Building a CISO Response Strategy to Advanced Threats
summary
SUNBURST shows supply‑chain compromises can live inside networks for dwell time nearly a year, so assume logs and EDR may be tampered and invest in network telemetry that preserves historic forensic evidence. Use NIST incident‑response phases to run retrospectives, update threat models, and prioritize detecting a small set of internal TTPs (credential theft, lateral movement, stealthy C2) so containment is surgical rather than “burn it down” reconstruction. SUNBURST is the example to emulate.
AI-written summary · about
chapters (15)
- 0:00Start
- 0:37CISO Threat Response Timeline
- 1:19Cone of Uncertainty During an Emergency
- 2:38Advanced Threats Require New Mental Models
- 5:07Update Your Incident Response Strategy
- 10:12Attackers Are Getting More Advanced
- 11:39Retrospectives Build Resilience
- 13:04Update Your Threat Modeling
- 14:23Assess The Risk You Hold
- 15:28The Attacker's Dilemma
- 16:40The Pyramid of Pain
- 17:36Flip Their Challenge Into Your Solution
- 18:03Enable Network Monitoring
- 18:53Rethink Evidence Preservation
- 21:19In Summary
related talks
54mSOCcing: Responding to a Cyber Incident
50mA CISO's Best Friend: The Pentester
51mCloudSec Hero to Zero: Self-Obsolescing Through Prolific Efficiency
29mFighting Back Without Hacking Back: Why “Risk Management” Isn’t Enough In The Era of Cyber War
49mTraining for Incident Response: The Red, the Blue, and the Ugly
51mReal World Stories of Incident Response and Threat Intelligence
27mThe Offensive Approach to Cybersecurity
57mInsights and Predictions: What's Next in InfoSec