Sniper Forensics v3.0 Hunt
|
|
|
- Angel Wilcox
- 10 years ago
- Views:
Transcription
1 Sniper Forensics v3.0 Hunt Presented by: Christopher Pogue, CISSP, CEH, CREA, GFCA, QSA Managing Consultant SpiderLabs Incident Response and Digital Forensics
2 Who Am I? Managing Consultant for the Trustwave SpiderLabs Master s degree in Information Security Author of Unix and Linux Forensic Analysis by Syngress Author of the award winning blog, The Digital Standard Chosen as a SANS Thought Leader in 2010 Member of the USSS Electronic Crimes Task Force SANS DFIR `09, 10, `11, `12, The Computer Forensics Show 09 and 10, Direct Response Forum 09, SecTor `09,`10,`11,`12 USSS ECTF Miami, Dallas, The Next HOPE 10, BSIDESLV 10, DEF CON 18 & 20, LM Connect `10, GFIRST `11, `12, SecureTech `11 and Career Day at my kids school. Former US Army Signal Corps Warrant Officer
3 Thank You Dan Christensen!
4 Thank You MAJ Carole Newell I think Twitter
5 TheDigitalStandard.Blogspot.com
6 Agenda Recap What is Sniper Forensics? The Evolution of Sniper Forensics What are the benefits of using Sniper Forensics? Testimonials Indicators of Compromise 1000 yard stare In the Cross Hairs Lethal Forensication Case Studies Conclusion
7 The Evolution of: Sniper Forensics The process of taking a targeted, deliberate approach to forensic investigations: Create an investigation plan Apply sound logic Locard s Exchange Principle Occam s Razor The Alexiou Principle Extract what needs to be extracted, nothing more Allow the data to provide the answers Report on what was done Answer the questions
8 Sniper Forensics V2.0: Target Acquisition What do I snipe? Registry Hives SAM Security System Software NTUSER.DAT How do I actually DO that? Manually via FTK using F-Response Script it How do I interpret the data? Infiltration Aggregation Exfiltration
9 Sniper Forensics v3.0: Hunt Identify Indicators of Compromise (IOC) 1000 yard stare In The Cross Hairs Lethal Forensication Endgame
10 Benefits Don t Take My Word For it! Sniper Forensics is the only methodology worth using. That's something the monolithic driving imaging shops don't want to hear. It will beat them to them results and help to stop the bleeding faster every time. - Nicholas J. Percoco - Senior Vice President, Trustwave SpiderLabs
11 Benefits Don t Take My Word For it! Sniper Forensic rocks because it's foundations lies in logic. Try it, you will thank us later! - Jibran Ilyas - Senior Security Consultant, SpiderLabs DFIR Team
12 Benefits Don t Take My Word For it! Chris' Sniper Forensics Series teaches something much more important than simple technical skills. It teaches the investigative process and how to keep your eye on the ball. Too many investigators, digital or otherwise, get bogged down and sidetracked with the massive quantities of information. Chris's methodology perfectly illustrates the methods investigators should be using to limit the scope of their engagements. - Larry "Lee" Sult - Security Analyst, SpiderLabs DFIR Team - CyberFrontSecurity.blogspot.com
13 Benefits Don t Take My Word For it! Look, digital forensics is getting more complicated not less complicated. The old school forensics methodology does not work on mobile and embedded devices, and you re not going to image the cloud. Sniper Forensics is the embodiment of how forensic cases will be worked in the future. Know what you need to solve the case and go get it. - Grayson Lenik - Security Consultant, SpiderLabs DFIR Team - Author of the award winning blog, EyeOnForenscis
14 Benefits Don t Take My Word For it! During a major breach, there is no plan B. Chris's presentation on Sniper Forensics are the result from his time spent on the front lines in the field. If you are looking to equip your team with what they really need, Sniper Forensics details special ops TTPs that make a clear difference. - Rob Lee - Forensics Curriculum Lead, SANS Institute * TTP = Tactics, Techniques, and Procedures
15 Indicators of Compromise What is different in the eyes of a hunter? They know what they are looking for Valuable past experience They know what it looks like when they found it They do not hesitate to pull the trigger
16 Indicators of Compromise
17 Indicators of Compromise
18 Indicators of Compromise
19 Indicators of Compromise
20 Indicators of Compromise
21 Indicators of Compromise What do all of these images have in common? Hoof print Burned Wall Bullet Cake Ball Comic Book
22 Indicators of Compromise To the untrained eye, they seem like one of hundreds of thousands images we see everyday. To the expert eye, they hold significant value. Hoof print Deer track Burned Wall Evidence of the use of a liquid fire accelerant Bullet.38 Caliber round Cake Ball Red Velvet cake ball with an almond bark exterior Comic Book Spiderman issue #1
23 1000 Yard Stare As practitioners of digital forensics, we are the expert eyes of the cyber crime world Arguably the most difficult of all forensic disciplines Constantly changing and evolving data sample Very real, very proactive adversary, with extensive resources and time Thousands of hiding places
24 1000 Yard Stare Study the terrain What is normal Research Experience Study the target Why is it a target? What value does the target hold? What weakness does the target possess? Study the enemy Learn his behaviors Where does he operate? How does he operate? Why does he operate?
