Conor Sherman's guest appearances

Conor Sherman

Brakeing Down Security Podcast

Zero Hour Podcast

Personal Foul Podcast

Zane Lackey

Ben Johnson

Ian Edwards

Tony Robinson

Jack Rhysider

Dean Blandino

Marcus Carey

Jared Folkins

Tanya Janca

Sirius XM

James Green

Liz Fong-Jones

Chris Hadnagy

Sean Malone

Adam Baldwin

OwlTail

“Between stimulus and response there is a space. In that space is our power to choose our response. In our response lies our growth and our freedom. --Victor Frankl  https://smile.amazon.com/Mans-Search-for-Meaning-audiobook/dp/B0006IU470   https://twitter.com/conordsherman   Conor Sherman - IR stories and more  Security Strategy and Incident Response, eZCater Confident Defense Podcast - https://www.confidentdefense.com/podcast https://www.linkedin.com/in/conordsherman/   Agenda:  Bio (How did I get here?)   Prior preparation and planning prevents poor performance -  https://military.wikia.org/wiki/7_Ps_(military_adage)  Discover Unique malware FIN 6 -  https://www.zdnet.com/article/cybercrime-group-fin6-evolves-from-pos-malware-to-ransomware/ FIN 7 - https://threatpost.com/fin7-retools/149117/  CCPA - https://oag.ca.gov/privacy/ccpa CIS 20 is ‘reasonable security program’ per California AG -  https://www.prnewswire.com/news-releases/california-attorney-general-concludes-that-failing-to-implement-the-center-for-internet-securitys-cis-critical-security-controls-constitutes-a-lack-of-reasonable-security-300223659.html  IBM breach cost: “Cost Of  A data Breach” (Search This)  https://newsroom.ibm.com/2020-07-29-IBM-Report-Compromised-Employee-Accounts-Led-to-Most-Expensive-Data-Breaches-Over-Past-Year    Cloud Infra Compliance-  Governance as Code -  https://www.cio.com/article/3277611/governance-as-code-keeping-pace-with-the-rate-of-change-in-the-cloud.html  “In the future, governance as code will be the backbone driving our IT systems and services. It will enable us to deliver consistent, efficient and highly repeating business outcomes at the lowest possible cost, with the maximum availability and security, while also allowing our people to expand into new and higher value-add roles across business.”   Detection as Code  “Freedom within Limits” - Security as Solutions Engineers  https://www.howwemontessori.com/how-we-montessori/2020/02/freedom-within-limits-what-it-looks-like-in-our-home-with-three-children.html    Sigma: https://github.com/Neo23x0/sigma  “Sigma is a generic and open signature format that allows you to describe relevant log events in a straightforward manner. The rule format is very flexible, easy to write and applicable to any type of log file.”   Japan CIRT event ID whitepaper:  https://www.jpcert.or.jp/english/pub/sr/DetectingLateralMovementThroughTrackingEventLogs_version2.pdf  https://jpcertcc.github.io/ToolAnalysisResultSheet/   https://shield.mitre.org/  “Shield is an active defense knowledge base MITRE is developing to capture and organize what we are learning about active defense and adversary engagement. Derived from over 10 years of adversary engagement experience, it spans the range from high level, CISO ready considerations of opportunities and objectives, to practitioner friendly discussions of the TTPs available to defenders.” IR Playbooks -   process of creating them (probably the hardest) Implementation Tabletop exercise (length, stakeholders, crafting a scenario to compare against)   What if an org has nothing? “We just blow up the environment and start over."   RTO/RPO metrics: How long can you survive as a company with an outage? How long does it take to get back online and operational? What’s your appetite for the risk of that?   Lots of dependencies to creating    https://swimlane.com/blog/incident-response-playbook   Tabletop discussion -   sponsors involved Initiating condition Threat modeling Process steps Best practices and local policies End state - what is the goal? (eradicate infection, back to operating status) Relation to governance/regulatory reqs. (do we have to report? What do we report? Fallout from incident, etc) Lessons Learned    https://sbscyber.com/resources/7-steps-to-building-an-incident-response-playbook (seems like there are different methodologies)   Why are the things that will give organizations the biggest benefit over time the cause of the most consternation?   Check out our Store on Teepub! https://brakesec.com/store Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com #AmazonMusic: https://brakesec.com/amazonmusic  #Brakesec Store!: https://brakesec.com/teepub  #Spotify: https://brakesec.com/spotifyBDS  #Pandora: https://brakesec.com/pandora  #RSS: https://brakesec.com/BrakesecRSS #Youtube Channel:  http://www.youtube.com/c/BDSPodcast #iTunes Store Link: https://brakesec.com/BDSiTunes #Google Play Store: https://brakesec.com/BDS-GooglePlay Our main site:  https://brakesec.com/bdswebsite #iHeartRadio App:  https://brakesec.com/iHeartBrakesec #SoundCloud: https://brakesec.com/SoundcloudBrakesec Comments, Questions, Feedback: bds.podcast@gmail.com Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon https://brakesec.com/BDSPatreon #Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir #Player.FM : https://brakesec.com/BDS-PlayerFM #Stitcher Network: https://brakesec.com/BrakeSecStitcher #TuneIn Radio App: https://brakesec.com/TuneInBrakesec #cybersecurity #informationsecurity #leadership #podcasts #CPEs #CISSP

