Faster Than a Speeding Bullet: Can Geolocation Find Supervillains in Your Network?
- Tim Collyer - Master's Degree Candidate
- Tuesday, June 16th, 7:15pm - 8:15pm
Good logging provides the IP addresses of external connections to our network. This data can be compared against geolocation databases to provide the physical location of the source IP. By extracting physical location data from network logs, we can track user location and determine if a user would need to be a superhero (or supervillain) to travel quickly enough between two different logon locations. This sounds great, but how does it work in practice? This talk will explore the technical mechanics behind tracking geolocation as well where the kryptonite lies in this process.
Speaker Bio: Tim spent almost a decade working as a professional mariner, largely teaching sail training to college students. He has a 200-ton near coastal captain's license and a 500-ton ocean mate's license as certified by the United States Coast Guard. Eventually he 'swallowed the anchor' and turned to a life ashore. After taking stock of his available skills - including proficiency with celestial navigation and knot-tying - and the next career in information security became immediately apparent. Tim has been taking SANS courses for years as a way to get a leg up in a new field and is currently pursuing a Master's degree with the SANS Technology Institute. Tim works on the Cyber Defense team at Motorola Solutions, blending some security architecture, security engineering, forensics, incident response, and hunting for the APTs in the cloudzors.
Bonus Sessions
The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:
- SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
- Special Events: SANS-hosted events and other non-technical recreational offerings. This category includes, but is not limited to, Receptions and Information Tables.
- Vendor: Events hosted by external vendor exhibitors.
- Lunch & Learn: Short presentations given during the lunch break.
- Master's Degree Presentation: Presentations given by SANS Technology Institute's Master's Degree candidates.
Sunday, June 14
Session | Speaker | Time | Type |
---|---|---|---|
Registration Welcome Reception | — | Sunday, June 14th, 5:00pm - 7:00pm | Reception |
Monday, June 15
Session | Speaker | Time | Type |
---|---|---|---|
General Session - Welcome to SANS | Johannes Ullrich | Monday, June 15th, 8:15am - 8:45am | Special Events |
SANS Technology Institute Information Session | Bill Lockhart | Monday, June 15th, 5:30pm - 7:00pm | Special Events |
State of the Internet Panel Discussion | Dr. Johannes Ullrich, ISC Director and Marcus Sachs, ISC Director Emeritus | Monday, June 15th, 7:15pm - 9:15pm | Keynote |
Tuesday, June 16
Session | Speaker | Time | Type |
---|---|---|---|
Protecting the Things, Including the Ones You Already Have (and don't know about) | John Thompson, Director, Systems Engineering, ThreatSTOP | Tuesday, June 16th, 12:30pm - 1:15pm | Lunch and Learn |
Tell It Like It Is - Managing Business Risk with Assurance Report Cards | Kelly Prevett, Product Manager, Tenable Network Security | Tuesday, June 16th, 12:30pm - 1:15pm | Lunch and Learn |
An Architecture for Continuous Monitoring and Mitigation | Shane Stephens, Federal Systems Engineer | Tuesday, June 16th, 12:30pm - 1:15pm | Lunch and Learn |
Connect the Dots with Domain Name Intelligence from DomainTools | Mark Kendrick, Director of Solution Engineering, Domain Tools | Tuesday, June 16th, 12:30pm - 1:15pm | Lunch and Learn |
Advanced Threats Need Comprehensive Defense | Gerald Mancini, Vice President of Engineering | Tuesday, June 16th, 12:30pm - 1:15pm | Lunch and Learn |
An Incident Response Walk-through: Identifying APT Remote Administration Tools (RATs) with EnCase Endpoint Security | Steve Sunday, Senior Solutions Consultant , Guidance Software | Tuesday, June 16th, 12:30pm - 1:15pm | Lunch and Learn |
Women in Technology Meet and Greet | — | Tuesday, June 16th, 5:30pm - 6:15pm | Reception |
A Special Reception for Cyber Leaders & Application Security Professionals | — | Tuesday, June 16th, 6:00pm - 7:00pm | Reception |
GIAC Program Overview | Jeff Frisk | Tuesday, June 16th, 6:15pm - 7:15pm | Special Events |
Online Training Baseball Bash | — | Tuesday, June 16th, 6:30pm - 8:00pm | Reception |
The State of the Takedown: Disrupting Online Cybercrime | John Bambenek | Tuesday, June 16th, 7:15pm - 8:15pm | SANS@Night |
