Name: Tales From the Frontlines - Threat Group UNC1945
Start: 2023-07-06T09:00:00Z
End: 2023-07-06T09:00:47.000Z
Location: BrightTALK
Rating: 5

Mandiant is a recognized leader in dynamic cyber defense, threat intelligence and incident response services. By scaling decades of frontline experience, Mandiant helps organizations to be confident in their readiness to defend against and respond to cyber threats. Mandiant is now part of Google Cloud.

While many organizations have threat intelligence as part of their security operations program, most struggle to apply it effectively, and lack the required resources and expertise to keep up with the latest threat actors and TTPs. In this webinar, we’ll take a look at the new intelligence-driven approach in Google Chronicle Security Operations, and how it can deliver turnkey security outcomes with threat intelligence that’s personalized, relevant, and seamlessly embedded.

Stay ahead of the latest threats with intelligence-driven security operations

Expert insights into today’s top cybersecurity trends and attacks from the frontlines for 15 years running.

Join Lead Threat Intelligence Advisor Europe, Jamie Collier, for a deeper dive into the 15th annual edition of M-Trends. Get an inside look at the evolving cyber threat landscape directly from incident response investigations and threat intelligence analysis of high-impact attacks and remediations around the globe.

Get ready to be informed on the following topics:

- The latest incident response metrics including dwell times, detection sources, top initial infection vectors and so much more
- China-nexus attackers increasingly targeting edge devices and platforms that lack EDR
- Trending adversary operations and motivations behind zero-day attacks
- The evolution of phishing techniques amidst modern security controls
- How attackers are leveraging AiTM to compromise multi-factor authentication safeguards
- The reasons and solutions behind growing cloud and hybrid cloud environment intrusions
- How AI is effectively used in red and purple team operations to help boost cyber defenses

M-Trends 2024 EMEA: By the Numbers of Today’s Top Cyber Trends and Attacks

The key to maintaining a strong cloud security posture is to build from the start on a robust foundation of baseline security controls. Google Cloud’s Security Foundation solution provides recommended controls for common cloud adoption use cases. In this session, you’ll learn how to use layered security defenses in the cloud to protect your cloud-based workloads. You’ll also learn how to build an architecture with security controls optimized for your modern infrastructure.

Security Foundation: Protecting your workloads with layered defenses

Proactive threat hunting is a critical function of cyber defense, even for resource constrained organizations. Join our experts for an in depth discussion on how we help our customers find threats in their networks, reduce attacker dwell time, and take decisive action.

Augmenting Cyber Defense with Mandiant Hunt

Outdated SIEM systems continue to form the backbone of many security operations despite increasing vulnerabilities and the rise of more powerful alternatives. This presentation offers a practical approach to SIEM migration, addressing the top challenges and providing actionable takeaways for a successful transition.

- Veteran security expert Anton Chuvakin will cover essential tips, including:
- Identifying the need for a new SIEM, understanding market options, and defining clear migration goals.
- Streamlining the process by focusing on essential log sources and detection content.
- Leveraging the migration as a catalyst to modernize security processes.
- Emphasizing thorough testing, training, phased approaches, and the benefits of expert help.

Whether you're a seasoned practitioner or just beginning to consider a SIEM migration, this presentation will provide valuable insights and actionable strategies to ensure success in 2024.

Smooth SIEM Surgery: Practical Tips for SIEM Migration Success in 2024

Many organizations are eager to take advantage of generative AI, but don’t have the resources to build, train, and maintain costly LLM models of their own. This session will provide an overview of the work Google Cloud is doing to allow customers and partners to call upon pre-trained security models and bring critical security intelligence to power their workflows.

Generative AI for your security use cases

See what is coming in the new year and hear how Mandiant consultants are helping organizations become threat ready by providing expertise before, during and after breaches.

Stay ahead in 2024 with the latest from Google and Mandiant

Proactive threat hunting enables cyber defenders to reduce attack dwell time through the identification of compromise activity previously missed by other detection mechanisms. Yet, many security teams do not have a dedicated threat hunting function and we’re on a mission to change that. 

