Richard Bejtlich
More info
- Known for
- Network security monitoring
- Affiliation
- AFCERT, GE-CIRT, Mandiant
- Country
- USA
Former Air Force officer who turned network security monitoring into a discipline, starting from the premise that intrusions can't be prevented, only caught in time.
Bejtlich learned the trade at the US Air Force's incident centre, AFCERT, in the late 1990s. In The Tao of Network Security Monitoring (2004) he argued that defenders should collect traffic data, analyse it and escalate — rather than wait for a signature-based IDS to start shouting. The tools came from others (Roesch's Snort, Paxson's Bro); the method was his.
He went on to build General Electric's incident response team and in 2011 became chief security officer at Mandiant, which two years later published the APT1 report naming a Chinese military unit. His TaoSecurity blog has long been one of the field's calmer voices.