SlideShare una empresa de Scribd logo

Mandiant Incident Response Methodology and Technology

•Descargar como PPTX, PDF•
•
FireEye, Inc.
FireEye, Inc.

This document discusses Mandiant's incident response methodology and technology. It covers their evolution of incident response approaches over time from disk forensics to memory forensics to live response. Mandiant's current approach involves hunting across endpoints and networks using indicators of compromise to identify compromised systems. They deploy network and host sensors to gain visibility and conduct deep analysis using tools like Mandiant Incident Response and Network Traffic Analysis Platform. The document also outlines Mandiant's incident response services and how they help organizations understand risk, identify compromises, and prepare for future incidents.

Tecnología
1 de 43
1© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. Know before others…Do you know the internal signs of a compromise? Methodology, Technology, and Services Stuart Davis, Mandiant Director
2© Mandiant, a FireEye Company. All rights reserved. Agenda  Background: Threat landscape  Methodology : Evolution of Incident Response  Technology : How MANDIANT finds Evil  Services : What MANDIANT can provide
3© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. 3 THREAT LANDSCAPE Evolution of Incident Response
4© Mandiant, a FireEye Company. All rights reserved. 4 It’s a “who,” not a “what” There is a human at a keyboard Highly tailored and customized attacks Targeted specifically at you They are professional, organized and well funded Escalate sophistication of tactics as needed Relentlessly focused on their objective If you kick them out they will return They have specific objectives Their goal is long-term occupation Persistence tools and tactics ensure ongoing access EVOLVING THREAT LANDSCAPE
5© Mandiant, a FireEye Company. All rights reserved. Gain Initial Access Into Target Strengthen Position within Target Steal Valid User Credentials Identify Target Data Package and Steal Target Data Establish Foothold Escalate Privileges Internal Recon Complete Mission Initial Compromise Move Laterally Maintain Presence ANATOMY OF A TARGETED ATTACK 6
6© Mandiant, a FireEye Company. All rights reserved. 6 TIME FROM INITIAL COMPROMISE TO DISCOVERY 416 243 229 205 2011 2012 2013 2014 Source: Mandiant M-Trends 2015 The longest time we detected attackers had been present in the victim’s environment was 2,982 days (over 8 years). Median number of days that threat groups were present on a victim’s network before detection
7© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. METHODOLOGY Evolution of Incident Response
8© Mandiant, a FireEye Company. All rights reserved. History of DFIR (Digital Forensic and Incident Response) Disk Forensics1995 Memory Forensics2005 • Live Response • Network Forensics 2010
9© Mandiant, a FireEye Company. All rights reserved. 1st Generation (1995-) : Disk Forensics  What to analyze - File System: Full Disk / Eventlogs / Prefetch / Registry Hives / Brower History / Scheduled Task / etc.  How to analyze - Shutdown system, Un-mount disk - Connect to Write blocker > Make disk image - Analyze with tools  Tools to use - The Sleuth Kit & Autopsy (Open Source) - Guidance EnCase - AccessData FTK - X-Ways
10© Mandiant, a FireEye Company. All rights reserved. 1st Generation (1995-) : Disk Forensics (cont.)  Pros - Data recover (Carving) - Law Enforcement  Cons - Business impact : Shutdown System - Difficult to collect : Disk Encryption, RAID, NAS, Cloud - Dead artifacts : No Live Data in the memory - Scale : Disk by disk  Cost-effectiveness - 1 disk for 1 week - JPY 1,500,000 / disk - Up to 100 hosts (100 weeks = 2 years?)
11© Mandiant, a FireEye Company. All rights reserved. 2nd Generation (2005-) : Memory Forensics  What to analyze - Memory : Process / Driver / Handles / Network Connection / etc.  How to analyze - Mount external USB or Network Drive - Dump Physical Memory - Analyze with tools  Tools - Volatility (Open Source) - Mandiant Redline (Free)
12© Mandiant, a FireEye Company. All rights reserved. 2nd Generation (2005-) : Memory Forensics (cont.)  Pros - No business impact - Live Data Acquisition  Cons - Limited Raw Disk Access - Scale : Host by host  Cost-effectiveness - 1 memory dump for half week - $8K USD / host (Forensics specialist needed) - Up to 100 hosts (50 weeks = 1 years?)
13© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Live Response  What to analyze - File System, Memory Forensics by remote  How to analyze - Server, Agent base - Execute a job in the Host by Agent and feed back the result to Server - Analyze the result with central tools  Tools - GRR (Open Source) - Guidance EnCase Enterprise - ManTech Active Defense
14© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Live Response (cont.)  Pros - No business impact - Enterprise Scale - Speed  Cons - No proactive detection - Lack of intelligence - Need extensive knowledge  Cost-effectiveness - Per Host License
15© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Network Forensics  What to analyze - Full packet / Session data / Protocol logs / Statistics  How to analyze - Packet Capture - Protocol Parsing - Analyze the result with central tools  Network Forensic Tools - Security Onion (Open Source) - BlueCoat Solera Networks - RSA Security Analytics (NetWitness)
16© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Network Forensics (cont.)  Pros - No business impact - Network Visibility  Cons - No visibility for encrypted traffic - No proactive detection - Lack of intelligence - Need extensive knowledge  Cost-effectiveness - Depends on traffic and storage
17© Mandiant, a FireEye Company. All rights reserved. Traditional Incident Response Process Identify System Collect Data Analyze Data Report
18© Mandiant, a FireEye Company. All rights reserved. Breadcrumb Trail  Incidents rarely have a simple, linear trail of evidence - Multiple “patient zero” hosts - Multiple pivot points for lateral movement - Forensic artifacts disappear over time - Noise from commodity malware
19© Mandiant, a FireEye Company. All rights reserved. CONFIDENTIAL Phishing Campaigns Compromised Hosts Accessed Hosts Hosts with Non- Targeted Malware Scoping Incidents
