Understanding strategic (cyber) threat Intelligence – SC Magazine

Written for the SC Magazine. The original link seems to have died. Here’s an archived version: https://web.archive.org/web/20200730233821/https://www.scmagazineuk.com/understanding-strategic-threat-intelligence/article/1685804.

In March 2020, Booz Allen Hamilton released a fascinating dossier analysing the cyber operations of GRU, the Russian military intelligence agency, spanning 15 years. The dossier ran the traditional cyber threat intelligence (CTI) tradecraft through an impressive analytic process, thus credibly gluing the cyber operations of GRU to the doctrinal framework and geopolitical imperatives of the Russian state.

Continue reading “Understanding strategic (cyber) threat Intelligence – SC Magazine”

How the MSSPs Can Strive to be Detection Ninjas – Infosecurity Mag

For the Infosecurity Mag: https://www.infosecurity-magazine.com/opinions/mssps-strive-detection-ninjas/.

I am having some strange epiphanies as I go knee-deep into SIEM engineering. While the MSSPs have existed in all flavors and sizes, there seems to be a broad consensus that they simply can’t mimic the capabilities of an in-house security operations function – especially when it comes to gaining context, visibility and speed.

Continue reading “How the MSSPs Can Strive to be Detection Ninjas – Infosecurity Mag”

“In cyber, the generals should lead from behind” – College of Air Warfare

My talk at College of Air Warfare, Secunderabad, delivered on 17th Dec, 2019. Exquisitely titled, “In cyber, the generals should lead from behind.”

Continue reading ““In cyber, the generals should lead from behind” – College of Air Warfare”

What Microsoft needs to get right about cyber norms

In my recent essay for the Centre for Internet & Society, I surmised that the current initiatives to derive cyber norms within the ambit of international law could be incongruous with the technical dynamics of cyber operations. I shed light on the critical fissures in global attempts to establish normative frameworks for cyberspace.

Continue reading “What Microsoft needs to get right about cyber norms”

Lessons from Kudankulam – Part II: Targeting, jointness & offensive toolchains

I may (or may not) do a series of quick posts highlighting the strategic challenges encountered while investigating a cyberattack like Kudankulam. They would be filed under the ‘lessons-from-kudankulam‘ tag. Since our agencies were literally caught napping, this is a good primer for understanding what nation-state-level cyber capabilities entail:

Some dumbified excerpts from my dispatches to the government:

Continue reading “Lessons from Kudankulam – Part II: Targeting, jointness & offensive toolchains”

Lessons from Kudankulam – I: Recreating the target context

I may (or may not) do a series of quick posts highlighting the strategic challenges encountered while investigating a cyberattack like Kudankulam. They would be filed under the ‘lessons-from-kudankulam‘ tag. Since our agencies were literally caught napping, this is a good primer for understanding what nation-state-level cyber capabilities entail:

Continue reading “Lessons from Kudankulam – I: Recreating the target context”