ask in job interviews, for practice and mentoring usage. You probably can’t/shouldn’t ask all of these, might not get an answer, and “No” isn’t bad. Deliberately excluded are most compensation and benefits questions which you should definitely ask about. People have different needs and priorities, so getting more information helps everyone make better decisions. Hope this helps!

InfoSec Things You Can Do with a little Python

programming experience helpful, but not required

Some thoughts and links about some of the things I’m thinking about for professional development and education for the year

A few thoughts on personal branding, starting with mine/ours here:

Things I learned (TIL) and what I got out of the awesome two days SANS course on Red Team and Adversary Emulation I took online after Purple Team Summit 2021

I did an AMA with my home hacker club in Atlanta, GA: DC404

Nearly half-way through a busy year I think I know what I’m working on … especially after dropping out of college again after trying it again for a couple years. I’m dividing up my time and attention mostly between the two skillsets that I’ve used so far and see myself continuing to use at $dayjob and beyond.

Herein are a few notes on my prepping to renew my GSE as traditionally made and posted before taking the exam. I’ll be taking the renewal exam shortly and won’t be able to comment about it. For my backstory try my previous GSE study post (2017) and for more info on GSE see the official site: https://giac.org/gse .

From the Mailbag: a VM tools question

A question came in via mail this week: “I see that there is Windows-based security distribution flare-vm. I am wondering the difference between REMnux and flare-vm.

2020 Professional Development and Education rollup

dc404: 17 Oct 2020 presentation notes and link dump

In which yours truly takes REMnux 7 and Ghidra for a spin with some newly famous malware

HNFC Again, Again

Your InfoSec Career, as presented at BSides ATL 2019 @ KSU

Here is a collection of links from class discussions.

Debugging for Attack and Defence: Learning to Attack, a brownbag in the 2018 series.

A few notes about SEC506 and what I learned from it, plus the the start of my exam prep list for GCUX

Reading and Writing the Web: Learning to Attack, a brownbag from the 2018 series

2018 Kickoff: Learning to Attack

Some good FAQs from mailbox

GIFAR’s Magic Mimes Filed in 8 by 3: File types, identification techniques, and their weaknesses to attack

SANS GIAC Exam Study Tips

Herein are a few notes on my journey towards GSE as traditionally made and posted before the exam. For more info on GSE see the official site: https://giac.org/gse

Some words about hunting including some perspectives from different sources

How can we see port proxy configurations in DFIR?

This morning with much coffee I’m working between email to practice netcat between hosts for GSE, PWK, and generally building good character.

Some fairly detailed notes on the classes I taught, took, conferences I attended, fees, and other professional development and education expenses in 2016, for discussion

After looking at the tables with the MAC address for awhile I looked up the OUI online and substituted them in, hoping to catch something I’d missed. Indeed there was a third MAC from a third manufacturer in the discussion. All three OEMs make network gear as well as endpoint systems.

Notes on email-based file submission to analysis platforms

@adricnet presented this at DC404, Sept 2016 PDF of slides here: http://dfirfiles.net/myslides/breakin_dc404_2016.pdf

Hunting investigations should be SMART, and more over must have a scope and a terminating condition. Measurement can be simple success/fail (did we find it?) or the number of incidents and/or SIEM/IPS rules generated or updated.

some bookmarks

A study group around Practical Malware Analysis, Part I

draft post, no images, end notes, links yet

draft post, needs more links and images

Emily sent me so many copies of this executable in the last couple days that I decided to take a look:

As I’ve mentioned before one of the things I’m self-studying these days is file analysis. The chosen text is the most excellent Practical Malware Analysis (red with the alien autopsy cover). The authors include lab exercises to demonstrate the analysis techniques from each chapter and they are freely available, so buy a couple copies of the book, such as from the publisher’s site.

How to Learn About $SYSTEM Security General techniques for developing better understanding about security functions and asserting confidence in them

Do you want to know more?

A few examples from the major Windows command line tools

outline and notes for 2012 file types brownbag

Since I don’t really want someone else’s pictures and didn’t order anything from FedEx this week so I could safely ignore the odd emails coming in with subjects like “Re:” and “Your package is available for pickup” and zip file attachments. But I’m a curious sort …

A fairly high level component to Unix and networking magicks. Not for the novice, much.

##Linux

Kiddies, don’t try this at $home, a fake contest I wrote up in the fall of 2001