20© Mandiant, a FireEye Company. All rights reserved. CONFIDENTIAL Phishing Campaigns Compromised Hosts Accessed Hosts ? ? ? Scoping Incidents
21© Mandiant, a FireEye Company. All rights reserved.  Can’t wait for an alarm to go off before investigating  Intelligence driven Hosts & Network Devices Gather Sources of Evidence ? Identify systems of interest, generate new leads Hunting
22© Mandiant, a FireEye Company. All rights reserved. 2 • Red Teaming and Penetration Testing • ICS Security Assessment • Security Program Assessment (SPA) • Response Readiness Assessment (RRA) • Other strategic services • Compromise Assessment (CA) • Incident Response (IR) • Cyber Defense Center Development (CDC) • SOC/CIRT transformation • Incident Response Retainer • Education • Deployment & Integration AM I AT RISK? AM I PREPARED? AM I COMPROMISED? I AM BREACHED! PREPARE FOR FUTURE EVENTS? INCIDENT RESPONSE AND PREPAREDNESS CYCLE
23© Mandiant, a FireEye Company. All rights reserved. AM I PREPARED?AM I AT RISK? AM I COMPROMISED? I AM BREACHED! PREPARE FOR FUTURE EVENTS DIFFERENTIATORS VALUE 2 COMPROMISE ASSESSMENT AM I COMPROMISED? COMPROMISE ASSESSMENT Evaluate your environment for the presence of targeted attacker activity using the same methods and technologies used during our incident investigations OUR APPROACH • Deploy network and host based inspection technology for comprehensiveness, efficiency, and scale • Apply intelligence from prior investigations and our own knowledge of attack group tools, tactics, and procedures to assess your environment • Analyze evidence and anomalous activity to confirm malicious activity • Summarize our findings and provide strategic recommendations based upon our observations during the engagement Understand the health of your network- whether or not you have been breached • Same technology used in all Mandiant investigations for comprehensiveness, efficiency, and scale • Leverage all of our Intel to search for signs of compromise across the environment • Pivot into Incident Response mode if targeted attacker activity is identified
24© Mandiant, a FireEye Company. All rights reserved.
25© Mandiant, a FireEye Company. All rights reserved.
26© Mandiant, a FireEye Company. All rights reserved.
27© Mandiant, a FireEye Company. All rights reserved.
28© Mandiant, a FireEye Company. All rights reserved.
29© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TECHNOLOGY How MANDIANT finds Evil
30© Mandiant, a FireEye Company. All rights reserved. Investigative Cycle  Indicators Of Compromise (IOC)  Host inspection (MIR)  Network analysis (NTAP)  Log analysis (TAP)  Malware reverse engineering  Threat Intelligence Analysis
31© Mandiant, a FireEye Company. All rights reserved. Indicators Of Compromise (IOCs)  Indicator Of Compromise  Way of describing threat data like - Malware - Attacker Methodology - Evidence of compromise or activity  What Is An Indicator? - MD5: Change Frequently - File Names/Directories: Many Reused - Registry Key Values: Many Reused - Services With Wrong Service dll’s: Outliers - IPs and Domain Names: Change Frequently
32© Mandiant, a FireEye Company. All rights reserved. Network : Attacker Monitoring & Forensics  Network visibility  Internet egress points  Decode traffic generated by known malware  Reconstruct command-and-control activity  Recover data theft  Monitor All protocols (full packet capture)
33© Mandiant, a FireEye Company. All rights reserved. Network : Architecture Mandiant VPN tunnel Internet Perimeter Firewall Switch Web Proxy Internal Network Firewall VPN Users Mandiant Mandiant Network Sensor = Network SPAN/TAP Servers, workstations, laptops INTERNAL NETWORK
34© Mandiant, a FireEye Company. All rights reserved. Endpoint : Hunting & Live Response  Host visibility  Agent / controller model  Deploy to all Windows systems in environment  Identify historical evidence of compromise  Search all hosts for IOCs  Conduct deep-dive analysis on systems of interest
35© Mandiant, a FireEye Company. All rights reserved. Endpoint : Architecture MIR Controller #nMIR Controller #1 VPN Users Mandiant Servers, workstations, laptops INTERNAL NETWORK = Mandiant Agent Mutually authenticated SSL
36© Mandiant, a FireEye Company. All rights reserved. Big data : Finding Needle & Analysis  Network, endpoint, application events visibility  Detect with Mandiant Threat Intelligence  Source from Syslog, Windows Event Log, File, ODBC  Communication Broker in customer environment  Cloud-based; all technology managed
37© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TOOLS OF THE TRADE A TEAM of analysts enabled by MIR and NTAP
38© Mandiant, a FireEye Company. All rights reserved. End-point Visibility – Sweeping the Environment
39© Mandiant, a FireEye Company. All rights reserved. Find One. IOC matches are verified by analysts by extracting suspect artifacts from end-points and/or verifying network sensors for corroborating evidence.
40© Mandiant, a FireEye Company. All rights reserved. Find One. Then Find Them All. An initial lead converted to an IOC can yield quick results across the entire estate.
41© Mandiant, a FireEye Company. All rights reserved. Regional Threats Indicators of Compromise (IOC) used during a Compromise Assessment are comprised of information from: • Incident Response engagements • Internal research • Publicly available data • Regional teams input IOCs are updated continuously and can be made client specific.
42© Mandiant, a FireEye Company. All rights reserved. Tracking Attackers With Network Sensors Network sensors enable near real-time detection of threats, capture of identified malicious traffic, and tracking of attacker activity.
43© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TO GAIN MORE INSIGHT WATCH THE WEBINAR HERE

Recomendados

The New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise AssessmentThe New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise AssessmentInfocyte
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterMichael Nickle
 
2022 APIsecure_Monitoring your APIs for Attacks Using SIEM versus XDR
2022 APIsecure_Monitoring your APIs for Attacks Using SIEM versus XDR2022 APIsecure_Monitoring your APIs for Attacks Using SIEM versus XDR
2022 APIsecure_Monitoring your APIs for Attacks Using SIEM versus XDRAPIsecure_ Official
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPrime Infoserv
 
