Maintaining Cyber Resiliency During Times of Disruption

Working in security can sometimes feel as though you are sitting on top of a powder keg. It’s a fact that cybersecurity professionals are reporting higher levels of stress than they did just two years ago. We wanted to learn the causes of tension and anxiety — as well as understand potential ways teams might alleviate and remediate the potential of job burnout.

Our global survey of more than 300 security professionals and executives investigated the reasons behind increased stress on security teams, solution capabilities, deployment strategies, technology gaps, and more. In this webinar, we explored some of the key findings from this research, including:

- Why security professionals say they have more work stress than they did just two years ago.
- Just how many teams feel that they have adequate executive support.
- How capable teams say they are to detect known security threats.
- The number one reason security professionals say they would leave their jobs.

If you work in security, hearing that stress is impacting your space is likely no surprise.

Listen to this on-demand webcast to learn from Andrew Hollister, Head of LogRhythm Labs & Security Advisor to the CSO at LogRhythm, about why your team may be experiencing more stress than ever before, the effect executive support has on your program and some indicators on how to alleviate some of the issues your team may be facing.

Today, ransomware attackers won’t simply back down if an organization refuses to pay the demanded sum in order to get their files back. Even companies who have great backups and a fast recovery process are vulnerable to an emerging strategy: exfiltrating the victim’s most private data before demanding ransom. Then if the victim refuses payment and initiates restoring their systems, the attacker reveals what information they have exfiltrated and threatens to post it online if the ransom goes unpaid.

That threat is a completely different from the standard ransomware threat. This is because we’ve now shifted from an Integrity and Availability threat to a Confidentiality threat. And of course there is the possible nightmare of privacy and other compliance regulations depending on the nature of the data that’s been exfiltrated.

During this webcast, Randy Franklin Smith from Ultimate Windows Security provided an overview of some recent high-profile attacks that have employed this strategy, including those against Honda, Xerox and Garmin. He also discussed detection methods and MITRE ATT&CK® techniques commonly used in ransomware attacks, such as:

- Phishing (T1566)
- System Services (T1569)
- Command and Scripting Interpreter (T1059)

Then, Brian Coulson from LogRhythm’s Threat Research team demonstrated how to detect and respond to these types of threats using MITRE ATT&CK, UEBA capabilities, and more.

Watch the on-demand webcast now to learn about the latest trends in ransomware and how you can protect your organization from them.

Any successful security operations center (SOC) will combine skilled people, effective processes and efficient technology. Previous SANS surveys have shown that the skills of the people are the prime prerequisite to enable organizations to define critical SOC processes; create use cases, hypotheses and plans; architect effective security solutions; and efficiently deploy, operate and maintain security systems. From that skills base, sophisticated technology and tools can be used as a force multiplier. CISOs and SOC managers who can reduce or close their critical skills gaps have the highest probability of minimizing business impact from cyberattacks when budgets and staffing are constrained.

Watch the webcast to learn:

- Where hiring managers turn when sourcing potential new hires
- Which skill areas are most sought after
- What technologies employers wish new hires had hands-on experience using
- Which security technologies are perceived as enabling organizations to delay or mitigate the need for additional staff

In this webcast, SANS reviews findings from a recent report, providing expert guidance to help cyber defense professionals learn how to best leverage the MITRE ATT&CK Framework to improve their organization’s security posture.

The Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) project by MITRE is an initiative started in 2015 with the goal of providing a knowledge base of adversarial tactics, based on real-world observations and accessible globally. With its rapid uptake by vendors and information security teams, ATT&CK now provides a key capability that many organizations have traditionally struggled with: A standard language of attack techniques, groups that use them, and the data sources that detect them.

This webcast reviews key ideas and strategies for using ATT&CK to inform security defenses, improve them, and quantify and demonstrate that improvement.

Watch the webcast to learn more as John Hubbard from SANS presents his findings.

