Name: How our customers with Microsoft tools detect and protect against attacks
Start: 2021-07-20T17:00:00Z
End: 2021-07-20T17:40:11.000Z
Location: BrightTALK
Rating: 5

Expel is a managed detection and response (MDR) provider whose mission is to make great security as accessible as the internet. Our 24x7 SOC offers security monitoring and response for cloud, hybrid and on-premises environments. Our BrightTalk channel focuses on tips and tricks for detecting the latest threats using all your go-to security tech. 

Learn more about us at https://expel.io.


Timely remediation: It’s critical to responding to active threats in an environment. Knowing when (and when not) to apply automation is equally important. Given the speed at which threat actors can progress through the attack lifecycle, configuring automated remediation steps can go a long way. Hear how Expel approaches incident response and puts auto-remediation into practice.

The steps to sensible auto-remediation

Video: The steps to sensible auto-remediation

Join Expel, a managed detection and response (MDR) provider offering 24x7 security monitoring and response for cloud, hybrid and on-premises environments, as we focus on the trends in supply chain targeting that stood out to our security operations center (SOC) last year. We’ll discuss best practices, what we learned in 2021 to mitigate supply chain targeting and protect against future threats, what’s changing, and what to keep a close eye on.

You’ll learn:
What Expel’s SOC saw in 2021
How to prepare for and detect these threats
Recommendations to protect your org
Predictions on what to look for in 2022

You’ll leave this session with helpful information to make your org more secure in 2022.

Supply chain targeting: trends and predictions for 2022

Join Expel, a managed detection and response (MDR) provider offering 24x7 security monitoring and response for cloud, hybrid and on-premises environments, as we focus on the trends in business email compromise (BEC) that stood out to our security operations center (SOC) last year. We’ll discuss best practices, share what we learned in 2021 about the evolution of BEC attacks, and let you know what we all need to keep a close eye on in the months ahead. We’ll also explain how you can build resilience against future BEC threats.

You’ll learn:
What Expel’s SOC saw in 2021
How to detect BEC incidents 
Recommendations to protect your org
Predictions on what to look for in 2022

You’ll leave this session with helpful information to make your org more secure in 2022.

Business email compromise: Trends and predictions for 2022

Join Expel, a managed detection and response (MDR) provider offering 24x7 security monitoring and response for cloud, hybrid and on-premises environments, as we focus on the trends in ransomware and cryptojacking that stood out to our security operations center (SOC) last year. We’ll discuss best practices, what we learned in 2021 to help mitigate future threats, what’s changing, and what we all need to keep a close eye on this year.

You’ll learn:
What Expel’s SOC saw in 2021
How we detected and responded to ransomware incidents
How to you can detect these threats and protect your org
Predictions on what to look for in 2022

You’ll leave this session with helpful information to make your org more secure in 2022.

Ransomware & cryptojacking: trends and predictions for 2022

Join Expel, a managed detection and response (MDR) provider offering 24x7 security monitoring and response for cloud, hybrid and on-premises environments, and special guest Sean Mason, Managing Director - Cyber Defense at United Airlines as we explore the top cybersecurity trends that stood out last year. 

We’ll dive into the four most important attack trends, including what we saw in 2021, practical recommendations to handle these threats and protect your org, and predictions for what to expect this year.

These trends include: 
- Business email compromise (BEC) targeting emails and application data
- Ransomware
- Supply chain targeting
- Cryptojacking

You’ll leave this session with helpful information to make your org more secure in 2022.

Great eXpeltations: Cybersecurity trends and predictions for 2022

Alerts in any environment, but especially the cloud are only as useful as the investigative time put into them. Digging through logs and sorting through false-positives is time consuming and every second can matter. The solution? Automating the right things at the right time. Join a panel of Expel customers who have build their own automation and taken advantage of Expel’s automation to free up their time. 

In this panel we’ll discuss:
• Benefits from automation (ex: staffing, faster time to detect and respond, improved visibility)
• Challenges with automation
• How it’s freed up resources and the follow on effect of what else they were able to focus on

Panelists:
Peter Silberman, CTO, Expel
Brandon Maxwell, Senior Security Engineer, Auth0
Jeremy Stinson, Chief Architect of SaaS, Precisely
Aaron Blum, Lead Security Engineer, Cockroach Labs

Free up your time with automation

AWS Sr. Security Specialist, Lior Cohen, will give an overview of cultural, procedural and technical perspectives of how to effectively and continuously improve cloud security. He’ll review highlights from AWS’s internal culture of security, the use of frameworks to continuously improve security and give guidance on how to improve your AWS security posture now. You’ll also learn more about the shared responsibility model, AWS’s Well Architected Framework, cloud security design patterns, the NIST Cyber Security Framework and native AWS security services.

