Hello. My name is David. Welcome to handling incidence. We're gonna talk about a broad number of fools. I'll probably make some recommendations as we go through. I has a say in the next.
he asks, I'm teaching the scores. Yes, I've got experience. Yes, handle incidents myself before from ground up and talked down. However,
I if you go to any kind of a class in cyber security, even the instructors tell you there are no experts
because there's always more to learn. There's always a new attack coming servicing. There's a new skill that you need to learn. So coming across a friend of thousands of expert is always something that hasn't
because there's always somebody that knows more than you know, one and number two I.
So it pays to be humble in this view, I'd be willing to learn, And when it comes to tools, that's especially
because there are a ton of tools out there. They'll help you with handling, and it's
I can't give you exposure to all of them. I myself have exposure at all because there's just such a vast variety of the mountains. Keep that in mind as we start talking about our two kids together.
First of all, um, and this is far too often. Look, if you need a good method for recording everything that happens stories,
a lot of companies that I've dealt with in the past used templates you something in and say a word document or a Nextel sprint. Um,
and I chucked with that because that's still probably one of the most common methods of recording. What's going on There is, or one note for Microsoft or Google dot of some sort here in the recent past. New technology on dhe I use that term loosely here
because sores have come into play.
Soldiers are a great tool to be able to use if your company will buy you one.
because what they do is they actually combine these three different technologies, which is why I use that term loosely sore as a total package because it's actually three different ones. On one the first you get security workers spiritual. Then you get threat intelligence, and the you also get is that response
methodologies the road in there
part of that spelling mistake on on this the stones, I'm gonna point that out before somebody else does to say no, but a sore can do a lot to help you
record these aspects of mints in it. Now I used Excel spreadsheets. I used one new.
I've used a shared drive and internal shared drive. All those things can be used. Hello.
Sore is probably the way todo I probably vision works. I personally think it's the waiting
some sister does. See, here's the iose, those in the executive level.
I forgot where they came from. Maybe, Or we're never there in the first place. I'm not sure, but any time a new technology comes along a new process,
it needs to be investigated. And if it's good, the *** and sore is proven.
There are a lot of different upcoming companies that use and sell soars. So I'm not gonna get into the degree of all these different companies. Kind of gives beyond the scope of our time here together. But what It is basically sore stand for security orchestration, automation in response,
and it isn't an enhancement for his response. And
I know what play on this, because I want to build your enthusiastic support to when I worked with an M s S p. We fought battle. Get a sore, enduring incident response.
were not going along with the bourbon. Um, in the private feel again, Soar has come up again. Begin again. But yet no funding ever comes forward to put implement a sore in the environment. And that is disgraced.
Um, hopefully nobody that I
No, I will actually hear some of this, but those that I work with will say, Oh, yeah, he's right. Uh, if you're a sea level executive or your director level, put this on your most of things to get fight four, please.
Because your team needs seats. A sore can do so much to mediate time issues, personnel issues. I can't stress it enough when it comes. It's handling that you need this overarching tool that brains and your security tools brings in your threat intelligence.
It brings in your instant response processes
and it automates learned portions of that. Take that off your team.
They right now are trying to fill out itself spreadsheets, one news there
gathering information from our reviews of memory analysis, forensic reviews, and then they're happy to take that information and translated a word document translated one that you see where I'm going with that. So what a waste of time and energy
s O a sore can alleviate about. It's important, important tool in its him. Now you need lists, contact lists, names, numbers about numbers of key stakeholders. I've seen this in everything from re grain binders
It could be incorporated into a source. Well, now these need to be,
But they turned on external because you're gonna need all of the people that you need. You have to have during an incident, and you don't want to have to be searching for, You know, back in my day, they used something called a Rolex.
How many of you have ever seen
Now, though, that's all changed. So you got that list. You've got notification list. They need to be kept up to date. Need legal resources, technical resources. You're gonna need public relations. It's ah, huge element in any incident. Especially one that's gonna go public.
Um, because you'll have the old negative press. You'll have to deal with people calling in several of the waters of bridges here in the recent past. They actually have to set up our call centers in order to be able to handle the amount of calls that were coming in.
So all these things were things that you need business inhaler considering and asking about
when it comes to the entire process. Now there's even more or less than you need. That's just my cat. I'm gonna drop it in. There's, uh,
you need port list. Need packet sniffers is available in the network protocol analyzers, security documentation
network diagrams. There's a ton of things that you need to be able to access quickly. You need to know where that so that you could turn to it if you need it.
Uh, just one real quick case in point. Um, I say you have an internal database.
In fact, when the use of rewards
company handles contracts with third parties, was working on a multi $1,000,000 contract, they got sidetracked with another time issue. When they circle back around to this multi $1,000,000 contract went to log in to the database where this store it was going,
he had been deleted.
I mean, who has access to it. Uh, if you have your network documentation and diagrams and say a packet sniffer set up
community going out Yeah, try that. If you go,
probably gonna find yourself in the middle of an incident without the ability to get the information to need. Problem investigated. You need forensic tools
and you need imaging for a variety of different systems that celebrate up there in the upper corner. It's for cell phone house in the bring your own device environment in which we now live.
You've got tablets, you got laptops. You've got cell phones that our company on their privately owned, but they're used by police.
You need the programs to do the analysis, how you do a packet, capture house to your analysts, have access to a wire shock per diem or packets, let you have forensic software. You have, in case you have access data X ways.
You know, Sydney physical tools you need get to kick to take out the field with you. And in our other course, we know Warren definite that who's that you would need? But
you do need to understand that you have to fill this out pre emptively.
You have any questions? Feel free to reach out to me on cyber when it comes to defining it, isn't it? Be happy to talk to you. Maybe we could get together and start putting out. It could standardize definitional when an incident is and start solving some of these problems together. Hey, have a great day.