FIRST
FIRST
  • 437
  • 185 695
Collaboratively Caring and Securely Sharing of Information that Matters
Dave Matthews (Gen Digital, AU)
After getting his PhD in Mathematics, Dave spent the next 25 years consulting for the Australian Government, primarily working with Defence, Intel and Law Enforcement, before moving to CrowdStrike, and Gen Digital (which is formed from the merger of Avira, Avast and NortonLifelock). He has continually worked in Incident Response and Forensics and has had the privilege of helping people while they are having their worst days at work. He has experience with all flavours of cybersecurity - ranging from attack and defence to incident response as well as security capability development. He is particularly passionate about digital forensics and incident response, helping people prevent and recover from attacks.When he's not working or learning something new, Dave loves spending time with his family and their puppy, Rufus!
---
This presentation, 'Collaboratively Caring and Securely Sharing', describes situations where sharing Intel would greatly help others. The talk initially discusses forms of Intelligence that are valuable and worth promptly communicating. Examples of how this lack of sharing prevents rapid response to incidents and, in many cases, allows threat actors time to achieve their objectives.Common reasons that prevent sharing are discussed to highlight problems and to show how secure collaboration can help. For example, your organisation might have suffered a breach; you want to share pertinent lessons learned and even Intelligence to help others. However, doing so could expose your reputation. What can you do?Or your organisation might be attacked, and you want to ask for help - anonymously, without divulging where you work.We show how Intel sharing can be achieved in an Incident Responder community and provide step-by-step instructions on implementing with popular team messaging platforms like Slack, Mattermost, Discord and Microsoft Teams. The presentation will demonstrate how this can work in a trusted IR community like FIRST, other CERTs or Incident Response communities.
Переглядів: 113

