The Roundup: Blue Team

Abstract: In 2020, a group of 15 security professional released the Threat Modeling Manifesto. Learn from one of the authors about how to break with the complex models and return to the values and principles of what threat modeling should be. Discover how this often-over-looked activity can actually make development pipelines more efficient while improving overall security of software. Get real practical examples of how you can use the manifesto as a guide to define or tailor a methodology that fits your needs and avoid common pitfalls that often derail this critical activity.

Abstract: Proactiveness has no bounds. This is especially true in a Security Operation Center (SOC), where analysts armed with processes and technologies collaborate to reduce the likelihood of a breach or minimize its impact. All three of these facets (People, Process, Technology) are essential to maintaining a healthy and proactive SOC. But how do we ensure analysts are able to respond to adversarial activity? That our procedures are current or applicable? Or that the tools we invest time and money in are actually doing what they say they’re supposed to do? Prudent SOC analysts don’t wait for attacks to answer these questions.

Learn how to take your preparational steps to the next level. In this talk, I’ll discuss ways to build and improve upon the most important phase of the Incident Response Lifecycle – Phase 0: Preparation. I’ll explore some of the pitfalls that an Incident Response team is likely to face and examine techniques to identify and remediate the chinks in the armor before it’s too late. I will cover useful methods for getting more value out of the resources you already have in place as well as share some ideas that facilitate an atmosphere where SOC analysts are excited to come to work!

Abstract: Most analysts are strapped for time, with too many alerts and too many dashboards to survey to find critical incident details. How and when can host-based artifact and memory analysis help? Let’s jump into real-world use cases where digging into file system and OS artifacts as well as findings from memory can propel an investigation! We’ll pivot from initial detection into host triage analysis to discern attackers’ discovery and defense evasion techniques and generate high-fidelity detections.

Abstract: Securing Windows environments is a never-ending task, especially with all the users that “need” administrator privileges. As a defender, we are entrusted to secure the environments that we manage and to protect them from compromise. This task is always changing and is never complete. Together we will cover common challenges such as detecting unauthorized local group memberships on Windows OS, Windows local admin password management, admin user credential hygiene, and the danger of weak password policies. I will provide you with techniques that can be used to help with these challenges. Defense in depth is not only a cliché but a practical method of limiting damage as much as possible in the eventual likelihood of an incident.

Abstract: Vulnerability management (VM) programs used to be simple scans on a company’s network which would enumerate outdated software/OS versions and open ports and even detect rogue assets the company was unaware of. Today, however, companies computing needs and methods have evolved and so must VM programs if they hope to address expanding threats to organizations that network scans cannot perceive. System hardening, code dependencies, container images, cloud storage permissions, SaaS applications, and third-party hosting providers represent a whole new world of opportunity and therefore vulnerability to your organization. Being able to process data from these areas and prioritize efforts for remediation with measurable reduction to the organization’s risk profile should be considered the “new norm” when it comes to vulnerability management.

This talk will explore building a vulnerability management program from the ground up to address these areas, including the nontechnical work of governance and coalition building to accomplish one’s VM goals.

It’s time to patch our VM programs!