Differentiating Evil from Benign in the Normally Abnormal World - SANS Threat Hunting Summit 2018

Подробнее о видео

Have you ever been positive you had found evil, only to realize it was normal after hours of triage and work? We have all heard and love “KNOW NORMAL FIND EVIL,” but how hard is it to actually know normal? The MITRE ATT&CK Framework gives defenders a better map to “find evil,” but how can this framework be used to “know normal”?

Rick will discuss how knowing normal in a world of abnormal is harder than one thinks, and how addressing the actual root cause of evil can improve the technology industry as a whole.

Rick McElroy, Security Strategist, Carbon Black
Rick McElroy, security strategist for Carbon Black, has more than 15 years of information security
experience educating and advising organizations on reducing their risk posture and tackling tough
security challenges. He has held security positions with the U.S. Department of Defense, and in several
industries including retail, insurance, entertainment, cloud computing, and higher education. McElroy’s
experience ranges from performing penetration testing to building and leading security programs. He is
a Certified Information Systems Security Professional (CISSP), a Certified Information Security Manager
(CSIM), and Certified in Risk and Information Systems Control (CRISC). As a United States Marine,
McElroy’s work included physical security and counterterrorism services. A fierce advocate for privacy
and security who believes education and innovation are the keys to improving the security landscape,
McElroy is program chair for the Securing Our eCity Foundation’s annual CyberFest, a San Diego event
dedicated to educating public and private sector security and IT professionals and business executives
on the realities of security