Saturday, October 14, 2017

RiskWatch and Suspicious Activity Reporting

In the last 30 days we've sent approximately automated 25,000 suspicious activity reports from a new application that we call RiskWatch.  While our 'open' numbers appear strong, we're still building trust in the recipients of those. You see, we compete in victim notifications with bad guys who've been sending "You're infected" emails to users for years in attempts to sell fake AV.

So today I'm going to do a bit more socializing.

What is it we're doing? The process is simple --and patent pending ;)

For a while now, we've been sending polite victim notifications to those where we identify (ahem) suspicious activity. Of course, this suspicious activity is rarely just suspicious. We send notifications in which we break out malicious (high probability compromise) and suspicious activity (maybe a compromise but needs a look). And why do I say polite? We're complimented by many as not using scare tactics to sell subscriptions and services. Polite means that we normally handle victim notifications like I'd like it handled if someone were calling me… I call them, and send them a report. Many times, I didn't charge —only to be put under NDA, or blown off, or simply, not answered —and then we watch as the victims continue to be victimized, and those connecting to them do as well. The numbers of victims have grown exponentially in the last two years.

For months, we've been sending suspicious activity reports to the maritime community, and last week I hired a person who'll begin authoring victim reports for the banking and finance industry. This person will be doing nothing but mining our collections for information suggesting bankers, financiers, or insurance companies are notified when we see activities.

What do these things look like? Here's one for the .gov space —of course, this isn't a full report and it isn't in our template or letterhead yet, but I'm sure you get the picture. This shows a small sample of state governments but one from a survey site at Government folks aren't allowed in the Red Sky portal, but they can pull subscriptions from us. This snippet is, of course, sanitized, but I'll be posting the report in its entirety in our online storefront.

Sorry folks. I realize this isn't my typical sassy Saturday morning blog, but this stuff is important, and those who can't afford a good security shop —which includes many of the states we live in, still need to have the information presented to them. This isn't a 60 page in-depth study. It's down and dirty, short, and in a completely actionable format. This report, when finalized post-QA will be available on via our online storefront at

Moving forward, we're making the automation available for supply chain management. Please feel free to reach out for more information.

Until next time,
Have a great weekend.

Saturday, October 07, 2017

Free email systems are not secure. This is easy button.

I'm tuning a presentation that I'll be giving at the National Defense Transportation Association's Fall meeting in St. Louis next week. I'll be on the podium on Tuesday, and as I think through the flow, and I have my first cup of coffee for the morning, I think about the new Yahoo breach numbers —3 billion, and the fact that the Equifax CEO is no more. And as I run through my deck and consider my blog, I have to wonder.. how many email accounts show up in our own data sets?

Anytime we see a password in our collections we substitute the word "redacted".

I queried one data set only. This specific dataset goes back to only April of last year.  In that dataset, the word "redacted" appears 650,472 times and was recorded in 11,227,687 records of attempted uses, meaning, someone tried to log into something with the credentials and we recorded data about the attempt.

Figure 1 - Victim Counts, Government and Logistics
Last year, in front of the four star and his staff, in front of hundreds of transportation company representatives, in two different talks, I told to them about the "Daily Show" campaign that we've been following since roughly 2014. Daily Show is the theft of credentials (using key-loggers) from the transportation and logistics sectors —primarily ports and maritime, but now extending out to anything supporting logistics —air, money movement, transactions, vessel traffic monitoring, and more.  I put up the big maps, and I showed a few passwords, and I scared the bejesus out of many of them. I went for volume instead of specificity —and the volume was enormous.

This year, I'm going to update the victim count. Figure 1 shows the victim counts in the government and logistics sectors from the data set I mentioned above. They are not on the top of the victim count list, but certainly they're high on that list. By way of reference, the entire list in Figure 1 represents 3779 victims -a small fraction of the total 650,472, but remember, they are already victims. It starts with one and spreads.

