Rethinking Security Detection in an XDR World

Lead cyber crime researcher for Google Cloud's Uppercase Brandon Levene discusses crimeware and how, in 2020, financially motivated threat actors are likely to cause damage far outstripping that of nation-state or espionage oriented attacks.

¿Alguna vez ha sentido que su equipo de seguridad se basa demasiado en detecciones de amenazas dependientes de vendedores externos? En ocasiones, es necesario disponer de una aproximación más personalizada para detectar TTPs potenciales. Los actores maliciosos pueden utilizar métodos, técnicas y procedimientos especialmente diseñados contra su organización. El arte de la detección está evolucionando, y cada vez se destina más inversión a analistas de SOC, respuesta a incidentes, y cazadores de amenazas - y como parte de este movimiento, la detección basada en datos surge como la técnica más adecuada para crear detecciones específicas para cada entorno particular.

En esta sesión aprenderá cómo transformar su estrategia de seguridad mediante la creación de detecciones, creadas de forma muy parecida a la creación de código, y usando las mejores prácticas para el uso, almacenamiento, compartición y mantenimiento de sus detecciones personalizadas.

Aprenda cómo iniciar su estrategia de detección personalizada.
Vea cómo el ciclo de vida de detecciones personalizadas le proporciona visibilidad del comportamiento de los atacantes.
Descubra los principios para crear sus propias detecciones.
Aprenda cómo incorporar marcos de seguridad en sus detecciones
Entienda cómo la aproximación basada en datos para la creación de detecciones destila lecciones aprendidas y se refuerza con el conocimiento particular de su institución.

Cloud PKI is disrupting the conventionally on-premise PKI market. Why? The On-premise model has traditionally taken significant costs and manpower to set up, deploy, and manage. Sometimes, they also lack agility and compatibility with new tech like cloud applications and IoT devices. The COVID-19 pandemic has also created a need for easy-to-administer PKI which can be remotely managed and does not require skilled personnel to be on-site to do so. Cloud PKI solves all these problems by incorporating a scalable pay-as-you-go model along with rapid deployment – allowing teams to obtain and use PKI whenever they want to, with little to no infrastructure costs being incurred along the way.

Google created the Google CA Service to PKI delegate deployment to the cloud, and AppViewX creates market-leading certificate lifecycle management solutions. In this webinar, you’ll learn how the Google-AppViewX joint solution has made it incredibly easy and inexpensive for businesses of all sizes to deploy, maintain, manage, and scale a highly secure PKI system from a single pane of glass, while streamlining certificate and key lifecycle management processes through consolidation and automation. The solution is highly available, and conducive to the growing needs for compatibility with DevOps, IoT, remote working (VPNs), and a lot more. What’s more, the AppViewX platform can help teams shift gears and move towards a cryptographically agile operating model, which means PKI migrations are minimally disruptive, and take days, not months.

Key Takeaways:
1. Cloud PKI Model Overview
2. Key Benefits of Cloud PKI and PKIaaS
3. Lifecycle Management of Cloud-based PKI
4. Joint Lifecycle Management Solution: Google CA Service and AppViewX

Google Cloud Security has launched modern detection at Google scale with the debut of our new solution, Chronicle Detect. It includes a rules engine that operates at the speed of search, a widely-used detection language for describing threat behaviors, and a regular stream of new rules and indicators, built by our elite research team. Join this webinar to hear from Paul Farley, Deputy CISO, NCR about their journey with Chronicle.

Google Cloud's Chronicle platform works seamlessly with Palo Alto Networks Cortex XSOAR solution to investigate and remediate security threats with speed and scale. Join this webinar to learn more about this integration and see our product teams walk through a live ransomware attack identification and remediation exercise in the product.

Ransomware attacks are one of the biggest worries for any company. During the last years, cybercriminal groups were attracted to ransomware given the huge benefit and difficulties to trace attacks back.
Not everything is lost. Prevention is the most effective measure, and from VirusTotal we want to show what to do in order to avoid being a victim.
During this workshop we will show with practical examples what Threat Intelligence can do to significantly reduce your risk vector against ransomware.

Opportunistically targeted ransomware deployments, aka Big Game Hunting (BGH), have caused a distinct disruption in the mechanics of monetizing crimeware compromises. This strategy has become the “end game” for the majority of organized cybercrime organizations, and one effect of this shift is the increased emphasis on enterprise-level targets. This session will walk you through research about how a specific BGH threat actor pursues entry points, gains its foothold, pivots, and deploys payloads to maximize their financial gains with minimal effort - and infrastructure! You’ll walk away with an understanding of the latest BGH TTPs seen in enterprise environments, and how they map to the ATT&CK framework so you can build this research into your threat detection strategy and enhance your defenses.

Los ataques de ransomware son, por un buen motivo, una de las mayores preocupaciones de cualquier empresa. Durante los últimos años, grupos dedicados a otros ciberdelitos se han visto atraídos por esta modalidad dado el gran beneficio que reporta y la dificultad para seguir el rastro del ataque.

No todo está perdido. La prevención es evidentemente la medida más efectiva, y desde VirusTotal queremos enseñarte qué técnicas aplicar para evitar ser una víctima.

