by Jesper Kråkhede, Sweden
Posted in Business on Oct 26th, 2021
In my previous post I wrote about the holidays being high season for attackers. This one is for management: prepare your readiness now, not on the 23rd of December. First, decide who is on call. Not just in IT but in management. If you are hit on Christmas Eve, someone needs the authority to make […]
Posted in Security Architecture, Technology on Sep 19th, 2021
A short personal one. My wife and I finally got away for a week in New York. Our first real trip in a long time. The plan was simple. Walk around Manhattan, eat too much and see a show or two. The plan lasted about a day. Then a customer incident escalated and I spent […]
Posted in Security Architecture, Technology on Jul 10th, 2021
This one is a bit longer than usual, because it is a topic close to my heart after this spring. There are two kinds of SOC. The first one watches. It collects logs, looks at alerts, and when something looks bad it writes a ticket or sends a mail to the customer: ‘We have detected […]
Posted in Security Architecture, Technology on Jun 10th, 2021
I had been looking forward to this vacation for months. Bags packed, plans made. Then the phone rang. A service provider in northern Europe had been hit by ransomware, and not in a small way. More than 50 Active Directory forests, belonging to the provider and its customers, were lost. Encrypted or destroyed, all at […]
Posted in Security Architecture, Technology on May 6th, 2021
Spring is well under way in Sweden. The birds are back, the evenings are getting longer and I see very little of it. Ransomware is everywhere right now. This month alone a major fuel pipeline in the US and the Irish health service have been hit, and those are only the ones that made the […]
Posted in Business, Security Architecture on Jun 19th, 2020
Something I have noticed during this spring is that the incidents I work on cost more than they used to. Not only because the attackers ask for more money, although they do, but because everything around the incident has become harder. When everyone works from home it takes longer to gather the right people. Laptops […]
Posted in Security Architecture, Technology on Jun 16th, 2020
A short one. Travelling this spring has been close to impossible. Borders are closed or come with a long list of restrictions, flights are cancelled and most meetings happen on a screen. For most of my work that is fine. Incident response is the exception. When a customer´s whole environment is down, some things simply […]
Posted in Business, Security Architecture on Dec 19th, 2019
On the 4th of November one of Spain´s largest IT consultancies was hit by ransomware. The employees were told to keep their computers turned off and the company disconnected the network to its clients. Some of their customers cut the connections from their side as well, just to be on the safe side. Imagine being […]
Posted in Computer Forensics, Technology on Aug 13th, 2019
After an incident there is a moment when everyone just wants things to go back to normal. Servers are restored, passwords are reset, the incident response team goes home and management breathes out. This is exactly the moment when you are the most vulnerable. Look at it from the hacker´s perspective. You found a company […]