Now consider this.
Figure 2 - Victim Counts, Totals

Of that list 650,472 mentions of the word 'redacted' and 11,227,687 records of attempted uses, there are several that we have not been able to characterize by industry or type, but of those that we can, the top four are Email, Search Engines, Social Networking and Financial Management. Yahoo email accounts alone account for 38,764 compromises in our data set. How many of those are used from ships at sea? That's a great question.

But wait, there's more. 3854 victims appear from free email services (Yahoo, Gmail, Hotmail, AOL, etc.), accounting for over 3,562,444 records (recorded uses) in this one, singular, dataset.  So what? 32% of the victims came from free email services. 

We keep chasing the really hard stuff… we're going to hear talks of advanced persistent threats, fighting through the cyber, and talks about why this stuff is really hard —and it is really hard, but there's also easy stuff.

Why are ships at sea allowed to use free email services? And if they want to allow them (there are probably many reasons why they would —crew changes, shared computers, etc.), why not do so on machines not connected to other devices? Why are these same computers used for email, surfing porn (yes, we see a ton of that too), shipboard logistics, and communicating between the ports, masters, agents, etc.?

Don't get me started in minimum manning, integrated bridge systems connected to engineering, and the push toward both connected and autonomous ships? This scares the heck out of me.

A much simpler concept. Free email systems are not secure. This is easy button stuff folks.

There are plenty of reasons why commercial logistics operators would want a free email system —crew changes make it impossible to keep up with the moves, adds, and changes or new crews and the required provisioning. These email accounts are used to connect with the wife and kids, surf porn for those lonely guys/gals, and buy Christmas presents on Amazon. I get it all. But, when one infected user on a shared computer onboard ship gets infected, they all get infected.

Do I care that 3 billion yahoo accounts were stolen? You bet I do, but in every place where I've worked, where they take security seriously, one of the top things that they all do is block free web based email systems.

I've not discussed search engines, social media use, or financial, but you get the point. One user spreads to many compromises. In one (a story I'm going to tell next week), we authored a report in which one compromised payment processor had over 35 pages of transaction records —each record per transaction. Why? Because a shared machine was compromised.

OK folks. My family will be up soon and I'm behind on posting. I hope to see you in St. Louis next week. Stop by and buy me a beer! :)

Have a great weekend!

Saturday, September 30, 2017

Why is security hard? (or maybe, If it Bleeds, it Leads?)

It appears Equifax has had its fifteen minutes of fame. It came and went as fast as the the winds shifted in Washington and another shiny story caught the eye of the press. But it made me think...

Anyone else remember Fred Giesler? Fred was a cool old guy that taught the information warfare program at the National Defense University at Ft. McNair. 

Fred ran a class on full spectrum information operations, and one of my favorite speakers was a CNN reporter that operated his own refurbished C-130 gunship, in which he operated cameras instead of guns in the side doors… and the quote I'll remember forever from this guy, and Fred, was "if it bleeds it leads"

And so it comes to Equifax. I saw this headline in an online security publication that I used to read often —today not as much, but this brought back a vidid memory of my days in information warfare training ..."if it bleeds it leads". I'm not sure who took advantage of who, but...

"Lawmaker rips Equifax for eschewing DHS's Automated Indicator Sharing program"

"Rep. John Ratcliffe, R-Texas, chairman of the House Cybersecurity and Infrastructure Protection Subcommittee, slammed Equifax, still reeling from a breach that affected 143 million Americans, for not taking advantage of the Department of Homeland Security's Automated Indicator Sharing program, designed to facilitate the sharing of threat indicators between government and the private sector."

According to a 2015 US Census Bureau report, 99% of the companies in the US are less than 500 employees. If that's the case, 1% (or less) of the security folks in the US know what it feels like to manage security operations (i.e. patching) in companies larger than 500 —right? And even a smaller, much smaller percentage operate in larger enterprise companies —of which Equifax is one with roughly 10,000 employees. 

I'd like to take a moment and offer a small education for Rep. Ratcliffe:

There is a ton of noise out there. You can't swing a dead cat without someone selling, pushing, or dumping indicators of compromise on you, and the DHS AIS program, while probably good enough for most, is, I would argue, likely not as good as the intelligence processed by the Equifax team today. In fact, I've had conversations with them in the past. I'm jealous of their malware processing capabilities. Even if Equifax had participated in DHS's AIS program, they would have had to sift through the noise to get to the good stuff… and my bet is, they probably had it already.

