The Critical Infrastructure Attack Surface: Assessing Its Threats and Defenses

Many successful attacks begin with a phishing email that some user falls for. And that’s why MITRE prominently features Spearphishing (T1192) as an Initial Access technique in ATT&CK.

In this webinar, LogRhythm and Ultimate Windows Security explore the latest phishing techniques used by attackers and how MITRE ATT&CK can help detect and remediate these threats.

In this on-demand webinar, we’ll show you actual examples of phishing attempts executed through:

- Legitimate file-sharing sites
- Fake Office 365 websites
- Spoofed executive emails
- The baseStriker vulnerability

Watch now to learn more.

“If you know the enemy and know yourself you need not fear the results of a hundred battles” - Sun Tzu. The MITRE ATT&CK knowledge base provides a mechanism to understand the tactics employed by adversaries to compromise systems and ultimately exfiltrate data.

In this webinar, Kev Eley and Dan Crossley outline genuine attack scenarios in the context of ATT&CK and discuss effective techniques for thwarting bad actors.

Watch this webinar: if you are a SOC manager, security analyst, security architect and you are responsible for stopping cyberattacks to protect your organisation.

Certain vendors, some industry commentators and even some security professionals in enterprises proclaim that SIEM is no longer relevant and can be replaced by other controls. What fuels this speculation? And is it accurate?

In this webinar, Kevin Eley and Daniel Crossley will

- discuss the reasons why elements of the security community have become disillusioned with SIEM longing for its demise
- outline the reasons why SIEM can deliver on its promise if undertaken correctly.

If the volume of data in your environment is expanding exponentially, you have likely been surprised to see a rise in your SIEM contract each year. You may have even had to make the difficult — and risky — decision of which data not to protect to stay within your budget. Starting now, you don’t have to.

With LogRhythm’s new True Unlimited Data Plan, your organization will pay one price to protect all data, users, and systems, even if those numbers increase year to year.

Join Optiv and LogRhythm as we discuss how the True Unlimited Data Plan can help you reduce risk in your environment without spending millions of dollars to do so.

This webinar will review how together, Optiv and LogRhythm can help you overcome the following challenges:

> Increased headcount: more people means more data.
> Infrastructure growth: adding networking and hardware increases your log volumes.
> Increased revenue: the more your organization is worth, the larger the target it becomes.
> Cloud-first initiatives: apps in the cloud generate more logs.

MITRE ATT&CK is a knowledge base and framework that lists and details adversary tactics and techniques within a common taxonomy. Having a taxonomy by itself has many valuable uses, such as providing a common vocabulary for exchanging information with others in the security community. But it also serves as a real technical framework for classifying your current detection efforts and identifying gaps where you are blind to certain types of attack behaviours.

Join Randy Franklin Smith of Ultimate Windows Security and Brian Coulson of LogRhythm for an introduction to MITRE ATT&CK, as well as:

- Share various ways to use ATT&CK, specifically in relation to designing, enhancing, assessing, and maintaining your security monitoring efforts.
- Walk through an example of the MITRE attack process from start to finish while focusing on rule development and alignment in the LogRhythm NextGen SIEM Platform.

Brian Coulson, from LogRhythm Labs, is leading an outstanding project at LogRhythm Labs where-in he will show you how they’re aligning the ATT&CK matrix with log sources, including windows event logs (XML – Security, XML Sysmon 8.0 and XML-System). While the matrix is wide spread in what it monitors, there are effective ways to filter around common and relevant detection techniques and logs.

Too often, when looking for malicious network traffic you either search for known bad or investigate anomalous traffic that doesn’t look normal. That reactive approach is time consuming, and potentially over-reliant on searching for larger concerns. Fortunately, new solutions use advanced analytics to proactively identify, enrich and alert on malicious traffic.

Why is this important?

Detecting known bad traffic is great when it works, but it’s a lot like signature-based AV (which is rigid and unable to detect unknown threats):
**Only really effective for widespread, generalized attacks – not so great for unique targeted attacks
**There’s an indefinite amount of time before the malicious traffic signature, domain name or IP makes it into the pattern updates and threat intel feeds from your vendors
**Detecting anomalous traffic can address the aforementioned weaknesses, but in practice it depends heavily on how – and how well – you define anomalous traffic, and how quickly (accurately) you can spot it.

