Speed Dating for Security Teams: Finding Alerts that Lead to Compromise
This webinar will address the following topics:
- How to quickly triage and validate the seemingly overwhelming volume
of daily alerts
- Strategies for prioritizing and throttling your workflow
- Tools for querying intel and obtaining context
- Approaches for creating an indicator management process
RecordedAug 12 201446 mins
Your place is confirmed, we'll send you email reminders
Austin Baker, Sr. Consultant (Mandiant), Patrick Charbonneau, Consultant (Mandiant)
Multi-Factor Authentication (MFA) is the standard for protecting sensitive systems and credentials. What once was limited to physical tokens and keycodes has expanded into digital tokens, phone applications, and password vaults, all in the effort to offer additional safeguards for critical access points like VPN connectivity and system administrator accounts.
While MFA is now an industry-standard security practice, monitoring and protecting these implementations from exploitation is not widely practiced.
Gathered from the trenches of both our Incident Responders and Red Teamers, here is a quick introduction to the problems faced with common MFA systems, the ways real-world attackers (e.g. APT28 & ATP29) and our Red Team have bypassed or subverted them, and some techniques your team can use to further protect the multi-factor keys to your kingdom.
Stuart McKenzie, VP of EMEA, Mandiant. Gerasimos Stellatos, Director, Mandiant.
Major events of 2016 have created great uncertainty about the future, but in cyber security one thing is certain: Some attacks and crimes will continue and new challenges will emerge.
What new developments in cyber security should you expect in 2017?
Join us to hear from some of FireEye top experts about our predictions for 2017 which draw from our executive team, Mandiant incident responders, FireEye iSIGHT Intelligence and FireEye Labs. These insights include:
•What investments in security organizations will make in 2017
•Which industry or type of organization might unexpectedly become a target of threat groups in 2017
•How threat groups will continue to target industrial control systems (ICS) in the near future
•What the future hold for less security-mature regions in Asia Pacific and EMEA
Register today to understand what lies ahead, so you can prepare to stay one step ahead of cyber security threats.
Register today to watch this free encore presentation from the 2016 FireEye Government Forum featuring Virginia Governor Terry McAuliffe. Watch from the convenience of your computer as Governor McAuliffe discusses the importance of making cyber security a priority at the state and federal level, particularly as cyber attacks are on the increase.
Additional topics discussed include:
• What Virginia is doing to address the cyber skills gap, and fill job openings
• Cyber challenges facing state and federal agencies
• Steps Virginia has taken to increase its investment in cyber security
• How and why he wants to make Virginia the cyber capital of America
Paul Nguyen, VP of Orchestration & Integration, FireEye. Joseph Blankenship, Sr. Analyst, Forrester.
Most security programs are understaffed and overwhelmed with alerts, often defined by processes that rely on manual intervention and containment. They must keep pace with attackers who have access to intellectual resources, computing power and the backbone of the fastest digital delivery networks.
Security orchestration levels the battlefield by bringing together disparate technologies and incident handling processes into a single console and facilitates processes with automation. The goal is to improve response time, reduce risk exposure and maintain consistent security processes.
Join this webinar with Paul Nguyen, VP of Orchestration and Integration at FireEye and guest speaker Joseph Blankenship of Forrester to learn what orchestration really is, how to use it, and how to recognize a quality orchestration solution. You’ll discover:
•Why we are seeing a rise in security orchestration
•Where the market is movingHow to get the most out of orchestration
•Which orchestration capabilities are essential and which are differentiators
•What drivers and functional capabilities will define the market
•How to best evaluate and deploy orchestration solutions
Register today for the latest on orchestration from FireEye and Forrester experts.
Jeff Berg, Sr. Manager, Cyber Threat Intelligence Services, Mandiant
In a rapidly evolving threat landscape with the realities of limited security program resources, it can be difficult for organizations to know what the most critical risks and exposures are, presently and looking forward. While most organizations recognize the importance of cyber threat intelligence (CTI), Mandiant consulting frequently finds organizations have limited capabilities to operationalize CTI throughout all aspects of their security program.
A recent online poll conducted by FireEye about the operational use of CTI found that 84% of responders use threat intelligence for business decision-making. 67% use it to make decisions about resources and security tools while 17% said they use it for risk assessment on new business initiatives. 17% don’t use it at all.
In this webinar, Jeff Berg, Senior Manager of Mandiant’s Cyber Threat Intelligence Services, discusses the role of intelligence in cyber security programs and steps organizations can take to transform security operations to be intelligence-led, so they can continuously adapt to the threat landscape, and ultimately infuse intelligence capabilities across the entire organization for informed decision making.
