DOCSEARCHbyAlgolia
Submit Docs

KHOI | Blog

website·Indexed 32 days ago

https://blog.imkhoi.com

A personal knowledge-sharing blog covering technical topics including Golang, Next.js, Docker, DevOps, and cybersecurity. Content includes guides on incident response (NIST and SANS), SOAR playbooks, zero-day attack prevention, and practical tutorials on deploying apps to Ubuntu VPS using CI/CD workflows.

Tokens
13.6K
Snippets
31
Records
116
Agent score
63%

What's inside KHOI Blog

  1. Understand the limitations of Lean Startup for novel product development

    While Lean Startup principles are derived from Toyota's lean production system (focused on waste reduction and continuous improvement), they are primarily designed for the incremental improvement of existing processes and products. For startups creating truly novel products, relying solely on Lean Startup can be limiting because:

    1. Customer Imagination Limits: Customer feedback is often delimited by existing products. As noted by Steve Jobs and Henry Ford, customers may not know what they want if it doesn't exist yet (e.g., asking for a 'faster horse' instead of a car).
    2. Incremental vs. Radical Value: Lean techniques tend to increase the value of existing products incrementally rather than driving breakthroughs that look beyond present realities.
    3. Premature Validation: Listening to customers before forming a compelling theory of value can lead a startup astray or toward mediocre, incremental value.

  2. Understand network and subnetting fundamentals

    A network consists of two or more connected computing devices, typically connected via a central hub such as a router. To manage large numbers of IP addresses and devices (as seen with ISPs), networks are divided into smaller subdivisions called subnetworks (subnets). The Internet is conceptualized as a 'network of networks,' where individual networks interconnect to allow global communication.

  3. Use MISP for threat intelligence sharing

    The Malware Information Sharing Platform (MISP) is an open-source software solution used by incident analysts and security professionals to collect, store, distribute, and share structured cyber security indicators and malware analysis data. It facilitates the exchange of indicators of compromise (IoCs) and malware samples while helping organizations avoid sharing confidential information.

  4. Understand Security Orchestration, Automation and Response (SOAR)

    SOAR (Security Orchestration, Automation and Response) is a technology solution designed to streamline and automate security operations. It integrates various security tools and processes—such as SIEM and threat intelligence—into a single platform. A SOAR platform automatically collects and analyzes security alerts from multiple sources, correlates events to identify threats, and initiates responses based on pre-defined playbooks to increase response speed and effectiveness.

  5. Understand Advanced Persistent Threats (APT) characteristics

    An Advanced Persistent Threat (APT) is a sophisticated cyber attack aimed at infiltrating a network to steal sensitive information or disrupt operations. Key characteristics include:

    • Persistence: Attackers continue attempting to penetrate defenses over a long period, even after initial failures.
    • Adaptability: Attackers modify their tactics in response to improved security measures.
    • Targeting: Common targets include governments, corporations, and organizations holding sensitive data. Common actors include nation-states, criminal organizations, and malicious insiders.

  7. Perform a hypothesis-driven security investigation

    Hypothesis-driven investigation is a proactive process where a security professional develops a specific theory about a potential threat based on available data and then conducts targeted investigations to confirm or refute it. This approach focuses resources on high-risk threats and accelerates the investigation process by providing a clear direction.

    Common sources for deriving hypotheses include:

    • Threat intelligence
    • Network analysis
    • System logs
    • User behavior analysis
    # Example Scenario
**Hypothesis**: A malicious actor has gained unauthorized access to a company’s network and is exfiltrating sensitive data.

**Investigation Steps**:
1. Collect and analyze network logs for suspicious activity (e.g., unusual login attempts or data transfers).
2. Check endpoint logs for communication with known malicious domains or IP addresses.
3. If confirmed, remediate by isolating affected devices and updating security protocols.

  8. Understand the purpose of swap space

    Swap space is a designated area on a hard drive (HDD or SSD) that acts as an extension of a computer’s physical RAM. When physical RAM is full, the operating system moves inactive or less frequently used data to this swap space to free up memory for active tasks. This is particularly useful for preventing build failures (e.g., Docker builds for NextJS) on VPS instances with limited RAM.

  9. Identify common rental fees and hidden costs

    Beyond the monthly rent, budget for the following common fees: application fees, parking fees, pet fees, and move-in/move-out fees. Additionally, inquire about the average cost of utilities before signing a lease.

  10. Understand the core functions of SIEM

    Security Information & Event Management (SIEM) tools combine Security Information Management (SIM) and Security Event Management (SEM) to convert log entries and events into actionable information. SIEM is used to detect threats in real time, manage incident response, perform forensic investigations on past incidents, and prepare compliance audits. Common SIEM tools include Splunk Enterprise Security, Datadog Security Monitoring, and Fortinet FortiSIEM.

  11. Understand data packets and headers in networking

    Data transmitted over the Internet is divided into small chunks called packets. At the network layer, software attaches a header to each packet. This header acts like an envelope, containing critical metadata including the content, source address, and destination address, which allows the receiving software to process the packet correctly.

  12. How to generate startup ideas and find cofounders

    The most effective way to generate startup ideas is not to consciously try to think of them, but to cultivate a mind where they form unconsciously. This is achieved by:

    1. Learning extensively about things that matter.
    2. Working on problems that interest you with people you like and respect.

    Following this approach allows you to find cofounders and a viable idea simultaneously.