Security practitioners are getting better by the day at looking for anomalies. Here’s just a few:

**Protocols
**Unrecognized port protocol numbers
**Malformed/non-compliant traffic compared to protocol expected on known port
**Protocols you don’t want or at least don’t expect to see in the given context
**High bandwidth usage for that protocol
**Traffic patterns
**Disproportionate inbound/outbound bandwidth usage for a given endpoint
**Suspicious Destination/Source IP combinations

In this real training for free event, we will explore how to analyze your network so that you can learn and understand its traffic patterns and get a handle for what’s normal. You’ll then be able to take this information and look for anomalous traffic, build known-bad detections and make your network detection and response (NDR) technologies and efforts smarter.

The ever-growing Internet of Things continues to pose security and privacy threats. How are businesses managing the risks associated with IoT devices on their networks? What are the best strategies for achieving basic security and cyber hygiene?

Join this interactive panel with IoT and security experts to learn more about:
- Impact of IoT on enterprise security
- How to assess the IoT risk
- Most common IoT vulnerabilities and how to address them
- Recommendations for improving IoT security

Panellists
Jason Soroko, CTO of IoT, Sectigo
Andrew Hollister, Chief Architect & Product Manager, LogRhythm
Wallace Sann, VP Global Systems Engineering, Forescout Technologies
Nigel Stanley, CTO - Global OT & Industrial Cyber Security CoE, TÜV Rheinland Group

Moderated by Yotam Gutman, Founder & Community Manager, Cybersecurity Marketing Community

Applications are increasingly being containerized, and when that happens, they are likely to find their way to a cluster within a container-orchestration system like Kubernetes. However, containerized applications are only as safe as the Kubernetes cluster they run in. So how do you ensure a secure environment? The answer is visibility.

In this on-demand webinar, LogRhythm sales engineers join Ultimate Security Windows Host Randy Franklin Smith to introduce you to Kubernetes audit logging. The presenters demonstrate how to use the LogRhythm NextGen SIEM Platform to gain visibility into your Kubernetes clusters.

Explore Kubernetes audit logging and learn how to isolate important events to reduce the noise from all other events. Smith provides examples of real Kubernetes audit events to show you audit policies in action.

LogRhythm sales engineers build on Smith’s introduction and apply those learnings with security considerations in mind to show you how to:

- Ensure you create an approved container image
- Ensure the API isn’t open to the outside world
- Track inbound and outbound traffic from the cluster and pods
- Monitor and visualize container log data

Too often, when looking for malicious network traffic, you either search for known bad network traffic or investigate anomalous traffic that doesn’t look normal. That reactive approach is time consuming, and potentially over-reliant on searching for larger concerns. Fortunately, new solutions use advanced network analytics to proactively identify, enrich and alert on malicious traffic.

Why is this important?

Detecting known bad network traffic is great when it works, but it’s a lot like signature-based AV (which is rigid and unable to detect unknown threats). Often it is only really effective for widespread, generalized attacks – not so great for unique targeted attacks. Further, there’s an indefinite amount of time before the malicious traffic signature, domain name or IP makes it into the pattern updates and threat intel feeds from your vendors.

Detecting anomalous traffic can address the aforementioned weaknesses, but in practice it depends heavily on how – and how well – you define anomalous traffic, and how quickly (accurately) you can spot it.

Security practitioners are getting better by the day at looking for anomalies. Here’s just a few we’ll focus on in our webinar:
- Unrecognized port protocol numbers
- Malformed/non-compliant traffic compared to protocol expected on known port
- Protocols you don’t want or at least don’t expect to see in the given context
- Disproportionate inbound/outbound bandwidth usage for a given endpoint
- Suspicious Destination/Source IP combinations

In this webinar, Randy Franklin Smith (of Ultimate Windows Security) and Rick Fernandez (of LogRhythm) will explore how to analyze your network so that you can learn and understand its traffic patterns and get a handle for what’s normal. You’ll then be able to take this information and look for anomalous traffic, build known-bad detections and make your network detection and response (NDR) technologies and efforts smarter.

