CIRT-Level Response to Advanced Persistent Threat - SANS ...

ePAPER READ

DOWNLOAD ePAPER

computer.forensics.sans.org

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

START NOW

Questions?

Richard Bejtlich

richard@taosecurity.com

taosecurity.blogspot.com

Building, Maturing & Rocking a Security Operations Center - SANS ...

Sniper Forensics “One Shot, One Kill” - SANS Computer Forensics

examples of recent apt persistence mechanisms - SANS Computer ...

Ovie Carroll - SANS Forensic Trends and Futures.pdf

Analysis & Correlation of Mac Logs - SANS

“ANN'S AURORA” - SANS Computer Forensics

Encryption v20.10 - SANS Computer Forensics

Tales from the Crypt - TrueCrypt Analysis - SANS

Digital Forensics for IaaS Cloud Computing - SANS Computer ...

All the Gear..and No Idea.. - Scalable, fast - SANS

Protecting Privileged Domain Accounts during Live Response

Mark McKinnon RedWolf Computer Forensics Mark ... - SANS

Taking Registry Analysis to the Next Level - SANS Computer ...

Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

Security Project Managers Red-Blue Team Business Response Teams Incident Handlers Incident Cycle Plan Resist Prepare Assess Resolve Security Tasks Escalate Filter Protect Collect Analyze Respond Detect Incident Response Center Note: GE-CIRT Components IT and Security Teams Technical Assistance Group Threat Cell Event Analysts Incident Analysts

Questions? Richard Bejtlich richard@taosecurity.com taosecurity.blogspot.com 17

Page 1 and 2: CIRT-Level Response to Advanced Per
Page 3 and 4: • You are an APT victim. • You
Page 5 and 6: Favorite Kris Harms APT Quotes (FIR
Page 7 and 8: First Day after D-Zero • Switch t
Page 9 and 10: • Determine incident scope. First
Page 11 and 12: • Create Red-Blue Team. Second Ye
Page 13 and 14: Incident Response Center Incident H
Page 15: Company General Electric Aerospace

CIRT-Level Response to Advanced Persistent Threat - SANS ...

Create successful ePaper yourself

Delete template?

Save as template?