Empower Your Security Practitioners with Elastic SIEM
Empower Your Security Practitioners with Elastic SIEMEmpower Your Security Practitioners with Elastic SIEM
Empower Your Security Practitioners with Elastic SIEMElasticsearch
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)PECB
 
QRadar, ArcSight and Splunk
QRadar, ArcSight and Splunk QRadar, ArcSight and Splunk
QRadar, ArcSight and Splunk M sharifi
 
IBM Security QRadar
IBM Security QRadar IBM Security QRadar
IBM Security QRadarVirginia Fernandez
 

Recomendados

The New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise AssessmentThe New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise AssessmentInfocyte
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterMichael Nickle
 
2022 APIsecure_Monitoring your APIs for Attacks Using SIEM versus XDR
2022 APIsecure_Monitoring your APIs for Attacks Using SIEM versus XDR2022 APIsecure_Monitoring your APIs for Attacks Using SIEM versus XDR
2022 APIsecure_Monitoring your APIs for Attacks Using SIEM versus XDRAPIsecure_ Official
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPrime Infoserv
 
Empower Your Security Practitioners with Elastic SIEM
Empower Your Security Practitioners with Elastic SIEMEmpower Your Security Practitioners with Elastic SIEM
Empower Your Security Practitioners with Elastic SIEMElasticsearch
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)PECB
 
QRadar, ArcSight and Splunk
QRadar, ArcSight and Splunk QRadar, ArcSight and Splunk
QRadar, ArcSight and Splunk M sharifi
 
IBM Security QRadar
IBM Security QRadar IBM Security QRadar
IBM Security QRadarVirginia Fernandez
 
Cloud-Enabled: The Future of Endpoint Security
Cloud-Enabled: The Future of Endpoint SecurityCloud-Enabled: The Future of Endpoint Security
Cloud-Enabled: The Future of Endpoint SecurityCrowdStrike
 
Threat Hunting with Cyber Kill Chain
Threat Hunting with Cyber Kill ChainThreat Hunting with Cyber Kill Chain
Threat Hunting with Cyber Kill ChainSuwitcha Musijaral CISSP,CISA,GWAPT,SNORTCP
 
IBM Security Strategy Overview
IBM Security Strategy OverviewIBM Security Strategy Overview
IBM Security Strategy Overviewxband
 
IBM QRadar Security Intelligence Overview
IBM QRadar Security Intelligence OverviewIBM QRadar Security Intelligence Overview
IBM QRadar Security Intelligence OverviewCamilo Fandiño Gómez
 
Introduction to QRadar
Introduction to QRadarIntroduction to QRadar
Introduction to QRadarPencilData
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh
 
Security operation center
Security operation centerSecurity operation center
Security operation centerMuthuKumaran267
 
Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service Netpluz Asia Pte Ltd
 
Fortinet Corporate Overview Deck.pptx
Fortinet Corporate Overview Deck.pptxFortinet Corporate Overview Deck.pptx
Fortinet Corporate Overview Deck.pptxArianeSpano
 
Cylance Information Security: Compromise Assessment Datasheet
Cylance Information Security: Compromise Assessment DatasheetCylance Information Security: Compromise Assessment Datasheet
Cylance Information Security: Compromise Assessment DatasheetInnovation Network Technologies: InNet
 
IBM QRadar UBA
IBM QRadar UBA IBM QRadar UBA
IBM QRadar UBA IBM Security
 
Effective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza AdinehEffective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza AdinehReZa AdineH
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Sqrrl
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
State of the ATTACK
State of the ATTACKState of the ATTACK
State of the ATTACKMITRE - ATT&CKcon
 
Governance of security operation centers
Governance of security operation centersGovernance of security operation centers
Governance of security operation centersBrencil Kaimba
 
Security Operations, MITRE ATT&CK, SOC Roles / Competencies
Security Operations, MITRE ATT&CK, SOC Roles / Competencies Security Operations, MITRE ATT&CK, SOC Roles / Competencies
Security Operations, MITRE ATT&CK, SOC Roles / Competencies Harry McLaren
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)Ahmed Ayman
 
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansChristopher Korban
 
Crack the Code
Crack the CodeCrack the Code
Crack the CodeInnoTech
 

Más contenido relacionado

La actualidad más candente

Cloud-Enabled: The Future of Endpoint Security
Cloud-Enabled: The Future of Endpoint SecurityCloud-Enabled: The Future of Endpoint Security
Cloud-Enabled: The Future of Endpoint SecurityCrowdStrike
 
IBM Security Strategy Overview
IBM Security Strategy OverviewIBM Security Strategy Overview
IBM Security Strategy Overviewxband
 
IBM QRadar Security Intelligence Overview
IBM QRadar Security Intelligence OverviewIBM QRadar Security Intelligence Overview
IBM QRadar Security Intelligence OverviewCamilo Fandiño Gómez
 
Introduction to QRadar
Introduction to QRadarIntroduction to QRadar
Introduction to QRadarPencilData
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh
 
Security operation center
Security operation centerSecurity operation center
Security operation centerMuthuKumaran267
 
Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service Netpluz Asia Pte Ltd
 
Fortinet Corporate Overview Deck.pptx
Fortinet Corporate Overview Deck.pptxFortinet Corporate Overview Deck.pptx
Fortinet Corporate Overview Deck.pptxArianeSpano
 
Effective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza AdinehEffective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza AdinehReZa AdineH
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Sqrrl
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
Governance of security operation centers
Governance of security operation centersGovernance of security operation centers
Governance of security operation centersBrencil Kaimba
 
Security Operations, MITRE ATT&CK, SOC Roles / Competencies
Security Operations, MITRE ATT&CK, SOC Roles / Competencies Security Operations, MITRE ATT&CK, SOC Roles / Competencies
Security Operations, MITRE ATT&CK, SOC Roles / Competencies Harry McLaren
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)Ahmed Ayman
 

