DNS / Indicator of Compromise / domain owner colleagues I'd appreciate your help / advice: I need an uncomfortable analogy to an uncomfortable reality nobody wants to talk about.
You may know I've been writing a series of articles which I've been calling "Letters to Dubai" because of the friend who inspired me to write about this set of topics. (http://consulting.m3047.net/dubai-letters/)
I plan to write one about NOD (Newly Observed DNS Domains) on a technical / tactical / theoretical level, but events occurring around me are telling me I need to write two prequels: 1) the industrial complex which preruns your domain and 2) targeting places by targeting people.
See, it's that second one. An uncomfortable topic. It is what's happening though: indicator of compromise vendors target infrastructure and they should know (unless they're incompetent liars, which some of them are) who operates that infrastructure. But that word "operates" suffers from category confusion (https://en.wikipedia.org/wiki/Category_mistake): I operate a server, but I do not Operate the infrastructure which ultimately connects that server to the internet.
In the cases I'm seeing it's that infrastructure Operator who should be targeted at proportionate scale, but what they're doing instead is sniping at goatherders who went to get water from the well the same as they'd always done before the Operator moved in.
Who's got a better analogy? Happy to credit the analogy or analogies I use.