In this webinar, Mandiant experts will cover:
 - How to establish a threat hunting function 
 - Threat hunting best practices and methodologies
 - Aligning hunt findings to the MITRE ATT&CK framework

Learn how to proactively hunt for evidence from a previous or existing compromise to enhance future response capabilities and realize new methods of threat detection.

Beyond Detection: The Art and Science of Proactive Threat Hunting

Whether you're a security engineer, IT professional, or simply someone concerned about protecting your organization's information, this webinar will showcase how AI can transform the way you approach security.

Join us to learn how to:

Strengthen your defenses
Enhance threat detection
Improve response

Our expert speakers will demystify the complexity of AI and guide you through its practical applications in the realm of cybersecurity - even if you aren't an expert.

Unleashing AI for cybersecurity: Empowering non-experts to take action

As defences against mass-phishing emails have evolved, so have attacker tactics in targeting executives and employees. Spear-phishing, vishing, social media platforms, and even AI are now part of the standard aresenal for criminal and nation-state threat actors. Marie Moe from Mandiant's Strategic team and Stephen Begley from our Red Team discuss the sophisticated attacks used by modern attackers, including what Mandiant Threat Intelligence is seeing in the wild, how these attacks work, how organisations can defend themselves from the latest generation of attacks, and how we see these attacks changing and evolving in the future.

The Phuture of Phishing

No technology has ever emerged as quickly as generative AI has – or come with such a confusing set of myths about how threat actors are already leveraging AI-driven tools to overwhelm enterprise defenses.

Join us as we separate fact from fiction and put myths to rest about the use and capabilities of generative AI.

Watch this webinar to learn:
• How threat actors specifically use generative AI to bypass or compromise enterprise security systems;
• Real-world applications of generative AI that are proven successful in enhancing cybersecurity posture;
• Generative AI's projected growth rate and how it will affect your enterprise's ability to keep pace with security protocols.

Generative AI: Myths, Realities, and Practical Use Cases

To fully realise the benefits of cyber threat intelligence, we need to effectively communicate the threat landscape.

This webinar will explore the benefits of using operational profiling to build a more precise understanding of adversaries’ attributes. Adopting a richer vocabulary of descriptors offers far more than just nuanced understanding and can be used strategically to improve security outcomes. Crucially, a clearer understanding of threats allows intelligence to be applied more effectively across a wider range of use cases beyond the security operation centre.

Leveraging Operational Profiling to Improve Security Outcomes

Security operations are struggling. According to Enterprise Strategy Group (ESG), the primary challenges security teams are facing include spending too much time addressing high priority/emergency issues and not enough time on strategy and process improvement, along with monitoring security across a growing and changing attack surface.

In this webinar, Anton Chuvakin, Security Advisor at Office of the CISO, Google Cloud, and Jon Oltsik, Distinguished Analyst and Fellow, will explore how generative AI can help support your security operations. You will learn:
• Where & why security operations are struggling
• How GenAI can help
• Use cases for GenAI security
• Tips on how to get the most out of GenAI for your security operations

Watch the webinar now!

The Role of Generative AI for Security Operations

From compliance to security operations, every organization must test and measure security effectiveness to help identify and mitigate cyber risks.  Although the ‘how’ and ‘when’ to test that effectiveness varies from org to org. 

Join Mandiant experts for a live discussion on the best practice methodologies and technologies your security team can use to accomplish this. During the session, our experts will cover:

- The difference between breach and attack simulation, red teaming and penetration testing
- When to choose between automation or partnering with a trusted third-party
- How to prioritize specific gaps in your security posture identified by proactive testing
- Mobilizing your security team to improve the overall security program

How to Effectively Test and Measure Your Cyber Defense Program

Every year we see the threat landscape in EMEA evolve in different ways. While defenders must navigate challenges, their path doesn’t have to be so uncertain. By studying the trends we see today in EMEA, we can paint a clearer picture of the battles we expect to be fighting in the coming year.

