CIRT-Level Response to Advanced Persistent Threat - SANS ...

ePAPER READ

DOWNLOAD ePAPER

computer.forensics.sans.org

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

START NOW

Favorite Kris Harms APT Quotes (FIRST 2010)

• “Compliance is the floor

upon which you’re

going to fall when you

get hacked.”

• “Today a B [grade] is

not good enough.”

• “Do not get in a battle

over knowledge of

Windows with an

intruder. You will lose.”

• “Lesley Stahl, I pwn

your wireless.”

http://www.cbsnews.com/video/watch/?id=3538299n

Building, Maturing & Rocking a Security Operations Center - SANS ...

Sniper Forensics “One Shot, One Kill” - SANS Computer Forensics

examples of recent apt persistence mechanisms - SANS Computer ...

Ovie Carroll - SANS Forensic Trends and Futures.pdf

Analysis & Correlation of Mac Logs - SANS

“ANN'S AURORA” - SANS Computer Forensics

Encryption v20.10 - SANS Computer Forensics

Tales from the Crypt - TrueCrypt Analysis - SANS

Digital Forensics for IaaS Cloud Computing - SANS Computer ...

All the Gear..and No Idea.. - Scalable, fast - SANS

Protecting Privileged Domain Accounts during Live Response

Mark McKinnon RedWolf Computer Forensics Mark ... - SANS

Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

Taking Registry Analysis to the Next Level - SANS Computer ...

Critical Themes • Prevention eventually fails. • Persistent threats never give up. • Winning does not mean preventing compromise. Rather: – Increase $/MB – Predict next move – Track adversary change – Intrusion suppression 4

Favorite Kris Harms APT Quotes (FIRST 2010) • “Compliance is the floor upon which you’re going to fall when you get hacked.” • “Today a B [grade] is not good enough.” • “Do not get in a battle over knowledge of Windows with an intruder. You will lose.” • “Lesley Stahl, I pwn your wireless.” http://www.cbsnews.com/video/watch/?id=3538299n 5

Page 1 and 2: CIRT-Level Response to Advanced Per
Page 3: • You are an APT victim. • You
Page 7 and 8: First Day after D-Zero • Switch t
Page 9 and 10: • Determine incident scope. First
Page 11 and 12: • Create Red-Blue Team. Second Ye
Page 13 and 14: Incident Response Center Incident H
Page 15 and 16: Company General Electric Aerospace
Page 17: Questions? Richard Bejtlich richard

CIRT-Level Response to Advanced Persistent Threat - SANS ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?