25 In The Cross Hairs All malware has specific components Propagation Mechanism Aggregation Mechanism Encoding (not encryption) Exfiltration Remote Access
26 In The Cross Hairs How do those components work? How would a memory dumper, dump memory? Would it dump the entire contents of memory? Would it dump the memory from a specific process? How would a keylogger log keystrokes? Would log the input from a specific device? Would it gather screenshots? How would a network sniffer operate? What critical elements HAVE to be in place? How can you tell?
27 Lethal Forensication Indicators of Compromise All types of malware have to do three things: Live Run Generate output Once you identify what is being done and how, you can use that IOC on the current case, or future cases (ie build a database of known IOCs).
28 Lethal Forensication Once you know what the enemy looks like, and how he acts, it becomes exponentially easier to identify: The Likely Target The Likely means of Infiltration The Likely means of Aggregation The Likely means of Exfiltration
29 Case Studies What s wrong with this picture? Two processes called, OPS.exe Which one is legitimate, and which is not? How can I tell? What can I logically conclude from this finding?
30 Case Studies What s wrong with this picture? Two dlls called, webcheck.dll Which one is legitimate, and which is not? How can I tell? What can I logically conclude from this finding?
31 Case Studies What s wrong with this picture? Is svchost.exe a legitimate binary name? Is there a problem with this one? How can I tell? What can I logically conclude from this finding?
32 Conclusion To have the expert eyes of a hunter, you MUST: Put in the chair time What is normal What is abnormal Study your target Why are they likely a target What do they have that is worth stealing Study the enemy What are they doing How are they doing it What are the current trends Where can you foresee it going
33 Final Thought Is this merely a laptop? OR Is it a investigation tool in the hands of an expert?
34
Jibran Ilyas DIRECTOR
PROFESSIONAL EXPERIENCE STROZ FRIEDBERG, LLC Director, Incident Response, July 2015 to Present Assistant Director, Incident Response, August 2014 to July 2015 Assist in development of incident response
RETHINKING CYBER SECURITY
RETHINKING CYBER SECURITY Introduction Advanced Persistent Threats (APTs) and advanced malware have been plaguing IT professionals for over a decade. During that time, the traditional cyber security vendor
Global Security Report 2011
Global Security Report 2011 Charles Henderson Director of Application Security Services Trustwave s SpiderLabs Agenda Introduction Incident Response Investigations Malware Statistics Attack Vector Evolution
WRITTEN TESTIMONY OF
WRITTEN TESTIMONY OF KEVIN MANDIA CHIEF EXECUTIVE OFFICER MANDIANT CORPORATION BEFORE THE SUBCOMMITTEE ON CRIME AND TERRORISM JUDICIARY COMMITTEE UNITED STATES SENATE May 8, 2013 Introduction Thank you
Hunting for Indicators of Compromise
Hunting for Indicators of Compromise Lucas Zaichkowsky Mandiant Session ID: END-R31 Session Classification: Intermediate Agenda Threat brief Defensive strategy overview Hunting for Indicators of Compromise
2012 Global Threats and Trends
2012 Global Threats and Trends Presented by: Nicholas J. Percoco Trustwave SVP & Head of SpiderLabs Agenda Introduction 2011 Incident Investigations The Breach Triad Malware Trends Security Weaknesses
Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation. By Marc Ostryniec, vice president, CSID
Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation By Marc Ostryniec, vice president, CSID The increase in volume, severity, publicity and fallout of recent data breaches
DEF CON 19: Getting SSLizzard. Nicholas J. Percoco Trustwave SpiderLabs Paul Kehrer Trustwave SSL
DEF CON 19: Getting SSLizzard Nicholas J. Percoco Trustwave SpiderLabs Paul Kehrer Trustwave SSL Agenda Introductions Primer / History: SSL and MITM Attacks Mobile SSL User Experience Research Motivations
CYBER SECURITY TRAINING SAFE AND SECURE
CYBER SECURITY TRAINING KEEPING YOU SAFE AND SECURE Experts in Cyber Security training. Hardly a day goes by without a cyber attack being reported. With this ever-increasing threat there is a growing need
Network Security Monitoring: Looking Beyond the Network
1 Network Security Monitoring: Looking Beyond the Network Ian R. J. Burke: GCIH, GCFA, EC/SA, CEH, LPT [email protected] [email protected] February 8, 2011 2 Abstract Network security monitoring
Gaining the upper hand in today s cyber security battle
IBM Global Technology Services Managed Security Services Gaining the upper hand in today s cyber security battle How threat intelligence can help you stop attackers in their tracks 2 Gaining the upper
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global
Endpoint Threat Detection without the Pain
WHITEPAPER Endpoint Threat Detection without the Pain Contents Motivated Adversaries, Too Many Alerts, Not Enough Actionable Information: Incident Response is Getting Harder... 1 A New Solution, with a
National Cyber Security Month 2015: Daily Security Awareness Tips
National Cyber Security Month 2015: Daily Security Awareness Tips October 1 New Threats Are Constantly Being Developed. Protect Your Home Computer and Personal Devices by Automatically Installing OS Updates.
Covert Operations: Kill Chain Actions using Security Analytics
Covert Operations: Kill Chain Actions using Security Analytics Written by Aman Diwakar Twitter: https://twitter.com/ddos LinkedIn: http://www.linkedin.com/pub/aman-diwakar-ccie-cissp/5/217/4b7 In Special
After the Attack: RSA's Security Operations Transformed
After the Attack: RSA's Security Operations Transformed Ben Smith, CISSP RSA Field CTO (East), Security Portfolio Senior Member, ISSA Northern Virginia 1 The Environment ~ 2,000 security devices ~55M security
Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: APTs first came on the scene in 2010, creating a wave
Advanced Threat Protection with Dell SecureWorks Security Services
Advanced Threat Protection with Dell SecureWorks Security Services Table of Contents Summary... 2 What are Advanced Threats?... 3 How do advanced threat actors operate?... 3 Addressing the Threat... 5
Comprehensive Advanced Threat Defense
1 Comprehensive Advanced Threat Defense June 2014 PAGE 1 PAGE 1 1 INTRODUCTION The hot topic in the information security industry these days is Advanced Threat Defense (ATD). There are many definitions,
Privilege Gone Wild: The State of Privileged Account Management in 2015
Privilege Gone Wild: The State of Privileged Account Management in 2015 March 2015 1 Table of Contents... 4 Survey Results... 5 1. Risk is Recognized, and Control is Viewed as a Cross-Functional Need...
