IR tools & techniques
•Download as PPTX, PDF•
2 likes•713 views
This document discusses tools and techniques for incident response. It outlines the stages of a threat including reconnaissance, luring a target, redirecting them to exploit kits, dropping malware files, and stealing data. It also provides a data control mapping showing who has access to what sensitive information within an organization and how it is accessed. Finally, it discusses preparing for incidents through data collection and monitoring, establishing roles and structure, and responding by detecting, containing and mitigating threats during an incident and analyzing afterward.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to IR tools & techniques
Similar to IR tools & techniques (20)
More from SecureData Europe
More from SecureData Europe (8)
Recently uploaded
Recently uploaded (20)
IR tools & techniques
- 1. INCIDENT RESPONSE: TOOLS & TECHNIQUES Neil Thacker, Information Security & Strategy Officer EMEA, Websense 1
- 2. THREAT STAGE MODELLING RECON LURE REDIRECT EXPLOIT KIT DROPPER FILE CALL HOME DATA THEFT 2
- 4. ACTION NOT MONITORING Who Where What How Action Human Resources Source Code Benefits Provider File Transfer Audit Customer Service Business Plans Personal Web Storage Web Block Marketing Personal Information Business Partner Instant Messaging Notify Finance M&A Plans Blog Peer-to-Peer Remove Accounting Employee Salary Customer Email Encrypt Sales Financial Statements Spyware Site Print Quarantine Legal Customer Records USB Removable Media Technical Support Technical Documentation Competitor Print Screen Engineering Competitive Information Analyst Copy/Paste Confirm 4
- 5. INCIDENT RESPONSE - PREPARATION During Before • • • • Data Collection & Monitoring Infrastructure Incident Command Principles Roles and Organisational Structure Response Infrastructure and Preparatory Steps • • Trigger, Escalate, and Size appropriately Detect, Contain & Mitigate After • • • Triage Analyse QA effectiveness 5
- 6. INCIDENT RESPONSE Technology requirements: • Malware analysis • Digital/Data forensics • Composite scoring • Real-time event correlation • Kill-chain analysis 6
- 7. THANK YOU Neil Thacker Information Security & Strategy Officer EMEA Websense @nt_hacker 7
Editor's Notes
- Threat Model and Attack modeling. The number one thing an organization can do to better their security posture is threat model.
- Event correlation. Generating incidents with actions.