Відео

Empowering Cybersecurity Outreach And Learning Through Collaborative Challenge Building, Sharing ...
Переглядів 1442 місяці тому
Empowering Cybersecurity Outreach And Learning Through Collaborative Challenge Building, Sharing and Execution Alexandre Dulaunoy (CIRCL.lu, LU), David Durvaux (European Commission - EC Cybersecurity Operations Centre, BE), Renato Otranto Jr. (CERT.br / NIC.br, BR) Alexandre Dulaunoy enjoys when humans are using machines in unexpected ways. I break stuff and I do stuff at CIRCL David Durvaux is...
How AI is Changing the Way We Analyze Malware
Переглядів 1952 місяці тому
Fernando Urbano (ES) Fernando is a software engineer at VirusTotal. His experience involves analysis of banking trojans and development of automated binary analysis solutions. He also teaches binary instrumentation for UMA’s Malware Intelligence M.Sc. course. Fernando is the author of learnfrida.info, a free web resource for learning about binary instrumentation and its applications using the F...
Pushing Coordinated Vulnerability Disclosure Forward in Asia Pacific
Переглядів 472 місяці тому
Tomo Ito (JPCERT/CC, JP) Working as a vulnerability coordinator at JPCERT/CC for 8 years, Tomo currently leads the Global CVD project of the organization, which aims to contribute to the global CVD ecosystem stability through collaborations with the stakeholders from different parts of the world. Coordinated Vulnerability Disclosure (CVD) is a global challenge. In its process, vulnerability inf...
Zero Trust and Jurassic Park
Переглядів 772 місяці тому
Kathleen Noble (Intel, US) Director, PSIRT and Bug Bounty Katie serves as a CVE Program Board, Bug Bounty Community of Interest Board, and Hacking Policy Council member. She is a passionate defensive cybersecurity community activist, she is regularly involved is community driven projects and is most happy when she is able to effect positive progress in cyber defense. In her day-job Katie Noble ...
Enhancing Leadership Readiness for Cyber Incidents: A Strategic Pre-Briefing Approach
Переглядів 822 місяці тому
Robert Floodeen (CyXcel, GB) Rob Floodeen is a CyXcel Partner at Weightmans, leading the response services blending legal and technical response. Rob has worked across federal, defense, and commercial operations. Highlights from his cybersecurity career include Pentagon IR team lead, member of CERT/CC, manager of a DoD agency CERT, Technical Advisor to the Director of the SEI managing the FFRDC...
A Deep Dive into KEV
Переглядів 2632 місяці тому
Speakers: Tod Beardsley (CISA), Lindsey Cerkovnik (CISA, US) Tod Beardsley is employed at CISA, the Cybersecurity and Infrastructure Security Agency, part of the US government. There, he spends most of his time involved in vulnerability research and coordinated vulnerability disclosure (CVD). He has over 30 years of hands-on security experience, stretching from in-band telephony switching to mo...
Building a National CSIRT on a Nano Scale
Переглядів 1782 місяці тому
Paul Dutot (Jersey Cyber Security Centre, JE) Paul Dutot is head of Cyber Defence and CIO at the Jersey Cyber Security Centre. Previously, he held a CTO position at a cybersecurity business which provided both offensive and defensive services. Paul's particular skills before joining the Jersey Cybersecurity Centre include global penetration testing for over 10 years as well as custom SIEM desig...
Lightning Talks II
Переглядів 1032 місяці тому
Lightning talks are short presentations, usually 3-7 minutes long. The goal of a lightning talk is to share a topic or idea in an engaging and thought-provoking manner, to inspire new conversations and collaboration.
Are You Lazarus? - Cryptocurrency Hackers Targeting Japanese Organizations
Переглядів 512 місяці тому
Are You Lazarus? - Cryptocurrency Hackers Targeting Japanese Organizations
Dissecting the Arsenal of LockBit
Переглядів 712 місяці тому
Dissecting the Arsenal of LockBit
Unveiling Active Directory Secrets: Uncommon Tricks for Enhanced Security
Переглядів 4932 місяці тому
Unveiling Active Directory Secrets: Uncommon Tricks for Enhanced Security
From Code to Crime: Exploring Threats in GitHub Codespaces
Переглядів 1172 місяці тому
From Code to Crime: Exploring Threats in GitHub Codespaces
SIG Updates
Переглядів 532 місяці тому
Featuring Updates From: • Cyber Threat Intelligence SIG • Security Lounge SIG • Ai Security SIG • DNS Abuse SIG • Law Enforcement SIG • Malware Analysis SIG • Metrics SIG • NETSEC SIG • Standards SIG • TLP SIG • CVSS SIG • EPSS SIG • Human Factors in Security SIG • Next Gen SIRT • Red Team SIG • Women of FIRST SIG
Building up a PSIRT Team for an Open Source Project: Lessons Learned from Zephyr
Переглядів 292 місяці тому
Kate Stewart (Linux Foundation, US) Kate Stewart works with the safety, security and license compliance communities to advance the adoption of best practices into embedded open source projects. Kate was one of the founders of SPDX, and is currently one of the technical working group leads. She is also the co-lead for the CISA SBOM tooling working group, and the OpenSSF SBOM everywhere SIG. Sinc...
Sigma Unleashed: A Realistic Implementation
Переглядів 882 місяці тому
Mathieu Le Cleach (CERT-EU, BE) Mathieu is a member of CERT-EU's Digital Forensics and Incident Response team. He has two hats: respond to security incidents, including significant ones, and engineer CERT-EU's detection strategy. Before joining CERT-EU, Mathieu worked as a CSIRT analyst for a French financial institution. Sigma is a well-known generic detection rule format in the cybersecurity ...
A Recipe for Improving SecOps Detections
Переглядів 1142 місяці тому
A Recipe for Improving SecOps Detections: Take Three Security Controls, add a Tablespoon of Threat Intelligence, and Let it Rise John Stoner (Google Cloud, US) John Stoner is a Global Principal Security Strategist at Google Cloud and leverages his experience to improve users' capabilities in Security Operations, Threat Hunting, Incident Response, Detection Engineering and Threat Intelligence. H...
Cybersecurity Performance Goals for Critical Infrastructure: A Primer and A Progress Report
Переглядів 402 місяці тому
Tom Millar (CISA, US) Tom Millar has served in CISA for 15 years, working to strengthen the agency's information sharing capabilities, increasing the level of public, private and international partner engagement, and supporting initiatives to improve information exchange by both humans and machines, such as the standardization of the Traffic Light Protocol and the development of the Structured ...
Gearing Towards the Next Level in Playbook-Driven Security Automation - Leveraging CACAO V2
Переглядів 1852 місяці тому
Luca Morgese Zangrandi (TNO, NL), Vasileios Mavroeidis (University of Oslo, NO) Luca Morgese received a MSc in Cybersecurity at the University of Twente, Netherlands, in 2021. He is currently employed as a Cybersecurity Scientist at the Netherlands Organization for Applied Research (TNO). His work at TNO involves design, development, and validation of cybersecurity automation technologies for s...
Experiences of BtCIRT Making Impact for Bhutan Cyber Resilience: Challenges and Successes
Переглядів 462 місяці тому
Experiences of BtCIRT Making Impact for Bhutan Cyber Resilience: Challenges and Successes
Lessons Learned from a Countrywide Scanning Program
Переглядів 662 місяці тому
Lessons Learned from a Countrywide Scanning Program
Tales From a Cloud CSIRT- Let’s Deep Dive into a Kubernetes (k8s) Infection
Переглядів 1032 місяці тому
Tales From a Cloud CSIRT- Let’s Deep Dive into a Kubernetes (k8s) Infection
From Laboratory to Grid: Advancing IACS Incident Response and Cyber Resilience
Переглядів 222 місяці тому
From Laboratory to Grid: Advancing IACS Incident Response and Cyber Resilience
JTAN - Building a Data Sharing Network Using Open Source Tools
Переглядів 802 місяці тому
JTAN - Building a Data Sharing Network Using Open Source Tools
Dissecting Tradecraft: Building Robust Detections Through Tradecraft Decomposition
Переглядів 1252 місяці тому
Dissecting Tradecraft: Building Robust Detections Through Tradecraft Decomposition
Attack Path Based Detection Engineering - Leveraging BloodHound for Robust Defense
Переглядів 1252 місяці тому
Attack Path Based Detection Engineering - Leveraging BloodHound for Robust Defense
Organizing Security Issues Discovered During Product Testing for Easier Consumption by Product ...
Переглядів 392 місяці тому
Organizing Security Issues Discovered During Product Testing for Easier Consumption by Product ...
Tearing Down the Silos - Cyber Defense Needs an Integrated Approach
Переглядів 1072 місяці тому
Tearing Down the Silos - Cyber Defense Needs an Integrated Approach
Version Fingerprinting Tricks: Automating Software Identification for Vulnerability Scanners
Переглядів 1252 місяці тому
Version Fingerprinting Tricks: Automating Software Identification for Vulnerability Scanners
AI Governance with Multistakeholder for Safer AI Society
Переглядів 692 місяці тому
AI Governance with Multistakeholder for Safer AI Society