Modern cyber attackers are sophisticated, well-funded, well-organized and use highly-targeted techniques that leave technology-only security strategies exposed. To identify and stop attackers, organizations need to understand how they think, how they work, and what they want. Why? Because today, the most serious data breaches and disruptions result from well-planned, complex attacks that target specific companies or industries. Bolster your defenses with a proactive, forward-looking approach to security. Join our live webcast, Tuesday, November 15 at 2:00pm ET to learn:
-What cyber threat intelligence truly is and the benefits of being intelligence-led.
-How to tailor threat intelligence to your unique security mission.
-How FireEye iSIGHT’s 160 security experts around the globe mobilize to transform raw information into finished actionable intelligence.
Hunt advanced, tiered attacks lying in wait within your systems. Prioritize the most relevant threats amidst 1,000s of daily security alerts. Join us live and discover how savvy organizations operationalize intelligence up and down the organization to preempt attack, inform strategy and more.
Rajiv Raghunarayan, Sr. Director, Product Marketing, FireEye. Robert Westervelt, Research Manager, IDC.
Advanced threats continue to grow in severity, complexity and reach as threat actors expand their attacks to hit soft targets. Adding to this, as business workloads move to the cloud, and as shadow IT continues to proliferate, unforeseen security gaps expose new vectors for exploit and abuse.
Attacks are not just targeting the core of a network, nor are they limited to just large scale enterprises. More and more, threat actors are aiming at vulnerable endpoints, distributed network environments and porous perimeter defenses. To combat this, security solutions need to be as agile as today’s threat actors.
In this webinar, we will discuss the changing threat landscape and how today’s threat actors and advanced malware are impacting businesses of all sizes and types. Additionally, we will examine new security solutions and deployment models that provide agility, flexibility and widespread protective reach that scales and grows with IT and security needs.
Tim Appleby, Sr. Manager, Security Program Assessments, Mandiant Consulting.
Cybersecurity awareness is growing as more organizations learn they are vulnerable to an attack. While compliance with regulatory and security audit requirements provides a starting point, it alone will not keep the organization safe. An effective security program needs to be multifaceted, integrating people, processes and technologies across all layers of the organization. The specifics vary due to industry, size and geographic presence, as well the level of risk the organization is willing to accept.
Mandiant Sr. Manager Tim Appleby will discuss the benefits of proactive preparedness and 10 key areas that should be considered in order to form a holistic security program, and discuss how priorities can vary based on industry, size and geography.
Chris Leach, Chief Technologist (HPE). Vitor De Souza, VP, Global Communications (FireEye)
Are you prepared?
It’s headline news. Cyber attackers are increasingly more sophisticated and data breaches are becoming common place. Some say “it’s not a question of if you’ll be breached, but when”. You need a plan.
Even the most security-conscious organizations are not prepared for the necessary actions needed to gain control after a cyberattack. Preparing an emergency response communication plan keeps stakeholders informed following a breach. Taking an early communication approach will combat rumor and conjecture. The breach is now a business problem. From employees and customers to partner and suppliers – people need to be confident the situation is being addressed, managed, and resolved.
Communication is key.
Smart organizations view their security crisis-communication plan as an ongoing necessity. Get ahead of the reactive situation and decrease the uncertainty. Involve the company’s top leaders across the cross-functional organization. Create a framework for answering questions honestly and with integrity. Share information up front and often. Frequent detailed communication couple with action timelines creates confidence.
Get operational in real time.
You can’t control the communication cycle without having done some work in advance. A well-developed crisis response plan with different scenarios will train your team to operate in real time when the inevitable occurs. You can take control of the situation with timely communications.
Be prepared. Join us for our upcoming webinar to learn how to build a strong crisis-communication foundation for your organization.
The security paradigm for nearly two decades has been to increasingly invest in technology. These solutions have not only failed to solve the problem but have made the challenge more complex. Even if true threats are detected, they are lost in a sea of alerts and lack the context to prioritize and build response. This security posture is only exacerbated by the skills deficit currently facing the industry.
In this webinar, we look at the emergence of a new security-as-a-service paradigm and the capabilities required to help organizations reduce risk and time to protection. The discussion will cover how the cost, specialization and complexity of cyber defense have positioned security to follow other markets in adopting an “as-a-service” paradigm.
We will also address the capabilities that define an ideal security-as-a-service partner such as:
•the availability of security expertise
•a broad intelligence capability and
•flexible deployment options
Not only does this approach improve a security posture and reduce risk but it does so with a lower total cost of ownership (TCO). Register today to learn more about this emerging security-as-a-service model.
