Name: Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits
Start: 2024-01-18T17:00:00Z
End: 2024-01-18T17:00:29.000Z
Location: BrightTALK
Rating: 4.6

Mandiant is a recognized leader in dynamic cyber defense, threat intelligence and incident response services. By scaling decades of frontline experience, Mandiant helps organizations to be confident in their readiness to defend against and respond to cyber threats. Mandiant is part of Google Cloud.

Mandiant Managed Defense presents a quarterly webinar series, "Tales from the Trenches," to help you navigate the ever-evolving threat landscape. Our security experts will dive into the latest malware and attack trends they've encountered in the previous quarter. You'll gain valuable insights into how these threats were detected, along with actionable advice to strengthen your own defenses.
In the second installment of the series, Managed Defense Consultants will detail findings from July through September 2024.

Tales from the Trenches: Malware and attack trends from Managed Defense

Threat intelligence is the cornerstone of a proactive security posture, but traditional approaches often fall short. Static reports and delayed updates leave security teams struggling to keep pace with the speed of cyberattacks. To stay ahead of threats we need something more dynamic to provide us with more up-to-date and actionable threat intelligence. 

Join Emiliano Martinez, Lead Product Manager and TJ Alldridge, Product Marketing Manager as they explore:
*How dynamic threat intelligence will empower security professionals to use threat intelligence more efficiently. 
*The power of trusted circles - highlighting the power of community and collaboration to keep everyone more safe. 
*AI and automation - making threat intelligence more actionable than ever before.

Join us to unlock the future of threat intelligence and transform your security operations

The Evolution to Dynamic Threat Intelligence

As cyber threats grow in sophistication, securing a leg up as the defender is more important than ever. When going toe-to-toe with adversaries in your environment, you have the control, but organizations often struggle to capitalize on this advantage. 

The Defender’s Advantage is an award-winning framework that provides actionable strategies to enhance your cyber defense capabilities and serves as a blueprint for pivoting seamlessly between breach preparedness and immediate action.  

During this webinar, our experts will unlock the six critical functions of an effective cyber defense program: intelligence, detect, respond, validate, hunt, and mission control. They will also explain how each function plays a distinct yet interconnected role in protecting an organization's critical assets, and provide real-world examples on how this framework can be applied.
  
You will walk away from this webinar knowing how to:
*Develop a proactive and intelligence-led approach to cyber defense
*Activate the six critical functions of cyber defense to boost the resilience of your security program 
*Leverage tools that can enhance your overall security posture and help build an effective operating model

Who should attend:
*CIOs, CISOs, and security leaders and practitioners
*IT professionals responsible for cybersecurity
*Anyone interested in learning more about modern cyber defense

Speakers:
Dan Nutting, Consulting Manager, Mandiant, part of Google Cloud Security
Nate Toll, Consulting Manager, Mandiant, part of Google Cloud Security
Jennifer Guzzetta, Product Marketing Manager (Moderator)

Unlock your Defender's Advantage: A powerful framework for activating effective cyber defense

In the rapidly evolving landscape of cyber warfare, understanding and responding to the latest threats is crucial. This session offers unparalleled insights tailored to the frontline incident response and threat intelligence experts who tackle high-impact cyberattacks daily. We will cover the current threat landscape, evolutions in the attack surface, the role of AI in cybersecurity, advancements and shortcomings in defenses, and how Google Cloud is helping to bridge critical security gaps. Join us to equip yourself with the knowledge and strategies needed to navigate the complexities of modern cyber threats.

Key discussion points:

Current Threat Landscape: Identifying the most significant attacks and attackers impacting organizations today. Understand the prevalent and dangerous cyber threats that enterprises face.

Evolving Attack Surface: Assessing how the attack surface has changed over the past year and the implications for security strategies. Explore how digital transformation and remote work have expanded vulnerabilities.

AI in Cybersecurity: Exploring the dual role of AI in both facilitating cyber attacks and bolstering cybersecurity defenses. Discuss how AI is used by adversaries and defenders alike.

Defensive Adaptations: Reviewing the advancements and shortcomings in security defenses over the past year. Highlight effective measures, existing gaps, and innovative solutions.

