Last Day for MacBook Air, Dell XPS 13, or $600 Off with Online Training

SANSFIRE 2014

Baltimore, MD | Sat, Jun 21 - Mon, Jun 30, 2014
This event is over,
but there are more training opportunities.

C3CM ‚ Defeating the Command, Control, and Communications of Digital Assailants

  • Russ McRee
  • Tuesday, June 24th, 8:15pm - 9:15pm

C3CM: the acronym for command, control, and communications countermeasures. Ripe for use in the information security realm, C3CM takes us past C2 analysis and to the next level. Initially, C3CM was most often intended to wreck the command and control of enemy air defense networks, a very specific military mission. We'll apply that mindset in the context of combating bots and other evil. Our version of C3CM therefore is to identify, interrupt, and counter the command, control, and communications capabilities of our digital assailants. The three phases of C3CM will utilize: Nfsight with Nfdump, Nfsen, and fprobe to conduct our identification phase, Bro with Logstash and Kibana for the interruption phase, and ADHD for the counter phase.

Converge these on one useful platform and you too might have a chance deter those who would do you harm. We'll discuss each of these three phases (identify, interrupt, and counter) with tooling and tactics, complete with demonstrations and methodology attendees can put to use in their environments. Based on the three part ISSA Journal Toolsmith series: http://holisticinfosec.blogspot.com/search?q=c3cm&max-results=20&by-date=true.

Bio:

Russ McRee, GSE, CISSP, MSISE, directs the Threat Intelligence & Engineering team for Microsoft‚s Online Services Security & Compliance organization. He writes toolsmith, a monthly column for the ISSA Journal, and has written for numerous other publications including Information Security, (IN)SECURE, SysAdmin, Linux Magazine, and OWASP. Russ also speaks regularly at events such as DEFCON, BlueHat, Black Hat, SANSFIRE, RSA, FIRST, and RAID, amongst others, and is a SANS Internet Storm Center handler. His work includes service in the Washington State Guard as the Cybersecurity Advisor to the Washington Military Department. Russ advocates a holistic approach to the practice of information assurance and, as such maintains holisticinfosec.org. IBM's ISS X-Force cited Russ as the 6th ranked Top Vulnerability Discoverers of 2009.


Bonus Sessions

The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:

  • SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
  • Special Events: SANS-hosted events and other non-technical recreational offerings. This category includes, but is not limited to, Receptions and Information Tables.
  • Vendor: Events hosted by external vendor exhibitors.
  • Lunch & Learn: Short presentations given during the lunch break.
Monday, June 23
Session Speaker Time Type
General Session - Welcome to SANS Johannes Ullrich Monday, June 23rd, 8:15am - 8:45am Special Events
SANS Technology Institute Open House William Lockhart Monday, June 23rd, 6:00pm - 7:00pm Special Events
State of the Internet Panel Discussion Dr. Johannes Ullrich, ISC Director and Marcus Sachs, ISC Director Emeritus Monday, June 23rd, 7:15pm - 9:15pm Keynote
Tuesday, June 24
Session Speaker Time Type
Resurrection of the Data Entry Attack Aaron Higbee, Chief Technology Officer & Co-Founder, PhishMe Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
Using Intelligence Methods in Mobile Forensic Exams Lee Papathanasiou, Sales Engineer, Cellebrite Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
Continuous Monitoring & Mitigation Tim Jones, Systems Engineer, Forescout Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
The Power of Lossless Packet Capture (1G-100G) & Real-time Netflow Sam Cook, Senior Sales Engineer Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
Understanding the Threat: A Model to Enable Active Response Finn Ramsland, Solutions Architect, Federal - FireEye Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
Looking Beyond Layers: Why Authentication Security Matters Most Brian Kelly, Principal Product Marketing Manager at Duo Security Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
Online Training Reception Tuesday, June 24th, 6:00pm - 8:00pm Reception
Security Awareness Metrics: Measuring Human Behavior Lance Spitzner Tuesday, June 24th, 7:15pm - 8:15pm SANS@Night
Avoiding Cyberterrorism Threats Inside Electrical Substations Manuel Humberto Santander Pel√°ez Tuesday, June 24th, 7:15pm - 8:15pm SANS@Night
Securing The Kids Lance Spitzner Tuesday, June 24th, 8:15pm - 9:15pm SANS@Night
C3CM ‚ Defeating the Command, Control, and Communications of Digital Assailants Russ McRee Tuesday, June 24th, 8:15pm - 9:15pm SANS@Night
Wednesday, June 25
Session Speaker Time Type
Vendor Solutions Expo Wednesday, June 25th, 12:00pm - 1:30pm Vendor Event
Vendor Solutions Expo Wednesday, June 25th, 5:00pm - 7:00pm Vendor Event
An Introduction to PowerShell for Security Assessments James Tarala Wednesday, June 25th, 7:15pm - 8:15pm SANS@Night
Setting up Splunk for Event Correlation in Your Home Lab Aron Warren - Master's Degree Candidate Wednesday, June 25th, 7:15pm - 7:55pm Special Events
Consulting from Virtual Island Rob VandenBrink Wednesday, June 25th, 8:15pm - 9:15pm SANS@Night
Thursday, June 26
Session Speaker Time Type
Vile Vulnerabilities, Rampant Rights, and Pervasive Passwords Paul Harper, Product Manager, Beyond Trust Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Operationalize Open Intelligence ‚ YARA + Fidelis XPS Mike Nichols, Sr. Product Manager, General Dynamics Fidelis Cybersecurity Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Effective Forensics Analytics for Actionable Incident Response Narayan Makaram, Sr. Product Manager, Tenable Network Security Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Fortinet Next Generation Firewalls Rob Frickel, Security Analyst, Infogressive Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Insider Threat Kill Chain: Detecting Human Indicators Of Compromise Bryce G. Schroeder, Sr. Director of Systems Engineering - Tripwire Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Innovations in End Point Threat Detection (EDTR), Chad Fulgham, PerCredo CEO and former FBI CIO Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Penetration Testing Corporate Mobile Applications and BYOD Environments Dmitry Dessiatnikov Thursday, June 26th, 7:15pm - 8:15pm SANS@Night
How to Spy on your Employees with Memory Forensics Alissa Torres Thursday, June 26th, 7:15pm - 8:15pm SANS@Night
GIAC Program Overview Jeff Frisk Thursday, June 26th, 8:15pm - 8:45pm Special Events
Bust a Cap in a Web App With ZAP Adrien de Beaupre Thursday, June 26th, 8:15pm - 9:15pm SANS@Night
Friday, June 27
Session Speaker Time Type
The "Insider Threat" Revised: Crime, Understanding, and Prediction Richard Porter Friday, June 27th, 7:15pm - 8:15pm SANS@Night
Creating a Covert Channel in Wifi Ronald Hamann Friday, June 27th, 7:15pm - 8:15pm SANS@Night