AttackIQ

The creation of the MITRE ATT&CK framework has helped security teams focus on specific adversaries to enhance their defense effectiveness. Since the launch of the Center for Threat-Informed Defense in 2020, the Center has built out a library of adversary emulations, beginning with APT29 and FIN6. What is the benefit of thinking about a specific adversary in this way? Join leaders from a premier global technology company in a discussion about their prospective use of adversary emulations to improve cybersecurity operations.

Speakers:

Cory Sutliff, AttackIQ

Douglas Hurd, Cisco

Attacks on the healthcare sector have increased exponentially under the coronavirus pandemic, from ransomware attacks on strained hospitals to intellectual property theft of vaccine data from research institutions. What is the evolving threat landscape for the healthcare sector, particularly for medical devices, and how can security teams use known threat behaviors to improve their cybersecurity posture? In this session, join Ingrid Skoog, Assistant Director of Research & Development, Center for Threat-Informed Defense; Dr. Suzanne Schwartz, Director, Office of Strategic Partnerships and Technology Innovation, Center for Devices & Radiological Health, US FDA; Margie Zuk, Sr. Principal Cybersecurity Engineer, MITRE; and Jose Barajas, Technical Director, AttackIQ for an in-depth discussion for how to improve cybersecurity for medical devices and the healthcare and public health sectors.

Speakers:

Ingrid Skoog, Center for Threat-Informed Defense

Suzanne Schwartz, FDA

Margie Zuk, MITRE Corporation

Jose Barajas, AttackIQ

Are you capturing the right logs? Are your logs complete? Would you be able to detect the next Solorigate attack? These questions may keep you awake at night. But using DeTT&CT and the MITRE ATT&CK Framework can help you understand where you need to shore up your logging. Let me show you how!

In this session, we'll discuss why the ATT&CK Framework is important for threat detection. Then we'll dig into how you can use DeTTECT to identify the areas of your environment where your logging may not be comprehensive enough to catch the threats in ATT&CK. It's a fun exercise and very visual. Best of all, I'll walk you through the steps you'll need to perform to set this up on your own.

Speaker:

David Branscome, Microsoft

What will cybersecurity leaders Gabriel Lawrence of Toyota and Uma Mahesh Reddy of Prime Healthcare Services have to say about staying on top of threats and how to find your blind spots? Join this session to hear their thoughts on strategies for agility in the face of new threats, and if you can ever truly say "we’re secure."

Speakers:

Uma Mahesh Reddy, Prime Healthcare Services

Gabe Lawrence, Toyota

Julie O’Brien, AttackIQ

AttackIQ Purple Hats: www.purplehats.org/

AttackIQ Academy: academy.attackiq.com/

AttackIQ: attackiq.com/

Nation-state and cybercriminal adversaries are investing substantially in cyberoffensive capabilities in order to accomplish their objectives. Year over year, we continue to see a massive escalation in both frequency and severity of attacks. While organizations are spending more than ever before in the modern history of defensive cyberoperations, the unfortunate success of adversaries is measured in the trillions of dollars lost. Some argue we are involved in a kind of low-intensity, asymmetric warfare. For every dollar a cyberadversay spends we have to spend $100 on defense. It is clear we must shift our strategy, as governments and as capitalist markets, if we wish to maintain our strategic advantages. In the digital era, every organization can be considered a technology company. Whether you provide electricity, banking, public transportation or government services, you are increasingly dependent upon the internet and network connectively to make money, save lives, and provide services to citizens. If all organizations are technology companies, that means all companies need to prioritize cybersecurity as a strategic imperative to ensure they are connected, digitized, and defended.

In this fireside chat, Lt. Gen. Lori Reynolds (ret'd), US Marine Corps, former Commander of U.S. Marine Corps Cyberspace Command, and Carl Wright, Chief Commercial Officer of AttackIQ and former Chief Information Security Officer of the U.S. Marine Corps., will discuss strategic questions that organizations need to ask and answer as part of a proactive plan to stop cyberadversaries from disrupting operations. You will also learn about how Cyber Command and the NSA are sharing intelligence, as well as how to access this intelligence.

Speakers:

Lt. General Loretta (Lori) Reynolds, United States Marine Corps (Ret.)

