The Truth about Ransomware: Its not Complicated!

preview_player
Показать описание
The threat of ransomware now permeates our daily computing lives. News stories of attacks have become ubiquitous. While media outlets often portray ransomware attacks as advanced operations carried out by highly skilled threat actors, this often is not the case. In fact, the opposite is true -- Many ransomware attacks are opportunistic and leverage insecure configurations to enter an environment. These groups are not stealthy, in fact they are often quite loud. For example, most ransomware attacks involve multiple groups including initial access brokers (IABs), paid "pentester" affiliates, the ransomware malware authors, money mules, and more. The bulk of IABs and third-party affiliates are more akin to thieves who test door handles to find an opportunity vs. those who slink around in the shadows and cut holes in glass to enter buildings. In this talk, Ryan Chapman and Rob Lee discussing how to keep these groups out, how to detect them once they're in your network, and how to respond should the worst-case scenario occur. Thwarting ransomware isn't rocket science, it just takes awareness and diligence, so let's push to ensure we're all ready for what's ahead.

Speakers

Ryan Chapman
Ryan has worked in the Digital Forensics & Incident Response (DFIR) realm for over 10 years. He also currently teaches SANS FOR610: Reverse Engineering Malware, and he is the author of a SANS course on ransomware FOR528: Ransomware for Incident Responders, that will be available later in 2022. During his career, Ryan has worked in Security Operations Center and Cyber Incident Response Team roles that handled incidents from inception through remediation.

Rob Lee:
Rob Lee is the Chief Curriculum Director and Faculty Lead at SANS Institute and runs his own consulting business specializing in information security, incident response, threat hunting, and digital forensics. With more than 20 years of experience in digital forensics, vulnerability and exploit discovery, intrusion detection/prevention, and incident response, he is known as “The Godfather of DFIR”. Rob co-authored the book Know Your Enemy, 2nd Edition, and is course co-author of FOR500: Windows Forensic Analysis and FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics.
Рекомендации по теме
Комментарии
Автор

thanks Ryan, you're an amazing instructor - keep it up!

ochenx
Автор

I guess you are one of the best in the field. Thanks for sharing.

simonekraus
Автор

Hi Ryan - do you have a link to that google sheet for advised ESG file block types?

nickcurrie
Автор

Keeps stretching and stretching takes forever to get to any meat.

tomkruk
Автор

very nice talk! Thank you very much! Could you share with us your slides?
many thanks in advance

bonsaicnc
Автор

I love the delivery. You should work for Microsoft instead of Blackberry. Your talents are not fully leveraged there.

AlienWarTycoon
Автор

If you are a leader in your industry and love the tools that the company you work for makes, you are doing the industry a disservice by staying there. Move around and spread the talent. Your passion should be fighting attacks, not being comfortable in a longstanding job.

AlienWarTycoon
Автор

Lame unprofessional you're not intellect enough to attach ppt... please do

DavidCrypto-kclf