SANSFIRE 2014

C3CM â Defeating the Command, Control, and Communications of Digital Assailants

• Russ McRee
• Tuesday, June 24th, 8:15pm - 9:15pm

C3CM: the acronym for command, control, and communications countermeasures. Ripe for use in the information security realm, C3CM takes us past C2 analysis and to the next level. Initially, C3CM was most often intended to wreck the command and control of enemy air defense networks, a very specific military mission. We'll apply that mindset in the context of combating bots and other evil. Our version of C3CM therefore is to identify, interrupt, and counter the command, control, and communications capabilities of our digital assailants. The three phases of C3CM will utilize: Nfsight with Nfdump, Nfsen, and fprobe to conduct our identification phase, Bro with Logstash and Kibana for the interruption phase, and ADHD for the counter phase.

Converge these on one useful platform and you too might have a chance deter those who would do you harm. We'll discuss each of these three phases (identify, interrupt, and counter) with tooling and tactics, complete with demonstrations and methodology attendees can put to use in their environments. Based on the three part ISSA Journal Toolsmith series: http://holisticinfosec.blogspot.com/search?q=c3cm&max-results=20&by-date=true.

Bio:

Russ McRee, GSE, CISSP, MSISE, directs the Threat Intelligence & Engineering team for Microsoftâs Online Services Security & Compliance organization. He writes toolsmith, a monthly column for the ISSA Journal, and has written for numerous other publications including Information Security, (IN)SECURE, SysAdmin, Linux Magazine, and OWASP. Russ also speaks regularly at events such as DEFCON, BlueHat, Black Hat, SANSFIRE, RSA, FIRST, and RAID, amongst others, and is a SANS Internet Storm Center handler. His work includes service in the Washington State Guard as the Cybersecurity Advisor to the Washington Military Department. Russ advocates a holistic approach to the practice of information assurance and, as such maintains holisticinfosec.org. IBM's ISS X-Force cited Russ as the 6th ranked Top Vulnerability Discoverers of 2009.