devilreef.net

devilreef.net

Sign in Subscribe

How Palantir Manages Continuous Vulnerability Scanning at Scale

vulnerability management

How Palantir Manages Continuous Vulnerability Scanning at Scale

This was a post I co-authored which originally published on the Palantir Blog. It is copied here for posterity. The Challenge Effective vulnerability management is a cornerstone of any established security program. For complex cloud software providers like Palantir, staying on top of vulnerabilities and quickly remediating them is

Securing a Personal Android Phone

android Featured

Securing a Personal Android Phone

It's been far too long since I've made time to sit down and write. I recently went through the ritual of swapping phones, so I will use the opportunity to jot some notes down. I keep separate devices for work and personal usage. For the last

Democratizing Security Detection

Democratizing Security Detection

This was a post I authored which originally published on the Palantir Blog. It is copied here for posterity. Introduction Security detection programs face significant scaling challenges. As the size and scope of an organization grows, so too do the volume and diversity of security alerts; this influx can result

Expanding Palantir's bug bounty program

Expanding Palantir's bug bounty program

This was a post I authored which originally published on the Palantir Blog. It is copied here for posterity. We at Palantir are committed to continually investing in the privacy and security of our software products. As part of this commitment to safeguarding our customers and their data, especially during

Broadening Palantir's Bug Bounty Program: Trust, Security, and Transparency

Broadening Palantir's Bug Bounty Program: Trust, Security, and Transparency

This was a post I authored which originally published on the Palantir Blog. It is copied here for posterity. Security, privacy, transparency, and customer trust are pillars of our culture and business disposition. Continuing our investment in these values, we are excited to announce the expansion of our public bug

PhishCatch: Detecting password reuse from the inside out

PhishCatch: Detecting password reuse from the inside out

This was a post I co-authored which originally published on the Palantir Blog. It is copied here for posterity. A browser extension to enforce password hygiene In an effort to bolster Palantir’s password hygiene, our Information Security team, with deep collaboration from our friends at SpecterOps, sought to

Palantir joins GitHub's token scanning program

Palantir joins GitHub's token scanning program

This was a post I authored which originally published on the Palantir Blog. It is copied here for posterity. We are excited to announce we’ve partnered with GitHub as part of their token scanning program. This program will help us better protect our customers by discovering and revoking Palantir

Unlimited Unthrottled Anonymous LTE Access

Unlimited Unthrottled Anonymous LTE Access

Protecting privacy and enabling free speech on the Internet is germane to a healthy society and functioning democracy. Unfortunately, we too frequently find ourselves victims of an escalating war against privacy. Whether you're worried about your Government using their powers to snoop in your personal life or are

Assessing the effectiveness of a new security data source: Windows Defender Exploit Guard

Assessing the effectiveness of a new security data source: Windows Defender Exploit Guard

This was a post I co-authored which originally published on the Palantir Blog. It is copied here for posterity. Windows Defender Exploit Guard (WDEG) is a suite of preventative and detective controls to identify and mitigate active exploitation attempts against Windows hosts. Based on the previous success of the

Announcing Palantir's bug bounty program

Announcing Palantir's bug bounty program

This was a post I authored which originally published on the Palantir Blog. It is copied here for posterity. We are excited to announce the public bug bounty program for Palantir’s software and infrastructure. Read our new Vulnerability Disclosure Policy here. Security is one of our core tenets at

Windows Privilege Abuse: Auditing, Detection, and Defense

Windows Privilege Abuse: Auditing, Detection, and Defense

This was a post I co-authored which originally published on the Palantir Blog. It is copied here for posterity. Privileges are an important native security control in Windows. As the name suggests, privileges grant rights for accounts to perform privileged operations within the operating system: debugging, impersonation, etc. Defenders

Palantir + SpecterOps Partnership

Palantir + SpecterOps Partnership

This was a post I co-authored which originally published on the Palantir Blog. It is copied here for posterity. At Palantir, we’re passionate about building software that solves real-world problems. Our software has been used to stop terrorist attacks, develop new medicines, gain an edge in global

Detecting Windows Endpoint Compromise with SACLs

Detecting Windows Endpoint Compromise with SACLs

This post is going to focus on using the system access control list (SACL) functionality to detect endpoint compromise on Windows hosts. The goal is to quickly, cheaply, and effectively detect anomalous activity on an endpoint without focusing purely on anomalous process and thread execution. If you’re unfamiliar with

DARKSURGEON - A Windows 10 Packer Project for Defenders

DARKSURGEON - A Windows 10 Packer Project for Defenders

I’m happy to announce the alpha release of DARKSURGEON, a Windows 10 packer project to empower incident response, digital forensics, malware analysis, and network defense. DARKSURGEON is designed to perform the following: * Accelerate incident response, digital forensics, malware analysis, and network defense with a preconfigured Windows 10 environment complete

Endpoint Isolation with the Windows Firewall

Endpoint Isolation with the Windows Firewall

Over the last few weeks, I've had conversations with several individuals around mitigating lateral movement in a Windows environment. In all of these cases, I was surprised to learn that these defenders were not using the native Windows Firewall as one of their defense-in-depth layers. This

Alerting and Detection Strategy Framework

Alerting and Detection Strategy Framework

This was a post I co-authored which originally published on the Palantir Blog. It is copied here for posterity. Alerting and Detection Strategies (ADS) are one of the critical requirements for an effective Incident Response (IR) and Detection team. Well-functioning IR teams invest time and energy into development

Windows Event Forwarding for Network Defense

Windows Event Forwarding for Network Defense

This was a post I co-authored which originally published on the Palantir Blog. It is copied here for posterity. Incident detection and response across thousands of hosts requires a deep understanding of actions and behavior across users, applications, and devices. While endpoint detection and protection tools can provide some