Category Archives: Blog

The containerized GRR is a forked version of GRR Rapid Response, incident response framework designed by Google engineers. In today’s blog post I’m focusing on the GRR features that allow the real-time investigation to be made remotely via web-based user interface. Read more about the Docker containerized GRR from my previous blog post. GRR is an […]

Containerized GRR is a forked implementation of the GRR Rapid Response, a tool for incident response designed and developed by Google engineers. Containerized GRR differs from the original GRR by utilizing the Docker containers on its working. In my experience, Docker containers are a more approachable way to take the tool into use since containers […]

There are great sighs of relief among cyber criminals because the systems in use in organisations are not up to date, neither is the level of competence in the cyber security of users. Picture a realistic scene where a cybercriminal successfully secures access to the system of an organisation enabling access to sensitive and critical […]

After studying Internet user tracking and how to avoid it in my Thesis, I decided to experiment with Firefox privacy settings. With Firefox one can customize almost any parameters in a user.js file under the user’s profile. There are many projects that aim to provide a template for these customizations for better security and privacy. […]

In the digital world, whenever we click on something and reply to some request for information, we are at every suitable opportunity vulnerable to be misled and defrauded. Human nature is trusting, compliant, and curious, as well as desiring more of something and all it requires is a suitable moment and a confidence raising enquirer. […]

This blog post presents a tool called ioc_strings that can be used to gather relevant technical information from file strings. The tool is developed for CinCan project to be used in incident analysis Continuous Integration (CI) pipelines, and also for standalone use for incident analyst. ioc_strings tool extracts possible IoC (Indicator of Compromize) information from files, such as urls, domains, emails, hashes etc. These IoC types are compatible with Cortex-Analyzers, therefore it is possible to feed these gathered […]

Week 21 was the actual exercise week for the national cyber security exercise. The immense planning and implementation work led by the Secretary General of the Security Committee, Vesa Valtonen, culminated in the exercise week where the organisations of state administration practiced in a technical-operational cyber exercise survival in wide-ranging and multidimensional cyber incidents. Now […]

In an earlier post, Analysing malicious PDF documents using Dockerized tools, we covered the use of some PDF analysis tools we have Dockerized in the CinCan project. A Docker image can often be made quite easily, but there are things you should take in account to make it a good one. In this post we take a […]

Disobey, the annual Nordic security event was held on 11th-12th of January 2019 at Kaapelitehdas, Helsinki. The group of JYVSECTEC staff members participated to the event with an aim to hear the latest news from the field, meet their colleagues, increase their knowledge and of course, to have fun! Group had also a desire to […]

One of the goals of the CinCan project is to provide tools that automate the repetitive tasks of malware analysis using practices familiar from continuous integration to enable rapid creation, augmentation, correlation and sharing of analysis and threat intelligence. Using Docker containers, we have portable tools, which can be conveniently configured for use in designated […]