Keynote: Getting better at [cloud] security

If you’ve got GuardDuty set up in your AWS environment, then your security is already heading in the right direction. But knowing what to do with the alerts and how to make the most out of them isn’t always as clear. I’ll break down the classes of GuardDuty alerts and discuss different strategies to identify quality alerts using levers to tweak the volume and mapping of alerts based on your business needs.

Optimizing AWS GuardDuty alerts for your environment

Enrichments help you up-level your detections capabilities by giving you the full picture of what’s going on and a baseline for your users’ activity. Find out how Expel automates AWS alerts enrichment with the help of the Expel Workbench™ and our bot, Ruxie™. We’ll cover the key questions our automations help us quickly answer and how these automations make spotting true positives in the complexity of the cloud easier.

Automating AWS alert enrichment

Containers are complex, and securing them is even more complicated. It all starts with understanding the different components from the bottom up. Join our partners at Lacework to unpack each part of a container with insights on how to best secure each using AWS native tools as well as additional monitoring from the Lacework platform.

Breaking down container security

Learn how Expel approaches detection writing by iterating upon previous research and detection work. We’ll explore how our detection coverage evolves as we learn more about a technology and brainstorm ways to iterate upon your own detections. Then you’ll get a glimpse of our detections for lesser known AWS controls that can be used to unseat security in your environment.

Iterating on detections in AWS

Join Expel in the data caves to see how we dig for coin miners in customer environments. You’ll leave this session with some tips on how you can use signal to find unauthorized coin mining in your AWS environment.

Mining your data to find Coin Miners

We’ve seen quite a few incidents in AWS. And we noticed a few common themes about when and why attackers use different AWS APIs – and they mapped nicely to the MITRE ATT&CK tactics. Follow along as we walk you through Expel’s AWS mind map and share why constructing a mind map can assist in developing detections, performing timeline analyses and identify attacker paths in AWS.

A walk through Expel’s AWS Mind Map

Successful phishing attacks are making way for an increase in business email compromise (BEC). Simply turning on multi-factor authentication (MFA) is no longer enough to halt the crafty attackers, as bad actors are continually finding ways to bypass MFA and are even creating fake Okta pages to steal user credentials. To prevent these attacks, you need detection and response coverage across the email attack lifecycle. 

Join Expel’s CISO, Bruce Potter and Tina Velez, Principal Solution Architect, to learn how to detect these advanced attacker tactics. We’ll show you how we triage phishy emails, detect BEC and uncover risky behavior. 

During this chat, we'll cover: 
Phishing trends we’re seeing among our own customer base
How to detect and respond to phishing email and BEC threats
A behind-the-scenes walk through of an investigation

Securing your email: re-thinking phishing and business email compromise attacks

Hunting can be a game changing strategy for your security posture. But how do you start building that strategy? Using a vulnerability-centric approach isn't enough. Hunting techniques need to focus on a proactive approach as the threat landscape has evolved to new places – like the cloud. Learn how to develop hunts that are hypothesis-driven and use a threat-centric approach to identify areas in your environment that need improvement.

Hunting in your Microsoft Environments

Phishing attacks are on the rise and BEC is still the number one tactic. In order to keep your org and its users safe, it’s important to understand the BEC attack life cycle and know where to look to spot evil – especially as these attacks continue to evolve. In this session you’ll find out what the BEC attack life cycle looks like, what signal is available in Microsoft Azure and O365 to detect a potential BEC attack and get three tips on how you can detect an attacker in your Exchange Online environment.

3 Ways to Detect Business Email Compromise in Office 365

Detections in your cloud infrastructure

How to use Defender for Endpoint to investigate a ransomware incident

How MSFT thinks about security strategy

Expel Detection Day july

Join us for a conversation with Joe Oney, Security Operations Manager at Hogan Lovells, to hear about how he and his team use Microsoft security tools to keep their org safe. He'll share some tips and tricks on how to support your Microsoft stack and amplify alerts, along with some Microsoft-specific lessons learned.

How our customers with Microsoft tools detect and protect against attacks

Cyber Security

Detection

IT Security

managed detection and response

Microsoft

Microsoft Azure

SecOps

Security

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

How our customers with Microsoft tools detect and protect against attacks

Presented by

About this talk

More from this channel