An In Depth Look at AI & the Evolving Cyber Threat Landscape

In the face of increasingly sophisticated and relentless cyber threats, Security Operations Centers (SOCs) are turning to Artificial Intelligence (AI) to bolster their defenses. This webinar explores the transformative potential of AI in modernizing SOCs, enhancing threat detection, automating incident response, and empowering security analysts.

Key Takeaways:

- Discover how AI can augment human capabilities and streamline security operations.
- Learn about real-world use cases of AI in threat detection, incident response, and vulnerability management.
- Understand the key considerations and best practices for implementing AI in your SOC.

The AI-Powered SOC: Transforming Cybersecurity Defense

Ethical AI is the new code of conduct and we’re in the midst of an industrial revolution based on synthetic intelligence.

The Keys to the Kingdom: Security and Governance for Generative AI

Today, it’s more imperative than ever to stay one step ahead of the threat by understanding the most common  tactics, techniques, and procedures (TTPs). We continue to observe threat actors from cyber criminal groups evolve their TTPs for ransomware and multi-faceted extortion operations and see a surge in compromises originate with credential compromise and highly effective social engineering attacks.

In this webinar, we will shed light on the latest trends and real-world insights into initial access vectors and TTPs observed across the attack lifecycle, dive into the current ransomware-as-a-service (RaaS) landscape,  and provide defensive recommendations for your organization based on Google Threat Intelligence analysis of the threat as well as expert Mandiant incident response investigation insights.

What you will learn:

*Latest trends and insights into initial access vectors, tools, and tactics, techniques, and procedures observed across the attack life cycle
*Insights into the current ransomware-as-a-service (RaaS) landscape
*Practical defensive recommendations and preparedness strategies from frontline Mandiant Incident Response investigations

Presenters: 

Josh Madeley, Regional Lead, Mandiant Incident Response
Josh Stern, Senior Analyst, Google Threat Intelligence
Greg Kapourellos, Lead, Google Threat Intelligence Advisors (moderator)

Evolution of Ransomware and Data Theft Extortion: Expert Insights and Defense Strategies

Mandiant Managed Defense presents a quarterly webinar series, "Tales from the Trenches," to help you navigate the ever-evolving threat landscape. Our security experts will dive into the latest malware and attack trends they've encountered in the previous quarter. You'll gain valuable insights into how these threats were detected, along with actionable advice to strengthen your own defenses.

In the second installment of the series, Managed Defense Consultants will detail findings from April through June 2024, including:

*Exploiting tax season with tax-theme phishing emails to deliver DARKGATE malware 
*Malicious JavaScript droppers from attempts to download pirated films
*Trojanized software campaign leads to backdoor deployment

Tales from the Trenches: Malware and attack trends from Managed Defense, Q2 2024

Artificial intelligence (AI) is poised to revolutionize how federal agencies operate, enhancing mission effectiveness and streamlining processes. However, the integration of AI also introduces unique cybersecurity challenges in the government context. How can federal IT leaders harness the transformative power of AI while ensuring the protection of sensitive data and critical systems?

Google Cloud Security partnered with market research firm Market Connections to determine how leaders are moving into the AI era with a strong focus on security. Join GovExec and Google Cloud Security as we share the findings of this study and look at next steps for the intersection of AI and security. 

You’ll learn about:

- The evolving threat landscape specific to public sector organizations
- Understanding the specific cybersecurity risks faced by federal agencies in the adoption of AI, including foreign interference, data breaches, and insider threats
- Security frameworks and best practices and strategies for government
- Critical AI capabilities for government
- Building trust in government; ethical considerations and privacy concerns
- Practical next steps for government

Secure AI: Mitigating Risk in the Age of Innovation

Organizations today face the growing challenge of pulling actionable insights from the noise surrounding generative AI, as media hype often overshadows the technology's practical implications. Because of this, it’s critical to have a clear understanding of what generative AI actually is and what it isn't.

In this webinar, we will demystify the benefits, challenges, and risks of AI based on our frontline observations. From there, we will help you adopt a practical framework to assess the security of AI in your environment and outline actionable strategies to improve your specific AI security approach.