Digital Forensic Techniques
Digital Forensic Techniques Namrata Choudhury, Sr. Principal Information Security Analyst, Symantec Corporation Professional Techniques T23 CRISC CGEIT CISM CISA AGENDA Computer Forensics vs. Digital Forensics
Incident Response. Six Best Practices for Managing Cyber Breaches. www.encase.com
Incident Response Six Best Practices for Managing Cyber Breaches www.encase.com What We ll Cover Your Challenges in Incident Response Six Best Practices for Managing a Cyber Breach In Depth: Best Practices
How To Stop A Cybercriminal From Stealing A Credit Card Data From A Business Network
2012 Payment Card Threat Report The second annual study of unencrypted payment card storage Automated Attacks and Card Data Handling In 2011, data breaches increased 42% and as such, last year was reported
Getting Started Guide
Getting Started Guide Before you set up your account, you may want to spend a few minutes thinking about what you want to get out of Flextivity. Of course, Flextivity helps you successfully manage basic
Top 10 Tips to Keep Your Small Business Safe
Securing Your Web World Top 10 Tips to Keep Your Small Business Safe Protecting your business against the latest Web threats has become an incredibly complicated task. The consequences of external attacks,
Rethinking Information Security for Advanced Threats. CEB Information Risk Leadership Council
Rethinking Information Security for Advanced Threats CEB Information Risk Leadership Council Advanced threats differ from conventional security threats along many dimensions, making them much more difficult
As threat actors target various types of networks, companies with improperly configured network infrastructures risk the following repercussions:
TrendLabs Targeted attacks often employ tools and routines that can bypass traditional security and allow threat actors to move deeper into the enterprise network. Threat actors do this to access data
Digital Evidence and Threat Intelligence
Digital Evidence and Threat Intelligence 09 November 2015 Mark Clancy CEO www.soltra.com @soltraedge External Threats Growing 117,339 incoming attacks every day The total number of security incidents detected
A Wake-Up Call? Fight Back Against Cybercrime. Prepared for: Ricky Link Managing Director, Southwest Region May 15, 2014
A Wake-Up Call? Fight Back Against Cybercrime Prepared for: Ricky Link Managing Director, Southwest Region May 15, 2014 1 Coalfire Background Leading Information Security Consulting Firm Offices: Atlanta,
Threat Intelligence Pty Ltd [email protected] 1300 809 437. Specialist Security Training Catalogue
Threat Intelligence Pty Ltd [email protected] 1300 809 437 Specialist Security Training Catalogue Did you know that the faster you detect a security breach, the lesser the impact to the organisation?
One-Man Shop. How to build a functional security program with limited resources DEF CON 22
One-Man Shop How to build a functional security program with limited resources DEF CON 22 One-Man Shop Agenda Caveats & Considerations People and Processes Network Architecture System Design Continuous
Cyber/IT Risk: Threat Intelligence Countering Advanced Adversaries Jeff Lunglhofer, Principal, Booz Allen. 14th Annual Risk Management Convention
Cyber/IT Risk: Threat Intelligence Countering Advanced Adversaries Jeff Lunglhofer, Principal, Booz Allen 14th Annual Risk Management Convention New York, New York March 13, 2013 Today s Presentation 1)
Privilege Gone Wild: The State of Privileged Account Management in 2015
Privilege Gone Wild: The State of Privileged Account Management in 2015 March 2015 1 Table of Contents... 4 Survey Results... 5 1. Risk is Recognized, and Control is Viewed as a Cross-Functional Need...
Advanced Threats: The New World Order
Advanced Threats: The New World Order Gary Lau Technology Consulting Manager Greater China [email protected] 1 Agenda Change of Threat Landscape and Business Impact Case Sharing Korean Incidents EMC CIRC
Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst Abstract: Large organizations have spent millions of dollars on security
ENISA s Study on the Evolving Threat Landscape. European Network and Information Security Agency
ENISA s Study on the Evolving Threat Landscape European Network and Information Security Agency Agenda Introduction to ENISA Preliminary remarks The ENISA report Major findings Conclusions 2 ENISA The
Alert (TA14-212A) Backoff Point-of-Sale Malware
Alert (TA14-212A) Backoff Point-of-Sale Malware Original release date: July 31, 2014 Systems Affected Point-of-Sale Systems Overview This advisory was prepared in collaboration with the National Cybersecurity
NEW JERSEY STATE POLICE EXAMPLES OF CRIMINAL INTENT
Appendix A to 11-02-P1-NJOIT NJ OFFICE OF INFORMATION TECHNOLOGY P.O. Box 212 www.nj.gov/it/ps/ 300 Riverview Plaza Trenton, NJ 08625-0212 NEW JERSEY STATE POLICE EXAMPLES OF CRIMINAL INTENT The Intent
Persistence Mechanisms as Indicators of Compromise
Persistence Persistence Mechanisms as Indicators of Compromise An automated technology for identifying cyber attacks designed to survive indefinitely the reboot process on PCs White Paper Date: October
InfoSec Academy Forensics Track
Fundamental Courses Foundational Courses InfoSec Academy Specialized Courses Advanced Courses Certification Preparation Courses Certified Information Systems Security Professional (CISSP) Texas Security
A Day in the Life of a Cyber Tool Developer
A Day in the Life of a Cyber Tool Developer by Jonathan Tomczak [email protected] Jonathan Tomczak ( Front Man ) Software Engineer w/ over 7 years experience working in software and web development Dave
Top 5 Global Bank Selects Resolution1 for Cyber Incident Response.
