blue team Archives - Jean-Christoph von Oertzen https://jeanchristophvonoertzen.com/tag/blue-team Exploring the intersection of cybersecurity, psychology, and resilience. Fri, 14 Nov 2025 18:34:47 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.4 https://jeanchristophvonoertzen.com/wp-content/uploads/2020/10/favicon-4.png blue team Archives - Jean-Christoph von Oertzen https://jeanchristophvonoertzen.com/tag/blue-team 32 32 What Fantasy Role-Playing Games Can Teach Us About Cybersecurity Roles https://jeanchristophvonoertzen.com/what-fantasy-role-playing-games-can-teach-us-about-cybersecurity-roles https://jeanchristophvonoertzen.com/what-fantasy-role-playing-games-can-teach-us-about-cybersecurity-roles#respond Fri, 14 Nov 2025 18:34:47 +0000 https://jeanchristophvonoertzen.com/?p=1760 — And why your SOC might actually need a Bard 🐉⚔️ Cybersecurity teams are often compared to armies, fire brigades, or special forces. Personally? I think they’re much closer to a party of heroes in a classic fantasy role-playing game. No matter how many frameworks, SIEMs, or AI tools we summon, defending a digital kingdom […]

The post What Fantasy Role-Playing Games Can Teach Us About Cybersecurity Roles appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/what-fantasy-role-playing-games-can-teach-us-about-cybersecurity-roles/feed 0 Webinar takeaway – How to Detect and Respond to Business Email (M365) Compromise https://jeanchristophvonoertzen.com/webinar-takeaway-how-to-detect-and-respond-to-business-email-m365 https://jeanchristophvonoertzen.com/webinar-takeaway-how-to-detect-and-respond-to-business-email-m365#respond Thu, 24 Feb 2022 19:18:55 +0000 https://jeanchristophvonoertzen.com/?p=866 My key takeaways BEC external-to-internal passes all technical security measures like SPF, DKIM and DMARC BEC internal-to-internal bypasses anti-spam solutions Get comfy with PowerShell to interact with M365 since Jan 2019 MS enabled mailbox auditing for Exchange Online CrowdStrike Reporting Tool also reviews excessive permissions in Azure AD If you are suspiscous to have a […]

The post Webinar takeaway – How to Detect and Respond to Business Email (M365) Compromise appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/webinar-takeaway-how-to-detect-and-respond-to-business-email-m365/feed 0 Webinar takeaway: Hacking Packet Captures: The Foundations of Network Security https://jeanchristophvonoertzen.com/webinar-takeaway-hacking-packet-captures-the-foundations-of-network-security https://jeanchristophvonoertzen.com/webinar-takeaway-hacking-packet-captures-the-foundations-of-network-security#respond Wed, 07 Jul 2021 19:22:53 +0000 https://jeanchristophvonoertzen.com/?p=524 My key takeaways Zeek does not capture whole packets but saves summaries of all conversations it sees to log files saves time and space "You wouldn’t normally use Zeek for packet capture, instead you use it for analysis." – Bill Stearn Sending a lot more data then recieving might indicate malicious traffic use NetworkMiner to […]

The post Webinar takeaway: Hacking Packet Captures: The Foundations of Network Security appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/webinar-takeaway-hacking-packet-captures-the-foundations-of-network-security/feed 0 Webinar takeaway: Learn to Detect and Defend Against Supply Chain Attacks Before They Compromise Your Network https://jeanchristophvonoertzen.com/webinar-takeaway-learn-to-detect-and-defend-against-supply-chain-attacks-before-they-compromise-your-network https://jeanchristophvonoertzen.com/webinar-takeaway-learn-to-detect-and-defend-against-supply-chain-attacks-before-they-compromise-your-network#respond Wed, 16 Jun 2021 19:35:55 +0000 https://jeanchristophvonoertzen.com/?p=481 My key takeaways First trojan probably was implemented 1983 by Ken Thompson, who invented Unix, C,.. He also warned back then: "You can’t trust code that you did not totally create yourself" Brand new hardware from the factory can be infected by malicious code as well Also open source software is constantly compromised example of […]