The 13 Absolute Truths of Security | Keith Palmgren | Tuesday, June 16th, 7:15pm - 8:15pm | SANS@Night |
How to Run Linux Malware Analysis Apps as Docker Containers | Lenny Zeltser | Tuesday, June 16th, 7:15pm - 8:15pm | SANS@Night |
Making Awareness Stick | Lance Spitzner | Tuesday, June 16th, 7:15pm - 8:15pm | SANS@Night |
Faster Than a Speeding Bullet: Can Geolocation Find Supervillains in Your Network? | Tim Collyer - Master's Degree Candidate | Tuesday, June 16th, 7:15pm - 8:15pm | Master's Degree Presentation |
Insider Threat: The Enemy Within | Doug Thomas and Dr. Eric Cole | Tuesday, June 16th, 7:30pm - 9:30pm | SANS@Night |
Attacks by BroBot against the US Financial Markets | Donald Smith | Tuesday, June 16th, 8:15pm - 9:15pm | SANS@Night |
Enterprise PowerShell for Remote Security Assessment | James Tarala | Tuesday, June 16th, 8:15pm - 9:15pm | SANS@Night |
Debunking the Complex Password Myth | Keith Palmgren | Tuesday, June 16th, 8:15pm - 9:15pm | SANS@Night |
Securing The Kids | Lance Spitzner | Tuesday, June 16th, 8:15pm - 9:15pm | SANS@Night |
Practical Attack Detection using Big Data, Semantics, and Kill Chains | Brian Nafziger - Master's Degree Candidate | Tuesday, June 16th, 8:15pm - 9:15pm | Master's Degree Presentation |
Wednesday, June 17
Session | Speaker | Time | Type |
---|---|---|---|
Solutions Expo | — | Wednesday, June 17th, 12:00pm - 1:30pm | Vendor Event |
Solutions Expo | — | Wednesday, June 17th, 5:30pm - 7:30pm | Vendor Event |
"Network Security as Counterinsurgency" Replacing The Art of War with FM 3-24 | Kevin Liston | Wednesday, June 17th, 7:15pm - 8:15pm | SANS@Night |
Windows Exploratory Surgery with Process Hacker | Jason Fossen | Wednesday, June 17th, 7:15pm - 8:45pm | SANS@Night |
Bueller... Bueller...: Smartphone Forensics Moves Fast. Stay Current or Miss Evidence. | Heather Mahalik | Wednesday, June 17th, 7:15pm - 8:15pm | SANS@Night |
Security Visibility in the Enterprise | Jim Hendrick - Master's Degree Candidate | Wednesday, June 17th, 7:15pm - 7:55pm | Master's Degree Presentation |
Unconventional Linux Incident Response | Tom Webb | Wednesday, June 17th, 8:15pm - 9:15pm | SANS@Night |
Evolving Threats | Paul A. Henry | Wednesday, June 17th, 8:15pm - 9:15pm | SANS@Night |
Offensive Countermeasures, Active Defenses, and Internet Tough Guys | John Strand | Wednesday, June 17th, 8:15pm - 9:15pm | SANS@Night |
Creating a Baseline of Process Activity for Memory Forensics | Gordon Fraser - Master's Degree Candidate | Wednesday, June 17th, 8:15pm - 9:15pm | Master's Degree Presentation |
Thursday, June 18
Session | Speaker | Time | Type |
---|---|---|---|
Prevent - Detect - Respond | Rob Frickel, Security Analyst, Infogressive | Thursday, June 18th, 12:30pm - 1:15pm | Lunch and Learn |
Anatomy of an Attack: It Takes an Expert to Stop Attackers | Stephen Coty, Chief Security Evangelist, Alert Logic | Thursday, June 18th, 12:30pm - 1:15pm | Lunch and Learn |
Combating Insider Threats - Protecting Your Agency from the Inside Out | Andrew Wild, Chief Information Security Officer, Lancope Inc | Thursday, June 18th, 12:30pm - 1:15pm | Lunch and Learn |
Real-time Detection, Prevention in Seconds: Make Attackers Part of Your Defense | Jonathon Ross, Systems Engineer, Bit9+Carbon Black | Thursday, June 18th, 12:30pm - 1:15pm | Lunch and Learn |
Crack the Code and Defeat the Advanced Adversary | Brian O'Neil, SE Manager at Palo Alto Networks | Thursday, June 18th, 12:30pm - 1:15pm | Lunch and Learn |
Examining the Phishing Aspect of the OPM Breach | Aaron Higbie, CTO and Co-Founder, PhishMe | Thursday, June 18th, 12:30pm - 1:15pm | Lunch and Learn |
Software Defined Networking / Attacker Defined Networking | Rob Vandenbrink | Thursday, June 18th, 7:15pm - 8:15pm | SANS@Night |
The Spy with a License to Kill | Matthew Hosburgh - Master's Degree Candidate | Thursday, June 18th, 7:15pm - 7:55pm | Master's Degree Presentation |
Cyber Counter Intelligence and Deception: Toward Adaptive Defense | Gadi Evron | Thursday, June 18th, 8:15pm - 9:15pm | SANS@Night |
Outsharing the Bad Guys. How to get involved with the InternetStorm Center | Dr. Johannes Ullrich, ISC Director | Thursday, June 18th, 8:15pm - 9:15pm | SANS@Night |
Friday, June 19
Session | Speaker | Time | Type |
---|---|---|---|
Continuous Monitoring and Real-World Analysis | Seth Misenar | Friday, June 19th, 7:15pm - 8:15pm | SANS@Night |
Defending Control Systems in an Enterprise Environment | Robert M. Lee | Friday, June 19th, 7:15pm - 8:15pm | SANS@Night |