Carl Wright, AttackIQ

AttackIQ Purple Hats: www.purplehats.org/

AttackIQ Academy: academy.attackiq.com/

AttackIQ: attackiq.com/

There has been a lot of buzz around Extended Detection and Response (XDR) as an evolution of Endpoint Detection and Response (EDR), however definitions of what comprises an effective XDR solution vary depending on who you ask. The dramatic changes to IT infrastructure as organizations accelerate their migration to the Cloud while still relying on traditional on-premises security architecture has increased telemetry volumes and the complexity of correlating threat intelligence across disparate environments to make accurate detections early in the attack sequence. In this session we will discuss the evolution of security from the endpoint to across the entire IT ecosystem, from legacy antivirus to EDR, and now from EDR to XDR. We will show how detection use cases and workflows that previously required complex syntax queries and manually configured SIEM and SOAR solutions can be automated and streamlined with XDR for rapid detection, investigation and predictive response actions that move intervention further to the left in the attack sequence.

Speakers:

Ken Westin, Cybereason

Mark Bagle, AttackIQ

AttackIQ Purple Hats: www.purplehats.org/

AttackIQ Academy: academy.attackiq.com/

AttackIQ: attackiq.com/

Since MITRE ATT&CK was first published in 2015, it has led to a transformation in how security teams think about and approach threats and cybersecurity effectiveness. Now ATT&CK is being amplified by cutting-edge research from the Center for Threat-Informed Defense, a non-profit, privately funded research and development organization operated by MITRE Engenuity with over 13 major projects behind it. How is ATT&CK and the practice of threat-informed defense changing the world? Join Neal Bridges, creator of the Cyber Insecurity livestream channel on Twitch and Chief Cyber Security and Content Officer at INE, Jonathan Baker, Director of Research and Development, Center for Threat-Informed Defense, MITRE Enguiniety, and Cat Self, Lead Adversary Emulation Engineer, MITRE for a conversation about ATT&CK and the future of threat-informed defense.

Speakers:

Neal Bridges, Query.AI

Jonathan Baker, MITRE Engenuity

Cat Self, MITRE Corporation

AttackIQ Purple Hats: www.purplehats.org/

AttackIQ Academy: academy.attackiq.com/

AttackIQ: attackiq.com/

Information technology is creating a more connected world, and our dependence on technology for all aspects of our lives continues to increase. However, the advanced technology and sophisticated logistics networks that support this connectivity are facing unprecedented attacks, which risk undermining the trust on which growth, prosperity, and international relations rest. Complicating matters further, the complexity, sophistication and potential impact of attacks also have increased substantially over time. This session will focus on taking a holistic approach to protecting supply chains and delivering products, solutions and services that customers can trust. John will clearly define the modern supply chain (both physical and digital), provide examples of past attacks, current threats and how security governance, risk management and preventative threat assessment are critical to safeguarding the performance and integrity of global supply chains. The session will further examine a posture of "defense-in-depth" and "defense-in-breadth" that involves multiple layers of preventative measures and controls to mitigate threats that could be introduced into global critical infrastructure supply chains.

Speaker:

John Boyle. Dell

AttackIQ Purple Hats: www.purplehats.org/

AttackIQ Academy: academy.attackiq.com/

AttackIQ: attackiq.com/

Threat hunting is one of the most popular techniques used by security analysts for all kinds of investigations. It is both science and, to some degree, inspiration. However in the last years the security industry has developed new tools and techniques that can dramatically improve the effectiveness and efficiency of our threat hunting. In particular, similarity and automatic Yara generation are key when dealing with large amounts of data. In this talk we learn what's new in the process of threat hunting and showcase how to leverage new techniques available for analysts to step research up to the next level.

Speaker:

Vicente Diaz, Google

AttackIQ Purple Hats: www.purplehats.org/

AttackIQ Academy: academy.attackiq.com/

AttackIQ: attackiq.com/

Despite spending billions of dollars adopting best-in-class cyberdefense technologies and hiring top-tier personnel, organizations continue to suffer security breaches. How can organizations achieve a strong return on their cybersecurity investments, particularly through the use of purple teaming and a threat-informed defense? Join two innovative CISOs that are answering this question. Martin Petersen, Chief Information Security Officer at ISS World Services A/S and Allan Alford, Chief Information Security Officer and Chief Technology Officer at TrustMAPP.

Speakers:

Martin Petersen, ISS A/S

Allan Alford, TrustMAPP

AttackIQ Purple Hats: www.purplehats.org/

AttackIQ Academy: academy.attackiq.com/

AttackIQ: attackiq.com/