C3CM ‚ Defeating the Command, Control, and Communications of Digital Assailants
- Russ McRee
- Tuesday, June 24th, 8:15pm - 9:15pm
C3CM: the acronym for command, control, and communications countermeasures. Ripe for use in the information security realm, C3CM takes us past C2 analysis and to the next level. Initially, C3CM was most often intended to wreck the command and control of enemy air defense networks, a very specific military mission. We'll apply that mindset in the context of combating bots and other evil. Our version of C3CM therefore is to identify, interrupt, and counter the command, control, and communications capabilities of our digital assailants. The three phases of C3CM will utilize: Nfsight with Nfdump, Nfsen, and fprobe to conduct our identification phase, Bro with Logstash and Kibana for the interruption phase, and ADHD for the counter phase.
Converge these on one useful platform and you too might have a chance deter those who would do you harm. We'll discuss each of these three phases (identify, interrupt, and counter) with tooling and tactics, complete with demonstrations and methodology attendees can put to use in their environments. Based on the three part ISSA Journal Toolsmith series: http://holisticinfosec.blogspot.com/search?q=c3cm&max-results=20&by-date=true.
Russ McRee, GSE, CISSP, MSISE, directs the Threat Intelligence & Engineering team for Microsoft‚s Online Services Security & Compliance organization. He writes toolsmith, a monthly column for the ISSA Journal, and has written for numerous other publications including Information Security, (IN)SECURE, SysAdmin, Linux Magazine, and OWASP. Russ also speaks regularly at events such as DEFCON, BlueHat, Black Hat, SANSFIRE, RSA, FIRST, and RAID, amongst others, and is a SANS Internet Storm Center handler. His work includes service in the Washington State Guard as the Cybersecurity Advisor to the Washington Military Department. Russ advocates a holistic approach to the practice of information assurance and, as such maintains holisticinfosec.org. IBM's ISS X-Force cited Russ as the 6th ranked Top Vulnerability Discoverers of 2009.
The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:
- SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
- Special Events: SANS-hosted events and other non-technical recreational offerings. This category includes, but is not limited to, Receptions and Information Tables.
- Vendor: Events hosted by external vendor exhibitors.
- Lunch & Learn: Short presentations given during the lunch break.
Monday, June 23
|General Session - Welcome to SANS||Johannes Ullrich||Monday, June 23rd, 8:15am - 8:45am||Special Events|
|SANS Technology Institute Open House||William Lockhart||Monday, June 23rd, 6:00pm - 7:00pm||Special Events|
|State of the Internet Panel Discussion||Dr. Johannes Ullrich, ISC Director and Marcus Sachs, ISC Director Emeritus||Monday, June 23rd, 7:15pm - 9:15pm||Keynote|
Tuesday, June 24
|Resurrection of the Data Entry Attack||Aaron Higbee, Chief Technology Officer & Co-Founder, PhishMe||Tuesday, June 24th, 12:30pm - 1:15pm||Lunch and Learn|
|Using Intelligence Methods in Mobile Forensic Exams||Lee Papathanasiou, Sales Engineer, Cellebrite||Tuesday, June 24th, 12:30pm - 1:15pm||Lunch and Learn|
|Continuous Monitoring & Mitigation||Tim Jones, Systems Engineer, Forescout||Tuesday, June 24th, 12:30pm - 1:15pm||Lunch and Learn|
