Decisions and Revisions - The Ever Evolving Face of the Black Hat NOC
summary
Black Hat NOC describes concrete tooling and results: core firewall is Palo Alto, packet collection uses Gigamon taps, sandboxing goes to Cisco Threat Grid and endpoint/forensics run on RSA NetWitness. The US show hits ~20,000 attendees with a peak of 605 concurrent devices, ~1,700 unique MACs, ~2.4 billion packets (≈2 TB) written to disk, and ~8 million DNS queries year; 76.2% traffic is encrypted with TLS 1.2 dominant. Automation deploys captive‑portal warnings and emails for cleartext creds, crypto mining and C2, and registration SSL is decrypted for inspection.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:21NOC PARTNERS
- 4:18THE TEAM
- 4:44ARCHITECTURE
- 6:14THE GEAR
- 7:22THE DASHBOARDS
- 12:56MOAR DASHBOARDS
- 15:22NETWORK STATS
- 17:18DNS STATS
- 18:55EVOLUTION
- 26:31COLLABORATION
- 29:12ENCRYPTED VS DUMB
- 30:51EMAIL SECURITY
- 34:45GONG ROGUE
related talks
45mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
45mThe Black Hat NOC: Greatest Hits and Holy...Cows
38mThe Black Hat Europe Network Operations Center (NOC) Report
40mThe NOC Report
33mThe Black Hat Europe NOC Report
40mThe 9th Annual Black Hat USA Network Operations Center (NOC) Report
47mTales from the NOC: Going Public in Asia