Tales from the NOC: Going Public in Asia
summary
Black Hat Asia runs a public NOC that writes every packet to disk (data deleted after the show) using Palo Alto for the edge, RSA NetWitness for deep visibility, Ruckus Wi‑Fi, Gigamon taps, myRepublic bandwidth and Cisco Umbrella. The design does no outbound blocking except to protect infrastructure or registration. Operations spot things fast: six Monero miners, thousands of malicious domains, single attendees downloading gigabytes of porn, a zero‑day exploited within ~12 hours, rogue APs found, and vendor patches deployed within hours.
AI-written summary · about
chapters (16)
- 0:00Black Hat Asia NOC welcome
- 1:53NOC team and partners
- 4:00NOC infrastructure evolution
- 7:19Public NOC access
- 9:26NOC network architecture
- 12:46Packet capture and visibility
- 18:26Security lessons 2023
- 22:48Cleartext passwords and VPN issues
- 26:13Patch management traffic
- 27:38Anomalous traffic and zero-day exploits
- 31:36Vendor response to issues
- 34:48Physical attacks and rogue devices
- 37:03Wi-Fi threats and wireless security
- 40:14Q&A on IoT and Bluetooth
- 44:16Manero miners and integrations
- 45:48Data capture scale and bandwidth
related talks
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
38mThe Black Hat Europe Network Operations Center (NOC) Report
40mThe NOC Report
45mThe Black Hat NOC: Greatest Hits and Holy...Cows
33mThe Black Hat Europe NOC Report
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
40mThe 9th Annual Black Hat USA Network Operations Center (NOC) Report
45mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC