Locknote: Conclusions and Key Takeaways from Day 2
summary
Remote-work shifts expose simple failures that enable major incidents: employees plugging laptops straight into home modems leads to 80 of 100 systems encrypted within ten hours after RDP brute force and mimikatz credential theft; missing MFA and overlooked mailbox forwarding let BEC and exfiltration persist — one case shows mail forwarding unnoticed for three weeks. IoT firmware commonly lacks canaries and timely patches; recommended fixes include software bill of materials and better patch distribution. Investigations require logging, segmented credentials, and remote IR tooling.
AI-written summary · about
chapters (5)
- 0:00Start
- 11:11Business Email Compromise
- 28:52Have You Seen Many Incident Response Cases Where Forensics on Iot or Embedded Devices Must Be Done To Identify the Attacker's Entry Point
- 31:41Patching Firmware
- 37:17Final Thoughts
related talks
41mLocknote: Conclusions and Key Takeaways from Day 1 locknote
51mLocknote: Conclusions and Key Takeaways
45mOpening Remarks, Rumblings, Ruminations, and Rants
44mLocknote: Conclusions and Key Takeaways From Black Hat Europe 2017
30mLocknote: Conclusions and Key Takeaways from Day 1
57mInsights and Predictions: What's Next in InfoSec
47mLocknote: Conclusions and Key Takeaways from Black Hat Asia 2022
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home