MAJOR FINANCIAL SERVICES LEADER Top 5 Global Bank Selects Resolution1 for Cyber Incident Response. Automation and remote endpoint remediation reduce incident response (IR) times from 10 days to 5 hours.
Whose IP Is It Anyways: Tales of IP Reputation Failures
Whose IP Is It Anyways: Tales of IP Reputation Failures SESSION ID: SPO-T07 Michael Hamelin Lead X-Force Security Architect IBM Security Systems @HackerJoe What is reputation? 2 House banners tell a story
Stop the Maelstrom: Using Endpoint Sensor Data in a SIEM to Isolate Threats
Stop the Maelstrom: Using Endpoint Sensor Data in a SIEM to Isolate Threats Jody C. Patilla The Johns Hopkins University Session ID: TECH-107 Session Classification: Intermediate Objectives Get more out
Whitepaper. Advanced Threat Hunting with Carbon Black
Advanced Threat Hunting with Carbon Black TABLE OF CONTENTS Overview Threat Hunting Defined Existing Challenges and Solutions Prioritize Endpoint Data Collection Over Detection Leverage Comprehensive Threat
InfoSec Academy Application & Secure Code Track
Fundamental Courses Foundational Courses InfoSec Academy Specialized Courses Advanced Courses Certification Preparation Courses Certified Information Systems Security Professional (CISSP) Texas Security
Computer Hacking Forensic Investigator v8
CÔNG TY CỔ PHẦN TRƯỜNG CNTT TÂN ĐỨC TAN DUC INFORMATION TECHNOLOGY SCHOOL JSC LEARN MORE WITH LESS! Computer Hacking Forensic Investigator v8 Course Description: EC-Council releases the most advanced Computer
Whitepaper on AuthShield Two Factor Authentication with ERP Applications
Whitepaper on AuthShield Two Factor Authentication with ERP Applications By INNEFU Labs Pvt. Ltd Table of Contents 1. Overview... 3 2. Threats to account passwords... 4 2.1 Social Engineering or Password
ASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES
ASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES Leonard Levy PricewaterhouseCoopers LLP Session ID: SEC-W03 Session Classification: Intermediate Agenda The opportunity Assuming
A NEW APPROACH TO CYBER SECURITY
A NEW APPROACH TO CYBER SECURITY We believe cyber security should be about what you can do not what you can t. DRIVEN BY BUSINESS ASPIRATIONS We work with you to move your business forward. Positively
Breach Found. Did It Hurt?
ANALYST BRIEF Breach Found. Did It Hurt? INCIDENT RESPONSE PART 2: A PROCESS FOR ASSESSING LOSS Authors Christopher Morales, Jason Pappalexis Overview Malware infections impact every organization. Many
After the Attack. The Transformation of EMC Security Operations
After the Attack The Transformation of EMC Security Operations Thomas Wood Senior Systems Engineer, GSNA CISSP RSA, The Security Division of EMC [email protected] 1 Agenda Review 2011 Attack on RSA
Seven Simple steps. For Mobile Device Management (MDM) 1. Why MDM? Series
Series Seven Simple steps For Mobile Device Management (MDM) Mobile device management (MDM) has become a necessity across the globe due to the ever expanding and developing world of technology; Technavio
Agenda. 3 2012, Palo Alto Networks. Confidential and Proprietary.