Assuming DHS had given them information on Struts (I'm certain they probably included it in their subscription, and I did see it in Infragard reporting), patching in large distributed enterprise environments is to say the least, difficult. Why?
    • Almost no company has full visibility into every computer on their network. Why? As companies grow, either through acquisition or organically, tools change, people change, and requirements for IT change —usability, storage, operational requirements, etc. Security must change too. Unfortunately, one can simply not reengineer the entire security posture with every change. Virtualization and cloud processing brought massive requirement changes for security but, even if the tools existed to manage all of these new advances in IT, budgets did not, and could not keep up. 
    • Assuming they had both full visibility and ability to reach every computer, in global companies, it still takes time to push. And since we know assuming makes and "ass of u and me", it's a safer bet that they probably didn't have full visibility. Full viz is nearly impossible.. In fact, I'd say it probably is.
    • There's a real shortage of skilled labor - Actually, maybe not a shortage of labor but a shortage of skilled labor —with all of those cloud, virtualization, and deep technical capabilities needed to operate in todays environment, there are no more one-size-fits-all security folks.
    • The Fog of War - Let's do some simple math. Equifax has ~10,000 employees. On any given day there will be 3-5% moves, adds, and changes. That equates to roughy 400 computers in motion every day. Add in those compromised, plus mobiles, plus tracking those in motion, and then dealing with the multitudes of alerts from the many technologies used to defend them. The numbers are staggering. This is absolutely nuts. Now let's go back to number one… almost no company (I'd argue large, or small) has full visibility and control into every computer on their network. I say again -staggering. The Fog of War changes everything —how you see the problems(s), which one(s) you handle first, and figuring out best how to use the limited resources that you do have.
    • Inadequacy of tools - Nearly every tool is Windows based. Unix, Linux, Solaris, BSD all require higher degrees of manual processing. While not impossible, accounting for patches, updates, system outages, and even simple inventories require higher levels of due diligence and manual processing.

I could do this all day. There are no less than 300 reasons that could have cost a simple miss —one that on that particular day, at that particular moment, something went wrong, leaving a hole exposed.

I do not fault Equifax.  I've said this many times in past blogs. I know exactly what it feels like to be a security operator in a large enterprise company. And, I know exactly what it feels like to be a security operator in a very small company. This is a hard business and I'd throw the bull sh*t flag at anyone who tells me that they have perfect security and could have prevented this. I'd throw the bigger bull sh*t flag at the person who says that by being a member of DHS's AIS program, the Equifax breach could have been stopped. Heck, my own marketing people urged me to write a blog that said that we'd seen information that would have stopped the breach. I could not, and would not. Others? Maybe. Not me. The Internet was not built to be secure, and adding layers upon layers upon layers of tools and technologies on top of this insecure foundation will eventually cause a massive failure. The fact that we trust it with nearly everything is a fools game.

I rarely pay attention to the security news anymore. There are a few to whom I will talk, but even then, I watch with one squinty eye to see if I'll be misquoted —and if I am, I don't talk to them again. The magazine that quoted Ratcliffe? I stopped reading them in 2002 when I was a new Cisco employee and they misquoted me; I took a real blistering from my co-workers for that one.  For some reason, every now and again, one of their stories pop up on my radar. I generally pass it by but this one? For whatever reason, I couldn't let it pass. I was compelled to write about it. 

In the mean time, nearly every time I see one of these headlines, my butt clinches and I smile. I think of Fred Giesler… if it bleeds it leads.

For Rep. Ratcliffe? Send me your computer. I'll bet a dollar it's not up on its patches :)

I have to laugh. 

Saturday, September 23, 2017

An mambo dogface in the banana patch?

Steve Martin had this routine where he talked about playing a cruel joke on kids —by teaching them to talk wrong.  As a kid, I laughed many times, listing to this old record over and over, but last week, something happened that made me laugh --not because it was as funny as Steve Martin, but because I listened in horror as a well paid security guy sprinkled in words and phrases that he absolutely nothing about.  

