DNA Cybertech Solutions / Blog
Long-form arguments and dated analysis. Product claims remain separate from external evidence and from results that have not been measured.
Six government agencies described a ransomware operation whose tradecraft is almost entirely ordinary, except for the part aimed at the investigation rather than the detection. Deleted logs are not missing data. They are an action with effects, and a record that cannot say so will quietly mislead you.
Read articleA web shell built for one application ran its database queries as that application. Nothing new authenticated, no new principal appeared, and every access log stayed truthful. This is what it looks like when identity stops being a discriminating signal.
Read articleAgents got better at using tools when interfaces started declaring what they meant. The same principle applies one layer down, to the data an agent reasons over, and security data is where it applies hardest.
Read articleAs more of the security decision moves into software, the operative question stops being 'did we detect it' and becomes 'can I defend this conclusion'. Three different failure modes of trust, and why passing one tells you nothing about the other two.
Read articleA compiler never translates a program straight into machine code. It builds something in the middle first, and it does so for reasons that have very little to do with saving effort. Security telemetry may need the same kind of middle layer, and the argument for it is more interesting than the engineering.
Read article