“Between stimulus and response there is a space. In that space is our power to choose our response. In our response lies our growth and our freedom. --Victor Frankl <a href="https://smile.amazon.com/Mans-Search-for-Meaning-audiobook/dp/B0006IU470" rel="nofollow" target="_blank"> https://smile.amazon.com/Mans-Search-for-Meaning-audiobook/dp/B0006IU470</a> <a href="https://twitter.com/conordsherman" rel="nofollow" target="_blank">https://twitter.com/conordsherman</a> Conor Sherman - IR stories and more  Security Strategy and Incident Response, eZCater Confident Defense Podcast - <a href="https://www.confidentdefense.com/podcast" rel="nofollow" target="_blank">https://www.confidentdefense.com/podcast</a> <a href="https://www.linkedin.com/in/conordsherman/" rel="nofollow" target="_blank">https://www.linkedin.com/in/conordsherman/</a> Agenda:  Bio (How did I get here?) Prior preparation and planning prevents poor performance - <a href="https://military.wikia.org/wiki/7_Ps_(military_adage)" rel="nofollow" target="_blank"> https://military.wikia.org/wiki/7_Ps_(military_adage)</a> Discover Unique malware FIN 6 - <a href="https://www.zdnet.com/article/cybercrime-group-fin6-evolves-from-pos-malware-to-ransomware/" rel="nofollow" target="_blank"> https://www.zdnet.com/article/cybercrime-group-fin6-evolves-from-pos-malware-to-ransomware/</a> FIN 7 - <a href="https://threatpost.com/fin7-retools/149117/" rel="nofollow" target="_blank">https://threatpost.com/fin7-retools/149117/</a> CCPA - <a href="https://oag.ca.gov/privacy/ccpa" rel="nofollow" target="_blank">https://oag.ca.gov/privacy/ccpa</a> CIS 20 is ‘reasonable security program’ per California AG - <a href="https://www.prnewswire.com/news-releases/california-attorney-general-concludes-that-failing-to-implement-the-center-for-internet-securitys-cis-critical-security-controls-constitutes-a-lack-of-reasonable-security-300223659.html" rel="nofollow" target="_blank"> https://www.prnewswire.com/news-releases/california-attorney-general-concludes-that-failing-to-implement-the-center-for-internet-securitys-cis-critical-security-controls-constitutes-a-lack-of-reasonable-security-300223659.html</a> IBM breach cost: “Cost Of  A data Breach” (Search This) <a href="https://newsroom.ibm.com/2020-07-29-IBM-Report-Compromised-Employee-Accounts-Led-to-Most-Expensive-Data-Breaches-Over-Past-Year" rel="nofollow" target="_blank"> https://newsroom.ibm.com/2020-07-29-IBM-Report-Compromised-Employee-Accounts-Led-to-Most-Expensive-Data-Breaches-Over-Past-Year</a> Cloud Infra Compliance-  Governance as Code - <a href="https://www.cio.com/article/3277611/governance-as-code-keeping-pace-with-the-rate-of-change-in-the-cloud.html" rel="nofollow" target="_blank"> https://www.cio.com/article/3277611/governance-as-code-keeping-pace-with-the-rate-of-change-in-the-cloud.html</a> “In the future, governance as code will be the backbone driving our IT systems and services. It will enable us to deliver consistent, efficient and highly repeating business outcomes at the lowest possible cost, with the maximum availability