3 ms·
Corporate firewalls throw so many alerts that it's unlikely that a human even sees it let alone looks into it.
by willcipriano 3y ago
Corporate firewalls throw so many alerts that it's unlikely that a human even sees it let alone looks into it.
- jcrawfordor 3y agoMost corporate SOCs would probably investigate IRC connections at least briefly, they have a very high signal to noise ratio for compromised devices. Modern security devices do generate a tremendous amount of information, but the security operations industry as a whole and SIEMs in particular were developed to make it feasible to risk score and triage these findings.
- willcipriano 3y agoThis is quite the opposite of all my personal experience.
- jdietrich 3y agoA well-configured corporate firewall is going to block anything that looks like an IRC packet, because for the overwhelming majority of users, the probability of that packet being malicious is ~1.