The Cloud, The Cloud - What Security Products do you Need in the Cloud?

We’ve been hearing it for years, everything is moving to the cloud. Maybe not fully true, but there is a good amount of cloud migration projects all around us. What does this mean for security and security products?

In this webinar, Paul Asadoorian and Matt Alderman will discuss the evolution of cloud security products, including challenges, maturity, and latest trends. The pace and adoption of cloud security products have varied depending on the type of cloud you’re adopting (IaasS, PaaS, or SaaS).

Stephen Smith and Jeff Braucher from LogRhythm, will discuss the migration of security services/products to the cloud, including topics such as:

- What products should be heading for the cloud
- Thoughts on cloud service providers entering the security market
- Benefits/disadvantages to SaaS security products

Effective security operations are the first line of defence when it comes to preventing cyberattacks. In order to accomplish this, organisations need a mature security program that leverages people, process, and technology to enable rapid detection and response.

Yet some organisations struggle with the overall effectiveness of their security operations. They lack a model for maturing their capabilities. A mature security operation enables threats to be detected earlier in the cyberattack lifecycle which is critical.

Join this webinar to discover LogRhythm's Security Operations Maturity Model (SOMM) which was developed to help organisations assess their level of maturity and plan for making improvements over time.

Organisations can use this model to evaluate their current security operations and develop a roadmap to achieve the level that is appropriate in the light of their resources, budget, and risk tolerance. You will also hear about the critical measures of security operations effectiveness.

Dabble or Deep Dive: 7 Different Threat Hunts You Can Do With Available Resources

In this real training for free session, we will discuss the minimum toolset and data requirements (and not necessarily volume) you need for successful threat hunting. We will take into account that while some of you can devote most of your time to threat hunting, most of us have limited time and resources for this activity. The good news is that threat hunting is flexible and anyone can do it, ranging from a few hours a week to full-time.

As just one example, a great type of threat hunting is to look for unrecognized/suspicious executables running on you network. You can dip your toe in the water with this type of hunt with a small commitment of time and resources or you can plunge in deep with a major data collection and analysis effort. Starting out simple means you just focus on EXE names; baseline the EXE names being executed on your network, and then perform a daily review of new EXE names showing up for the first time. You can get this information from event ID 4688 and the query capabilities are very light. But I think you’ll be surprised what you are able to learn and catch.

We will take the same approach with a total of 7 types of threat hunting:

Recognizing suspicious software
Scripting abuse
AV follow-up
Lateral movement
Persistence
DNS abuse
Bait-the-bad-guy

LogRhythm is sponsoring this real training for free event and Nathan Quist (aka “Q”) is helping me on this event. Q is LogRythm’s Threat Research Engineer and works with LogRhythm’s internal SOC team and its clients to perform deep dives into their environments to uncover threats facing our industry.

Tips & Tricks for Defending the Enterprise Using Open Source Tools

One of the common complaints I hear from security professionals is, “I don’t have the budget for that.” Do you know many of the tools that can solve problems in the enterprise are free, as in free beer? You don’t have to buy commercial products to secure your entire enterprise. Sure, there are some areas that do require a PO, however, there are also several areas of your security program that can be implemented using free and/or open source tools.

Learn which aspects of your security program can benefit the most from these tools, and how to configure and use them. (Free beer will NOT be provided during this webcast, however, you are encouraged to bring your own, as the presenter’s jokes may be funnier if you are enjoying an adult beverage.)

Outline:
– Lightweight threat intelligence: pi-hole in the cloud (+TacyonNet)
– Vulnerability profiling: Integration with vFeed
– Patching your systems with Ansible
– Network monitoring with Bro
– High-performance firewalls with OpnSense
– The best free training resources

Steve Kaufman, a Technical Product Manager from LogRhythm, will be joining the webinar to cover how security technology vendors are aligning with open source tools. He’ll explore how LogRhythm’s architecture, including elasticsearch, enables the product to integrate with open source tools.