КОМЕНТАРІ

  • @bethanychapman9800
    @bethanychapman9800 Місяць тому

    I really like your layout and the language you spoke when you were talking about the 🚨 sound of music...zoom

  • @EtibarTaghiyev
    @EtibarTaghiyev Місяць тому

    Fully agree: “If you think technology can solve your security problems, then you don’t understand the problems, and you don’t understand the technology.” ― Bruce Schneier

  • @vikrantvijit1436
    @vikrantvijit1436 Місяць тому

    Thanks for the great presentation addressing fundamental issues involved in successful cyber threat hunting secured posture.😊❤

  • @JossOrtan
    @JossOrtan Місяць тому

    Great insights on building a Cyber Threat Intelligence Maturity Model! What are the key benchmarks to assess an organization's maturity in threat intelligence?

  • @duncansparrell
    @duncansparrell Місяць тому

    Great talk. I'm all about 'show me the money' and was particularly impressed with the slide at 20:15 with the 80% savings in real life examples that followed.

  • @JossOrtan
    @JossOrtan Місяць тому

    Great breakdown of automating CTI! What do you think are the biggest challenges in fully automating vulnerability management?

  • @danielrodriguezrodriguez415
    @danielrodriguezrodriguez415 Місяць тому

    Amazing job Santiago! que genio!

  • @danielrodriguezrodriguez415
    @danielrodriguezrodriguez415 Місяць тому

    Thanks for Cacao Roster, I will give a try.

  • @danielrodriguezrodriguez415
    @danielrodriguezrodriguez415 Місяць тому

    Great talk 👏👏

  • @neilbaal6758
    @neilbaal6758 2 місяці тому

    Well done Paul!

  • @ffrangiosa
    @ffrangiosa 2 місяці тому

    This is wild! And very clearly explained, super interesting!

  • @macrosoft
    @macrosoft 2 місяці тому

    Excellent talk. Thank you for sharing your knowledge!

  • @PastorJamesGillespie
    @PastorJamesGillespie 2 місяці тому

    You would have more viewers if not your audio is being forced out of the Left Channel only

  • @AlgoNudger
    @AlgoNudger 2 місяці тому

    Thanks.

  • @Hnsabcd
    @Hnsabcd 2 місяці тому

    詐騙仙人跳集團

  • @jreamscape
    @jreamscape 2 місяці тому

    thanks dude

  • @0xIAMROOT
    @0xIAMROOT 2 місяці тому

    Love the Simen sinek gold circle approach (why, how, what) for describing attack treees

  • @AlgoNudger
    @AlgoNudger 3 місяці тому

    Thanks.

