Chief Technology Officer

Chris Horsley

Chris Horsley has a long background in the international CSIRT community, with over seven years of experience working in national CSIRTs, almost five years of experience consulting to CSIRTs, and five years experience as a software developer and sysadmin prior to that.

Posts by

Chris Horsley

Browse all posts

Threat Intelligence

Seven Great New MISP Features You May Have Missed

MISP has such a cracking pace of development that you may have missed some of its more interesting features of late. Let’s go through some of our favourite additions that you might want to consider using.

Podcast

Episode #004: How ChatGPT Could Transform the CTI Analyst Role with Chris Horsley

Cosive CTO Chris Horsley conducted early experiments using ChatGPT to help assign ATT&CK IDs to threat intelligence reports. While the tool won’t replace an experienced analyst as of today, it will likely change the way we do this kind of work.

Podcast

Episode #002: Building Production-worthy Software in SecOps Teams with Chris Horsley, CTO at Cosive

Before jointly founding Cosive with Kayne Naughton and Terry MacDonald, Chris Horsley (Cosive’s CTO) spent many years working in national CSIRTs in both Australia and Japan, as well as doing freelance secure software development for operations teams. In this interview Chris talks about the challenges of building software and writing critical automation scripts in SecOps teams.

Threat Intelligence

Establishing a Threat Intel Program: Principles for Security Leaders

One of the more frequent conversations we have with security leaders is how to establish a new threat intelligence program in their organisation. In these conversations there are a few basic principles that we cover because they’re applicable to almost everyone. We’re sharing these principles publicly so that more organisations can learn about our threat intel philosophy and avoid the most common mistakes that can lead to failed programs.

Threat Intelligence

How ChatGPT Could Transform the CTI Analyst Role

The interview in this post is taken from Episode 004 of the Cosive Podcast, where Cosive CTO Chris Horsley sat down with Tash Postolovski to talk about the implications for AI tools like ChatGPT on the future of the CTI Analyst role.

Threat Intelligence

7 MISP Best Practices: Lessons from Effective Threat Intel Teams

MISP is a powerful open source threat intelligence and sharing platform used by countless SOC teams around the world. Getting a barebones MISP instance up and running is well within the skill-set of most SOC teams. Download MISP, run it on a VM, and log in to the MISP admin console using default credentials… all within about 10 minutes. That part is easy. Now for the hard part: how do you get from a barebones MISP install to actually using MISP to solve real-world cybersecurity problems? Making that leap can be much more complex and challenging than it may seem on the surface.

Threat Intelligence

ATT&CKing with OpenAI’s ChatGPT

We try out some exciting early experiments using ChatGPT for helping us assign ATT&CK IDs to threat intelligence reports. While it’s not going to replace an experienced analyst as of today, it will likely change the way we do this kind of work.

Security Operations

Building Production-worthy Software in SecOps Teams: An Impossible Challenge?

Before jointly founding Cosive with Kayne Naughton and Terry MacDonald, Chris Horsley (Cosive’s CTO) spent many years working in national CSIRTs in both Australia and Japan, as well as doing freelance secure software development for operations teams. In this interview Chris Horsley (CTO at Cosive) talks about the challenges of building software and doing development in SecOps teams.

Anti Phishing

Automating Anti Phishing Canary Credentials at Scale

In part 1 of our mini-series on canary credentials, we talked about what canary credentials are, why to use them, and how to use them well. It’s highly recommended to read part 1 first. So, let’s assume you’ve had some early success in manually using canary credentials in limited numbers - great! Now you’re looking to take your next steps. Arguably, the most powerful way to land a blow against phishing attackers and deter future attacks is using canary credentials at scale via automation. Here’s why.

Anti Phishing

How to Disrupt Phishing with Anti Phishing Canary Credentials

The traditional response to a phishing attack is to issue a take-down request and wait for the site to (possibly) be yanked offline. Take-downs, while necessary, just don’t hit phishers where it hurts - they still harvest plenty of stolen credentials while the site is up. In light of this, security teams are looking for new, more effective ways to fight back against phishers. Rather than be reactive, we want to disrupt phishers’ operations. A strategy rapidly gaining in popularity is the use of credential poisoning techniques, utilising what are referred to as ‘canary credentials’.

Company Culture

How to Communicate Remotely

Since our last post we've been inundated with requests asking for more details on how we work remotely at Cosive. For those who don't know us, we're a specialist IT security company that has been working completely remotely since 2015. And when I say we have been working remotely, I mean we don't have offices at all. We're fully online, with staff distributed across Australia and New Zealand.

Company Culture

Cosive’s Tips for Making a Happy and Productive Remote Team

As COVID-19 spreads globally, and employees are asked to work from home for the first time, we’ve seen many people looking for tips on managing a remote team. So, we decided to distill a few lessons we’ve learned at Cosive about how to make a cohesive remote team work well.