Secure Networks: Endace Packet Forensics Files

Secure Networks: Endace Packet Forensics Files is a guest interview series hosted by Michael Morris, and its subject is the practical mechanics of keeping networks safe. The format is simple. Morris opens by asking each guest to describe their background, then steers toward the problems they deal with in the field. Those backgrounds are often worth hearing on their own. Ryan Chapman, a SANS author and instructor, describes moving from a security operations center to a CERT to incident response consulting, then leaving consulting for a managed threat hunting team once the hours became too much. Lionel Jacobs of Palo Alto Networks describes 25 years in the energy sector, working with grid and pipeline companies, before joining the company. Jen Miller-Osborn, a deputy director at Palo Alto Networks, recounts dropping genetic engineering because she disliked repetitive lab work, then volunteering for a government cybersecurity training course when the field barely existed. The technical stretches are dense and specific. Jack Chan, VP of Product and Field CTO at Fortinet, points out that internal segmentation firewalls carry a policy-management burden, that almost nobody locks anything down at the switch level, and that sniffing a span port with network detection and response tooling helps fill the gap. His example is DC sync. A compromised PC asks a domain controller to sync, which looks like normal traffic, except the aim is to pull usernames and passwords. Chapman's incident response advice starts at the most basic level: many groups have no solid plan, so step one is to write one and connect it to business continuity and disaster recovery. Morris adds that dwell times, last he heard, stretched past 200 days. Jacobs explains why patching industrial systems is as dangerous as not patching. A vendor update can push a specialized machine out of spec or lock it up, so teams test patches on isolated systems for months and run a version or two behind. The mitigation he describes is grouping similarly vulnerable devices into an enclave or zone with a protective control in front. Taran Singh of Keysight Technologies raises the mismatch between monitoring built for one-to-ten gigabit networks and segments already upgraded to 25 or 100, and argues that visibility and analytics, a pillar of zero trust, should be planned up front rather than treated as a second-tier concern. The episode pairing Wireshark creator Gerald Combs with Stephen Donnelly of Endace sits closest to the show's name, walking through how an investigation moves from firewall and application logs to flow records, each one only a summary of what occurred. Morris keeps the tone warm and is generous with praise. Most episodes close by pointing to Endace's network packet capture platform and its integrations with partners, often the guest's own company. For detection detail, the Chan episode is a strong place to start. The Jacobs episode covers industrial security, and the Miller-Osborn conversation is the pick for a career story.