Session 3 Leveraging Global Datasets to Improve Your Cyber Investigations with Jeff Lenton @RiskIQ

No ratings

Presented at BSidesLondon 2017 by

Jeff Lenton

Limited Capacity full Adding this to your schedule will put you on the waitlist. While their cyber tactics may be continuously changing, bad actors can’t avoid interacting with core components of the internet. These interactions leave a trail that when connected through rigorous threat infrastructure analysis, can reveal the full scale of an attack and provide the information needed to determine the best response. The key to this analysis is access to a variety of global datasets and the ability to correlate and pivot between them in your investigation. In this workshop, Jeff will look at a range of global datasets and how each can be used to shed additional light on your adversary’s infrastructure. In addition to the more traditional datasets; Passive DNS, Whois and Malware data, he will highlight several datasets unique to RiskIQ; Host Pairs, SSL Cert History and Trackers and show how they can be used to make connections when traditional datasets come up short. Workshop attendees with use the community version of RiskIQ’s PassiveTotal to gain access to and pivot across these global datasets to investigate several real indicators.