Profile for tf
- Display name
- Tilman Frosch
- Username
- @tf@threatactor.club
About tf
Bio
Old enough to remember cyber as a verb. Prefers building things over breaking things. Enjoys hanging out with the other side. One tour as founding CEO, occasionally still incident response. Likes networks, cryptographic protocols, and most board sports. Ops for a great boutique, structural defence things for a critical infra provider. Sometimes freelance. PhD from RUB/HGI.
- Joined
- Posts
- 5
- Followed by
- 26
- Following
- 60
Stats
Recent public posts
USG decided once again to contribute to the tech sovereignty discussion, using the example of AI model access: https://www.anthropic.com/news/fable-mythos-access
Luckily for everyone (except Anthropic) the affected models were a) new and b) most probably too heavily fraught with safeguards to be already in relevant production use.
How do we know that we detect what we intend to detect? There are quite a few answers to that question, regrettably also along the lines of “we’ve implemented the detection, d’oh!”.
In the last two years we have been (and continue to be) busy with improving efficiency and effectiveness in detection engineering. The traditional manual approach clearly doesn’t cut it in a large heterogeneous IT landscapes of today, where security monitoring makes use of more than one or two technologies to gain visibility in a variety of system contexts. We thus quickly moved towards Detection as Code (DaC). The question of how a CI/CD pipeline in this context would look like then swiftly confronted us with the question of testability of detection mechanisms, which led to the question of how to automate tests. Having solved that, we arrived at: “if we agree that we want to verify detection effectiveness anyways, why don’t we define a test for a potential attacker action first, if and only accept detections for that specific vector, if they pass the test?“
Adapting from Kent Beck‘s concept of Test-Driven Development (TDD) in software engineering, we refer to our approach as Test-Driven Detection Engineering (TDDE).
We’ve written up the what and how in a short paper together with @seecurity, which we decided to submit to DIMVA as a mere poster, as all of that is WIP. We‘re happy that our submission has been accepted and I’m looking forward to discuss the approach with attendees and fellow practitioners.
Find a preprint of the short-paper here: https://tilmanfrosch.de/dl/preprint/Test_Driven_Detection_Engineering.pdf
Aloha! I expect this account to be rather low-traffic.