Ron Bushar, VP - Global Government Services, Mandiant. Russ Cohen, Director of Cyber/Privacy Services, Chubb.
As cyberattacks become more frequent, more sophisticated, and more costly, businesses are increasingly turning to cyber insurance to transfer some of the risk. In turn, insurance underwriters are challenged by the complexity of assessing cyber risk, and need a simple yet objective methodology to assist in decision making.
In response to this, Chubb has developed a new model for cyber underwriting, Cyber COPETM. Intended to simplify and improve the assessment of both cyber and privacy risks, this methodology is based on COPE, a time-tested underwriting model that has been used by property underwriters to analyze risk for nearly 300 years.
Mandiant Consulting has teamed with Chubb to create a Cyber Risk Insurance Assessment Process that aligns with the new Cyber COPETM methodology to allow a more effective evaluation of an insured’s cyber and privacy risk.
In this webinar, experts from Mandiant Consulting and Chubb will discuss the Cyber COPETM methodology, Mandiant's new CIRA service, and how organizations can use both to better understand their cyber and privacy risks.
Steve Elovitz, Manager, Consulting Services (Mandiant), Ian Ahl, Manager, Incident Response (Mandiant)
Beginning in January 2016, Mandiant identified a financially-motivated threat actor that launched several tailored, spear-phishing campaigns—targeting industries that process large volumes of consumer credit cards such as retail, restaurant, and hospitality. To date, Mandiant has seen this group at over 150 organizations. This group is interesting due to the large number of organizations they quickly targeted, how quickly they shift tools, tactics, and procedures (TTPs), and their unusual persistence in attempting to re-compromise an organization after remediation.
During this conversation, we will walk through examples from several Mandiant investigations of this groups activity. We will take a technical look at this threat actor's TTPs as well as talk about what to look for to determine if they are active in your environment.
Register for this webinar as our experts share key insights on this new cyber threat group!
Gary Fisk (Solutions Architect, FireEye), Robert McNutt (Director, Strategic System Engineer, ForeScout)
According to the latest M-Trends report, 53 percent of network compromises are identified by an external organization rather than the internal IT department. This is especially apparent in the hospitality industry where massive amounts of customer data and credit card information are stored. Now more than ever, it’s critical to understand the security posture of your network and implement comprehensive security solutions that help you rapidly detect, analyze and contain potential threats.
Join us and learn how a Fortune 500 company Gaming/Hospitality company gained instant visibility of previously unknown devices and deployed policy-based access controls in days. Our special guest customer will comment on the state of threats to hospitality companies and discuss how FireEye Network Threat Prevention Platform (NX Series) and ForeScout CounterACT® work together to provide a holistic approach to risk mitigation and threat management.
Gain visibility into what and who is on your network—especially un-managed devices. Improve your defenses against advanced threats and create a policy based automated response to potential threats.
Dan McWhorter, Chief Intelligence Strategist, FireEye, John Klassen, Sr. Director, Solutions Marketing, FireEye
Medical devices (biomed) introduce many cybersecurity challenges into healthcare delivery organizations, but what can you do? Connecting medical devices to your network and in turn to your physicians and EMR system increases clinical workflow while opening security holes. Much is out of your control. Device manufacturers control patch cycles and vulnerabilities persist so you segment your network which introduces administration overhead and increases the possibility of breaches due to misconfigurations. As you try harder to improve efficiency, is your environment becoming less secure due to improved connectivity? And what about patient safety when medical devices are connected directly to patients?
Join Dan McWhorter, Chief Intelligence Strategist at FireEye, and John Klassen, Sr Director Solutions Marketing, on this webinar to learn:
•The impact on Healthcare cybersecurity from complex medical device ecosystems
•What kind of attacks connected medical devices are vulnerable to
•Strategies and tools to lower your risk from compromised devices
Register today to understand this emerging threat landscape.
Devon Kerr, Incident Response Manager, Professional Services, Mandiant
Intrusion investigations are a response to the detection of a threat in the environment. Organizations are investing heavily in technology, training, and personnel who can quickly detect and respond to threats after they’ve gained some amount of access to their environments. It’s this process that leads to containment and gives businesses back control.
Companies are getting better at detecting threats as a result, but actors may still have been in the environment for several months before that critical moment when tools and personnel finally detect the bump in the night and the investigative process can begin.
During this conversation, we’ll look at the security ecosystem and some of the reasons why technologies that react to threat activity may not be adequate in this golden age of cyber threats. We’ll also discuss a few of the most important skillsets necessary to cultivate and why personnel and expertise are your secret weapons. Lastly, we’ll suggest some of the most effective sources of evidence to examine as well as some of the analysis techniques you should be using to filter through the noise.
