Blue Team Tactics and Techniques – PSW #631
It's often said that attackers need only to get it right once, where defenders have to be right all of the time. Those of us who have worked in a security role as a defender know we don't always get it right, in fact, there are often many exposures in our defenses. This segment will aim to help defenders learn tactics and techniques that are effective and try to answer some of the following questions:
- How do you prioritize your defensive efforts?
- How do you best detect attacks?
- How do you best protect against attacks?
- We always say "patch your stuff" but how often should you patch? Which systems should you patch?
- What techniques work best to defend against email phishing?
- How do you provide a "good enough" level of security for your Active Directory?
- What are the fundamentals of defense? How do they differ per environment and organization?
- How do you get management to buy-in to your security plans and spending?
Guests
An industry leader in cyber defense strategy, with over 18 years of experience in both technical and executive cyber security roles. Bill has devoted my career to building and protecting critical infrastructure and Fortune 100 companies from advanced threats. Bill has direct experience from ‘hands on keyboard’ from being on the front lines, and in-depth understanding of the challenges security teams are faced with.
Recognized as an influential figure in the industry, I have established a prominent public profile through my strong public speaking abilities. As a keynote presenter at prestigious events such as BlackHat and DEF CON, I have effectively communicated complex cybersecurity concepts to large audiences, showcasing my expertise and thought leadership.
Bill is a big believer in “be nice” even when things get tough and “the harder you work, the luckier you get.” If you really want to get on my good side, show me something you made. 🙂
Chris CEO of HypaSec. Previously, Chris headed the Information Protection Group, NOC, SOC and joint-international intelligence team for the Aramco family. Helping to recover Aramco from a nation-state attack, implementing digital security and reconnecting international business operations. Responsible for all digital IT and ICS assets throughout the EMEA region (minus KSA) and Latin America. Subsequently, establishing and assisting global digital security teams, standards, security-driven legal contracts for secure software development with third parties, the Aramco EU/UK Privacy group with internal and external counsel and computer emergency response teams. Chris has practical and strategic hands-on experience in several cyber warfare incidents. USAF Space Command, detecting and helping to halt the July 2009 Second Wave attacks from the DPKR against South Korea and helping to recover and re-establish international business operations after the world’s most devastating cyber warfare attack, Shamoon in 2012. Expert advisor and panelist for several governments and parliaments.
Jason has been in the IT industry since the late ’90s and has worked in manufacturing, government, retail, and finance verticals in every IT-related job role imaginable. He is passionate about defending organizations and greatly enjoys creative, unique solutions to complex problems. His favorite past time is trolling the red team and driving them to profanity.
Currently a Senior Security Engineer at AppRiver, LLC., a Zix company, his team is responsible for global network deployments and manages the SecureSurf global DNS infrastructure and SecureTide global spam and virus filtering infrastructure as well as all internal applications. Jim works directly with the CISO helping to bring the Zix compliance standards to AppRiver’s services. He holds the CISSP and CISM certifications in addition to a Bachelor of Science degree with a major in biology from Ursinus College and a Master of Science degree with a major in microbiology from the University of Alabama.
Michael is a Malware Archaeologist, Blue Team defender, Incident Responder and logoholic. Michael developed several Windows logging cheat sheets to help the security industry understand Windows logging, where to start and what to look for. Michael is a primary contributor to the Open Source project ARTHIR. Michael is also co-developer of LOG-MD, a free tool that audits the settings, harvests and reports on malicious Windows log data and malicious system artifacts. Michael also is co-host of the “Brakeing Down Incident Response” BDIR Podcast to education on Incident Response daily tasks. Michael also ran BSides Texas for five years for the Austin, San Antonio, Dallas and Houston cons.
Since 2017, GTA has invested in dozens of cyber start-ups and funds and supported multiple cyber nonprofits and projects. Ron has served on the Board of Directors for a number of GTA’s portfolio companies and has been a steadfast mentor and advisor to many founders. Ron has also supported a variety of cyber nonprofits and think tanks, with both his substantive expertise and through philanthropic funding.
From 2002 to 2016, Ron was the co-founder and CEO of Tenable Network Security. Under Ron’s leadership, Tenable grew to 20,000 customers, raised $300m in venture capital, and grew revenues to $100 million annually; this positioned the company for a successful IPO in 2018, where it was valued at $3 billion.
Prior to founding Tenable, Ron was a cyber industry pioneer. Ron developed Dragon, one of the first commercial network intrusion detection systems, and he also ran risk mitigation for one of the first cloud companies. While serving as a US Air Force officer, Ron deployed network honeypots in the mid 90s for the US Defense Department (DOD) and served as a penetration tester at the National Security Agency (NSA), participating in some of the nation’s first cyber exercises.
For these efforts, Ron received in 2020 both the Northern Virginia Technology Council Cyber Investor of the Year award and the Baltimore Business Journal Power 10 CEO award.
Trent is a seasoned security professional with a distinguished career defending a Tier 1 Network from skillful adversaries. His versatile background in both offense and defense has helped him architect visionary security solutions that are deployed within numerous Fortune 500 Companies. He is an established Security Researcher who has reported vulnerabilities in organizations like Microsoft, Google and Southwest Airlines. He is also the creator of ‘OvRfLoW’ (Microsoft Flow Attack Framework). Trent is a key contributor to Government Cyber Exercises like Cyber Shield and Cyber Storm. He has also built relationships on Threat Intelligence Sharing by speaking at the Network Security Information Exchanges (NSIE,) National Defense Information Sharing and Analysis Center (ND-ISAC) and Multilateral Network Security Information Exchanges (MNSIE.) Trent has worked with industry partners and government agencies to dismantle botnets like “3ve” and “themoon”.
Hosts
