What have I been up to?

Well, as promised, I haven't written a post in awhile.  I've been really really busy, so I'll give you a crash course on what I've been doing that's kept me, and thoughts about things that have come to market in the past month or so.

1)  My Mother passed away.  As anyone who has had this happen knows, it's a pretty hard time, emotionally, as well as just, all the stuff you have to do.  Writing your own mother's obituary isn't necessarily a good time.  Selecting what she's going to wear, the casket, ...  just a lot.  The people that have written me and talked to me face to face have been great and I thank you all very much.

2)  VRT.  April 1st I moved to the Vulnerability Research Team at Sourcefire.  I'm one of the many other analysts responsible for writing Snort (and now recently ClamAV!) rules to detect the known, and the unknown.  It's a difficult job, it's challenging, it's fun, and it's busy.  I currently have over 100 bugs in my cue.  Lots of bugs and research to do.  My current focus is Malware and some redesign efforts.  We're trying to make the Snort rules easier to manage and provide more intelligence to the end user as well as increase our coverage in a lot of areas.  Making our rules harder to bypass and more and more adaptable to today's client-based landscape.  Over the rest of 2011, the VRT ruleset is going to change, for the better, and significantly.  There's essentially going to be three steps to this, and I'll post about the changes soon over on the Snort Blog.

3)  Snort Community.  It's growing.  When I took over the job in October of last year, I thought the Snort community had reached critical mass.  Most open source projects that I've seen plateau after awhile.  When I was running the BASE project we got up to about 15k downloads a day, and that was our plateau.  But since I took over, I've started to keep a lot of metrics.  Metrics about email postings, forum postings, users, downloads, etc.  Lots of metrics.  They are all going up.  We're doing well.

4)  Snort.  It's changing and evolving.  We're rolling out 2.9.1 soon with some very significant changes (read about PAF!) in detection and the IP reputation preprocessor.  The changes we have planned for post 2.9.1 make Snort even faster (we are already hitting WAY over 20 G/sec in detection, and the next number we are aiming for is unheard of in our industry), and easier to deploy.  Changes in it's detection will make it more accurate and significantly increase the effectiveness of our rules and keywords.

5)  ClamAV.  Also growing.  Now built into Immunet 3.0 (the company we acquired in December of last year) providing not only cloud based detection (so awesome), and offline detection.  Immunet is growing very fast by the looks of our daily metrics which means ClamAV use is increasing as well.  OEM solutions that are building ClamAV are also growing, and now recently we are going to start accepting community virus detection as well.  This will grow our detection rate exponentially.

6)  OSX Lion.  It's out.  I'm using it (have been for about a month and a half).  It works great.  The only thing I don't like about it is the deletion of the scroll bar.  I don't mind it as much as my wife will (I haven't converted her yet).

7)  Defcon.  We'll (VRT) be there.  Look for us in pink.  For those of you that were able to get an invite to TheBarCon, we'll see you there.

I can't think of anything more right now, and am being summoned for dinner.  I'll write more when I have a chance. If you have any questions, leave a comment below.

---

Please leave comments below.

Hackinations: 5 really good Lion tweaks | TUAW - The Unofficial Apple Weblog

Hackinations: 5 really good Lion tweaks | TUAW - The Unofficial Apple Weblog

I know I haven't written in awhile, I have a blog post planned in my head, just have been too busy to put it down on paper. But in the meantime, I saw this article and thought it was pretty good for you OSX readers that have upgraded to Lion.