London, UK -  Cyber security professional specialising in detection and response, blogging about technology, business, and life to scratch a writing itch from a previous life as a journalist

Recent blog posts

The Social Network: A film that passed me by for eight years
 -  When it first came out eight years ago, I assumed The Social Network would be a fairly dull retelling of the origin story of what was then everyone’s favourite social network. I finally caught it the other day, and it turns out I’d been missing out on a great movie....
What a security operations centre (SOC) is and how it works
 -  The security operations centre (SOC) is the heart of a firm’s cyber defences. Here are the basic elements and processes that a SOC uses to monitor for and respond to security incidents. Cyber security has a staffing problem. With so many roles out there and so few people with the...
Checking DNS requests against a domain blacklist in Python
 -  A while ago I wrote a post about using Python to parse tcpdump output for domains and URLs. Recently, I started to wonder if I could take that a step further. What if the DNS requests I saw could be checked against a blacklist in real time? And what if...
Stuff I did in April: Isle of Dogs, RAF Museum, coffee and non-league football
 -  Welcome to what might be a new regular post series, which I’m going to nickname “Stuff I only posted to Instagram and haven’t had a chance to write about yet”. Basically, I’m making an effort to make more of my weekends, and if I start writing about it I’m probably...
Automatically generating SOC emails with a Python script
 -  The life of a SOC analyst – as is the case with many other jobs – can involve a lot of repetitive tasks, including the process of writing tens of similar emails each day. But what if this could be automated, saving time and reducing the potential for error? The...
Incident triage: Identifying the source of a malware infection
 -  Part of my time at the SANS Cyber Retraining Academy covered the incident response methodology and how to identify what’s wrong and how to fix it. But theory is quite different to the real thing, so I thought it would be useful to make a cheat sheet with a few...
Here are some of the best things I did, saw and ate in Japan
 -  I’ve just arrived back in the UK after spending nearly two weeks travelling across Japan, visiting Tokyo, Nagoya, Osaka and Kyoto. Before I get back to work and the memories start to fade, I wanted to put pen to paper and share some experiences, thoughts, and photos. I have a...
I’ve arrived in the wearable future (but time is running out)
 -  I have a confession to make: I’ve never liked the way the Apple Watch looks. I’ve owned a range of Apple products over the last decade and I’ve always thought they were beautiful and well-polished, but wearing a big silver box on my wrist has never appealed to me. Unfortunately,...
What cyber security courses don’t prepare you for
 -  It’s almost a year to the day that I left my journalism job and started at the SANS Cyber Retraining Academy, and I’ve written a lot of blog posts about how much I enjoyed the experience and how valuable and life-changing it was. But now I’ve been in the industry...
What I’ll be playing and reading in 2018
 -  It’s the Christmas break, and in between family gatherings and travelling up and down the country I’ve finally found time to get stuck into a few good games and books. What I’ll be playing in 2018 My new work commitments mean I don’t get as much chance to play games...

Thinking about

Digital journalism
Coincidentally, in the space of a week I encountered both Zach Seward's article about Quartz and Craig Mod's excellent podcasts with Tim Ferriss. Both evoked fond memories of my time in journalism and the buzz surrounding digital journalism and media in the 2010s

Interests

  • Cyber security
  • Tech
  • Python
  • PowerShell
  • JavaScript
  • F1
  • Reading
  • Writing
  • Psychology
  • Philosophy
  • Exercise
  • Running
  • Gaming
  • Football
  • Music
  • Guitar