Crowdstrike presents on the current e-crime landscape and procedures used by APT actors
December 11, 2019 by John NashMonday January 6th, 2020 / 6 PM - 9 PM
WHO: Southwest CyberSec Forum
WHEN: 1st Monday of each month 6:00 PM - 9:00 PM
WHERE: UAT theater at 2625 W Baseline Rd, Tempe, AZ 85283
WHY: To stay current with new cyber threats, explore new security technologies, and network with your peers.
FREE: No membership fees, no RSVP’s, food and drinks provided by our sponsors.
**Sponsor: CrowdStrike **
Our thanks to CrowdStrike for sponsoring this months meeting!
Contact: Grace Bergen SLED Marketing Manager
[5:30-6:30 PM]
Pizza and Networking in the UAT common area
- Open to the public and UAT students
- Pizza and Drink provided.
- No food or drink in the UAT Theater (Please)
[6:30-6:50 PM]
Announcements and Sponsor Segment
- Review of Community CyberEvents (~5 min)
- Short presentation by our sponsor, Luke Zeman of Crowdstrike (~15 min)
[6:50-7:00 PM]
Cyber Security Community updates
- Cyber threat update with Erik Graham (~15 min)
[7-7:45 PM]
The Not So Itsy Bitsy Spider
by Matt Russell, Threat Intelligence Advisory Lead- The Americas, Crowdstrike
Bio:
Matt Russell an internationally seasoned business and technology executive. He combines the exceptional leadership skills he learned leading and training intelligence teams in US Special Operations, with his commercial experience in consulting and industry to successfully operate across a variety of business domains, geographic boundaries, and cultural landscapes. Matt spent 5 years living and working in Asia and possesses advanced fluency in both Korean and Spanish.
Topic:
Wizard Spider, made famous by their commodity banking malware “TrickBot” and “Ryuk”, is a notorious threat actor that conducts high impact attacks across a variety of industry verticals and sectors. We’ll start off with an overview of the current e-crime landscape and emerging trends, and the begin to breakdown the tactics, techniques, and procedures that Wizard Spider leverages as they conduct operations across the globe. Focus will be on the TrickBot, Ryuk, and AnchorDNS malware families, providing high-level overviews of their functionality and deployment. A victimology case study will provide a deep-dive into a real world scenario where both the failures and lessons learned will be on display. This talk will conclude with defensive strategies to help mitigate the threat, as well as, an interactive question and answer session.
[7:45-8:45 PM]
The Need for Advanced Incident Response Tools and Capabilities
by Michael McAndrews, Vice President, Network Security Services, WGM Associates
Bio:
Michael McAndrews has been involved in Information Technology and Security for more than 25 years. Michael worked in the financial services, manufacturing and pharmaceutical industries before joining the Federal Bureau of Investigation in 2006 as a Special Agent. During his time with the FBI, he investigated numerous violations, but focused primarily on computer crimes such as intrusions, Internet frauds and intellectual property violations. He was also a member of the FBI's Cyber Action Team, a group of selected agents who would deploy worldwide for the most critical of intrusions. With experience in both the National Security and Criminal arenas, Michael left the FBI in December 2013 to rejoin the private sector. He now works as an expert in the field using leading edge security devices and performing awareness training to groups worldwide.
Michael is a Certified Information Systems Security Professional (CISSP) and has been certified by GIAC as a GSEC professional, an Intrusion Analyst (GCIA), and Incident Handler (GCIH). Michael also holds the A+ and Network+ certifications from Comptia.
Topic:
With the ongoing epidemic of cyber security breaches, the need to successfully execute an incident response plan is of the utmost importance to shorted the time between breech and recovery and lower the overall risk to the organization. Michael will discuss incident response and how full network packet capture and end-point detection/response technologies can be leveraged together as a powerful combination to improve the investigative and remediation process. Actual scenarios will be shared where WGM and CrowdStrike have worked together on an international Incident Response engagement.