#SHERMAN 2 ATTACK OF THE TAGGER HOW TO#

Question then is how to get people to care and/or get involved? Plenty of processes and technologies that can be used to accomplish this. I'd go as far as including knowing how your business views infosec because if they don't care about it, then that will increase the risk you have as an organization. Understanding your attack surface means visibility into your entire infrastructure (on prem, cloud, endpoints, network, physical, IoT, etc), your user base and knowledge of your business/industry. In all seriousness, a recurring theme I've heard is reducing risk and understanding your attack surface. I've heard that that strategy could work. Hire a 'fall person' and title the position: Intern. It’s not your core competency as a business.

It’s too hard to find, hire and retain good analysts for eyes on glass. This keeps corporate-wide detection at the speed of identification of your fastest inbox readers.

For non-infosec staff, publish a phishing alert button to their email client/web portal so that any bulk-delivered spam/malware emails benefit from a collective defense/awareness automated tagging of the email sender, attachment hash and malicious links. If someone needs to send a blocked file type they can use a secure transfer tool/platform instead. Why wake up the on-call if a malware detection can automatically quarantine the file/payload, isolate the device and kick off a full forensic scan? For non-infosec staff, ask them to minimize the presence of company data on their laptop (don’t save local copies, don’t be a data hoarder since you are creating more assets that can be stolen or sold on the dark web).ĭetection time - block at least 40+ file types by default on your email gateway. That’s actually three potentially discrete questions across two dimensions/angles:ĭamage reduction - device isolation automation.

Sherman 2 attack of the tagger