The healthcare industry already faces a number of unique challenges and threats. The data that these organizations collect includes extremely sensitive — and therefore valuable — information, making those organizations a target among cyberattackers. As telemedicine continues to grow, healthcare providers will have to address the proliferation of these threats, as well as the new cybersecurity concerns that come with a rise in adoption.

Listen to this on-demand webinar to learn about the current telemedicine landscape and the future risks and requirements healthcare organizations will need to address if they want to secure ongoing and evolving telemedicine initiatives. You’ll hear from James Carder, LogRhythm’s CSO and former healthcare security director, and Kevin McDonald, a healthcare cybersecurity advisor with decades of experience in the industry.

You’ll learn:

• The current state of telemedicine
• The cybersecurity threats specific to telemedicine
• Future risks and requirements of securing telemedicine
• Examples of how your team can best use its tools to monitor for these risks

Looking to take the next step in your career? Find out how others paved the way for success in the security field.

In this roundtable, you'll hear from tenured security professionals on how they established their careers, overcame obstacles, and ascertained new roles and promotions. Most careers in cybersecurity are anything but linear. Learn how to navigate your own path — with or without a "traditional" background.

Panelists included Kevin McDonald, Principal Healthcare Cybersecurity Advisor at MedSec, Kyle Dimitt Compliance Research, Senior Engineer at LogRhythm, and Sam Straka, Manager, Product Owners at LogRhythm.

Watch the on-demand webinar today to find out how to achieve your career goals in the world of security.

Working with the DoD? The U.S. Department of Defense (DoD) requires that your organization meet the Cybersecurity Maturity Model Certification (CMMC) requirements to bid on contracts.

During this webinar, LogRhythm federal cybersecurity experts will discuss these new requirements and help your team prepare for CMMC certification.

You’ll learn:
- What the CMMC requirement is and if your organization needs certification
- An overview of the five certification levels
- When CMMC requirements will be required
- How to use LogRhythm’s downloadable mapping of NIST controls to CMMC practices
- Q&A panel

Your Panelists:

Erinn Connor
Kyle Dimitt

APT29, or Cozy Bear, is well-known for its alleged infiltration of the U.S. Democratic National Committee in 2016.

And whether 2020 election security is relevant to your organization, it's worthwhile to be familiar with the threat group; other actors can easily implement many of its behaviors to target organizations across industries.

During this webinar, Randy Franklin Smith from Ultimate Windows Security and LogRhythm Labs' Threat Research team will:

- Provide a holistic overview of APT29 and its notable activities
- Share commonly-used TTPs that other threat actors can easily implement
- Demonstrate how to identify and remediate threats resulting from these TTPs

Recent world events (COVID-19) have fundamentally changed the way organizations enable employees and provide them access to critical applications and data.

During this webinar, Bill Larson, Sales Engineer at LogRhythm and Paul Caiazzo, SVP of Security & Compliance at Avertium, will discuss topics that include:

- Fundamental best practices when implementing remote security policies
- Compliance and privacy law considerations
- Monitoring considerations in a perimeter environment
- Overcoming infrastructure challenges

Register Now!

MITRE isn’t resting on their laurels with ATT&CK; they keep making it better. ATT&CK now includes cloud-specific content, and I don’t mean just generalized cloud guidance. Just like how ATT&CK has specific Techniques for Windows and Linux, ATT&CK’s cloud matrix defines Techniques specific to Office 365, Azure, AWS, Google, and others. It also covers most of the same Tactics found in the original ATT&CK matrix, including:

- Initial Access: Get into your network
- Persistence: Maintain their foothold
- Privilege Escalation: Gain higher-level permissions
- Defense Evasion: Avoid being detected
- Credential Access: Steal account names and passwords
- Discovery: Figure out your environment
- Lateral Movement: Move through your environment
- Collection: Gather data of interest to their goal
- Exfiltration: Steal data

The only ones missing at this time are:

- Execution: Run malicious code
- Command and Control: Communicate with compromised systems to control them
- Impact: Where the adversary tries to manipulate, interrupt, or destroy your systems and data.

