SANSFIRE 2015

Faster Than a Speeding Bullet: Can Geolocation Find Supervillains in Your Network?

• Tim Collyer - Master's Degree Candidate
• Tuesday, June 16th, 7:15pm - 8:15pm

Good logging provides the IP addresses of external connections to our network. This data can be compared against geolocation databases to provide the physical location of the source IP. By extracting physical location data from network logs, we can track user location and determine if a user would need to be a superhero (or supervillain) to travel quickly enough between two different logon locations. This sounds great, but how does it work in practice? This talk will explore the technical mechanics behind tracking geolocation as well where the kryptonite lies in this process.

Speaker Bio: Tim spent almost a decade working as a professional mariner, largely teaching sail training to college students. He has a 200-ton near coastal captain's license and a 500-ton ocean mate's license as certified by the United States Coast Guard. Eventually he 'swallowed the anchor' and turned to a life ashore. After taking stock of his available skills - including proficiency with celestial navigation and knot-tying - and the next career in information security became immediately apparent. Tim has been taking SANS courses for years as a way to get a leg up in a new field and is currently pursuing a Master's degree with the SANS Technology Institute. Tim works on the Cyber Defense team at Motorola Solutions, blending some security architecture, security engineering, forensics, incident response, and hunting for the APTs in the cloudzors.