  • @guc9ugjvobovov526
    @guc9ugjvobovov526 4 місяці тому

    🎉

  • @lorenzoprincipi5078
    @lorenzoprincipi5078 5 місяців тому

    Thank you very much but: improve audio, improve organization and slide order, split slides, add more text. You repeat the same things ten times in ten different slides among both part 1 and part 2. For who doesn't know what MISP is about it is impossible to understand at the first listening, it is very confusing, and the disorganization of the talk is reflected on the speakers too. This is a very important topic which needs to be well explained, but the effort to understand MISP with this webinar is very high. Thank you again for your time and your work, but you are not explaining very easily what MISP is, and that should be done.

  • @Chatgpt-wc6vo
    @Chatgpt-wc6vo 5 місяців тому

    Informative session !

  • @sampleoffers1978
    @sampleoffers1978 5 місяців тому

    I just read a celebrity accused of indulging in it. If it's prevalent enough it's real financial factor in illicit economy, it's real societal reckoning,

  • @jorgeandino6553
    @jorgeandino6553 7 місяців тому

    Does American society is aware of this existential threat? wake up free world! Who said: It would be so nice to be close friends with Russia??? (Make Russia great again)

  • @asanovicsimo
    @asanovicsimo 7 місяців тому

    great!

  • @ma34529
    @ma34529 7 місяців тому

    Great video and walkthrough of a cloud attack, presentations like this are rare. 10/10

  • @bharanichary5241
    @bharanichary5241 7 місяців тому

    Good Info

  • @horaceward1657
    @horaceward1657 10 місяців тому

    The accountant most likely was not authorized to work/travel to the country he was located by the company.

    • @GuyThompsonFWTX
      @GuyThompsonFWTX 9 місяців тому

      Not likely, but what would’ve prevented this would’ve been deployment of VPN to access the network which requires an RSA token unique to only the user, as well as MFA.

  • @MohsenJebelli145
    @MohsenJebelli145 10 місяців тому

    great inforamation

  • @stephenlawson9593
    @stephenlawson9593 10 місяців тому

    'PromoSM' 😝

  • @DaryllGomas
    @DaryllGomas 11 місяців тому

    Thanks !

  • @Beautyofthechosen
    @Beautyofthechosen Рік тому

    Thank You

  • @neilbaal6758
    @neilbaal6758 Рік тому

    Good content, thanks!

  • @allanguwatudde7623
    @allanguwatudde7623 Рік тому

    Everything is open source if you know how to reverse engineer

  • @aaroncarlo9846
    @aaroncarlo9846 Рік тому

    Thank you for this wonderful and very informative video! As I was exploring MITRE ATT&CK, I noticed that Data Source is no longer available on the right side.

  • @sublimealchemy2951
    @sublimealchemy2951 Рік тому

    Awesome

  • @ArmendHawary-ny7up
    @ArmendHawary-ny7up Рік тому

    I want to know what the real secret please advise

  • @ytg6663
    @ytg6663 Рік тому

    But an elf file doent execute without chmod permission ... Then how it got to run ???

  • @pipi_delina
    @pipi_delina Рік тому

    10months and no comment

  • @andreferreira4735
    @andreferreira4735 Рік тому

    Believe it or now, I got here from the slide deck i had saved while tidying up my env! Really enjoyed re-watching.

  • @xeroxcopy8183
    @xeroxcopy8183 Рік тому

    a whole ass 30 minutes of shit always explain nothing

  • @LeonSheeter
    @LeonSheeter Рік тому

    These gentlemen are helping something. Explaining this & showing these slides are making a difference & helping to combat against bad people. Those guys are good people.

  • @theforgottenson0916
    @theforgottenson0916 Рік тому

    I wonder if you have any revisions now that the Twitter files explained how the left within government and social media garnered control of the tools to a greater extent than any "Russian Bots"

  • @djseodksow9765
    @djseodksow9765 Рік тому

    Hi, thanks for this beautiful tutorial. The login infirmation at: 1:47:52 is not correct. Would be great if you can share it again

  • @polonia66
    @polonia66 Рік тому

    6:21

  • @polonia66
    @polonia66 Рік тому

    thanks

  • @polonia66
    @polonia66 Рік тому

    done1

  • @josephleonardomolinaarreol2625

    Thanks courses

  • @MyLife-uc5wy
    @MyLife-uc5wy Рік тому

    Thank you!

  • @commantrosexetlos4700
    @commantrosexetlos4700 Рік тому

    Wtf my ip is shadowban by you? Saving life's BS are to hide your shadow bussines.. There are ways to complain that you will Not like.. Unblocked it Today

  • @petergitzlaff3737
    @petergitzlaff3737 Рік тому

    yeah guys ehhhhh reallly ehhhh need to ehhhhh redo the ehhhh audio ehhhhh and trim this up possibly ehhhhhhh. too many ehhhhhhs as welll ehhhhhhh