|The Power of Lossless Packet Capture (1G-100G) & Real-time Netflow||Sam Cook, Senior Sales Engineer||Tuesday, June 24th, 12:30pm - 1:15pm||Lunch and Learn|
|Understanding the Threat: A Model to Enable Active Response||Finn Ramsland, Solutions Architect, Federal - FireEye||Tuesday, June 24th, 12:30pm - 1:15pm||Lunch and Learn|
|Looking Beyond Layers: Why Authentication Security Matters Most||Brian Kelly, Principal Product Marketing Manager at Duo Security||Tuesday, June 24th, 12:30pm - 1:15pm||Lunch and Learn|
|Online Training Reception||—||Tuesday, June 24th, 6:00pm - 8:00pm||Reception|
|Security Awareness Metrics: Measuring Human Behavior||Lance Spitzner||Tuesday, June 24th, 7:15pm - 8:15pm||SANS@Night|
|Avoiding Cyberterrorism Threats Inside Electrical Substations||Manuel Humberto Santander Pel√°ez||Tuesday, June 24th, 7:15pm - 8:15pm||SANS@Night|
|Securing The Kids||Lance Spitzner||Tuesday, June 24th, 8:15pm - 9:15pm||SANS@Night|
|C3CM ‚ Defeating the Command, Control, and Communications of Digital Assailants||Russ McRee||Tuesday, June 24th, 8:15pm - 9:15pm||SANS@Night|
Wednesday, June 25
|Vendor Solutions Expo||—||Wednesday, June 25th, 12:00pm - 1:30pm||Vendor Event|
|Vendor Solutions Expo||—||Wednesday, June 25th, 5:00pm - 7:00pm||Vendor Event|
|An Introduction to PowerShell for Security Assessments||James Tarala||Wednesday, June 25th, 7:15pm - 8:15pm||SANS@Night|
|Setting up Splunk for Event Correlation in Your Home Lab||Aron Warren - Master's Degree Candidate||Wednesday, June 25th, 7:15pm - 7:55pm||Special Events|
|Consulting from Virtual Island||Rob VandenBrink||Wednesday, June 25th, 8:15pm - 9:15pm||SANS@Night|
Thursday, June 26
|Vile Vulnerabilities, Rampant Rights, and Pervasive Passwords||Paul Harper, Product Manager, Beyond Trust||Thursday, June 26th, 12:30pm - 1:15pm||Lunch and Learn|
|Operationalize Open Intelligence ‚ YARA + Fidelis XPS||Mike Nichols, Sr. Product Manager, General Dynamics Fidelis Cybersecurity||Thursday, June 26th, 12:30pm - 1:15pm||Lunch and Learn|
|Effective Forensics Analytics for Actionable Incident Response||Narayan Makaram, Sr. Product Manager, Tenable Network Security||Thursday, June 26th, 12:30pm - 1:15pm||Lunch and Learn|
|Fortinet Next Generation Firewalls||Rob Frickel, Security Analyst, Infogressive||Thursday, June 26th, 12:30pm - 1:15pm||Lunch and Learn|
|Insider Threat Kill Chain: Detecting Human Indicators Of Compromise||Bryce G. Schroeder, Sr. Director of Systems Engineering - Tripwire||Thursday, June 26th, 12:30pm - 1:15pm||Lunch and Learn|
|Innovations in End Point Threat Detection (EDTR),||Chad Fulgham, PerCredo CEO and former FBI CIO||Thursday, June 26th, 12:30pm - 1:15pm||Lunch and Learn|
|Penetration Testing Corporate Mobile Applications and BYOD Environments||Dmitry Dessiatnikov||Thursday, June 26th, 7:15pm - 8:15pm||SANS@Night|
|How to Spy on your Employees with Memory Forensics||Alissa Torres||Thursday, June 26th, 7:15pm - 8:15pm||SANS@Night|
|GIAC Program Overview||Jeff Frisk||Thursday, June 26th, 8:15pm - 8:45pm||Special Events|
|Bust a Cap in a Web App With ZAP||Adrien de Beaupre||Thursday, June 26th, 8:15pm - 9:15pm||SANS@Night|
Friday, June 27
|The "Insider Threat" Revised: Crime, Understanding, and Prediction||Richard Porter||Friday, June 27th, 7:15pm - 8:15pm||SANS@Night|
|Creating a Covert Channel in Wifi||Ronald Hamann||Friday, June 27th, 7:15pm - 8:15pm||SANS@Night|