It's a reminder how powerful the combination of simple tools and a little reasoning can be.
I once found myself by chance with a customer just as they got smacked with a DDoS attack that they were completely unprepared for.
The security folks threw up their hands claiming that they couldn't do anything to stop the attack due to certain random elements. The executives panicked and everyone started pointing fingers while their site went offline. It was chaos.
I asked to have a look at logs on a hunch that the "random" element wasn't entirely random. One line of awk, grep and uniq later it was revealed that roughly 85% of the attack could be mitigated with a trivial change at the edge.
I'm not an expert in all the areas I'm expected to cover by any means. Some days, it's all I can do to not say "act of God, maybe?" I try to learn new things when I am afforded the time, but since we don't live in a CSI world, it's just not possible to always have the right tools, the right knowledge or the right answer at all times, especially when it comes to computer security.
Bruce Schneier ain't cheap and not everyone can afford the services of specialists when it isn't a common occurence.
It's a reminder how powerful the combination of simple tools and a little reasoning can be.
I once found myself by chance with a customer just as they got smacked with a DDoS attack that they were completely unprepared for.
The security folks threw up their hands claiming that they couldn't do anything to stop the attack due to certain random elements. The executives panicked and everyone started pointing fingers while their site went offline. It was chaos.
I asked to have a look at logs on a hunch that the "random" element wasn't entirely random. One line of awk, grep and uniq later it was revealed that roughly 85% of the attack could be mitigated with a trivial change at the edge.