Corelight DefeNDRs

TechnologyTech News3 episodes

Gain clear, actionable intelligence from Corelight’s network defense experts. Corelight DefeNDRs translates complex cybersecurity detection challenges into concise, practical episodes designed to support faster, smarter decision-making across modern security teams.

Latest episode

All Episodes

Episode 3 - Network Visibility in the Cloud: Why Network Traffic Analysis Remains Critical

16 min 28 sec

Richard Bejtlich discusses cloud security from a network-centric perspective with Corelight's cloud security researcher, David Burkett. They explore why monitoring network traffic remains essential in cloud environments, despite the presence of native security features offered by cloud providers. David highlights common threats such as container compromises, coin miners, and supply chain attacks, emphasizing the value of traffic visibility for detecting unusual behaviors and breaches. The episode delves into practical approaches like baselining cloud workloads, analyzing ingress and egress traffic, and the unique advantages of monitoring cloud infrastructure through network-based taps. Tune in to discover how organizations can enhance their cloud security strategies through proactive network visibility.

Play episode

Episode 2 - Inside the Black Hat NOC: Defending a hostile conference network

16 min 24 sec

Richard Bejtlich talks with Corelight Principal Technical Marketing Engineer Mark Overholser about what it takes to run the Black Hat Network Operations Center and keep a “hostile” training network safe. They walk through how partners like Corelight, Cisco, Palo Alto Networks, Arista, and Lumen build and monitor the conference network, how the team tells lab traffic from real infections, and why misconfigured self hosted services still show up in surprising ways. Mark shares how the NOC works together in one room to investigate issues, when they decide to block or intervene, and practical advice for attendees on preparing their devices, monitoring their own traffic with tools like Zeek, and staying safe on conference Wi Fi without living out of a Faraday bag.

Play episode

Episode 1 - Typhoon season: How Chinese threat actors are quietly staging for disruption

15 min 44 sec

Richard Bejtlich sits down with Vince Stoffer, Corelight's Field CTO, to dive into the recent wave of cyberattacks attributed to Chinese threat actors, known as "Typhoon" groups. Vince unpacks the distinctions between "Volt Typhoon," targeting critical infrastructure sectors such as energy and transportation, and "Salt Typhoon," which is infiltrating telecommunications networks for espionage. The conversation explores the evolving tactics, techniques, and procedures (TTPs) used by these groups, including their exploitation of zero-day vulnerabilities and outdated infrastructure. Richard and Vince discuss the challenges of securing public-facing appliances and critical infrastructure and highlight the importance of robust network visibility and proactive threat detection strategies. Tune in to discover actionable insights on how organizations can better defend against sophisticated state-sponsored cyber threats.

Play episode