Organizations are becoming multicloud by choice or by chance. Many of them integrate their multiple clouds with one another to improve Availability, support Disaster Recovery, and leverage the services from each provider that best fits their needs. These integrations are usually supported with long-lived credentials. These credentials are much more valuable to attackers than those that are short-lived. Even following best practices will leave...

In the 1990s, government agencies, industry groups, and cybersecurity researchers started creating cybersecurity standards, and these standards led to cybersecurity regulations and laws that dictate to organizations what they must do to protect their data. Today, there are dozens of standards dictating thousands of cybersecurity controls that organizations can consider when building their cybersecurity plans. Every year more standards are rele...

The financial services industry continues to be a popular attack target, in large part due to the sensitive data and personal information financial institutions safeguard. These institutions are subjected to data scraping, credential stuffing, network intrusion attempts, and more — all while needing to provide fast, reliable service for their end-users and remain compliant with the strictest possible privacy and security regulations. Q2...

Adversaries get to hone and change their tradecraft whenever it suits them. If they notice a subtle difference in an environment, they pivot to avoid and/or delay detection. Who says defenders cannot do the same, pivoting with technology to enable smarter defenses? With the detection and investigation, automation, and integration capabilities available in today’s security solutions, this should be a no brainer! In the 2023 XDR/EDR forum,...

Incident response (IR) capabilities play a major role in an organization’s security posture. IR teams’ capabilities determine how well organizations respond to an event when a threat actor strikes. The SANS 2023 Incident Response survey examined the tools, processes, and people involved in IR. This webcast will explore rising technologies, response and recovery times, and employment trends in the industry. In addition, gathered dat...

How often do you practice or exercise your major cyber incident plans? How often do involve your execs? Most people when asked said they'd love to cyber exercise more but don't know how. The problem with major incident response plans is that they are largely untested. The SOC and IR team may work together to test some aspects but for most organisations, the inherited critical incident plans are largely untested and, more importantly, so are t...

Learn real-world cyber security skills from top industry experts during SANS Network Security 2023 (September 6-11, PT). Join us Live Online or in Las Vegas, NV to experience interactive training with hands-on labs, practice your skills during NetWars Tournaments, and network with your peers in real time. SANS Network Security 2023 Features Courses In-Person or Live Online Core, DFIR, and Grid NetWars Tournaments on Sep 9 & 10 (In-Person O...

It appears that every few months, there's news of yet another cloud breach stemming from a carelessly configured cloud storage solution. While this isn't the default for most cloud vendors, some users still manage to make their cloud data publicly accessible by going out of their way - sometimes to a significant extent. Whether it's out of ignorance or convenience, it doesn't matter - this practice must come to an end. To address this issue, w...

AI seems to have taken the world by storm lately. From ChatGPT to automated spear phishing techniques, the security world has already seen changes in processes, automation, and threat detection - not to mention attack techniques! The recent surge of AI opens up opportunities for both defenders and adversaries alike. What can we build? What can we automate? How can we use AI to augment security to buy time and add another layer of defense to ou...

With the exponential growth and agility of development activities, it is imperative that development, security, and operations personnel work collectively to produce the highest quality of service with a strong focus on risk reduction. The 2023 DevSecOps Survey will examine several indicators of secure DevOps maturity retrospectively from the prior years' survey responses. As a part of the survey, we will analyze the accelerated nature of CI/C...