Displaying items by tag: Incident Response

Black Hat 2023 Las Vegas – One of the areas I wanted to focus on this year while at both Black Hat and Def Con was to get an understanding of the threat landscape from both an industry and attacker perspective. My conversations (I don’t really do interviews) all included parts that related to the general attack landscape. So, it only made sense that one of my conversations needed to be with ZeroFox For those of you that might not be aware, ZeroFox throws a great Black Hat party… no wait. ZeroFox is an external attack surface management company. If you only think of them in terms of social media intelligence, then you probably need to revisit them.

The news has been abuzz about the $65+ Billion-dollar purchase of Activision/Blizzard by Microsoft. It has been seen as an opening shot in a new stage in the console wars and is, even now, under review by the FTC. However, there are rumors that Mandiant and Microsoft are in talks about a potential acquisition of the Incident Response company. These rumors come on the heels of an announcement by Mandiant that they are partnering with NextGen XDR developer SentinelOne. Where to start on this one…

Black Hat USA 2017 - Las Vegas, NV.
Another company that we have the chance to sit down with was Attivo Networks. Attivo, if you are not familiar with them specialize in network deception through the use of projected systems. These are systems that do not really exist in the network but that occupy space and would appear real to someone looking at the network from behind the scenes. They use different methods to make these systems appear to be real including mapped drives (that are invisible to an actual user). This way when a system on the network is compromised an attacker might be fooled into interacting with a deception system and give themselves away.

Black Hat 2014  Las Vegas, NV - The thought of a network breach or targeted attack is what keeps most systems admins up at night and constantly irritated to boot. The need to man the walls and make sure the moat is filled all the time is exhausting and nearly impossible in today’s moderns and increasingly distributed networks and business models. It makes the thought of a breach not a “what if”, but a “when”. This is becoming the new way of thinking about security. As we have talked about in the past people are no longer thinking they can keep everyone out, but are concentrating on quickly identifying and mitigating the inevitable breach.