4 ms·
>> The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis. Defenders are usuall
by easy_rider 13y ago
>> The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.
I read this as: attackers are usually one step ahead at least, and "defenders" (sic: developers (?) ) do not like pentesting? These tools are available to anyone..
- bazzargh 13y agoNo amount of pentesting with tools that are 'available to anyone' will help you with the attacks that aren't invented yet. MozDef is about incident handling. You still need to do this, even if you do pentesting.
- cones688 13y ago> "defenders" (sic: developers (?) ) Defenders are usually companies or a consultancies ERT (emergency repsonse team) or in their SOC (Security Operations Center) to monitor real time security threats to their business and Triage, mitigate, investigate, block etc. Some of the enterprise tools (QRadar, Arcsight, EnVision) for these are really advanced but run into the 100's of thousands cost, so I think MozDef is an open sources initiative for smaller teams who don't have the resources for the above.
- easy_rider 13y agoAh, should not comment before the coffee kicks in... That's actually an awesome concept. Thanks for the explanation.