Episode 5 - Detecting DNS Covert Channels in the Wild (Part 1)
In Episode 5 of Corelight Defenders, I, Richard Bejtlich, engage with Corelight's co-founder and chief scientist, Vern Paxson, to delve into the intricate world of DNS covert channels. We explore how adversaries exploit DNS lookups to silently communicate within tightly controlled enterprise environments. Vern explains various methods attackers may use, from encoding data in seemingly benign domain names to manipulating the timing of requests. Our discussion highlights the challenges of detecting these covert channels, especially in the presence of network monitoring.
2026: Trust Is the Currency, Platforms Are the Standard, and Vendors Must Justify Their Seat at the Table
Why security-first platforms, outcome-based services and value-driven pricing will define software delivery in an increasingly complex AI-world.
Beaconing Detection: How Attackers Stay Hidden
Attackers, after an initial compromise, look to remain inside a network for as long as possible. For this, they use different methods. Beaconing is one of the common techniques used to maintain this access. Beaconing activity can easily blend into normal traffic and can remain unnoticed for long periods. Therefore, it is important for IT and security teams to understand how beaconing works in order to effectively carry out beaconing detection and response.
Why Unmanaged IoT Devices Are the Biggest Security Blind Spot in 2026
The rapid expansion of connected devices has fundamentally changed how organisations operate. From smart sensors and industrial controllers to gateways, cameras, and embedded systems, IoT has become integral to modern business. Digital transformation is accelerating the adoption of IoT technologies, increasing the attack surface and making IoT security a critical component of modern cybersecurity strategies.
AI and the Vanishing Entry Level Security Jobs in 2025
The Razorwire Christmas Party 2025 episode compares automation in law and cybersecurity, where junior roles shrink and the talent pipeline starts to break. AI pressure on tier one soc work in 2025 leaves new entrants with debt and fewer real training grounds, raising hard questions about the future of senior expertise.
Account Takeover Prevention for Credit Unions: What Actually Works in 2026
Account takeover prevention for credit unions has reached an inflection point. One concept underpins most modern failures: the timing gap, the period between a member engaging with a scam or impersonation interaction and the moment a security or fraud team becomes aware of risk. During this gap, access is often treated as legitimate even though compromise has already occurred.
What is Safe Remediation in Check Point Exposure Management's Offering?
Safe Remediation is the process of turning validated exposure insights into coordinated, non-disruptive fixes across security controls ensuring teams can reduce risk quickly without breaking production. More specifically, Safe Remediation includes: Validation before enforcement Remediation without downtime Automated, coordinated action across controls Preemptive blocking of attacker infrastructure Safe-by-design automation Safe Remediation ensures that exposures are fixed quickly, automatically, and without operational risk – turning detection into trusted, validated action.
Your app store listings are changing without you noticing. Here's why it matters.
Most teams treat an app release as the finish line. The build clears CI/CD checks. Security scans pass. The app ships. Celebrations follow. But for mobile apps, the real exposure often begins after release, inside app stores, where metadata lives a completely different lifecycle from your code. App store listings are not static assets. They evolve constantly: What your team approved on day one may look very different to users on day ten.
How modified APKs disguise themselves as your app across third-party stores
Attackers don’t need to breach your infrastructure to harm your users. They don’t need source code access, credentials, or backend vulnerabilities. They just need your public APK. Once your app is publicly available, attackers can download it, decompile it, inject malicious code, repackage it, and redistribute it through third-party app stores and unofficial marketplaces.