Digital footprints have always been hard to follow. Now it feels more Like tracking ghosts. Over seas. In the fog. Attackers are using a number of creative new tactics to bypass typical defenses. The ghosts are using the Cloud, encryption, short-lived sites, and the Internet of Things to do Their devious deeds. We’ll discuss how to clear the fog a bit: what works and what doesn’t. (This is an updated version of a talk given at RSA Conference earlier this year.)