You will also walk away with knowledge of a three-pronged approach that organizations can take to secure their existing AI solutions by:

*Assessing your security posture
*Performing threat modeling for your AI solutions
*Executing threat hunting across your AI pipeline

Presenters: 
Muhammad Muneer, Principal Consultant, Mandiant, Google Cloud Security
Dan Browne, Senior Consultant, Mandiant, Google Cloud Security
Jennifer Guzzetta, Product Marketing Manager, Mandiant, Google Cloud Security (Moderator)

An Actionable Approach to Assess and Improve the Security of Your AI Solutions

Elevate your threat hunting expertise by joining a live session with a leading Google Threat Intelligence researcher and a seasoned threat hunting expert. In this hands-on session, we'll guide you through the entire threat hunting process, from crafting your pipeline to executing various hunt types. We'll delve into the strategic and tactical use of Google Threat Intelligence to uncover critical insights, identify pivot points, and pinpoint additional indicators of compromise (IOCs) for your hunts.

Threat Hunting with Google Threat Intelligence

Join our webinar to learn how AI in Google Threat Intelligence helps your team uncover hidden threats, streamline investigations, and make faster, more informed decisions. See how AI is transforming threat intelligence in real-world scenarios.

Gemini in Threat Intelligence analyzes vast datasets and acts as a force multiplier, immediately surfacing threats most relevant to your unique risk profile, reducing the noise of generic alerts. It continuously learns from your actions, tailoring its output to become increasingly relevant to your specific needs over time.

Use Cases in Threat Intelligence: Leveraging Gemini

Outsmart attackers and protect your organization with intelligence-driven vulnerability management. In this webinar, Google threat intelligence experts will demonstrate how to prioritize vulnerabilities based on active exploit risk, get early warnings on threats, maximize patch efficiency, and reduce your attack surface.

Use Cases in Threat Intelligence: Making Vulnerability Management Easier

Join Mandiant Consulting experts as they examine the opportunities and proven methodologies to align cybersecurity with an organization’s business priorities or mission. As security professionals, elements of our shared experience often include unclear priorities, difficulty achieving project goals, and friction with cross-functional stakeholders. These elements can contribute to a culture of compounded apathy towards security teams and deprioritization of security initiatives. 

In this session, we’ll discuss how security teams can effectively and efficiently implement short- and long-term objectives through a newfound partnership with their organizational stakeholders. Additionally, we’ll cover how CISOs and security leaders can help plan and execute against a strategy that brings security to the forefront of an organization for critical risk mitigation.

Attendees will leave this session with knowledge on how to:
 - Make security initiatives more visible across an organization
 - Increase a security team’s throughput and optimize its operations
 - Develop a cohesive security strategy that aligns to organizational objectives
 - Optimize security work to reduce attrition and enable business success

How To Optimize and Accelerate Cybersecurity Initiatives for Your Business

Discover how to streamline your security operations and maximize your threat intelligence investment. In this webinar, we'll explore essential use cases for Google Threat Intelligence, showcasing how it can empower your IOC Enrichment, Incident Response and Forensics, Threat Hunting, Brand Protection and Vulnerability Management.

Join us for a hands-on demonstration of each use case and see benefits of faster threat detection and proactive defense strategies.

Use Cases in Threat Intelligence: Turn Insights into Action

Whether you're a security engineer, IT professional, or simply someone concerned about protecting your organization's information, this webinar will showcase how AI can transform the way you approach security. 
 
Join us to learn how to strengthen your defenses, enhance threat detection, and improve response. Our expert speakers will demystify the complexity of AI and guide you through its practical applications in the realm of cybersecurity - even if you aren't an expert.

Unleashing AI for cybersecurity: Empowering non-experts to take action

The M-Trends 2024 Special Report provides an inside look at the latest cyber trends and attacker operations from around the globe. The second half of the report is dedicated to deep insights drawn directly from the frontlines of Mandiant investigations and threat intelligence findings that have shaped today’s evolving cyber threat landscape.

Join six of our report authors and experts on May 23, 2024 at 12:00pm ET as they share their point of view on these hot topics and provide best practice solutions to help improve your cyber defense capabilities in these areas.

