Mining Splunk's Internal Logs

Matt Alshab, IT Security Consultant, Technical Cyber Services, Coalfire Federal

Splunk is great about logging its warnings and errors, but it won’t tell you about them – you have to ask!

As the leading machine-generated data analysis software, it’s not surprising that Splunk excels at creating robust logs. The current version of Splunk Enterprise (v 8.05) generates 22 different logs (for a complete current list see: What Splunk logs about itself). These logs don't consume license usage, so other than disk space, there is no downside to all this logging, and the information the logs provide can be eye opening. The challenge for the Splunk administrator is getting a handle on these logs and using them to troubleshoot issues, find unknown errors, and improve performance.

Using Azure Blueprints to Control Azure Compliance

Doug Francis, Senior Consultant, Cloud Solutions Engineering, Coalfire

As Peter Parker says, with great power comes great responsibility. And so it goes with public cloud: With cloud scale and agility come cloud-scale problems and compliance nightmares. Every day, IT professionals balance the need to act quickly—often leveraging cloud speed of execution to implement resources—with the need to control resource deployments in their efforts to maintain proper organizational compliance and security posture.

Getting around the cybersecurity talent shortage

Bob Post, Senior Practice Director, Cyber Risk Advisory, Coalfire

More remote workers mean larger attack surfaces, and as cyber criminals take advantage of the rush to provision a remote workforce, the pain of the cybersecurity professionals’ shortage has become acute. Last year, the ISC(2) Workforce Study identified a shortage of 561,000 cybersecurity professionals in North America. Globally, that number is over 4,000,000 professionals. In April of this year, another ISC(2) survey found that 47 percent of the cybersecurity professionals surveyed were reassigned to other IT support activities while companies were ramping up to deal with the requirements of a newly remote workforce. As we move to “what’s next?”, how do enterprises obtain the needed resources and expertise to better address cyber risk in the new environment?

PCI DSS version 4.0 – what we know so far

Andrew Barratt, Managing Director, Europe

From September 23 - November 13, 2020, stakeholders can participate in the Request for Comments (RFC) on the draft of PCI Data Security Standard (DSS) version 4.0. This is the second RFC for the PCI DSS v4.0 draft—the first RFC was in late 2019 and that feedback was incorporated into the draft.

The Basics of Exploit Development 5: x86-64 Buffer Overflows

Andy Bowden, Consultant, Coalfire Labs

In this article we will be covering a technique similar to the one in the first installment of this series, however, with the twist in that this exploit will be of a 64-bit process running on Windows 10. Due to the nature of modern operating systems and the exploit mitigation techniques they employ, this will not be a very realistic example due to the fact that we will be disabling everything so we can concentrate on a few aspects of exploiting a 64-bit application. Specifically, we will be looking at the differences in how the different architectures call functions and how the features of the 64-bit method can be leveraged to exploit a vulnerability.