Security Analyst, Author, and Instructor, Ed.D.
Studying the intersection of security investigation doctrine, cognitive psychology, and education.
Founder of Applied Network Defense and Rural Tech Fund
Books:
🍯 Intrusion Detection Honeypots
🦈 Practical Packet Analysis
🌐 Applied Network Security Monitoring
Former: Mandiant, InGuardians, Dept of Defense, Roadside Fruit Vendor.
A question well stated is a problem half-solved. #InvestigationTheory
https://chrissanders.org/links/
Investigation Scenario 🔎
A user received this SMS: “UPS: Package Delivery Failed. Update your address.”
Browser history shows a visit to a fake UPS site, followed by a POST request to /api/verify.
What do you look for to investigate whether an incident occurred? (Your choice on phone OS)
A difficult investigation isn’t necessarily a dead end. Sometimes the difficulty is a signal that the problem deserves more attention, not less. How you interpret difficulty shapes how you invest our time and effort.
Successful analysts must learn to distinguish between two thoughts:
“This investigation is difficult.”
“This investigation is going nowhere.”
The first describes the work. The second is a judgment about its prospects.
Research suggests that when we interpret difficulty as a sign of importance, we’re more likely to persist. When we interpret it as a sign of impossibility, we’re more likely to disengage.
