Decipher Podcast: Andrew Morris

Summary: Andrew Morris, founder of GreyNoise, describes starting the company from a 2013 pet project in which he set up honeypots on roughly ten $10 lifetime VPS instances across ten data centers and found the same IP addresses attacking all of them. He presented the honeypot system at ShmooCon around 2014 in a talk called "No Budget Threat Intel," after which an audience member asked him to build it out for a customer he could not name.
Why it matters: Morris's conclusion was that the traffic hitting every host on the internet is background noise, not threat intelligence, and that subtracting it from what hits a specific network leaves only what is actually targeting that network - the distinction a security leader needs when deciding which alerts deserve attention.

Read the original at GreyNoise Blog ↗