When I was an Ensign (ok, and sometimes as a JG) we used to (sometimes) sit in meetings and write down all of the acronyms, buzz words and power phrases, and then string them together to make jibberish paragraphs that actually sounded like they could be legit! It was even more fun to hear those phrases later when someone else picked them up and used them as their own. Imagine how hard we laughed!

A few years ago I had a young guy that worked for me in, who after a few drinks at an offsite used the phrase "fake it till you make it".  I hadn't thought about that comment in a while but I was reminded of it last week during a conversation with a young security pro(?), who I'm convinced writes key words and buzz phrases from the multitude of information security conversations he participates in and then saves them in reserve for those times when he's in a conversation where he needs be credible, but lacks depth. The thought is, sprinkle in a few important words, names or concepts —regardless of how well they're known, do it with conviction, take cover from the halo effect of previous successes, and there's a high likelihood that won't be (most times) challenged.

I feel like I'm seeing this more and more. I went to an ISC2 meeting where a Mandiant exec (at the time) and I both presented on APT. We talked about indicators and TTPs, until one brave young woman, in this otherwise deer-in-the-headlights audience, chimed in and asked What is an IOC? OK, so she's the CISO for a string of medical facilities and should know that, but if there were ever a place to ask the question and get an education, it'd be at an ISC2 meeting right?

Good for her! 

Last week one of my own guys, when talking about possibly introducing a new application, made a comment (something to the effect) Changing a firewall rule is easy! Anyone can do it! To which I responded When's the last time you changed a firewall rule? And, when's the last time you changed that firewall in a large enterprise company (like our customers)??

This is hard stuff. You can't just log into a Netgear box and increase to the next highest security settings needed to keep you safe. There are a dozen (or more —usually more) interdependencies that also must be considered.

In fact, this is one of my favorite (past) presentations, I talk about the SANS Top 20 controls, ISO 27001, and NIST. The could easily go for an hour, but it's only one slide long. I talk about the moats and controls that must be built around critical assets, and I talk about the fact that there are like 300 things that must be done right every minute of every day, and if you miss even one, well…  At that time, I was talking about large enterprise. Today, however, after having been in the seat for just under six years, I'm finding that even the smallest companies have those exact same problems. 

So I'm thinking maybe it's time to blow the dust off of my one slide 'Why is Infosec Hard?' presentation and do some training on change management in defense in depth, system design requirements, network design requirements, and the butterfly effect that happens when making internal defensive changes. It's a hard lesson but important. 

I don't fault anyone for the lack of depth. The just one of those things where if you've not operated in a SOC, you may not know how hard it really can be. As well, we've gone from 10 mph in demand to over 100 mph in the last few years —virtualized footprints, the criminal shift from having fun to making real money, regulatory requirements, government reporting, and a dozen other variables have all contributed to this massive sucking sound —sucking many many people into positions to which they may not yet be ready.

So where do these people go for help? Besides asking friends (who are, many times, in the same boat as they are), they come to information sharing environments. In some, they get a steady stream of IOCS, in others, they get hammered by vendors paying their way into educational speaking engagements, and in others they get two way collaboration in which they can ask those question, receive non-biased information. 

One of the reasons that I absolutely LOVE the idea of information sharing is because there are no stupid questions! And if you feel like you're going to be embarrassed asking the question in one of our public forums, IM or DM us and we'll answer you in private! Heck, request a training session. We do one every Friday! Maybe someone else will benefit too. 

Red Sky Alliance isn't here to sell you products or services. Its only purpose is to share information collaboratively. And its changing to stay up with the times. We run this area that we call the Cyber Threat Analysis Center (CTAC for short). I like to call it ISAC 3.0 but it's really a suite of our favorite tools in one desktop made available for our customers.  Open the desktop. Select a tool. Need a script? Open our Script repository and either grab one you need or collaborate on building one. Need help? We're here. Open HipChat or Slack and ask for help. Need a report? Fast? We have an archive. Need something fresh? Try Wapack Pagekicker. Enter your query, wait thirty seconds and get a machine written report. 