MITRE ATT&CK is a knowledge base and framework that lists and details adversary tactics and techniques within a common taxonomy. Having a taxonomy by itself has many valuable uses, such as providing a common vocabulary for exchanging information with others in the security community. But it also serves as a real technical framework for classifying your current detection efforts and identifying gaps where you are blind to certain types of attack behaviors.

In this webinar, Randy Franklin Smith of Ultimate Windows Security and Brian Coulson of LogRhythm will introduce viewers to MITRE ATT&CK, as well as:

- Share various ways to use ATT&CK, specifically in relation to designing, enhancing, assessing, and maintaining your security monitoring efforts.
- Discuss LogRhythm Labs’ project that includes aligning the ATT&CK matrix with log sources.
- Walk through an example of the MITRE attack process from start to finish while focusing on rule development and alignment in the LogRhythm NextGen SIEM Platform.

Brian Coulson, from LogRhythm Labs, is leading an outstanding project at LogRhythm Labs where-in he will show you how they’re aligning the ATT&CK matrix with log sources, including windows event logs (XML – Security, XML Sysmon 8.0 and XML-System). While the matrix is wide spread in what it monitors, there are effective ways to filter around common and relevant detection techniques and logs.

Too often, when looking for malicious network traffic you either search for known bad or investigate anomalous traffic that doesn’t look normal. That reactive approach is time consuming, and potentially over-reliant on searching for larger concerns. Fortunately, new solutions use advanced analytics to proactively identify, enrich and alert on malicious traffic.

Why is this important?

Detecting known bad traffic is great when it works, but it’s a lot like signature-based AV (which is rigid and unable to detect unknown threats):
**Only really effective for widespread, generalized attacks – not so great for unique targeted attacks
**There’s an indefinite amount of time before the malicious traffic signature, domain name or IP makes it into the pattern updates and threat intel feeds from your vendors
**Detecting anomalous traffic can address the aforementioned weaknesses, but in practice it depends heavily on how – and how well – you define anomalous traffic, and how quickly (accurately) you can spot it.

Security practitioners are getting better by the day at looking for anomalies. Here’s just a few:

**Protocols
**Unrecognized port protocol numbers
**Malformed/non-compliant traffic compared to protocol expected on known port
**Protocols you don’t want or at least don’t expect to see in the given context
**High bandwidth usage for that protocol
**Traffic patterns
**Disproportionate inbound/outbound bandwidth usage for a given endpoint
**Suspicious Destination/Source IP combinations

In this real training for free event, we will explore how to analyze your network so that you can learn and understand its traffic patterns and get a handle for what’s normal. You’ll then be able to take this information and look for anomalous traffic, build known-bad detections and make your network detection and response (NDR) technologies and efforts smarter.

Too often, when looking for malicious network traffic you either search for known bad or investigate anomalous traffic that doesn’t look normal. That reactive approach is time consuming, and potentially over-reliant on searching for larger concerns. Fortunately, new solutions use advanced analytics to proactively identify, enrich and alert on malicious traffic.

Why is this important?

Detecting known bad traffic is great when it works, but it’s a lot like signature-based AV (which is rigid and unable to detect unknown threats):
**Only really effective for widespread, generalized attacks – not so great for unique targeted attacks
**There’s an indefinite amount of time before the malicious traffic signature, domain name or IP makes it into the pattern updates and threat intel feeds from your vendors
**Detecting anomalous traffic can address the aforementioned weaknesses, but in practice it depends heavily on how – and how well – you define anomalous traffic, and how quickly (accurately) you can spot it.

Security practitioners are getting better by the day at looking for anomalies. Here’s just a few:

**Protocols
**Unrecognized port protocol numbers
**Malformed/non-compliant traffic compared to protocol expected on known port
**Protocols you don’t want or at least don’t expect to see in the given context
**High bandwidth usage for that protocol
**Traffic patterns
**Disproportionate inbound/outbound bandwidth usage for a given endpoint
**Suspicious Destination/Source IP combinations

In this real training for free event, we will explore how to analyze your network so that you can learn and understand its traffic patterns and get a handle for what’s normal. You’ll then be able to take this information and look for anomalous traffic, build known-bad detections and make your network detection and response (NDR) technologies and efforts smarter.