In addition, MITRE’s cloud matrix already has over 40 different documented Techniques, and in this real training for free ™ event, Randy Franklin Smith of Ultimate Windows Security will provide an overview of the matrix and show you how it fits into the overall ATT&CK framework.

Then, members of LogRhythm’s Threat Research team — Brian Coulson, Dan Kaiser, and Sally Vincent — demonstrate how you can use the following 5 cloud Techniques to identify anomalies in an Office 365 environment:

- T1114: Email Collection
- T1534: Internal Spearphishing
- T1098: Account Manipulation
- T1136: Create Account
- T1192: Spearphishing Link

Watch this on-demand technical session for the latest ways to protect your cloud resources with MITRE ATT&CK.

As the workforce has pivoted to a predominately remote work environment, a holistic security operations strategy is more imperative than ever. Organizations need to quickly assess and implement measures to mitigate and absorb risk. Parts of your security program might be working well, but there are likely areas where you could use sound guidance and advice from industry practitioners and proven leaders.

During this webinar, Rich Bakos, Director of Sales Engineering - LogRhythm, and Kat (Kathryn) Hall, Director of Security Operations, Global Services Demand – Optiv, will discuss topics that include:
• Adopting and leveraging managed security services
• Best practices to support a remote workforce
• Addressing resource constraints
• Overcoming infrastructure challenges

Register Now!

For the majority of us, our work routines have changed dramatically due to the novel coronavirus, COVID-19. Bad actors, looking to capitalize on the headlines, continue to accelerate their malicious efforts.

During this webinar, Rocky Rosas, Director of Sales Engineering - LogRhythm, and Val Wrenholt, OEM Partner Enablement Manager – Webroot will discuss how to implement safeguards as the workforce rapidly pivots to a remote environment.

We’ll also be joined by Tyler Moffit, Security Analyst at Webroot for a panelist Q&A session and tips on how best to proactively plan for threats to your data.

Topics covered in this webinar will include:
•Leveraging threat intelligence to accelerate and optimize your detection and threat hunting capabilities
•Protecting yourself against malicious IP activity
•Priority use cases while working remote
•Q&A panel

Register Today!

As a result of recent events and the COVID-19 pandemic, most organizations are implementing work-at-home policies. Yet company-wide remote environments present unique challenges for IT and cybersecurity professionals.

During this on-demand webinar, Rex Young, chief information officer, and Zack Rowland, strategic integrations engineer, revealed how LogRhythm rapidly migrated employees from in-office to remote work.

The two discussed the steps LogRhythm took to prepare for such an event and how they put that plan in action as remote work became necessary. Rex and Zack then answered questions to help you implement the same work-from-home environment while keeping IT and security best practices top of mind.

Topics covered during this webinar included:

- How LogRhythm prepared its IT and security operations to accommodate
a global work-from-home event
- A personalized Q&A session to help your IT and security teams accommodate a remote team
- How to balance business continuity with security measures
- IT and security implications to consider when implementing a work-at-home set-up

In light of COVID-19, we’ve seen businesses across industries implement remote work policies. This brings about new security concerns, many of which either weren’t considered or prioritized beforehand.

During this webinar LogRhythm experts including James Carder, CSO and VP of LogRhythm Labs, reviewed best practices for securing a remote workforce and what to expect when your employees make this kind of shift, whether it needs to happen now or in the future. Specific topics included:

- Getting started with log collection for remote systems
- Priority use cases you should employ, such as monitoring VPN access and collaboration security
- The types and levels of activity you should expect to see on your network, depending on your industry

We also discussed the impacts we’ve seen from the rush to support remote work due to COVID-19. These reveal lessons that others can implement now or work into a future plan to support a rise in remote workers.