La actualidad más candente (20)

Cloud-Enabled: The Future of Endpoint Security
Cloud-Enabled: The Future of Endpoint SecurityCloud-Enabled: The Future of Endpoint Security
Cloud-Enabled: The Future of Endpoint Security
 
Threat Hunting with Cyber Kill Chain
Threat Hunting with Cyber Kill ChainThreat Hunting with Cyber Kill Chain
Threat Hunting with Cyber Kill Chain
 
IBM Security Strategy Overview
IBM Security Strategy OverviewIBM Security Strategy Overview
IBM Security Strategy Overview
 
IBM QRadar Security Intelligence Overview
IBM QRadar Security Intelligence OverviewIBM QRadar Security Intelligence Overview
IBM QRadar Security Intelligence Overview
 
Introduction to QRadar
Introduction to QRadarIntroduction to QRadar
Introduction to QRadar
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)
 
Security operation center
Security operation centerSecurity operation center
Security operation center
 
Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service
 
Fortinet Corporate Overview Deck.pptx
Fortinet Corporate Overview Deck.pptxFortinet Corporate Overview Deck.pptx
Fortinet Corporate Overview Deck.pptx
 
Cylance Information Security: Compromise Assessment Datasheet
Cylance Information Security: Compromise Assessment DatasheetCylance Information Security: Compromise Assessment Datasheet
Cylance Information Security: Compromise Assessment Datasheet
 
IBM QRadar UBA
IBM QRadar UBA IBM QRadar UBA
IBM QRadar UBA
 
Effective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza AdinehEffective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza Adineh
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formal
 
State of the ATTACK
State of the ATTACKState of the ATTACK
State of the ATTACK
 
Governance of security operation centers
Governance of security operation centersGovernance of security operation centers
Governance of security operation centers
 
Security Operations, MITRE ATT&CK, SOC Roles / Competencies
Security Operations, MITRE ATT&CK, SOC Roles / Competencies Security Operations, MITRE ATT&CK, SOC Roles / Competencies
Security Operations, MITRE ATT&CK, SOC Roles / Competencies
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
 

Similar a Mandiant Incident Response Methodology and Technology

Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansChristopher Korban
 
Crack the Code
Crack the CodeCrack the Code
Crack the CodeInnoTech
 
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoBSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoKatie Nickels
 
ICS Network Security Monitoring (NSM)
ICS Network Security Monitoring (NSM)ICS Network Security Monitoring (NSM)
ICS Network Security Monitoring (NSM)Digital Bond
 
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec
 
Big Data Analytics to Enhance Security
Big Data Analytics to Enhance SecurityBig Data Analytics to Enhance Security
Big Data Analytics to Enhance SecurityData Science Thailand
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™Katie Nickels
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 
The Cyber Security Landscape: An OurCrowd Briefing for Investors
The Cyber Security Landscape: An OurCrowd Briefing for InvestorsThe Cyber Security Landscape: An OurCrowd Briefing for Investors
The Cyber Security Landscape: An OurCrowd Briefing for InvestorsOurCrowd
 
WHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingWHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingAPNIC
 
[CLASS 2014] Palestra Técnica - Fabio Rosa
[CLASS 2014] Palestra Técnica - Fabio Rosa[CLASS 2014] Palestra Técnica - Fabio Rosa
[CLASS 2014] Palestra Técnica - Fabio RosaTI Safe
 
Security Breakout Session
Security Breakout Session Security Breakout Session
Security Breakout Session Splunk
 
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...MohamedOmerMusa
 
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced Threats
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced ThreatsGood Guys vs Bad Guys: Using Big Data to Counteract Advanced Threats
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced ThreatsZivaro Inc
 
Računalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidenteRačunalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidenteDamir Delija
 
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...Symantec
 
Cyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APTCyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APTSimone Onofri
 
Grid Analytics Europe 2016: "Defend the Grid", April 2016
Grid Analytics Europe 2016: "Defend the Grid", April 2016Grid Analytics Europe 2016: "Defend the Grid", April 2016
Grid Analytics Europe 2016: "Defend the Grid", April 2016OMNETRIC
 

Similar a Mandiant Incident Response Methodology and Technology (20)

Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
 
Crack the Code
Crack the CodeCrack the Code
Crack the Code
 
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoBSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
 
ICS Network Security Monitoring (NSM)
ICS Network Security Monitoring (NSM)ICS Network Security Monitoring (NSM)
ICS Network Security Monitoring (NSM)
 
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
 
Big Data Analytics to Enhance Security
Big Data Analytics to Enhance SecurityBig Data Analytics to Enhance Security
Big Data Analytics to Enhance Security
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
 
The Cyber Security Landscape: An OurCrowd Briefing for Investors
The Cyber Security Landscape: An OurCrowd Briefing for InvestorsThe Cyber Security Landscape: An OurCrowd Briefing for Investors
The Cyber Security Landscape: An OurCrowd Briefing for Investors
 
WHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingWHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & Handling
 
[CLASS 2014] Palestra Técnica - Fabio Rosa
[CLASS 2014] Palestra Técnica - Fabio Rosa[CLASS 2014] Palestra Técnica - Fabio Rosa
[CLASS 2014] Palestra Técnica - Fabio Rosa
 
Security Breakout Session
Security Breakout Session Security Breakout Session
Security Breakout Session
 
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
 
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced Threats
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced ThreatsGood Guys vs Bad Guys: Using Big Data to Counteract Advanced Threats
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced Threats
 
Red Team P1.pdf
Red Team P1.pdfRed Team P1.pdf
Red Team P1.pdf
 
Računalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidenteRačunalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidente
 
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...
 
