EXPOSURE: The 4th Annual RSAC SOC Report
summary
NetWitness XDR plus Cisco Umbrella/SecureX and Firepower IDS capture live conference wifi into a SOC with about 100 TB packet capture (roughly 18.5 billion packets, 214M logs) and ~40,000 unique devices; analysts replay files, detonate carved binaries, and correlate multiple threat intel feeds. Major findings: abundant cleartext files and email, dating app images and vendor sales decks leaking, C2 infections appearing within 30 minutes on rental booths; infected booths get cleaned or banned and all captured data is destroyed after the show.
AI-written summary · about
chapters (11)
- 0:00Introduction to the SOC
- 2:57Topology and architecture
- 6:23Data capture and storage
- 8:39Dashboards and monitoring
- 11:24Traffic statistics
- 14:42Encryption and security
- 18:43Security findings and stories
- 23:36Risks of cleartext data
- 30:09Threat hunting in action
- 34:02Recommendations for users
- 36:54Q&A session
related talks
44mEXPOSURE: The 5th Annual RSAC SOC Report
51mEXPOSURE: The 3rd Annual RSAC SOC Report
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
40mThe NOC Report
49mPay No Attention to That Hacker Behind the Curtain: A Look Inside the Black Hat Network
33mThe Black Hat Europe NOC Report
38mThe Black Hat Europe Network Operations Center (NOC) Report