Security Researcher Ryan Fetterman Discusses Career Path and 'Pandora Song' APT Incident
Veteran security researcher Ryan Fetterman shares insights on his career journey from federal agencies to Cisco Talos, highlighting his pioneering work on host-based analytics during the 'Pandora Song' APT incident.
Security researcher Ryan Fetterman has joined Cisco Talos, bringing over 15 years of experience in cybersecurity, much of it gained during his decade working in the Washington D.C. area. Fetterman's career began in consulting before pivoting to research, where he accumulated significant experience within federal agencies and government consulting. This early work provided him with his first exposure to actual security operations and the powerful capabilities of Splunk for log analysis and visualization.
Fetterman describes his early work with Splunk as a natural inclination, emphasizing that finding one's specialization in cybersecurity is not something that can be rushed. His dedication to this area eventually led him to work on the Splunk research team, SURGe. Following Cisco's acquisition of Splunk, Fetterman was integrated into the Talos team, continuing his focus on practical security research and detection engineering.
A pivotal experience in Fetterman's career was his involvement in an Advanced Persistent Threat (APT) incident known as 'Pandora Song.' While working in a federal Security Operations Center (SOC) in the D.C. area, he was among the first to implement host-based analytics, a technique now central to much of modern detection engineering. This pioneering work involved analyzing host-based sensor data and writing custom analytics within Splunk.
Fetterman was alerted to the 'Pandora Song' incident by a third party. While examining the details, he focused on how the attackers were progressing through their attack chain. This deep dive into the incident allowed him to develop novel ways to track and understand the adversary's movements, laying the groundwork for more sophisticated detection strategies.
The interview also touches upon the broader aspects of building a sustainable career in cybersecurity. Fetterman advocates for project-based learning and stresses the importance of stepping away from the keyboard to avoid burnout. His philosophy centers on practical application and continuous learning, essential traits for navigating the ever-evolving threat landscape.
Fetterman's journey underscores the value of hands-on experience and a "blue collar" approach to blue team operations. His work on 'Pandora Song' exemplifies how dedicated analysis of host-level data can yield critical insights into sophisticated threats, contributing to the collective defense against advanced adversaries.
His move to Talos signifies a continued commitment to threat research and developing practical security solutions. Fetterman's expertise in detection engineering and his experience with real-world APTs like 'Pandora Song' are expected to be valuable assets to Cisco's threat intelligence efforts.