New In-Person Event locations added! Choose your event, and join us for practical cyber security training.


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Threat Actor Analysis and Strategic Security Investments

  • Thursday, February 20, 2020 at 1:00 PM EST (2020-02-20 18:00:00 UTC)
  • Jackie Abrams, Chris Crowley


  • DomainTools

You can now attend the webcast using your mobile device!



Over the past few months, nation-state campaigns have found their way into a majority of conversations in the infosec space. While these discussions are particularly interesting during national election years, there is a fine balance of understanding where your organization sits and your value as a target based on the information, access, or partners that you have.

In this webinar, DomainTools Senior Product Manager, Jackie Abrams, and Chris Crowley from SANS, will demonstrate how to understand attacker motivations, identify prime targets within your organization, and most effectively defend your critical and valued assets and access.

This webinar will cover:

  • The Attribution Debate: pros and cons of relying on attribution to guide your security decisions
  • A checklist to guide the identification of organization assets and strategic targets
  • Mapping of assets to nation-state or criminal priorities and recent publicly-declared or evidenced objectives

Speaker Bios

Chris Crowley

Christopher Crowley is the course author for SANS Management 517 - Managing Security Operations and SANS Management 535 - Incident Response Team Management. Chris holds several industry certifications including the GSEC, GCIA, GCIH (gold), GCFA, GPEN, GMOB, GASF, GREM, GXPN, and CISSP. His teaching experience includes FOR585, MGT517, MGT535, SEC401, SEC503, SEC504, SEC560, SEC575, and SEC580; Apache web server administration and configuration; and shell programming. He was awarded the SANS 2009 Local Mentor of the year award. "The Mentor of the Year Award is given to SANS Mentors who excel in leading SANS Mentor Training classes in their local communities." Mr. Crowley spends his spare time mountain biking, rock climbing and savoring epicurean treats.

Jackie Abrams

Jackie Abrams focuses on solving big-picture threat intelligence challenges through industry collaboration and innovative solution design. Responsible for the product vision at DomainTools, she leads the team to deliver data, intelligence, and tools to help our users make the Internet a safer place.

Before joining DomainTools, she leveraged her OSINT research and digital investigations experience to develop products and services in support of mobile threat assessment for text messages and message senders. Jackie is a graduate of Cornell University and is an active supporter of the Messaging Malware Mobile Anti-Abuse Working Group (M3AAWG), where she collaborates with threat intelligence and abuse mitigation practitioners on solving industry-wide problems in the digital services and ISP space.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.