Hacking3e ppt ch06
Hacking3e ppt ch06Hacking3e ppt ch06
Hacking3e ppt ch06
 
Cyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APTCyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APT
 
Grid Analytics Europe 2016: "Defend the Grid", April 2016
Grid Analytics Europe 2016: "Defend the Grid", April 2016Grid Analytics Europe 2016: "Defend the Grid", April 2016
Grid Analytics Europe 2016: "Defend the Grid", April 2016
 

Más de FireEye, Inc.

Asia Pacific & The Security Gap: Don't Stand Still
Asia Pacific & The Security Gap: Don't Stand StillAsia Pacific & The Security Gap: Don't Stand Still
Asia Pacific & The Security Gap: Don't Stand StillFireEye, Inc.
 
EMEA & The Security Gap: Don't Stand Still
EMEA & The Security Gap: Don't Stand StillEMEA & The Security Gap: Don't Stand Still
EMEA & The Security Gap: Don't Stand StillFireEye, Inc.
 
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...FireEye, Inc.
 
M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点FireEye, Inc.
 
[Infographic] Healthcare Cyber Security: Threat Prognosis
[Infographic] Healthcare Cyber Security: Threat Prognosis[Infographic] Healthcare Cyber Security: Threat Prognosis
[Infographic] Healthcare Cyber Security: Threat PrognosisFireEye, Inc.
 
[Infographic] Email: The First Security Gap Targeted by Attackers
[Infographic] Email: The First Security Gap Targeted by Attackers[Infographic] Email: The First Security Gap Targeted by Attackers
[Infographic] Email: The First Security Gap Targeted by AttackersFireEye, Inc.
 
M-Trends 2015: 최일선에서 본 관점
M-Trends 2015: 최일선에서 본 관점 M-Trends 2015: 최일선에서 본 관점
M-Trends 2015: 최일선에서 본 관점 FireEye, Inc.
 
M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点FireEye, Inc.
 
M-Trends 2015 : Les nouvelles du front
M-Trends 2015 : Les nouvelles du frontM-Trends 2015 : Les nouvelles du front
M-Trends 2015 : Les nouvelles du frontFireEye, Inc.
 
5 Reasons Cyber Attackers Target Small and Medium Businesses
5 Reasons Cyber Attackers Target Small and Medium Businesses 5 Reasons Cyber Attackers Target Small and Medium Businesses
5 Reasons Cyber Attackers Target Small and Medium Businesses FireEye, Inc.
 
Connected Cares: The Open Road For Hackers
Connected Cares: The Open Road For HackersConnected Cares: The Open Road For Hackers
Connected Cares: The Open Road For HackersFireEye, Inc.
 
M-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security GapM-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security GapFireEye, Inc.
 
M-Trends® 2012: An Evolving Threat
M-Trends® 2012: An Evolving Threat M-Trends® 2012: An Evolving Threat
M-Trends® 2012: An Evolving Threat FireEye, Inc.
 
M-Trends® 2011: When Prevention Fails
M-Trends® 2011: When Prevention Fails M-Trends® 2011: When Prevention Fails
M-Trends® 2011: When Prevention Fails FireEye, Inc.
 
M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent ThreatFireEye, Inc.
 
SANS 2013 Report: Digital Forensics and Incident Response Survey
SANS 2013 Report: Digital Forensics and Incident Response Survey SANS 2013 Report: Digital Forensics and Incident Response Survey
SANS 2013 Report: Digital Forensics and Incident Response Survey FireEye, Inc.
 
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...FireEye, Inc.
 
2013 Incident Response Survey
2013 Incident Response Survey2013 Incident Response Survey
2013 Incident Response SurveyFireEye, Inc.
 
The Board and Cyber Security
The Board and Cyber SecurityThe Board and Cyber Security
The Board and Cyber SecurityFireEye, Inc.
 
FireEye Cyber Defense Summit 2016 Now What - Before & After The Breach
FireEye Cyber Defense Summit 2016 Now What - Before & After The BreachFireEye Cyber Defense Summit 2016 Now What - Before & After The Breach
FireEye Cyber Defense Summit 2016 Now What - Before & After The BreachFireEye, Inc.
 

Más de FireEye, Inc. (20)

Asia Pacific & The Security Gap: Don't Stand Still
Asia Pacific & The Security Gap: Don't Stand StillAsia Pacific & The Security Gap: Don't Stand Still
Asia Pacific & The Security Gap: Don't Stand Still
 
EMEA & The Security Gap: Don't Stand Still
EMEA & The Security Gap: Don't Stand StillEMEA & The Security Gap: Don't Stand Still
EMEA & The Security Gap: Don't Stand Still
 
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...
 
M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点
 
[Infographic] Healthcare Cyber Security: Threat Prognosis
[Infographic] Healthcare Cyber Security: Threat Prognosis[Infographic] Healthcare Cyber Security: Threat Prognosis
[Infographic] Healthcare Cyber Security: Threat Prognosis
 
[Infographic] Email: The First Security Gap Targeted by Attackers
[Infographic] Email: The First Security Gap Targeted by Attackers[Infographic] Email: The First Security Gap Targeted by Attackers
[Infographic] Email: The First Security Gap Targeted by Attackers
 
M-Trends 2015: 최일선에서 본 관점
M-Trends 2015: 최일선에서 본 관점 M-Trends 2015: 최일선에서 본 관점
M-Trends 2015: 최일선에서 본 관점
 
M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点
 
M-Trends 2015 : Les nouvelles du front
M-Trends 2015 : Les nouvelles du frontM-Trends 2015 : Les nouvelles du front
M-Trends 2015 : Les nouvelles du front
 
5 Reasons Cyber Attackers Target Small and Medium Businesses
5 Reasons Cyber Attackers Target Small and Medium Businesses 5 Reasons Cyber Attackers Target Small and Medium Businesses
5 Reasons Cyber Attackers Target Small and Medium Businesses
 
Connected Cares: The Open Road For Hackers
Connected Cares: The Open Road For HackersConnected Cares: The Open Road For Hackers
Connected Cares: The Open Road For Hackers
 
M-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security GapM-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security Gap
 
M-Trends® 2012: An Evolving Threat
M-Trends® 2012: An Evolving Threat M-Trends® 2012: An Evolving Threat
M-Trends® 2012: An Evolving Threat
 
M-Trends® 2011: When Prevention Fails
M-Trends® 2011: When Prevention Fails M-Trends® 2011: When Prevention Fails
M-Trends® 2011: When Prevention Fails
 
M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat
 
SANS 2013 Report: Digital Forensics and Incident Response Survey
SANS 2013 Report: Digital Forensics and Incident Response Survey SANS 2013 Report: Digital Forensics and Incident Response Survey
SANS 2013 Report: Digital Forensics and Incident Response Survey
 
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...
 
