Pen-testing, honey-potting, and exploiting your way to a better defense

No ratings

Presented at BsidesConnecticut 2014 by

Alvin Fong

In this talk, I will discuss TTPs (Tools, Tactics, and Procedures) we used supporting the defense and intelligence community and how well they apply in the Healthcare space, or could apply to your corporate environment. The framework we used was "Kill-Chain analysis" for detecting advanced and insider threats. I will talk about the security infrastructure, organization, and skills needed to find actual intruders in your network during the Recon - Weaponize - Deliver - Exploit - Control - Execute - and Maintain phases of the Kill-Chain. A portion of the talk will be dedicated to discussing our use of honey pots to gain intelligence on adversary TTPs to create more effective intrusion indicators. Topics covered span everything from IDS/IPS, Security Monitoring, Malware analysis, Threat Intelligence sharing, endpoint security/AV to Counter-intelligence and deception.