Sign up to save your podcasts
Or
Share Lightweight Forensics With Verve Reporting
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Lightweight Forensics With Verve Reporting
In this episode, we take a look at how Verve Reporting, and in particular its ability to search and filter logs, can be useful for high-level forensic investigation. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Dustin Gogue (Technical Account Manager), Andrew Wintermyer (Team Lead, Device & Integration Research) and Zach Woltjer (ICS Security Specialist) as they dive into how Verve Reporting helped identify user account management and authentication issues.
Key Takeaways
- Proper user account hygiene (especially timely user off-boarding) is a key component of a robust security strategy.
- Maintaining named user accounts for key personnel is important for non-repudiation during investigations.
- OT software is sometimes installed in a way that binds its services or application authentication to a particular user account, which can present a challenge when and if that user needs to be off-boarded.
- The ability to collect, filter, and search event logs quickly and easily is a key component of forensic and incident investigation.
Timestamps
00:00 – Introduction and sound check
00:27 – Welcome to Season Two of OT After Hours
00:37 – Guest introductions: Dustin, Andrew & Zach
01:30 – Quick overview of what logs are
02:19 – Why logs are important to digital forensics
04:43 – Dustin steps through the process of investigating an influx of logs and discovering key issues
12:50 – Identifying an improperly off-boarded user account within the authentication logging data
13:30 – The complexities of user off-boarding in OT environments
16:32 – Zach on incorporating user account privileges and user employment status into risk calculations
24:15 – Value of the Verve Reporting platform and roundtable discussion
32:33 - Outtro and thank yous
Guest Information
- Dustin Gogue: Technical Account Manager at Verve Industrial
- Andrew Wintermyer: Device & Integration Research Team Lead at Verve Industrial
- Zach Woltjer: ICS Security Specialist at Verve Industrial
Subscribe
Follow and Subscribe
Get in Touch
LinkedIn | YouTube | Twitter/X | Contact Verve I Listener Q&A
View all episodes
By Rockwell AutomationIn this episode, we take a look at how Verve Reporting, and in particular its ability to search and filter logs, can be useful for high-level forensic investigation. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Dustin Gogue (Technical Account Manager), Andrew Wintermyer (Team Lead, Device & Integration Research) and Zach Woltjer (ICS Security Specialist) as they dive into how Verve Reporting helped identify user account management and authentication issues.
Key Takeaways
- Proper user account hygiene (especially timely user off-boarding) is a key component of a robust security strategy.
- Maintaining named user accounts for key personnel is important for non-repudiation during investigations.
- OT software is sometimes installed in a way that binds its services or application authentication to a particular user account, which can present a challenge when and if that user needs to be off-boarded.
- The ability to collect, filter, and search event logs quickly and easily is a key component of forensic and incident investigation.
Timestamps
00:00 – Introduction and sound check
00:27 – Welcome to Season Two of OT After Hours
00:37 – Guest introductions: Dustin, Andrew & Zach
01:30 – Quick overview of what logs are
02:19 – Why logs are important to digital forensics
04:43 – Dustin steps through the process of investigating an influx of logs and discovering key issues
12:50 – Identifying an improperly off-boarded user account within the authentication logging data
13:30 – The complexities of user off-boarding in OT environments
16:32 – Zach on incorporating user account privileges and user employment status into risk calculations
24:15 – Value of the Verve Reporting platform and roundtable discussion
32:33 - Outtro and thank yous
Guest Information
- Dustin Gogue: Technical Account Manager at Verve Industrial
- Andrew Wintermyer: Device & Integration Research Team Lead at Verve Industrial
- Zach Woltjer: ICS Security Specialist at Verve Industrial
Subscribe
Follow and Subscribe
Get in Touch
LinkedIn | YouTube | Twitter/X | Contact Verve I Listener Q&A