2013 Incident Response Survey
2013 Incident Response Survey2013 Incident Response Survey
2013 Incident Response Survey
 
The Board and Cyber Security
The Board and Cyber SecurityThe Board and Cyber Security
The Board and Cyber Security
 
FireEye Cyber Defense Summit 2016 Now What - Before & After The Breach
FireEye Cyber Defense Summit 2016 Now What - Before & After The BreachFireEye Cyber Defense Summit 2016 Now What - Before & After The Breach
FireEye Cyber Defense Summit 2016 Now What - Before & After The Breach
 

Último

Manual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance AuditManual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance AuditSkynet Technologies
 
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentEmixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentPim van der Noll
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxLoriGlavin3
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxLoriGlavin3
 
Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rick Flair
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3
 
Data governance with Unity Catalog Presentation
Data governance with Unity Catalog PresentationData governance with Unity Catalog Presentation
Data governance with Unity Catalog PresentationKnoldus Inc.
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesThousandEyes
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesKari Kakkonen
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxLoriGlavin3
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersNicole Novielli
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfSo einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfpanagenda
 
Generative Artificial Intelligence: How generative AI works.pdf
Generative Artificial Intelligence: How generative AI works.pdfGenerative Artificial Intelligence: How generative AI works.pdf
Generative Artificial Intelligence: How generative AI works.pdfIngrid Airi González
 
Connecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfConnecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfNeo4j
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPathCommunity
 
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...AliaaTarek5
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteDianaGray10
 
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...panagenda
 

Último (20)

Manual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance AuditManual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance Audit
 
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentEmixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
 
Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
 
Data governance with Unity Catalog Presentation
Data governance with Unity Catalog PresentationData governance with Unity Catalog Presentation
Data governance with Unity Catalog Presentation
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examples
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptx
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software Developers
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfSo einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
 
Generative Artificial Intelligence: How generative AI works.pdf
Generative Artificial Intelligence: How generative AI works.pdfGenerative Artificial Intelligence: How generative AI works.pdf
Generative Artificial Intelligence: How generative AI works.pdf
 
Connecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfConnecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdf
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to Hero
 