and security, while also allowing our people to expand into new and higher value-add roles across business.” Detection as Code  “Freedom within Limits” - Security as Solutions Engineers <a href="https://www.howwemontessori.com/how-we-montessori/2020/02/freedom-within-limits-what-it-looks-like-in-our-home-with-three-children.html" rel="nofollow" target="_blank"> https://www.howwemontessori.com/how-we-montessori/2020/02/freedom-within-limits-what-it-looks-like-in-our-home-with-three-children.html</a> Sigma: <a href="https://github.com/Neo23x0/sigma" rel="nofollow" target="_blank">https://github.com/Neo23x0/sigma</a> “Sigma is a generic and open signature format that allows you to describe relevant log events in a straightforward manner. The rule format is very flexible, easy to write and applicable to any type of log file.” Japan CIRT event ID whitepaper: <a href="https://www.jpcert.or.jp/english/pub/sr/DetectingLateralMovementThroughTrackingEventLogs_version2.pdf" rel="nofollow" target="_blank"> https://www.jpcert.or.jp/english/pub/sr/DetectingLateralMovementThroughTrackingEventLogs_version2.pdf</a> <a href="https://jpcertcc.github.io/ToolAnalysisResultSheet/" rel="nofollow" target="_blank">https://jpcertcc.github.io/ToolAnalysisResultSheet/</a> <a href="https://shield.mitre.org/" rel="nofollow" target="_blank">https://shield.mitre.org/</a> “Shield is an active defense knowledge base MITRE is developing to capture and organize what we are learning about active defense and adversary engagement. Derived from over 10 years of adversary engagement experience, it spans the range from high level, CISO ready considerations of opportunities and objectives, to practitioner friendly discussions of the TTPs available to defenders.” IR Playbooks -   process of creating them (probably the hardest) Implementation Tabletop exercise (length, stakeholders, crafting a scenario to compare against) What if an org has nothing? “We just blow up the environment and start over." RTO/RPO metrics: How long can you survive as a company with an outage? How long does it take to get back online and operational? What’s your appetite for the risk of that? Lots of dependencies to creating  <a href="https://swimlane.com/blog/incident-response-playbook" rel="nofollow" target="_blank">https://swimlane.com/blog/incident-response-playbook</a> Tabletop discussion - sponsors involved Initiating condition Threat modeling Process steps Best practices and local policies End state - what is the goal? (eradicate infection, back to operating status) Relation to governance/regulatory reqs. (do we have to report? What do we report? Fallout from incident, etc) Lessons Learned <a href="https://sbscyber.com/resources/7-steps-to-building-an-incident-response-playbook" rel="nofollow" target="_blank"> https://sbscyber.com/resources/7-steps-to-building-an-incident-response-playbook</a> (seems like there are different methodologies) Why are the things that will give organizations the biggest benefit over time the cause of the most consternation? Check out our Store on