Incident-Response on Andrew Healey

The SANS ICS Five Critical Controls: incident response, architecture, monitoring, remote access, vulnerability management

Wed, 14 Oct 2026 09:01:46 -0500

The SANS ICS Five Critical Controls: incident response, architecture, monitoring, remote access, vulnerability management. Pretty familiar to technology folks, but much more challenging in live production.

Isolating the wrong host can stop a line or create a safety problem. Segmentation means a new network that rarely gets a maintenance window or carving it up like swiss cheese for vendor support. Monitoring has to be passive and protocol-aware, because the active scanning we take for granted in IT can knock over a PLC. Secure remote access means tracking down every integrator and OEM who has had a standing VPN for a decade. Vulnerability management means accepting that some assets will never be patched, so you prioritize by what the process can survive.

So good

Sat, 03 Oct 2026 13:35:42 -0500

So good. The lesson isn’t really about SonicWall, though many will breeze past and see it just as that. It’s easy to blame the brand and feel safe on Cisco or Palo Alto. At this point, I can’t name a vendor that hasn’t had some embarrassing bug. For this one, it was a hardcoded Erlang cookie and a static AES key. And on top of that, it’s just as easy to say “we’re on Entra” or “we’re on Okta” and forget that most still have some hooks back to Active Directory.

The Power of Scripting: Finding Morto.A

Tue, 27 Sep 2011 22:58:26 -0500

Here I go on another vbScript tutorial. You might ask why I’m not doing this in powershell yet and it is simple: I still run into 2003 and XP environments. Oh yeah, and this works. I don’t care what scripting language I’m writing in if it gets the job done; you shouldn’t either. My $0.02. The original zip download is long gone, but every piece of the script is below.