
TLS Fingerprinting: Rethinking Encrypted Traffic Analysis Strategies
There seems to be some confusion about the appropriate way to use TLS fingerprinting in an environment. Anytime an SSL library, a library that uses any of those libraries, an OS or the application itself is updated or changed, there’s a good possibility that the fingerprint for that application will ... Read More

How to Break Broken SOC Cycles
We’ve all heard the same buzzwords used to describe the current situation in security operation centers (SOCs). Among them are “alert fatigue,” “labor crunch,” the “skills gap,” “high turnover” and “missing advanced threats.” Based on my experience working in and with SOCs, I agree with these assessments. Here’s a (brief) ... Read More