Te mostramos mediante ejemplos prácticos qué técnicas de inteligencia van a minimizar significativamente tu vector de riesgo ante este tipo de ataques.

Queremos compartir contigo todo lo que hemos aprendido para que estés seguro.

Google Cloud Security has launched modern detection at Google scale with the debut of our new solution, Chronicle Detect. It includes a rules engine that operates at the speed of search, a widely-used detection language for describing threat behaviors, and a regular stream of new rules and indicators, built by our elite research team.

Join this webinar to:

- Hear from Paul Farley, Deputy CISO, NCR about their journey with Chronicle
- Get a demo of the new detection engine that includes reference rules for the ATT&CK framework
- Learn how Chronicle's elite research team, UpperCase, creates rules and indicators so you don't have to

Google Cloud Security has launched modern detection at Google scale with the debut of our new solution, Chronicle Detect. It includes a rules engine that operates at the speed of search, a widely-used detection language for describing threat behaviors, and a regular stream of new rules and indicators, built by our elite research team.

Join this webinar to:

- Hear from Paul Farley, Deputy CISO, NCR about their journey with Chronicle
- Get a demo of the new detection engine that includes reference rules for the ATT&CK framework
- Learn how Chronicle's elite research team, UpperCase, creates rules and indicators so you don't have to

Nous allons, durant ce webinaire, faire un tour d’horizon des fonctionnalités de VirusTotal Intelligence et de VirusTotal Hunting. Nous vous montrerons comment vous pouvez identifier facilement les malwares qui vous intéressent au sein de notre vaste base de données et comment surveiller des menaces potentielles.
Nous vous montrerons comme une investigation peut commencer autour d’un malware dont on sait peu de choses. Puis comment un analyste sécurité pourra ensuite s’appuyer sur VirusTotal pour détecter des variantes de la menace initiale et les techniques que les groupes d’attaquants utilisent.

Découvrez comment VirusTotal peut vous aider à :
Enrichir les connaissances de vos équipes Sécurité.
Répondre aux incidents.
Détecter les menaces.

Join this session to hear directly from organizations about why they chose Chronicle, the impact and metrics they are transforming with Chronicle, and their experience with the rules engine.

Customer Panel: Matthew Svensson (BetterCloud), Ryan Ogden (Groupon), Sean Doyle (Paradigm Quest)

Skillful threat detection and investigation starts with a diverse hub of security telemetry to draw from. The Chronicle platform allows security teams to cost effectively store and analyze petabytes of security data in one place, and perform investigations in seconds. Join this session to learn all about what’s new in Chronicle and see it in action with a live demo.

Saber es Poder. Aprende cómo opera el malware, cuáles son los factores de riesgo y cómo protegerte.

Debido a las amenazas y ciberataques sufridos recientemente en varios sectores, desde Google queremos poner nuestro granito de arena y ayudar a todos nuestros clientes de Google Cloud a defenderse.

En 2012, Google, para protegerse a sí mismo, compró VirusTotal, el crowdsource de ciberseguridad más potente del mundo, que llevaba estudiando el funcionamiento de malwares desde 2004.

Ahora, este servicio lo ponemos a disposición de nuestros clientes para que se puedan beneficiar.

The world and the security landscape has changed and evolved over the last 10 years. Join Chronicle Co-founder, Shapor Naghibzadeh, and our team of Google Cloud Security experts for a digital event series - Key Learnings from the Last Decade. We’ll reflect on a decade’s worth of cybersecurity lessons learned and how we are redefining security analytics and implementing zero-trust access as a result.

Qualified security attendees may be eligible to receive a promo code after the event to shop our online Google Cloud Security swag store.
Qualified security attendees may be eligible to receive a promo code after the event to shop our online Google Cloud Security swag store.

The world and the security landscape has changed and evolved over the last 10 years. Join Chronicle Co-founder, Shapor Naghibzadeh, and our team of Google Cloud Security experts for a digital event series - Key Learnings from the Last Decade. We’ll reflect on a decade’s worth of cybersecurity lessons learned and how we are redefining security analytics and implementing zero-trust access as a result.

Qualified security attendees may be eligible to receive a promo code after the event to shop our online Google Cloud Security swag store.

Modern enterprises are extremely diverse and complex. Yet, security data collection, correlation, and analysis has not kept up with these complexities. It often seems like organizations collect too much without ever truly finding value in the vast amounts of data they have amassed.

In this webcast, SANS author Matt Bromiley and Chronicle Security's Dr. Anton Chuvakin focus on concepts to effectively detect malicious activity within large enterprises. They will review how to bring giga-/tera-/petabytes togethers, correlating them into actionable intel by using YARA-L to craft efficient detections that can be used across these vast data sets. The webcast will help attendees answer important questions such as:

- In your current state, how much data are you ingesting/analyzing?
- How is your team writing detections? What types of metadata points are they looking for?
- How do you detect threats?
- Can you effectively scale detections across your data sets?
- How do you manage the lifecycle of those detections, tune them, keep them relevant, remove them when no longer relevant?