To help organizations navigate the cyber landscape in 2024, security expert Dr. Jamie Collier is presenting a deep-dive session to cover many of the EMEA-focused topics discussed in the latest Google Cloud Cybersecurity Forecast 2024 report, including:

- Tactics and tools to steal credentials
- SMS phishing, notably to access environments
- Increasing use of zero-days
- More targeting of edge and other devices  

Register for the webinar, and read the Google Cloud Cybersecurity Forecast 2024 report when it releases on 8th November.

Google Cloud Cybersecurity Forecast 2024 - EMEA

As cloud adoption continues to grow, so too does the number of cloud-native security threats.  However, cloud environments can present significant opportunities to improve security with the right tools and processes in place.

In our recent “State of Cloud Threat Detection and Response Survey", 71% of respondents said that “entire classes of threats are eliminated by migrating to the cloud” and 82% stated that “the cloud affords the ability to process more data, including on-prem data, which can improve detection across the board.” To reap these benefits, however, organizations need to understand that effectively securing the cloud involves more than “lifting and shifting” their existing security tools and processes. The cloud presents a different attack surface across various cloud services and data repositories, each with different attack tactics, potential misconfigurations and context.  

Join us to learn:
 - How TDIR in the cloud differs from traditional on-premises approaches
 - How an end-to-end workflow can work for you
 - What you should look for in a turnkey TDIR solution

Simplify End-to-End Threat Detection, Investigation and Response in the Cloud

Detecting, investigating, and responding to cyberthreats is the core function of the SOC, and the team never gets a break - attackers are carrying out more sophisticated attacks, the attack surface continues to expand, and talent shortages are the reality.

Join our upcoming webinar and demo to see how Chronicle Security Operations has cracked the code on speed and scale, automation, and detection/investigation/response processes.

We’ll explore how you can:
- Eliminate security blindspots with cloud-native infrastructure.
- Get to “aha” faster with sub-second search, insights, and streamlined processes.
- Democratize security operations by leveraging threat intelligence, out-of-the-box detections, and playbooks.

Modernize Your SOC for the Future

Join this session to learn how F5 Automated Defense can help you reduce the risk of your applications being attacked by malicious actors, improve your security posture by providing a comprehensive set of application security features, and increase the uptime of your applications by protecting them from threats and attacks that could compromise or take them offline.

F5 Automated Defense for application security

The webinar is a summary of the activity that Mandiant captured while doing incident response and enterprise forensics on different entities targeted by the group UNC1945. 

Please join Mandiant’s Luis Rocha, Principal Consultant, Mandiant; Google Cloud, for an in-depth look at UNC1945, including the group’s:

- Demonstrated access to exploits, tools, and malware for multiple operating systems
- Exploitation of an Oracle Zero-day
- Disciplined interest in covering or manipulating their activity
- Advanced technical abilities during interactive operations

Tales From the Frontlines - Threat Group UNC1945

Cyber Attacks

Cyber Crime

Incident Detection

Incident Resolution

Incident Response

Threat Defence

Threat Detection

Threat Analysis

Cyber Incident Response

Cyber Defence

Cloud computing has exploded over the past few years, delivering a previously unimagined level of workplace mobility and flexibility. The cloud computing community on BrightTALK is made up of thousands of engaged professionals learning from the latest cloud computing research and resources. Join the community to expand your cloud computing knowledge and have your questions answered in live sessions with industry experts and vendor representatives.

Cloud Computing

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

Practicing business intelligence allows your company to transform raw data into sets of insights for targeted business growth. The business intelligence and analytics community on BrightTALK is made up of thousands of data scientists, database administrators, business analysts and other data professionals. Find relevant webinars and videos on business analytics, business intelligence, data analysis and more presented by recognized thought leaders. Join the conversation by participating in live webinars and round table discussions.

Business Intelligence and Analytics

Network infrastructure professionals understand that a reliable and secure infrastructure is crucial to enabling business execution. Join the network infrastructure community to interact with thousands of IT professionals. Browse hundreds of on-demand and live webinars and videos to learn about the latest trends in network computing, SDN, WAN optimization and more.

Network Infrastructure

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Tales From the Frontlines - Threat Group UNC1945

Presented by

About this talk

More from this channel