SOCcing: Responding to a Cyber Incident
summary
Explains a practical incident lifecycle: prepare a playbook, validate alerts, take forensic snapshots, and decide containment vs preserving evidence; investigations often run days to five weeks and can last a month. Recommends specific tools for detection and analysis like Wireshark and Splunk, running honeypots, and keeping comprehensive logs; cites surprising operational findings — forgotten fleets of 800 servers and roughly 50% of breaches involving insiders. Describes a built training SOC and cyber range used to rehearse Red/Blue scenarios.
AI-written summary · about
chapters (10)
- 0:00Start
- 9:28Does Your Organization Have a Written Plan
- 13:00Data Recovery Options
- 13:43The Response Lifecycle
- 14:33Preparation
- 14:43Contact Information
- 17:36How Do We Prevent Malware
- 24:13Checklist
- 40:00Map the Threat Landscape
- 40:10Threat Map Landscape
related talks
51mThe No BS SOC Story
18mSurviving the Attack: Planning and Practicing IoT Security Response
49mTraining for Incident Response: The Red, the Blue, and the Ugly
17mIncident Response @ Scale-Building a Next Generation SOC
32mHow to Orchestrate a Cyber Security Incident Tabletop Exercise
40mIncident Response – How to Give the Advantage to the Hackers!
40mBuilding a CISO Response Strategy to Advanced Threats
55mThe State of Incident Response