How to Orchestrate a Cyber Security Incident Tabletop Exercise
No ratings
Presented at BSidesSan 2019 by
"Assume breach" helps incident responders prepare for the next major cyber security incident. Ask yourself—What would you do if an attacker were inside your systems? In this interactive presentation, the speaker will present a hypothetical security incident and guide you through a simulated timeline of events. She will engage with the audience and ask questions like, "What would you do next?" Contact Center Authenticaion Kelley RobinsonN/AN/AYou've built login for your application—maybe you even have 2FA—but what happens when a customer calls the support number listed on your website or product?Security teams and app developers have thought a lot about online authentication, but we haven't applied the same rigor to designing systems for authenticating over the phone. At Twilio, product and engineering teams have spent the last year thinking about this problem and how to make the experience better for both the customer and the call center agent. In that time, I've called dozens of contact centers to learn about how everyone from startups to Fortune 50 companies attempt to identify and authenticate the end user. This talk will take a look at that research and outline best practices you can use in your own call centers. You'll leave the session understanding what information should be made available to the agent and what kind of product features you can build into your web or mobile application that can facilitate phone authentication. Operation PZCHAO Ivona-Alexandra ChiliN/AN/ANowadays cyber-attacks are growing in complexity as threat actors divide payloads in multiple modules with highly specialized uses to achieve a target's compromise. The past few years have seen high-profile cyber-attacks that shifted from damaging the targets' digital infrastructures to stealing highly sensitive data, silently monitoring the victim, and constantly laying the ground for a new wave of attacks. This is also the case of a custom-built piece of malware that we have been monitoring for several months as it wreaked havoc in Asia by targeting a number of high-profile institutions. Our threat intelligence systems picked up the first indicators of compromise in July last year and we have dissected it to better understand its capabilities, its communication techniques, and ultimately its impact on the victim's data.