The post Webinar takeaway: Learn to Detect and Defend Against Supply Chain Attacks Before They Compromise Your Network appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/webinar-takeaway-learn-to-detect-and-defend-against-supply-chain-attacks-before-they-compromise-your-network/feed 0 Webinar Takeaway: The Quest for the Kill Chain Killer Continues https://jeanchristophvonoertzen.com/webinar-takeaway-the-quest-for-the-kill-chain-killer-continues https://jeanchristophvonoertzen.com/webinar-takeaway-the-quest-for-the-kill-chain-killer-continues#respond Thu, 13 May 2021 18:10:36 +0000 https://jeanchristophvonoertzen.com/?p=457 My key takeaways baseline defence must grow centralized logging required anyway VPNs need MFA too, esp with working from home early installations of Zoom-client on Windows got you a webserver running with open RDP JUGLAR = J-User-Global-Universal-DomainLocal-Resource More than 50% of enterprises that BHIS tests, still have support for LLMNR and NBNS enabled How to […]

The post Webinar Takeaway: The Quest for the Kill Chain Killer Continues appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/webinar-takeaway-the-quest-for-the-kill-chain-killer-continues/feed 0 Webinar Takeaway: EMERGENCY WEBCAST: OK, let´s talk about ransomware… https://jeanchristophvonoertzen.com/webinar-takeaway-emergency-webcast-ok-lets-talk-about-ransomware https://jeanchristophvonoertzen.com/webinar-takeaway-emergency-webcast-ok-lets-talk-about-ransomware#respond Tue, 11 May 2021 17:52:08 +0000 https://jeanchristophvonoertzen.com/?p=445 My key takeaways 3 types of ransomware encrypt hard drive steal files and data and threat to release them both 1 & 2 Ransomware gangs usually have great customer support it has become a serious business It doesn’t matter if you consider your organsiation a valuable target, if at least some money could be extorted […]

The post Webinar Takeaway: EMERGENCY WEBCAST: OK, let´s talk about ransomware… appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/webinar-takeaway-emergency-webcast-ok-lets-talk-about-ransomware/feed 0 Webinar Takeaway: No SPAN Port? No Tap? No Problem! https://jeanchristophvonoertzen.com/webinar-takeaway-no-span-port-no-tap-no-problem https://jeanchristophvonoertzen.com/webinar-takeaway-no-span-port-no-tap-no-problem#respond Thu, 15 Apr 2021 18:07:17 +0000 https://jeanchristophvonoertzen.com/?p=419 My key takeaways setting up security in home network is no easy job no tap port? Think ARP cache poisoning don’t run it on a production network! Put RITA and Bettercap on a Raspberry Pi Bettercap is able to do full duplex ARP cache poisoning have to enable it in the config you can whitelist […]

The post Webinar Takeaway: No SPAN Port? No Tap? No Problem! appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/webinar-takeaway-no-span-port-no-tap-no-problem/feed 0 Webinar takeaway: How to Analyze Encrypted Traffic on Your Network https://jeanchristophvonoertzen.com/webinar-takeaway-how-to-analyze-encrypted-traffic-on-your-network https://jeanchristophvonoertzen.com/webinar-takeaway-how-to-analyze-encrypted-traffic-on-your-network#respond Wed, 03 Feb 2021 22:00:15 +0000 https://jeanchristophvonoertzen.com/?p=372 My key takeaways Encrypted traffic on the wire: can see headers, can’t see payload More and more traffic gets encrpyted like HTTPS and even DNS Most Threat Hunt techniques still work: beacons/strobes, long connections and connections to Threat Intel hosts Env Provided by Active Countermeasures Presenter: Alex Kirk from Corelight additional links https://corelight.blog/2020/11/19/corelight-at-home/ https://zeek.org/ Blog: […]

The post Webinar takeaway: How to Analyze Encrypted Traffic on Your Network appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/webinar-takeaway-how-to-analyze-encrypted-traffic-on-your-network/feed 0 Webinar takeaway: Atomic Red Team Hands-on Getting Started Guide https://jeanchristophvonoertzen.com/webinar-takeaway-atomic-red-team-hands-on-getting-started-guide https://jeanchristophvonoertzen.com/webinar-takeaway-atomic-red-team-hands-on-getting-started-guide#respond Thu, 28 Jan 2021 23:00:33 +0000 https://jeanchristophvonoertzen.com/?p=368 My key takeaways The Atomic Red Team Project (ART) is a open source library of scripted attacks ART uses the MITRE ATT&CK Matrix as structure ART emulates what an Attacker might do after compromise; msf tries to make use of vulns in software Emulating attacks helps to improve detection of attacks and comparing security products […]

The post Webinar takeaway: Atomic Red Team Hands-on Getting Started Guide appeared first on Jean-Christoph von Oertzen.

]]> https://jeanchristophvonoertzen.com/webinar-takeaway-atomic-red-team-hands-on-getting-started-guide/feed 0