Every network security solution which gives you control and visibility comes with one more thing – reporting. From time to time someone asks for a report with very specific information they need, and it has to be delivered. Process usually looks the same. I go to the solution, search through logs, look for the right… Read More »Nobody Likes Reporting
As I already mentioned a few times, most of network security today comes down to one simple rule: you can’t protect what you can’t see. Firewalls, DLP, IPS, all of it depends on somebody being able to look into the payload. And even that part isn’t fully solved already – I wrote before about how… Read More »The QUIC Problem
Organizations spend a lot of time thinking about advanced stuff. Right now it’s AI — everybody talks about what AI can do, what it can detect, what it can automate, what are the AI threats. Fine, that’s where the market is right now. But if you actually look at incident, most of them don’t come… Read More »Advanced Systems, Forgotten Basics
As I wrote many times, I work in integrator company. Part of the job is that new technology land on my desk on regular basis. As example, few years ago it was SD-WAN, now common things Then it was cloud-delivered firewall. Then ZTNA. Now it’s managed browser turn. Another new technology Managed browser, sometimes called… Read More »Managed Browser — New Technology, Old Doubts
I work for a systems integrator, and from time to time we have to prove the value of our solutions or proposals. Last time, I ran a quite “interesting” PoC. The customer planned to refresh their LAN/WAN infrastructure completely, introduce advanced network security capabilities, and manage everything through cloud-native management. At the beginning, my thoughts… Read More »Market Ready, Tech Broken: The Early Adoption Trap
Modern firewalls can be split into multiple virtual instances that share the same physical hardware. The most common reason for doing this is administrative separation. For example, different teams manage different parts of the infrastructure while using the same physical firewall. Another reason is to separate infrastructure areas or environments. As an instructor and engineer… Read More »Do you really need multiple virtual context (VDOMs/ VSYS)?
Let’s step into the practical stage of building a covert C2 channel on top of a public LLM. I first tried to build C2 using the approach from the previous post: a custom C2 website with the LLM acting as a proxy to fetch and pass commands. This did not work. All tested LLMs (ChatGPT,… Read More »Living off the Land (AI) part 2
In my previous blog post, I explained and tested how C2 over trusted DNS protocol works. Advanced C2 can be implemented in many ways. One interesting technique is the use of trusted services as a covert C2 tunnel, classified by MITRE as T1102. https://attack.mitre.org/techniques/T1102 LLMs such as ChatGPT, Gemini, and Claude are widely used and… Read More »Living off the Land (AI) part 1
Some time ago, I wrote an article about my first deployment in the public cloud, specifically in Azure. In general, many Azure networking rules and design patterns work very differently from what we know from traditional on-premises environments. In on-prem networking, asymmetric routing is usually not desirable. In the public cloud, it depends. For outbound… Read More »Azure Inbound traffic
Panorama is a well-known tool for managing Palo Alto Networks firewalls and providing central log storage. It has been available for as long as the NGFW firewalls themselves. I work with it frequently. Like any product, it is not perfect. I have encountered several specific drawbacks. Panorama management logic is based on Device Groups for… Read More »Strata Cloud Manager
