blog

Thomas Phillips drew on his unique background to develop an original approach to cybersecurity - interactive deception. Ridgeback Network Defense’s co-founder and CTO has not only spent 30 years of developing software but also has extensive experience in both offensive and defensive hacking. He studied computer science and psychology in college and is a military [...]

In the IT world, upgrading equipment is normal. However, businesses often view IT as a cost center, so spending on new equipment is highly discouraged unless absolutely necessary. The existence of better gear is rarely an acceptable reason for a hardware refresh. What about new hardware is that is more secure? Is better security a good [...]

Deloitte is a multinational professional services firm that “provides audit, tax, consulting, and financial advisory services to public and private clients spanning multiple industries.” In 2017, Gartner ranked Deloitte security consulting number one globally for the fifth year in a row. By all accounts, Deloitte is a well-respected company that definitely has their act together. [...]

ISACA, US is an independent, non-profit, global association engaged in the development, adoption, and use of globally accepted, industry-leading knowledge and practices for information systems. With more than 600 active members, Pune Chapter of ISACA organized an annual conference on Transforming Security and Governance for Digital Age on July 7 and 8, 2017. Ridgeback was [...]

BSidesCharm 2017 has wrapped up. There was fantastic weather, a huge crowd, plenty of great talks and training, a hiring village, and best of all, hackable badges! Hackable Badges at BSidesCharm I was one of the organizers again this year, helping to organize and manage the registration and check-in for the conference at the [...]

Just a quick note about the Ridgeback Acid Test Event... The Ridgeback Acid Test Events of 2015 were hugely popular. I really, really wanted to run another test event around October of last year (2016), but things became far too busy. We released Ridgeback Hunter 2.0, with it's new slick interface and included Ridgeback Log [...]

The feature customers have asked for the most is cloud management for Ridgeback Hunter. Guess what? Here it comes!   We used to sell only a hardware appliance. Customers kept asking for a software version, so we released Ridgeback Hunter in March 2016, a software version that runs on servers or on virtual machines. After [...]

Distributed denial of service (DDOS) attacks have been in the news lately, and a number of people have asked me whether Ridgeback can prevent such an attack. What seems like a simple question actually touches on some complex issues. This post breaks it all down. First, a DDOS attack consists of: An unregulated network connecting [...]

Logs are something we all love to hate. All the good stuff can be found in the log files, but often the amount of data becomes overwhelming. And then there is the fact that everything out there has its own log format. I had discussions about HP ArcSight, McAfee Enterprise Security Manager, IBM QRadar, Splunk, [...]

First, in case you missed it, Ridgeback Hunter version 1.3.0 has been posted in the early access forums. Now on to the topic of simulations... During the two Ridgeback Acid Test Events in 2015, Ridgeback had a number of basic simulators behind the responders. That is, you could connect to a decoy on a TCP [...]

Just a quick screenshot from version 1.3 showing a whole bunch of decoys lighting up in response to reconnaissance. Notice how all the lines are converging back onto the endpoint that did the recon. I took this screenshot while working on log normalization. The new log format for version 1.3 makes reporting and integration much [...]

Ridgeback Hunter runs on a variety of platforms, including laptops. I almost always run Ridgeback on my laptop whenever I connect to a network. This gives me a high-level perspective of how the network is operating and alerts me to any threats lurking on the network. The networks I connect to are often relatively safe, [...]

Just a quick sneak peek at 1.3. Even when decoys are not activated and Ridgeback is in network security monitoring (NSM) mode, it still sees reconnaissance. This is awesome for for those who need to do network troubleshooting.  

Two things today - the new Ridgeback Hunter name and some information about Ethernet interfaces. First, a name change. Ridgeback Agent is now called Ridgeback Hunter. The term "agent" was causing some confusion, thus the name change. (A single instance of Ridgeback Hunter can support many networks. Ridgeback Hunter does not need to be installed [...]

A few weeks ago I gave a brief talk on using the tcpdump utility for situational awareness on networks. The talk was for a general audience. The tcpdump utility can be used for security monitoring, audit, or just plain IT management. I am putting the slides up for download by anyone who might be interested. [...]

I recently read some posts from information security people who seemed to lack confidence in their abilities. Citing imposter syndrome, a feeling that they are not as competent as people think they are, they mused over whether their own skills and experience justified their roles as security professionals. This post is to spell out plainly [...]

What a weekend! BSidesCharm 2016 has concluded. There was a fantastic turnout with multiple speaking tracks, training, some CTF rooms, crypto challenge, fox chasing, happy hour, party -- all around fun for all! I gave the talk, "The Value of Deceiving Attackers." The talk was non-technical and attempted to guide people from thinking about static [...]

I want to gear up for another Acid Test. Instead of jumping right in, I would like to get some people trained up on running things. We can set stuff up at the UMBC incubator and run periodic training/hacking sessions for 1-2 hours at a time. The question is, what days / times are best [...]

This post is to help you get up and running with the Ridgeback Agent using the basic deception configuration. The Ridgeback Platform is very versatile and extensible, so don't be put off if this configuration is too simplistic for your needs. To get started, we will need the Ridgeback Agent software (with a valid license [...]

