Register by tomorrow to save $200 on top-notch cyber security training at SANS Santa Monica 2019!


To attend this webcast, login to your SANS Account or create your Account.

Analyzing the DHS/FBI's GRIZZLY STEPPE Report

  • Friday, January 6th, 2017 at 1:00 PM EST (18:00:00 UTC)
  • Robert M. Lee
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.

You can now attend the webcast using your mobile device!


GRIZZLY STEPPE is the U.S. Government's identification of Russian civilian and military Intelligence Services (RIS) malicious cyber activity targeted towards the US. This activity was specifically called out in context of the White House's retaliation and condemnation of Russia's hacking of the Democratic National Committee (DNC). In this presentation, Robert M. Lee, the lead author of FOR578 - Cyber Threat Intelligence, will analyze the report and offer critiques and lessons learned. The report will be used as a learning aid for strategic analysis, report writing, and the pitfalls of indicators of compromise (IOCs).

Speaker Bio

Robert M. Lee

Robert M. Lee, a SANS certified instructor and author of ICS515 ICS Active Defense and Incident Response and FOR578 Cyber Threat Intelligence courses, is the founder and CEO of Dragos, a critical infrastructure cyber security company, where he focuses on control system traffic analysis, incident response and threat intelligence research. He has performed defense, intelligence and attack missions in various government organizations, including the establishment of a first-of-its-kind ICS/SCADA cyber threat intelligence and intrusion analysis mission. Author of SCADA and Me and a nonresident National Cyber Security Fellow at New America, focusing on critical infrastructure cyber security policy issues, Robert was named EnergySec’s 2015 Energy Sector Security Professional of the Year.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.