Julian Dana (Director, Latin America, Mandiant), Chris Leach (Chief Technologist, HPE)
No question about it: Information security—or, more precisely, the lack of it—is firmly on the radar for business and information-technology leaders in organizations of all sizes and in every sector. Many executives and managers fear that their companies are ill-prepared to prevent, detect, and effectively respond to various types of cyber attacks, and a shortage of in-house security expertise remains of widespread concern.
Those are among the initial findings of the Cybersecurity Challenges, Risks, Trends, and Impacts Survey, conducted by MIT Technology Review Custom in February 2016. Commissioned by Hewlett Packard Enterprises Security Services and FireEye, join our experts as they discuss this industry survey to uncover:
•Implications of breach impacts for organizations
•Benefits of a risk management strategies
•Current trends in information-security threats
Ron Bushar, Managing Director, Mandiant (a FireEye company)
Over the last decade, cyber security has evolved from a niche concern confined to IT professionals to a major priority for CEOs and boards of directors. Company leaders are now charged with managing cyber risk with the same urgency that they have managed traditional business risk.
The emergence of cyber risk as a centerpiece of risk management is being fueled by new and increasingly complex threats. Organizations must deal with a quickly evolving set of threats to their information systems and data. Many of these threats were unimaginable just a few years ago.
In this discussion, we explain the different forms of cyber risk and show how the threat level has risen in recent years. We also provide a basic framework for managing cyber risk, and finally, we pose five key questions business leaders should ask themselves to ensure their security posture is sufficiently robust and resilient to meet evolving threats.
Register for this webinar today. As usual, we’ll leave time for Q&A.
Mike Resong (Dir, Tech Alliances, FireEye) David Schwartzberg (Sr. Mgr., Security & Privacy, MobileIron)
Mobile technology is driving a massive shift in the IT department’s ability to support the way people want to work and collaborate. In this era of enterprise mobility management (EMM), modern enterprises must deliver native mobile experiences that are available to users anywhere and anytime while ensuring that IT can secure corporate information everywhere.
In this webinar, MobileIron and FireEye experts will speak to:
- What trends we're seeing in the updated mobile security landscape
- How joint customers are leveraging their integrated solution in their corporate environments
- An overview of MobileIron and FireEye's combined solution
This session will also include a preview of what’s coming with FireEye Security Orchestrator and MobileIron’s integration with FireEye’s newest product.
Russell Teague, Managing Director, Mandiant, a FireEye Company
Are you ready to handle a security breach? Russell Teague, Managing Director, Mandiant, a FireEye Company, will discuss the Next Generation of Incident Preparedness. Mandiant is the world leader in Incident Response Management; no other company is involved in more of today's largest breaches. Russell will discuss what companies need to do to be breach ready, and how being proactive in your incident preparedness is essential and could save you from devastating cost.
Incident preparedness is more than having an incident response plan, it's more than having skilled personnel on staff. Come join us in an eye-opening discussion on key elements that every company should consider. Major security breaches have become part of everyone's daily news feed, from the front page of the newspaper to the top of every security blog, you can’t miss the steady flood of new breaches impacting the world today. In today’s every changing world of business and technology, breaches are inevitable, you must be prepared before they happen. Learn how to become prepared from the industry leader in breach management and ultimately control your cost in post breach recovery.
Register now for this compelling discussion on Next Generation Incident Preparedness.
Adam Bosnian, EVP, Global Business Dev, CyberArk, Milan Gavran, TAP Sales Mgr, FireEye
Mandiant Consulting’s 2016 M-Trends report once again shows that cyber attacks follow a regular pattern of crashing through perimeter defenses, obtaining a credential and then using the acquired access to move laterally throughout the network and escalate privileges to complete their primary objective. Once attackers obtain privileged credentials, they can slowly gain control of the entire organization’s IT environment.
This session will focus on how attackers find their way to the heart of enterprises, the role privileged credentials (passwords and SSH keys) play in an active cyber attack, and how the integration of CyberArk Privileged Account Security Solution and the FireEye Threat Analytics Platform (TAP) can help organizations detect, alert and rapidly respond to cyber attacks.
The audience will be walked through a few data breach examples and shown how combining intel from both systems is used to assist in detection and response acceleration. Attendees can expect to gain an advanced understanding of how they can start leveraging their enterprise-wide data and privileged threat analytics to quickly identify and disrupt the most critical in-progress attacks.