Need for network visibility in the age of modern EDR

Presented at Disobey 2023, Feb. 17, 2023, 5 p.m. (60 minutes).

EDR is an excellent tool for getting local visibility to endpoints but linking events to a context to get a clearer picture requires something more, especially when the users are mobile.

Presenters:

• Ville Vainikka - Cyber Security Architect
  Government grunt of 12 years and many roles, with interest on the technical deep end, especially networking. Currently working as cyber security architect at Valtori, focusing on network security solutions.LinkedIn: ville-vainikka-03a596148
• Henri Aalto - Cyber Security Architect
  Seasoned IT / cyber security professional who has been working for the Finnish Government for the last 14 years in different positions and organizations. Currently working as cyber security architect at Valtori, with main responsibilities being SOC & SIEM development (processes, technologies & tools, detection engineering, threat intel etc.).

Links:

• https://disobey.fi/2023/profile/need_for_network_visibility

Similar Presentations:

• TROOPERS18 (2018) / Mind the Gap, Bro: Using Network Monitoring to Overcome Lack of Host Visibility in ICS Environments
• Wild West Hackin' Fest 2018 / Red Teaming in the EDR age
• HushCon East 2023 / Using WSL 2 to Hide from EDR