Presidential Commission on Cloud Computing: What you need to know

Remember WannaCry - the ransomware attack that two years ago infected Windows devices across 150 countries and resulted in an estimated damage of $4B?. We now know that WannaCry was completely preventable. Microsoft had issued a patch two months prior to the attack. If you think WannaCry was bad, brace yourself: We have discovered a technique that attackers may use to deliver ransomware that most organizations have no way to detect or prevent.

This webinar will cover a Windows evasion technique called “RIPlace” that, when used to maliciously alter files, bypasses most existing ransomware protection technologies. In fact, even Endpoint Detection and Response (EDR) products are blind to this technique, which means these operations will not be visible for future incident response and investigation purposes.

The technique leverages an issue at the boundary between a Windows design flaw and improper error handling of an edge-case scenario by filter drivers of security products. While not a vulnerability per say, the technique is extremely easy for malicious actors to take advantage of with barely two lines of code. RIPlace abuses the way file rename operations are (mis)handled using a legacy Windows function.

We will review existing ransomware detection methods, the workflow of a typical ransomware and provide a live demo of RIPlace bypassing a number of anti-ransomware technologies.

Presenter: Nir Gaist, Founder and CTO of Nyotron.
Nir Gaist is a recognized information security expert and ethical hacker. He has worked with some of Israel’s largest public and private sector organizations, such as the Israeli Police, the Israeli parliament and Microsoft’s Israeli headquarters. He also wrote cybersecurity curriculum for the Israel Ministry of Education. Nir holds patents for the creation of a programming language called Behavior Pattern Mapping (BPM) that enables monitoring of the integrity of the operating system behavior to deliver threat-agnostic protection.

In today's world of IT, a robust safeguard service is required for identifying and managing applications from a single point to spot trends and see patterns that are out of the ordinary. SIEM (System Information and Event Management) is a managed security service used to gather information from end-user and even specialized security equipment like firewalls and antivirus systems. Security information and event management (SIEM) software gives security professionals both insight into and a track record of the activities within their IT environment.

While SIEM technology has been around for more than a decade, it’s become a critical component of a comprehensive security strategy in today’s threat environment.

Topics for discussion include:
- Evolution of SIEM.
- Best practices from expertise.
- Next generation SIEM – UEBA and SOAR
- SIEM solutions for some common SOC pains.
- Integrating AI and ML.

Speakers:
Geethanjali Natarajan, Security Solutions Lead at Sennovate Inc
Saumya Saxena, Software Engineer at Sennovate Inc