Agenda Evolution of the cyber threat How the cyber threat develops Why traditional systems are failing Need move to application controls Need for automation 3 2012, Palo Alto Networks. Confidential and
Post-Access Cyber Defense
Post-Access Cyber Defense Dr. Vipin Swarup Chief Scientist, Cyber Security The MITRE Corporation November 2015 Approved for Public Release; Distribution Unlimited. 15-3647. 2 Cyber Security Technical Center
How can Cloud help your Security. Christophe Van Mollekot Solution Advisor Microsoft
How can Cloud help your Security Christophe Van Mollekot Solution Advisor Microsoft Global datacenter footprint 100+ Datacenters in over 40 countries Integral to business transformation 71% of strategic
ESG Brief. Overview. 2014 by The Enterprise Strategy Group, Inc. All Rights Reserved.
ESG Brief Webroot Delivers Enterprise-Class Threat Intelligence to Security Technology Providers and Large Organizations Date: September 2014 Author: Jon Oltsik, Senior Principal Analyst; Kyle Prigmore,
Detecting Malware With Memory Forensics. Hal Pomeranz SANS Institute
Detecting Malware With Memory Forensics Hal Pomeranz SANS Institute Why Memory Forensics? Everything in the OS traverses RAM Processes and threads Malware (including rootkit technologies) Network sockets,
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
BE SAFE ONLINE: Lesson Plan
BE SAFE ONLINE: Lesson Plan Overview Danger lurks online. Web access, social media, computers, tablets and smart phones expose users to the possibility of fraud and identity theft. Learn the steps to take
Cognitive and Organizational Challenges of Big Data in Cyber Defense
Cognitive and Organizational Challenges of Big Data in Cyber Defense Nathan Bos & John Gersh Johns Hopkins University Applied Laboratory [email protected], [email protected] The cognitive and organizational
Seven Things To Consider When Evaluating Privileged Account Security Solutions
Seven Things To Consider When Evaluating Privileged Account Security Solutions Contents Introduction 1 Seven questions to ask every privileged account security provider 4 1. Is the solution really secure?
Preempting Business Risk with RSA SIEM and CORE Security Predictive Security Intelligence Solutions
Preempting Business Risk with RSA SIEM and CORE Security Predictive Security Intelligence Solutions CORE Security +1 617.399-6980 [email protected] www.coresecurity.com blog.coresecurity.com Preempting
2013 Open Source Digital Forensics Conference
4 TH ANNUAL OSDF 2013 Open Source Digital Forensics Conference Doing More with Less Willi Ballenthin Consultant MANDIANT Introduc4on: Willi Ballenthin Professionally Incident response Malware analysis
That Point of Sale is a PoS
SESSION ID: HTA-W02 That Point of Sale is a PoS Charles Henderson Vice President Managed Security Testing Trustwave @angus_tx David Byrne Senior Security Associate Bishop Fox Agenda POS Architecture Breach
Doris Yang [email protected] Vectra Networks, Inc. June 16, 2015 The World Ahead
Doris Yang [email protected] Vectra Networks, Inc. 1 June 16, 2015 The World Ahead June 16, 2015 The World Ahead Disclaimer The views and opinions expressed during this conference are those of the
Cisco Cyber Threat Defense - Visibility and Network Prevention
White Paper Advanced Threat Detection: Gain Network Visibility and Stop Malware What You Will Learn The Cisco Cyber Threat Defense (CTD) solution brings visibility to all the points of your extended network,
Defending against modern cyber threats
Defending against modern cyber threats Protecting Critical Assets October 2011 Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Agenda 1. The seriousness of today s situation
Building the Next Generation of Computer Security Professionals. Chris Simpson
Building the Next Generation of Computer Security Professionals Chris Simpson Overview Why teach computer security to high school students Deciding what to teach What I taught Community Support Lessons
Top Five Data Security Trends Impacting Franchise Operators. Payment System Risk September 29, 2009
Top Five Data Security Trends Impacting Franchise Operators Payment System Risk September 29, 2009 Top Five Data Security Trends Agenda Data Security Environment Compromise Overview and Attack Methods