Let's leave "An mambo dogface in the banana patch" and get everyone on the same page, speaking the same language, educating each other. Yes, we can do this. 

Call me for a demo. Yes, I take phone calls too.

Saturday, September 16, 2017

NEW! and Ridiculously Simple! Wapack Labs RiskWatch

Ridiculously simple is going to be my mantra. Wapack Lab's RiskWatch makes monitoring threat Ridiculously Simple. Define Ridiculously Simple you say?

We can do it for you, or you can do it yourself.

For the individual: Sign in, enter an email. That domain gets checked and monitored. When we see something, you get a report. Simple right?

RiskWatch tally's the number of times any of domains, IP, or domains are seen in our intelligence. If it is, a report is generated and you get an email.

When the recipient of one of our emails logs in (for free), they'll see a dashboard that will give them enough information to fix the problem. For a small fee (starting at $9 per month) the victim can sign up for a detailed look, including raw logs and a notification service.

Think credit monitoring, but we're watching for malicious activity targeting you.

For your company: Today, our analysts screen thousands of companies. When we find issues, we'll enter a point of contact and you'll get the report. Fix away. Interested in having one of these in your own company? Use it for reporting security concerns, risks, threats to your suppliers? Partners? Easy.  Interested? Drop us a note. We're working on that console as we speak.  We'll call you when we're ready.

I was told "think Equifax report".

As of this morning, we've sent out over 1300 suspicious activity reports to individual users in the last two days.  Received one? No sweat.  Sign in. We'll build your report on the fly.

Want to be proactive? Sign up on the site. If we see something, we'll tell you!

Simple right?

RiskWatch is Patent Pending.

Saturday, September 09, 2017

Could we have stopped the Equifax breach? Leading Indicators?

I have this friend (it seems like all the best stories start this way —or with This is a no sh*tter!). Regardless.. I have this friend. He's a long time friend that I worked with years ago during the days when I spent my morse code shifts with the positions glass door closed, head sets on to drown out external  noise, studying calculus while I waited for the next AMVER, or worse yet …- - -…  …- - -…  …- - -…

After leaving the Coast Guard, he went on to become a sales giant with Big Blue, and of course you know where I ended up!

This old friend, we'll call him Mike (I call everyone Mike when I want to anonymize them) was working us through a 'so what' exercise on Thursday night when the phone rang at about 6:00 —it was WMUR, the local ABC Affiliate, who wanted to come to the lab and interview us for comments on the Equifax breach. At that point I hadn't really kept up. Equifax is bad, but so are all of the others —OPM for example (of which most of my team were included). Equifax was just one more breach from a company who likely let their guard down for a moment, and ended up getting screwed as a result.

In preparing for the interview, I quickly pulled up our internal Kibana instance (you've heard me talk about Cyber Threat Analysis Center? An ELK stack is one of the tools that we make available to our members. So.. I pulled up our internal Kibana and punched in the search term *equifax* with a one year time window —and whadya know…

At the time, we knew that Equifax claimed to have identified the breach in late July. We suspected they'd actually suffered the breach earlier; it's rare to catch the breach on Day 0. I wouldn't surprise me to hear that this incredibly talented security team at Equifax probably caught it much earlier. I've met and had beers with these guys. The are scary smart like I was at that age ;) , and my bet is, they followed the same smart process that any large company would follow before reporting out… they identify the breach, investigate the breach, and at the same time, fix the hole and assess just how bad it is. They then break out the mop. The legal team decides how far it extends and what the reporting requirements are, and then, if they choose, the PR engine fires up. This entire effort could take anywhere from days to months. My estimate would have been that they would have actually suffered the breach approximately two to three months before they announced —sometime between late April and late May. Apparently I was close. Scuttlebutt says May.

So why the chart? We monitor all kinds of proprietary intelligence sources that give us leading indicators of when we think something might be coming. We had early warning on Amazon when Jeff Bezos was portrayed as the Devil Boss in the press a few years ago. We had increased levels of cyber activity (although we had no idea what it meant at the time) before the Paris shootings, and we had a leading edge spike in cyber indicators leading into the time when Equifax was believed breached. Of course this is all speculation at this time, but… what did we see?