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test Suite
 
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
 

Mandiant Incident Response Methodology and Technology

  • 1. 1© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. Know before others…Do you know the internal signs of a compromise? Methodology, Technology, and Services Stuart Davis, Mandiant Director
  • 2. 2© Mandiant, a FireEye Company. All rights reserved. Agenda  Background: Threat landscape  Methodology : Evolution of Incident Response  Technology : How MANDIANT finds Evil  Services : What MANDIANT can provide
  • 3. 3© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. 3 THREAT LANDSCAPE Evolution of Incident Response
  • 4. 4© Mandiant, a FireEye Company. All rights reserved. 4 It’s a “who,” not a “what” There is a human at a keyboard Highly tailored and customized attacks Targeted specifically at you They are professional, organized and well funded Escalate sophistication of tactics as needed Relentlessly focused on their objective If you kick them out they will return They have specific objectives Their goal is long-term occupation Persistence tools and tactics ensure ongoing access EVOLVING THREAT LANDSCAPE
  • 5. 5© Mandiant, a FireEye Company. All rights reserved. Gain Initial Access Into Target Strengthen Position within Target Steal Valid User Credentials Identify Target Data Package and Steal Target Data Establish Foothold Escalate Privileges Internal Recon Complete Mission Initial Compromise Move Laterally Maintain Presence ANATOMY OF A TARGETED ATTACK 6
  • 6. 6© Mandiant, a FireEye Company. All rights reserved. 6 TIME FROM INITIAL COMPROMISE TO DISCOVERY 416 243 229 205 2011 2012 2013 2014 Source: Mandiant M-Trends 2015 The longest time we detected attackers had been present in the victim’s environment was 2,982 days (over 8 years). Median number of days that threat groups were present on a victim’s network before detection
  • 7. 7© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. METHODOLOGY Evolution of Incident Response
  • 8. 8© Mandiant, a FireEye Company. All rights reserved. History of DFIR (Digital Forensic and Incident Response) Disk Forensics1995 Memory Forensics2005 • Live Response • Network Forensics 2010
  • 9. 9© Mandiant, a FireEye Company. All rights reserved. 1st Generation (1995-) : Disk Forensics  What to analyze - File System: Full Disk / Eventlogs / Prefetch / Registry Hives / Brower History / Scheduled Task / etc.  How to analyze - Shutdown system, Un-mount disk - Connect to Write blocker > Make disk image - Analyze with tools  Tools to use - The Sleuth Kit & Autopsy (Open Source) - Guidance EnCase - AccessData FTK - X-Ways
  • 10. 10© Mandiant, a FireEye Company. All rights reserved. 1st Generation (1995-) : Disk Forensics (cont.)  Pros - Data recover (Carving) - Law Enforcement  Cons - Business impact : Shutdown System - Difficult to collect : Disk Encryption, RAID, NAS, Cloud - Dead artifacts : No Live Data in the memory - Scale : Disk by disk  Cost-effectiveness - 1 disk for 1 week - JPY 1,500,000 / disk - Up to 100 hosts (100 weeks = 2 years?)
  • 11. 11© Mandiant, a FireEye Company. All rights reserved. 2nd Generation (2005-) : Memory Forensics  What to analyze - Memory : Process / Driver / Handles / Network Connection / etc.  How to analyze - Mount external USB or Network Drive - Dump Physical Memory - Analyze with tools  Tools - Volatility (Open Source) - Mandiant Redline (Free)
  • 12. 12© Mandiant, a FireEye Company. All rights reserved. 2nd Generation (2005-) : Memory Forensics (cont.)  Pros - No business impact - Live Data Acquisition  Cons - Limited Raw Disk Access - Scale : Host by host  Cost-effectiveness - 1 memory dump for half week - $8K USD / host (Forensics specialist needed) - Up to 100 hosts (50 weeks = 1 years?)
  • 13. 13© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Live Response  What to analyze - File System, Memory Forensics by remote  How to analyze - Server, Agent base - Execute a job in the Host by Agent and feed back the result to Server - Analyze the result with central tools  Tools - GRR (Open Source) - Guidance EnCase Enterprise - ManTech Active Defense
  • 14. 14© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Live Response (cont.)  Pros - No business impact - Enterprise Scale - Speed  Cons - No proactive detection - Lack of intelligence - Need extensive knowledge  Cost-effectiveness - Per Host License
  • 15. 15© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Network Forensics  What to analyze - Full packet / Session data / Protocol logs / Statistics  How to analyze - Packet Capture - Protocol Parsing - Analyze the result with central tools  Network Forensic Tools - Security Onion (Open Source) - BlueCoat Solera Networks - RSA Security Analytics (NetWitness)
  • 16. 16© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Network Forensics (cont.)  Pros - No business impact - Network Visibility  Cons - No visibility for encrypted traffic - No proactive detection - Lack of intelligence - Need extensive knowledge  Cost-effectiveness - Depends on traffic and storage
  • 17. 17© Mandiant, a FireEye Company. All rights reserved. Traditional Incident Response Process Identify System Collect Data Analyze Data Report
  • 18. 18© Mandiant, a FireEye Company. All rights reserved. Breadcrumb Trail  Incidents rarely have a simple, linear trail of evidence - Multiple “patient zero” hosts - Multiple pivot points for lateral movement - Forensic artifacts disappear over time - Noise from commodity malware
  • 19. 19© Mandiant, a FireEye Company. All rights reserved. CONFIDENTIAL Phishing Campaigns Compromised Hosts Accessed Hosts Hosts with Non- Targeted Malware Scoping Incidents
  • 20. 20© Mandiant, a FireEye Company. All rights reserved. CONFIDENTIAL Phishing Campaigns Compromised Hosts Accessed Hosts ? ? ? Scoping Incidents
  • 21. 21© Mandiant, a FireEye Company. All rights reserved.  Can’t wait for an alarm to go off before investigating  Intelligence driven Hosts & Network Devices Gather Sources of Evidence ? Identify systems of interest, generate new leads Hunting
  • 22. 22© Mandiant, a FireEye Company. All rights reserved. 2 • Red Teaming and Penetration Testing • ICS Security Assessment • Security Program Assessment (SPA) • Response Readiness Assessment (RRA) • Other strategic services • Compromise Assessment (CA) • Incident Response (IR) • Cyber Defense Center Development (CDC) • SOC/CIRT transformation • Incident Response Retainer • Education • Deployment & Integration AM I AT RISK? AM I PREPARED? AM I COMPROMISED? I AM BREACHED! PREPARE FOR FUTURE EVENTS? INCIDENT RESPONSE AND PREPAREDNESS CYCLE
  • 23. 23© Mandiant, a FireEye Company. All rights reserved. AM I PREPARED?AM I AT RISK? AM I COMPROMISED? I AM BREACHED! PREPARE FOR FUTURE EVENTS DIFFERENTIATORS VALUE 2 COMPROMISE ASSESSMENT AM I COMPROMISED? COMPROMISE ASSESSMENT Evaluate your environment for the presence of targeted attacker activity using the same methods and technologies used during our incident investigations OUR APPROACH • Deploy network and host based inspection technology for comprehensiveness, efficiency, and scale • Apply intelligence from prior investigations and our own knowledge of attack group tools, tactics, and procedures to assess your environment • Analyze evidence and anomalous activity to confirm malicious activity • Summarize our findings and provide strategic recommendations based upon our observations during the engagement Understand the health of your network- whether or not you have been breached • Same technology used in all Mandiant investigations for comprehensiveness, efficiency, and scale • Leverage all of our Intel to search for signs of compromise across the environment • Pivot into Incident Response mode if targeted attacker activity is identified
  • 24. 24© Mandiant, a FireEye Company. All rights reserved.
  • 25. 25© Mandiant, a FireEye Company. All rights reserved.
  • 26. 26© Mandiant, a FireEye Company. All rights reserved.
  • 27. 27© Mandiant, a FireEye Company. All rights reserved.
  • 28. 28© Mandiant, a FireEye Company. All rights reserved.
  • 29. 29© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TECHNOLOGY How MANDIANT finds Evil
  • 30. 30© Mandiant, a FireEye Company. All rights reserved. Investigative Cycle  Indicators Of Compromise (IOC)  Host inspection (MIR)  Network analysis (NTAP)  Log analysis (TAP)  Malware reverse engineering  Threat Intelligence Analysis
  • 31. 31© Mandiant, a FireEye Company. All rights reserved. Indicators Of Compromise (IOCs)  Indicator Of Compromise  Way of describing threat data like - Malware - Attacker Methodology - Evidence of compromise or activity  What Is An Indicator? - MD5: Change Frequently - File Names/Directories: Many Reused - Registry Key Values: Many Reused - Services With Wrong Service dll’s: Outliers - IPs and Domain Names: Change Frequently
  • 32. 32© Mandiant, a FireEye Company. All rights reserved. Network : Attacker Monitoring & Forensics  Network visibility  Internet egress points  Decode traffic generated by known malware  Reconstruct command-and-control activity  Recover data theft  Monitor All protocols (full packet capture)
  • 33. 33© Mandiant, a FireEye Company. All rights reserved. Network : Architecture Mandiant VPN tunnel Internet Perimeter Firewall Switch Web Proxy Internal Network Firewall VPN Users Mandiant Mandiant Network Sensor = Network SPAN/TAP Servers, workstations, laptops INTERNAL NETWORK
  • 34. 34© Mandiant, a FireEye Company. All rights reserved. Endpoint : Hunting & Live Response  Host visibility  Agent / controller model  Deploy to all Windows systems in environment  Identify historical evidence of compromise  Search all hosts for IOCs  Conduct deep-dive analysis on systems of interest
  • 35. 35© Mandiant, a FireEye Company. All rights reserved. Endpoint : Architecture MIR Controller #nMIR Controller #1 VPN Users Mandiant Servers, workstations, laptops INTERNAL NETWORK = Mandiant Agent Mutually authenticated SSL
  • 36. 36© Mandiant, a FireEye Company. All rights reserved. Big data : Finding Needle & Analysis  Network, endpoint, application events visibility  Detect with Mandiant Threat Intelligence  Source from Syslog, Windows Event Log, File, ODBC  Communication Broker in customer environment  Cloud-based; all technology managed
  • 37. 37© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TOOLS OF THE TRADE A TEAM of analysts enabled by MIR and NTAP
  • 38. 38© Mandiant, a FireEye Company. All rights reserved. End-point Visibility – Sweeping the Environment
  • 39. 39© Mandiant, a FireEye Company. All rights reserved. Find One. IOC matches are verified by analysts by extracting suspect artifacts from end-points and/or verifying network sensors for corroborating evidence.
  • 40. 40© Mandiant, a FireEye Company. All rights reserved. Find One. Then Find Them All. An initial lead converted to an IOC can yield quick results across the entire estate.
  • 41. 41© Mandiant, a FireEye Company. All rights reserved. Regional Threats Indicators of Compromise (IOC) used during a Compromise Assessment are comprised of information from: • Incident Response engagements • Internal research • Publicly available data • Regional teams input IOCs are updated continuously and can be made client specific.
  • 42. 42© Mandiant, a FireEye Company. All rights reserved. Tracking Attackers With Network Sensors Network sensors enable near real-time detection of threats, capture of identified malicious traffic, and tracking of attacker activity.
  • 43. 43© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TO GAIN MORE INSIGHT WATCH THE WEBINAR HERE