SECURITY CONSIDERATIONS FOR LAW FIRMS
SECURITY CONSIDERATIONS FOR LAW FIRMS Enterprise Risk Management Professional consulting firm that specializes in cyber security Founded in 1998 in Miami, Florida Serves more than 150 clients, locally,
Uroburos Highly complex espionage software with Russian roots
G Data Red Paper 2014 Uroburos Highly complex espionage software with Russian roots G Data discovers alleged intelligence agency software G Data SecurityLabs Contact: [email protected] Red Paper_February-2014
SAFECode Security Development Lifecycle (SDL)
SAFECode Security Development Lifecycle (SDL) Michael Howard Microsoft Matthew Coles EMC 15th Semi-annual Software Assurance Forum, September 12-16, 2011 Agenda Introduction to SAFECode Security Training
Visa Data Security Bulletin (AP)
Visa Data Security Bulletin (AP) Targeted Hospitality Sector Vulnerabilities December 1, 2009 To promote the security and integrity of the payment system, Visa is committed to helping clients and payment
C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR
Page: 1 TM C HFI Computer C HFI Computer Hacking Forensic INVESTIGATOR Hacking Forensic INVESTIGATOR TM v8 v8 Page: 2 Be the leader. Deserve a place in the CHFI certified elite class. Earn cutting edge
ADVANCED THREATS IN THE ENTERPRISE. Finding an Evil in the Haystack with RSA ECAT. White Paper
ADVANCED THREATS IN THE ENTERPRISE Finding an Evil in the Haystack with RSA ECAT White Paper With thousands of workstations and servers under management, most enterprises have no way to effectively make
Sophisticated Indicators for the Modern Threat Landscape: An Introduction to OpenIOC
WHITE PAPER Sophisticated Indicators for the Modern Threat Landscape: An Introduction to OpenIOC www.openioc.org OpenIOC 1 Table of Contents Introduction... 3 IOCs & OpenIOC... 4 IOC Functionality... 5
Adversary ROI: Why Spend $40B Developing It, When You Can Steal It for $1M?
Adversary ROI: Why Spend $40B Developing It, When You Can Steal It for $1M? Joshua Corman Akamai Technologies David Etue SafeNet Session ID: GRC-202 Session Classification: Intermediate About Joshua Corman
Operation Liberpy : Keyloggers and information theft in Latin America
Operation Liberpy : Keyloggers and information theft in Latin America Diego Pérez Magallanes Malware Analyst Pablo Ramos HEAD of LATAM Research Lab 7/7/2015 version 1.1 Contents Introduction... 3 Operation
Enterprise Incident Response: Network Intrusion Case Studies and Countermeasures
Enterprise Incident Response: Network Intrusion Case Studies and Countermeasures Eric J. Eifert Vice President, Cyber Defense Division ManTech s Mission, Cyber, & Technology Solutions Presentation Overview
NSA/DHS Centers of Academic Excellence for Information Assurance/Cyber Defense
NSA/DHS Centers of Academic Excellence for Information Assurance/Cyber Defense Cyber Investigations Data Management Systems Security Data Security Analysis Digital Forensics Health Care Security Industrial
An Accelerated Pathway to Careers in Cybersecurity for Transitioning Veterans. NICE Annual Conference November 2015
An Accelerated Pathway to Careers in Cybersecurity for Transitioning Veterans NICE Annual Conference November 2015 Panelists David Brown, Director of CyberTalent at the SANS Institute, a new business unit
Operational Lessons from the RSA/EMC CIRC: People, Process, & Threat Intel
Operational Lessons from the RSA/EMC CIRC: People, Process, & Threat Intel @Ben_Smith Ben Smith, CISSP Field CTO (US East), Security Portfolio A Security Maturity Path CONTROLS COMPLIANCE IT RISK BUSINESS
eguide: Designing a Continuous Response Architecture Disrupting the Threat: Identify, Respond, Contain & Recover in Seconds
Disrupting the Threat: Identify, Respond, Contain & Recover in Seconds Table of Contents Overview 3 The Problem 3 Defining the Threat 3 The Network is Not the Target 4 Incident Response is Ad Hoc 5 Incident
Advanced Threat Detection: Necessary but Not Sufficient The First Installment in the Blinded By the Hype Series
Advanced Threat Detection: Necessary but Not Sufficient The First Installment in the Blinded By the Hype Series Whitepaper Advanced Threat Detection: Necessary but Not Sufficient 2 Executive Summary Promotion