Topics will include:
- China-nexus attackers targeting edge devices and platforms that lack EDR
- Trending adversary operations and motivations behind zero-day attacks
- The evolution of phishing techniques amidst modern security controls
- How attackers leverage AiTM to compromise MFA safeguards
- The reasons and solutions behind growing cloud and hybrid cloud intrusions
- How AI is effectively used in red and purple teams to help boost cyber defenses

Presenters:
Ryan Tomcik, Principal Security Analyst, Mandiant - Google Cloud Security
Mathew Potaczek, Principal Threat Analyst, Mandiant - Google Cloud Security
Josh Fleischer, Principal Security Analyst, Mandiant - Google Cloud Security
James Sadowski, Principal Intelligence Analyst, Google Cloud Security
Tucker Clark, Senior Security Consultant, Mandiant - Google Cloud Security
Josh Madeley, Regional Lead, Mandiant - Google Cloud Security
Jennifer Guzzetta, Product Marketing - Google Cloud Security (Moderator)

M-Trends 2024 Round Up: Expert Insights on 6 Key Topics

The M-Trends 2024 Special Report provides an inside look at the latest cyber trends and attacker operations from around the globe. Packed with timely data from Mandiant frontline incident response investigations and threat intelligence findings between January 1, 2023 - December 31, 2023, readers can increase their awareness of the evolving cyber threat landscape and glean new, effective ways to stay on top of their cyber defense game.

Join two of our top threat analysts on May 21, 2024 at 12:00pm ET as they discuss these trending metrics and notable adversary behaviors. Learn how these findings can affect your security approach to future compromise. 

Topics will include:
- Global and regional dwell times
- Detection by source trends
- Industry targeting metrics
- New threat actor techniques, motivations, and behaviors
- Top infection vectors and malware families
- Ransomware attack developments
- And more!

M-Trends 2024: By the Numbers of Today's Top Cyber Threats & Attacker Operations

Suspected espionage group, UNC5221, has launched a sophisticated cyberattack exploiting zero-day vulnerabilities recently disclosed (CVE-2023-46805 and CVE-2024-21887) by Ivanti in their Connect Secure (ICS) VPN and Policy Secure (IPS) appliances. 

Please join Mandiant’s John Wolfram, Matt Lin, and Robert Wallace as they shed light on this suspected espionage campaign, including:

*Technical Analysis: We'll dissect UNC5221's custom malware arsenal, including the ZIPLINE backdoor, THINSPOOL dropper, LIGHTWIRE and WIREFIRE web shells, and WARPWIRE credential harvester.

*Attacker Motivations and Tactics: Explore UNC5221's suspected espionage objectives and the strategic use of compromised edge infrastructure for command and control.

*Remediation and Defense Strategies: Learn concrete steps to mitigate these vulnerabilities, deploy Ivanti's Integrity Checker Tool (ICT), and strengthen your defenses against future zero-day attacks.

This webinar is designed for IT security professionals, network administrators, and anyone concerned about zero-day exploits and espionage campaigns.

Presenters:

Andrew Kopcienski, Principal Analyst (Moderator)
Matt Lin, Consultant, Incident Response
Robert Wallace, Consultant, Incident Response
John Wolfram, Sr. Threat Analyst

Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits

Threat Analysis

Threat Detection

Incident Response

Incident Resolution

Incident Detection

Cyber Attacks

Zero Day Threats

Vulnerabilities

Vulnerability Intelligence

Vulnerability Management

Cloud computing has exploded over the past few years, delivering a previously unimagined level of workplace mobility and flexibility. The cloud computing community on BrightTALK is made up of thousands of engaged professionals learning from the latest cloud computing research and resources. Join the community to expand your cloud computing knowledge and have your questions answered in live sessions with industry experts and vendor representatives.

Cloud Computing

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The data center management community focuses on the holistic management and optimization of the data center. From technologies such as virtualization and cloud computing to data center design, colocation, energy efficiency and monitoring, the BrightTALK data center management community provides the most up-to-date and engaging content from industry experts to better your infrastructure and operations. Engage with a community of your peers and industry experts by asking questions, rating presentations and participating in polls during webinars, all while you gain insight that will help you transform your infrastructure into a next generation data center.

Data Center Management

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits

Presented by

About this talk

More from this channel