Log In Through the Front Door: Automating Defense Against...
summary
Claims that stolen credentials drive a large share of breaches and shows an operational pipeline that actually blocks them: ingest public combo lists and dark‑web stealer logs into blob storage, use Azure Databricks autoloader into delta tables, call internal admin APIs every 5–15 minutes to validate accounts, trigger force password reset + MFA and global session logout, and notify managers. Case wins include preventing reuse from Colonial‑style VPN leaks, stopping MFA‑fatigue paths like Uber, and reducing exposure from 25+ billion leaked credentials; vendor speed and transparency prove decisive.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker intro
- 1:05Credentials as modern attack vector
- 3:33Case studies of credential breaches
- 7:06How credentials leak into dark web
- 9:34Stealer logs and info stealers
- 12:43Approach to credential monitoring
- 15:12Monitoring stealer logs for proactive defense
- 16:38Automating combo list processing
- 19:06Vendor integration for dark web monitoring
- 20:54Remediation workflow for leaked credentials
- 25:08Choosing the right monitoring vendor
- 26:11Expectation vs reality in monitoring
- 27:15Key takeaways and program setup
- 28:19Recap of threats and solutions
- 29:21Q&A on pass keys and MFA
related talks
26mIntegrating Identity and Fraud
41m📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️
29mBecoming You: A Glimpse Into Credential Abuse
55mAzure Attacks Unpacked: Real-World Threats & Lessons
40mWeb Attacks and Fraud: Lessons Learned from the Deep End of the Pool
16mInnovation in Authentication and More
37mCustomer Identity for Modern Apps and APIs
45mApplying Past Lessons for Intel-Driven Identity Threat Detection