World-class instructors teaching today's, critical cyber skills - SANS Online Training


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Slacking on insider threats? Investigative and monitoring approaches to use within Slack to locate bad actors

  • Wednesday, January 27, 2021 at 10:30 AM EST (2021-01-27 15:30:00 UTC)
  • Joseph Pochron, Trey Amick


  • Magnet Forensics

You can now attend the webcast using your mobile device!



It no secret that Slack's popularity has exploded in recent years- once dubbed "the email killer", organizations have implemented Slack as an efficient collaboration environment either alongside email, and in some instances, replacing email as their primary internal communication mechanism. Although a large portion of communication and file transfers are taking place within Slack, often organizations are missing this crucial evidence during an investigation, either due to a lack of understanding or improper retention. Furthermore, organizations should be taking a proactive investigative approach and onboarding Slack as part of their insider threat program.

Speaker Bios

Joseph Pochron

Joseph Pochron currently serves as a Senior Manager for EY in their Forensics, Privacy & Cyber Response practice, presently based in San Francisco, CA. Prior, Joseph was the President of the Forensic Technology and Consulting division for TransPerfect Legal Solutions, providing management and oversight of more than a dozen digital forensic laboratories and their personnel. Joseph has extensive experience in digital forensics, previously assigned as the Commanding Officer of the Lehigh County Computer Crimes Task Force (L3CTF) through the Lehigh County District Attorney’s Office. Prior to his appointment to the District Attorney’s Office, Joseph served as a Detective with the Upper Saucon Township Police Department, spending several years investigating cybercrime. Joseph has taught undergraduate and graduate level courses in criminal justice and digital forensics for multiple academic institutions and in 2014, became the Director of Digital Forensics at DeSales University. In that role, Joseph was responsible for developing an undergraduate academic track in Digital Forensics as well as implementing a certificate in Digital Forensics curriculum for the graduate program.

Trey Amick

Trey Amick is a forensics investigator with a background in both law enforcement and corporate investigations. As a detective with the Rock Hill Police Department in South Carolina, Trey was sworn as a Special Deputy United States Marshal and supported the US Secret Service Electronic Crimes Task Force. Previously, he served in roles in both Patrol and Professional Standards.

Most recently, as a corporate investigator, Trey managed the Enterprise Cyber Education and Awareness Team at Capital One, where he also served as part of the Cyber Technical Investigations Team. Trey is currently a Forensics Consultant at Magnet Forensics, where he assists in the development of Magnet AXIOM and provides skilled support to customers with his combined knowledge of AXIOM and digital forensics

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.