Marketing leaders need to immediately embrace change and find creative solutions to add value with an increased emphasis on the digital world. This talk brings CMOs from around the US to share how they're adapting to our new reality with an emphasis on:
- Reaching your audience when travel is restricted and conferences are cancelled
- Adapting your content and standing out when everyone is doubling down on digital
- Pivoting your field marketing and event strategy to focus on digital opportunities
- Filling the lead gen and brand building gap
- Shifting channel strategies, plans, budget and resources
- Keeping your employees motivated during the crisis
- Messaging effectively around coronavirus

BrightTALK has teamed up with Boston Content, DC MarTech Talks and Obility B2B to deliver this special talk.

Women are rising through the cybersecurity ranks to become recognized leaders, experts, and mentors. The 2020 SANS Women in Cybersecurity Survey drew on the shared experiences of successful women in cybersecurity to provide practical advice on becoming leaders in their organizations.

Watch the webinar and learn why opportunities for women in security have never been better, including survey data points such as:

- More than 70% of respondents feel respected by their teammates

- 64% report that they are sought out for their opinions on cybersecurity issues

- 37% are advancing rapidly, moving into a senior position within one to four years

In this on-demand webcast, we discuss gender bias, the effects of mentorship, and practical advice on how to get ahead.

Many successful attacks begin with a phishing email that some user falls for. And that’s why MITRE prominently features Spearphishing (T1192) as an Initial Access technique in ATT&CK.

In this webinar, LogRhythm and Ultimate Windows Security explore the latest phishing techniques used by attackers and how MITRE ATT&CK can help detect and remediate these threats.

In this on-demand webinar, we’ll show you actual examples of phishing attempts executed through:

- Legitimate file-sharing sites
- Fake Office 365 websites
- Spoofed executive emails
- The baseStriker vulnerability

Watch now to learn more.

Smarter, faster security through LogRhythm and Cisco integrations

LogRhythm and Cisco are committed to helping you enhance your security operations through the seamless integration and powerful capabilities of the LogRhythm Threat Lifecycle Management platform and Cisco’s Threat Grid, Umbrella, Firepower and ISE.

Currently integrating with over three dozen Cisco products, LogRhythm provides centralized visibility and advanced security analytics across the Cisco-enabled environment and makes security events actionable in the network. Stay in front of cyber adversaries and proactively detect, respond to and remediate cyberthreats with this powerful integration.

In this technical webinar, you’ll learn how to:

Gain immediate insight with Cisco and LogRhythm’s comprehensive visibility
Streamline investigations with Umbrella and Threat Grid
Accelerate and enable endpoint and perimeter remediation with ISE and ASA

Dabble or Deep Dive: 7 Different Threat Hunts You Can Do With Available Resources

In this real training for free session, we will discuss the minimum toolset and data requirements (and not necessarily volume) you need for successful threat hunting. We will take into account that while some of you can devote most of your time to threat hunting, most of us have limited time and resources for this activity. The good news is that threat hunting is flexible and anyone can do it, ranging from a few hours a week to full-time.

As just one example, a great type of threat hunting is to look for unrecognized/suspicious executables running on you network. You can dip your toe in the water with this type of hunt with a small commitment of time and resources or you can plunge in deep with a major data collection and analysis effort. Starting out simple means you just focus on EXE names; baseline the EXE names being executed on your network, and then perform a daily review of new EXE names showing up for the first time. You can get this information from event ID 4688 and the query capabilities are very light. But I think you’ll be surprised what you are able to learn and catch.

We will take the same approach with a total of 7 types of threat hunting:

Recognizing suspicious software
Scripting abuse
AV follow-up
Lateral movement
Persistence
DNS abuse
Bait-the-bad-guy

LogRhythm is sponsoring this real training for free event and Nathan Quist (aka “Q”) is helping me on this event. Q is LogRythm’s Threat Research Engineer and works with LogRhythm’s internal SOC team and its clients to perform deep dives into their environments to uncover threats facing our industry.