Teepub! <a href="https://brakesec.com/store" rel="nofollow" target="_blank">https://brakesec.com/store</a> Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email <a href="mailto:bds.podcast@gmail.com">bds.podcast@gmail.com</a> #AmazonMusic: <a href="https://brakesec.com/amazonmusic" rel="noopener nofollow" target="_blank">https://brakesec.com/amazonmusic</a> #Brakesec Store!: <a href="https://brakesec.com/teepub" rel="noopener nofollow" target="_blank">https://brakesec.com/teepub</a> #Spotify: <a href="https://brakesec.com/spotifyBDS" rel="noopener nofollow" target="_blank">https://brakesec.com/spotifyBDS</a> #Pandora: <a href="https://brakesec.com/pandora" rel="noopener nofollow" target="_blank">https://brakesec.com/pandora</a> #RSS: <a href="https://brakesec.com/BrakesecRSS" rel="noopener nofollow" target="_blank">https://brakesec.com/BrakesecRSS</a> #Youtube Channel:  <a href="http://www.youtube.com/c/BDSPodcast" rel="noopener nofollow" target="_blank">http://www.youtube.com/c/BDSPodcast</a> #iTunes Store Link: <a href="https://brakesec.com/BDSiTunes" rel="noopener nofollow" target="_blank">https://brakesec.com/BDSiTunes</a> #Google Play Store: <a href="https://brakesec.com/BDS-GooglePlay" rel="noopener nofollow" target="_blank">https://brakesec.com/BDS-GooglePlay</a> Our main site:  <a href="https://brakesec.com/bdswebsite" rel="noopener nofollow" target="_blank">https://brakesec.com/bdswebsite</a> #iHeartRadio App:  <a href="https://brakesec.com/iHeartBrakesec" rel="noopener nofollow" target="_blank">https://brakesec.com/iHeartBrakesec</a> #SoundCloud: <a href="https://brakesec.com/SoundcloudBrakesec" rel="noopener nofollow" target="_blank">https://brakesec.com/SoundcloudBrakesec</a> Comments, Questions, Feedback: <a href="mailto:bds.podcast@gmail.com">bds.podcast@gmail.com</a> Support Brakeing Down Security Podcast by using our #Paypal: <a href="https://brakesec.com/PaypalBDS" rel="nofollow" target="_blank">https://brakesec.com/PaypalBDS</a> OR our #Patreon <a href="https://brakesec.com/BDSPatreon" rel="nofollow" target="_blank">https://brakesec.com/BDSPatreon</a> #Twitter: <a href="https://twitter.com/brakesec" rel="noopener nofollow" target="_blank">@brakesec</a> <a href="https://twitter.com/boettcherpwned" rel="noopener nofollow" target="_blank">@boettcherpwned</a> <a href="https://twitter.com/bryanbrake" rel="noopener nofollow" target="_blank">@bryanbrake</a> <a href="https://twitter.com/infosystir" rel="noopener nofollow" target="_blank">@infosystir</a> #<a href="http://Player.FM" rel="nofollow" target="_blank">Player.FM</a> : <a href="https://brakesec.com/BDS-PlayerFM" rel="noopener nofollow" target="_blank">https://brakesec.com/BDS-PlayerFM</a> #Stitcher Network: <a href="https://brakesec.com/BrakeSecStitcher" rel="noopener nofollow" target="_blank">https://brakesec.com/BrakeSecStitcher</a> #TuneIn Radio App: <a href="https://brakesec.com/TuneInBrakesec" rel="noopener nofollow" target="_blank">https://brakesec.com/TuneInBrakesec</a> #cybersecurity #informationsecurity #leadership #podcasts #CPEs #CISSP