  • A trojan was sent, several times, to three people —a senior account manager in Mexico, the Information Security Officer in Costa Rica, and an email account that appears to be associated with an unemployment claims service.
We identified these indicators —none of which were delivered —but we see only a small sample. My suspicion is that we saw only the unsuccessful indicators, but in many cases, there are several others occurring at the same time; we just don't have eyes on those sources.  The indicators that we identified were associated with emails sent to these users, with a trojan attached, delivering ransomware that sometimes (not always) uses a C2. 

There were other indicators from open source and misc others, but they didn't appear, at least on the surface to hold any kind of meaning. 

From an analytic perspective: 
  • FACT - We saw activity on the leading edge of the currently believed timeline of the incident. 
  • FACT - That activity targeted three locations (people and email accounts) that would have had significant access:
    • The Senior Account Manager would have had access to Equifax's customer relationship management (CRM) systems —that database that contains all of the customers information, easily access by sales and marketing teams to allow tracking of sales efforts.
    • The Information Security Officer, if breached would probably have administrative rights on some systems but not all. He would have knowledge of detailed local business unit operations, systems and locations of sensitive data.
    • The targeted email that we identified in our collections was associated with unemployment claims -and one (one that we saw), appeared to be sent from an Equifax user to a hospital —apparently looking for health information to support some kind of claim argument. 
  • ANALYTIC GAP - Did Equifax receive other emails like the ones that we saw, but with successful delivery?
  • ANALYTIC GAP - Why the spike in activity on that day anyway? Why was that day so special, as to have received almost three times as much activity as any other day in the preceding twelve months, and to date following? 
  • We saw only part of the storm.. the derivative of the storm. I believe that we may have seen activity generated by automated sensors, but it may have been only a small piece of what was actually happening. 
  • My bet is, others were targeted at the same time. In this case, we was emails with, at the time, a virus total detection rate of 2 out of 57 attempts, and others were probably compromised.
  • Some of what we saw were attempts to deliver ransomware —a diversion? Noise?
I'd make a low confidence assessment that goes something like this… I'm going out on a limb here. This is a first SWAG (Scientific Wild Ass Guess) at what may have occurred. Equifax is neither a customer or are we under NDA with them, so lets have a little fun. This is a total SWAG.
  • Access occurred in Latin America (Central America if our indicators are true).
  • The ISO was targeted to help him from working
  • The Salesperson was targeted because sales people have access, and are easy targets.
  • The unemployment line? No idea. Maybe because it was on the list?? 
Of course, that assessment will change over time as more information becomes available and as our sensor systems collect more information. Let's see how close I come to the real story. I'm betting we'll hear it in the future. It's to big to be swept under the Trump carpet (the noise that happens when he tweets in the middle of the night). 

So, for my sales buddy? He wanted to know… Could Wapack Labs have stopped this attack? 

Probably not. Could we have given them warning that might put them on higher alert, positioning them to stop an attack? Absolutely, yes. We would have put them on alert —for good cause.

For many customers (albeit, not Equifax), we deliver as-it-happens and weekly reports that show these pieces of information as we know them. Equifax most certainly may have benefited from our identification of a 3x spike in cyber activity targeting them on that that particular day. At a minimum, the security team would have been issued a warning, and would probably have taken a more heavily monitored perspective. I told you, that team is scary smart. I'm certain they would not have let our warning pass.
This is where humans have value. Machines are cool. AI is cool. But this set of indicators needed to be interpreted by a human (me), who can read between the lines and think in the gray areas. Humans have value, and information sharing has value. This analysis is posted in Red Sky Alliance, and this is where information sharing has value. We'll let our membership to evaluate our data with their own eyes and participate in the discussion 

For others? Drop me a note. We'll sign you up.

Traveling today. 
Have a great weekend!

Saturday, September 02, 2017

There ya go again Stutzman. You're selling the steak!