We have an immediate need for a bright, highly motivated Linux system administrator.  The job includes preparing systems for delivery to customers, helping assess customer needs, managing test environments, and wrangling other odds and ends.  Let me know if you are interested.

Learn how attackers take over networks, how deception technology has roots in military operations, and how deception technology can be applied practically in the defense of computer networks.  Reserve a seat today.

The seminar on deception technology in January went very well, so on March 2 we are doing it again.  Many people who could not attend January said it was difficult to take off two days for a seminar.  We are compressing the material into a single day to help people with their schedules.  For those [...]

Deception technology can change the game for cyber-defense. We are hosting a paid seminar titled "Introduction to Deception Technology" on January 13-14.  "Introduction to Deception Technology" is a two-day seminar for cybersecurity professionals who need to understand how the landscape of cyber-conflict is evolving.  You will learn how to better protect your organization's assets using [...]

When it comes to security, there are two kinds of organizations -- turtles and raptors.  When an adversary attacks your organization, your posture as a turtle or a raptor matters quite a bit. A turtle organization has a hard, outer shell, but a soft, vulnerable interior.  The organization spends a lot on firewalls and intrusion [...]

10/5 - 10/6 Washington DC: ACFCS 2015 Cyber Financial Crime Summit 10/7 New York, New York: Buy-Side Technology North American Summit  10/7 - 10/9 Arlington, Virginia: Homeland Security Week 10/9 Raleigh, North Carolina: BSides Raleigh 10/14 New York, New York: New York Metro Joint Cyber Security Conference 10/15 McLean, Virginia: Fall 2015 Cybersecurity Summit 10/15 Greenbelt, Maryland: NASA Goddard Cyber Expo 10/19 - 10/21 Washington DC: CSX 2015 [...]

Good times!  Ridgeback is growing and has expanded into the bwtech@UMBC CyberHive office space.  This extremely stylish office environment is letting us bring in more people and set up new test and demo equipment.  The CyberHive is definitely the place to visit us if you want to see a Ridgeback security appliance today.

I do not like fear mongering.  However, I do believe that technological advances are outpacing our collective understanding of their implications.  There is a dangerous difference between our understanding and what is actually happening.  We need to take action now. The threat I worry about is global interconnectivity.  As in, who the hell thinks it [...]

Hack from a tropical paradise!  Well, hack from wherever you are.  If like to hack, and want to build your skills and experience, then this may be the internship for you.  We need an intern to spend their time hacking into assigned targets, day or night, and from remote locations if you prefer.  You will [...]

We are looking for good sysadmins to help with some odds and ends.  If you think you are a good sysadmin and want some real-world experience at a cybersecurity startup, let me know.  Enthusiasm is a MUST.  In general, this is the job description: Required Knowledge Linux system administration, to include installation and configuration Basic [...]

The short answer: An actor is someone or something that is capable of sending information across your network. The long answer: The Ridgeback security appliance is really tracking agents in the sense of philosophy, sociology, linguistics, and artificial intelligence.  That is, an agent is an entity capable of "agency," or essentially capable of making something [...]

The Ridgeback Acid Test Summer 2015 event has finally wrapped up.  One important message we got from the spring test event was that participants wanted more feedback on how the test event went.  I am hoping that this post-event writeup will help people learn more about these events, and about computer and network security, in [...]

Natural sponges are fascinating structures.  A sponge is irregularly shaped and has no clear entry or exit.  The very idea of a "perimeter" seems completely ill-matched to a sponge.  Once water gets into a sponge, the water can travel to any other part of the sponge through what seems to be a practically infinite number [...]

Life at a startup is pretty hectic, and this week has been especially busy.  That's a good thing!  :-) Unfortunately, that means the Ridgeback Acid Test hasn't gotten as much love as it deserves, in terms of the game story.  To fix that, we are extending the event to run until midnight on July 5. [...]

The summer Acid Test has officially begun!  This time around we have "Basics" documents with tips and tutorials on offensive and defensive techniques, and "Game" documents with backstory and clues. I am hoping that this test event will be a great experience for everyone. (BTW, for the person who requested we make it rain, I [...]

Good times!  In case you missed it, there was a BSidesCharm 2015 security conference in Columbia, Maryland this weekend (April 11-12).  There were many great talks, great food, a great party at Unallocated Space, and the organizers did a fantastic job at putting it all together.  If you weren't there, then you missed Dr. Kryptia's [...]

A number of people have asked for a more robust way to communicate about the Ridgeback Acid Test this spring.  So, here we go! The Ridgeback Acid Test events serve two purposes.  First, the events are robust test scenarios for the product we are making.  We needed a robust test scenario because people kept asking, [...]

BSidesCharm will be April 23-24 this year, at the Baltimore Convention Center.  At the event I will be giving a talk titled "The Value of Deceiving Attackers."  The talk will touch on topics covered in the Deception Technology seminars. If you are in the Baltimore area this April, I recommend going to BSidesCharm 2016.