2020-041- Conor Sherman, IR stories, cost of not prepping for an incident

Fox Sports Charlotte's Conor Sherman joins the show and talks Yankees, Antonio Brown, Pittsburgh Steelers and NHL Hockey!

Fox Sports Charlotte's, Conor Sherman

Conor is currently VP of Security at Clear after recently leaving Apollo Global Management as Director of Cyber Security. Conor has successfully built, redesigned, and reinvigorated cyber security programs for fast paced, high performing companies. By leveraging security orchestration and automation (SOAR), and machine learning techniques, Conor delivers highly effective Security Operation Centers (SOCs), Threat Intelligence and hunting capabilities.The programs are aligned with business objectives, and bring exponential threat reduction with incremental investment. He takes a “hands on” leadership style and builds programs with a first principles mindset following the Agile methodology. Key minutes07:25 - What Cyber Security Means08:30 - Defining Confidence10:30 - Why would a organisation spend more on Cyber Security?17:50 - How would you go out and assess vulnerabilities within an organisation?22:15 - Would knowing your vulnerabilities help organisations move forwards23:50 - The difference between a SOC and a threat intelligence program27:00 - External vs internal threats30:10 - Implementing these into any organisation35:00 - The difference between a threat intelligence and threat hunter program38:40 - Selecting the right vendors44:25 - How long does it to build a program?46:00 - What does success look like?49:10 - Building the next generation of Investigation centresKey Points- Everything with Cyber Security has to bring integrity, trust and confidence- Security needs to be integrated within everything from day one- Threat intelligence is your lead indicator of an attack. SOC is your response. Threat hunting is you being pro-active before an attack has or is about to happen.You can find:Conor on LinkedIn at: https://www.linkedin.com/in/conordshermanConor on Twitter at: https://twitter.com/conordsherman?lang=enConor on Medium at: https://medium.com/@ConorDShermanFollow us:Twitter: @zero_hourpodInstagram: @zerohourexperienceWebsite: www.karlsharman.comThis podcast is sponsored by:BeecherMadden - www.beechermadden.comCyber Security Professionals - www.cybersecurity-professionals.com

Conor is currently VP of Security at Clear after recently leaving Apollo Global Management as Director of Cyber Security. Conor has successfully built, redesigned, and reinvigorated cyber security programs for fast paced, high performing companies. By leveraging security orchestration and automation (SOAR), and machine learning techniques, Conor delivers highly effective Security Operation Centers (SOCs), Threat Intelligence and hunting capabilities. The programs are aligned with business objectives, and bring exponential threat reduction with incremental investment. He takes a “hands on” leadership style and builds programs with a first principles mindset following the Agile methodology.  Key minutes 07:25 - What Cyber Security Means 08:30 - Defining Confidence 10:30 - Why would a organisation spend more on Cyber Security? 17:50 - How would you go out and assess vulnerabilities within an organisation? 22:15 - Would knowing your vulnerabilities help organisations move forwards 23:50 - The difference between a SOC and a threat intelligence program 27:00 - External vs internal threats 30:10 - Implementing these into any organisation 35:00 - The difference between a threat intelligence and threat hunter program 38:40 - Selecting the right vendors 44:25 - How long does it to build a program? 46:00 - What does success look like? 49:10 - Building the next generation of Investigation centres Key Points - Everything with Cyber Security has to bring integrity, trust and confidence - Security needs to be integrated within everything from day one - Threat intelligence is your lead indicator of an attack. SOC is your response. Threat hunting is you being pro-active before an attack has or is about to happen. You can find: Conor on LinkedIn at: <a href="https://www.linkedin.com/in/conordsherman" rel="nofollow" target="_blank">https://www.linkedin.com/in/conordsherman</a> Conor on Twitter at: <a href="https://twitter.com/conordsherman?lang=en" rel="nofollow" target="_blank">https://twitter.com/conordsherman?lang=en</a> Conor on Medium at: <a href="https://medium.com/@ConorDSherman" rel="nofollow" target="_blank">https://medium.com/@ConorDSherman</a> Follow us: Twitter: @zero_hourpod Instagram: @zerohourexperience Website: <a href="http://www.karlsharman.com" rel="nofollow" target="_blank">www.karlsharman.com</a> This podcast is sponsored by: BeecherMadden - <a href="http://www.beechermadden.com" rel="nofollow" target="_blank">www.beechermadden.com</a> Cyber Security Professionals - <a href="http://www.cybersecurity-professionals.com" rel="nofollow" target="_blank">www.cybersecurity-professionals.com</a>

Conor Sherman - Vulnerabilities, threat intelligence and hunting