On Thursday, an old friend from my enlisted Coast Guard days stopped in for a visit. We'd left the Guard at about the same time; he went to work for IBM and stayed there for 21 years to become an expert salesman. I went to Navy OCS and became an intelligence officer and a professional analyst.

For the first half hour in my office, we walked through our offerings. I could see in his expressions that he was thinking critically about what I was telling him. All the while, he kept asking me "So what"? "So what?" "So what?" This is the same thing that I do to my analysts when they present me with an idea for a paper.. I "so what?" them until we can't "so what?" any more to get to the root of why anyone would want to read that piece of analysis. In this case, the tables were turned on me. He kept saying "you have to make it simple". You're selling the steak when you really need to explain, and make them sense, the feeling of sitting in the restaurant, and the first cut into that perfectly done filet. He told me that ours was some of the best intelligence he'd seen in the space, but our messaging was complicated and didn't represent our product line as well as it should. 

Yesterday I received an email today from a company (a $3 billion per year company). We'd been demo'ing our firehose of intelligence.  He explained that they created their Infosec team small by design. They told me that they have an MSSP that handles their firewalls, and outsource other parts of their world to keep their internal team lean and mean. They'd considered our services but felt it was overkill for what they need. 

We sell lots of things, but they all boil down to two primary lines —you can do it yourself (DIY) using our tools, or we can do it for you.  In either case, you get access to Red Sky Alliance where you can share information, ask questions, and compare notes.

The DIY approach consists of accounts in our Cyber Threat Analysis Center (CTAC for short) —a place where we've loaded up a SaaS environment with suite of amazing analytic tools ranging from Elastic to CyberChef and H20. We've got Zeppelin, and GitBook/GitHub for sharing code and documentation. On the backend we've loaded our intelligence, pre-built some queries, and essentially, built an expert level sandbox for highly skilled analysts who love twisting and turning data. DIYers LOVE this offering —it puts everything they need at their fingertips. In fact, I joke and tell people that I'm following Bloomberg's business model! We supply the data, tools, and training. You supply the brain cells. 

At the other end of the offering, we've had several companies who tell us "we don't want to invest in intelligence", or, "we've already spent enough money on infrastructure", or, "we've intentionally kept our team small".  In those cases, we become their intelligence and analysis team, supplying inputs into their Information Security, Fraud, Physical, Risk and Intellectual Property teams.

So Jeff (my Coastie turned IBM friend) looked at me and and asked "How much would it cost if you sent me a weekly report, specifically for me and my company?

I gave him a price. That's easy I said. We do it all the time.

Back to my $3 billion per year prospect —They also told me that they couldn't handle intelligence inputs into their security team —they leave that to their MSSP and a small team. The head guy didn't want to invest in the DIY program. But, on more than one occasion we'd given them both compromises in their supply chain, and internal networks —things their MSSP should have seen, but missed. And when we did, in every case (three times), the analyst that we presented with our findings, acknowledged them in a positive way, once publicly.

I'd made a fundamental error.

I'd been trying to sell them on DIY, when whey they really wanted and needed, was option 2.

We're hearing this more and more… There's to much intelligence. We don't have a good way to process it. We're not interested in building an intelligence team. We rely on our MSSP for that. Or maybe it's what my old pal Jerome calls the 'green light syndrome' (where security people watch for the green light, and if it's green, they're good).  Not everyone wants to grill their own steak. Maybe they just want to pay a little more to sit at a nice restaurant and have a perfectly cooked filet mignon be placed in front of them. 

Wapack Labs is working hard to make this ridiculously simple. In the next few weeks, we'll be launching a tool to drip out the most important stuff -in chewable byte sized chunks. We've assigned primary analysts to each of our customers as their go-to analyst. And we've begun sending out reports and ad-hoc warnings. If you still want to be a DIY'er, please! By all means! But if you're one of those "we need it simple" types of folks, you're going to love this.

Interested in having a look? Check out, or sign up here for more information.


For those affected in Texas, we're thinking of you. As of this morning when I last watched the news, 39 dead, not to mention untold numbers of folks displaced or stranded. We're thinking of, and praying for you.

Until next week.