Lessons and Lulz: The 5th Annual Black Hat USA NOC Report
summary
Black Hat NOC describes the deployed stack: Palo Alto firewalls with Panorama, Gigamon taps, RSA NetWitness for full‑packet hunting, Cisco Threat Grid sandboxing, Ruckus APs and CenturyLink 20 Gbps circuits. Automation pipelines push NetWitness detections into Demisto for optional human-approved actions and captive portal alerts for cleartext passwords or cryptomining. Metrics: about 49 million DNS requests and ~85,000 flagged events with ~4,000 files processed. Built on VLAN segmentation, live pen‑tests and social‑engineering experiments work (clipboard heist), and all logs are wiped after the show.
AI-written summary · about
chapters (16)
- 0:00Introduction and NOC team
- 3:57Partners and infrastructure
- 13:16NOC monitoring and tools
- 14:26NOC physical security challenge
- 20:37DNS traffic analysis
- 21:46Encryption trends
- 23:39Malware and threat detection
- 24:46NOC evolution and automation
- 30:12Automated security notifications
- 31:21Partner collaboration
- 32:21Security stories from the NOC
- 34:01Malicious attendee activity
- 36:01PII exposure and security risks
- 37:00VPN usage and adult content
- 41:02NOC statistics and closing
- 42:08Audience Q&A
related talks
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
33mThe Black Hat Europe NOC Report
38mThe Black Hat Europe Network Operations Center (NOC) Report
45mThe Black Hat NOC: Greatest Hits and Holy...Cows
40mThe NOC Report
40mThe 9th Annual Black Hat USA Network Operations Center (NOC) Report
45mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
47mTales from the NOC: Going Public in Asia