Threat Hunting with Network Forensics Using network forensic techniques to detect threats

No ratings

Presented at toorcon2018SanDiego 2018 by

Tom Arnold

This presentation looks at TCP/UDP network traffic and protocols to identify what information can be of great value when either detecting a threat or responding to an alert.Although traditional system and security controls may exist, humans are still a part of building and fielding applications running in a modern IT shop. The likelihood of significant flaws in the applications, or configurations of the systems, opens the risk of a security breach or compromise that may signal an alert in a log file, or on an automated intrusion detection system. This presentation looks at TCP/UDP network traffic and protocols to identify what information can be of great value when either detecting a threat or responding to an alert.