D-Fens

Let's talk defense.

Offense might be a bit more fun (admit it - there is a small evil mini-me inside all of us that wants nothing but wielding the mighty power of the hack that ruled them all) but let's face it, there are only so many wrongdoing organisations with world domination aspirations that will hire you to develop attacks on company time. For most of us that wants a paycheck within security, defence is on the menu. So, how should we effectively use our company’s sparse resources to make it harder for an attacker to breach our defenses and when that inevitably happens anyway; how do we find the bad code and remove it?

Speaker bios and abstracts

Defender Economics
There are a lot of preconceptions about defense, the most prevalent one probably the “defenders dilemma” in which it is stated that an attacker only needs to find one weakness to compromise a network while a defender needs to defend all of them. While this may be true in a technical sense, things become a lot more complicated once you apply real world considerations. Preconceptions like this are often the foundation on which risk management and ultimately defense strategies are based, something that has led to a number of false but generally accepted assumptions about attackers and their capabilities, and how to defend against them. This talk will discuss the capabilities, and more importantly the limitations, of different types of attackers. Using the ancient wisdom of the Teenage Mutant Ninja Turtles, the speaker will explain how knowledge of an attacker’s limitations can be leveraged to raise the cost of attack, something that will tip the scale in the defenders favor. The speaker will also explain how different defensive measures will affect different types of attackers, how they are likely to react to them, and in the end how to get them to hopefully move on to another target.

Andreas Lindh (@addelindh) is a security analyst and engineer working for I Secure Sweden in Gothenburg, Sweden. He specializes in threat & vulnerability analysis, intrusion detection and generally making his clients more secure. When he's not dissecting threats or kicking some intruder off a network somewhere, he likes to write crappy Python code and make bad puns on Twitter. Andreas has previously presented his work at, among others, Black Hat USA, Virus Bulletin and 44Con.

Search and Destroy the unknown
What do you do after realizing that you have been infected by a previously unknown sample that your antimalware vendor failed to detect, or you are unsure that you have up-to-date antimalware products on all systems in your environment? Perhaps you are not able to install antimalware on some endpoints due to regulatory restrictions. So how do you go about to detect malware that hasn’t been detected by your antimalware software? Learn how you can make use of the sources of detection you already have, like your firewall logs, to detect unknown threats on your network and help you locate and extract the malicious software causing the issue. Once you got your hands on a sample you can analyze it for artifacts the malware creates. Those artifacts, called Indicators of Compromise (IOC), can be used to detect additional malware infections on your SMB or Enterprise network using tools you might already have or can easily be acquired freely from the internet.

Michael Boman (@mboman) is a senior malware analyst at the Malware Research Institute and has been presenting at several large security conferences including 44CON and DEEPSEC in the recent years about malware research, everything from finding malware samples to analyze suspected files at speed and on budget. Michael has been interested in malicious software since he got his own machine infected even though he followed all the best practices having his computer up-to-date with both patches and antimalware software. The fact that the only thing that notified him about the infection was the built-in Windows firewall asking if it was OK to open a port for a piece of executable. And the rest, as they say, is history. Malware Research Institute is an organization that promotes malware research, tools and techniques for aspiring and seasoned malware analysts. Malware Research Institute has a blog where they publish interesting resources for malware researchers over at http://blog.malwareresearch.institute.