Notas del editor

  1. Key Points: There are 7 major phases to a targeted attack. 1. The initial compromise typically begins with a victim clicking on a link or attachment in a spear phishing e-mail. 2. After the initial compromise the attacker creates back doors and establishes a foothold in the environment. 3. Very quickly the attacker steals valid credentials. At this point they blend in and it’s difficult to tell them apart from legitimate users. 4. Now the attacker begins to survey the network to identify the data they are trying to steal. 5. As they perform reconnaissance, they move laterally to other parts of the network in search of their target data. 6. As they move laterally they deploy additional backdoors and persistence mechanisms 7. Once they have identified their target data they package it up and steal it. I mentioned before that the attackers’ objectives are long-term occupation. The typical organization Mandiant responded to in the last year had been compromised an average of 229 days.
  2. In 1984 the FBI launched a Computer Analysis and Response In 1987 FTK founded in 1997 Guidance founded In 1998 EnCase launched In 2004, Michael Ford introduced memory forensics into security investigations with an article in SysAdmin Magazine. In 2005, DFRWS issued a Memory Analysis Forensics Challenge.
  3. Talk about scoping, DO NOT TALK ABOUT SYSTEMS WITH TOOLS, BACKDOORS, ACCESSED ETC NOT BEING THE SAME.
  4. Talk about scoping, DO NOT TALK ABOUT SYSTEMS WITH TOOLS, BACKDOORS, ACCESSED ETC NOT BEING THE SAME.
  5. May not find everything Will find more
  6. This slide represents the incident response and preparedness cycle. It captures our core mission and summarizes everything Mandiant consulting does by mapping it against the different phases and stages our clients go through. It highlights the completeness of our portfolio while showing how everything we do ties back to our core capabilities around IR. It highlights how organization continuously need to ask them selves questions such as Am I prepared? Am I compromised as the threat landscape continues to evolve. Given this rapidly evolving threat landscape, organizations require a trusted party to assist with the different stages of the IR and preparedness cycle. We provide organizations peace of mind in helping them protect their most critical assets, reducing cost in case of an incident and reducing risk of a future incident. We provide them with a deep understanding of attacker behavior, exceptional visibility in the rapidly evolving threat landscape and the technology to respond and defend with speed, scale, and efficiency.
  7. Answers the question – “am I compromised?” Grants companies access to Mandiant’s premier investigative consultants and FireEye’s technology and intelligence. Organizations should ideally have a compromise assessment performed on their environment yearly. Some companies choose to have compromise assessments performed on all companies they acquire or merge with prior to connecting the environments. Other companies choose to have a compromise assessment performed because a breach in their business sector (i.e. government, retail, financial, healthcare, mining, etc) made headlines. Companies naturally want to be proactive in detecting and remediating issues in their environment – compromise assessments help them be proactive. A compromise assessment can be though of as a light incident investigation – the tools, intelligence, and many of the tactics are the same. We deploy the same tools and technology as we normally would deploy but we deploy in an environment that which we have no prior knowledge of if they are actually compromise. We then start searching the environment for host and network indicators of compromise: the re-use of custom malware, C2 protocols, stolen certificates, persistence mechanisms, evidence of lateral movement or credential misuse, etc. In the event malicious activity is discovered we smoothly transition into a full Incident Response. Key Deliverables Executive and technical outbrief presentations, activity reports for both network and endpoint, and a summary of the findings. Peace of mind for the board, executive team, and internal security or audit team.
  8. Iterative analysis Each piece feeds into all of the others