Ten Strategies of a World-Class Computer Security Incident Response Team

Presented at ShmooCon IX (2013), Unknown date/time (Unknown duration).

Today's Computer Security Incident Response Team (CSIRT) should have everything they need to mount a competent defense of the ever-changing IT enterprise: a vast array of sophisticated detection and prevention technologies, a virtual sea of cyber intelligence reporting, and access to an exploding workforce of talented IT professionals. Yet most CSIRTs continue to fall short in keeping the adversary-even the unsophisticated attacker-- out of the enterprise.  Why is this? In this talk, the presenter will offer some observations on what it takes to do Computer Network Defense well in the modern IT enterprise. He will present ten fundamental qualities of an effective CSIRT that cut across elements of people, process, and technology.

Presenters:

• Carson Zimmerman
  The presenter is a Lead Cyber Security Engineer with The MITRE Corporation.  He has ten years of experience working with large Computer Security Incident Response Teams (CSIRTs) to better defend against the adversary.  He has held roles in the CSIRT ranging from tier 1 analyst to senior architect.  He received a BS in Computer Engineering from Purdue University in 2002 and an MS in Information Systems from George Mason University in 2007.

Links:

• https://infocon.org/cons/ShmooCon/ShmooCon 2013/ShmooCon 2013 Videos/Ten Strategies of a World-Class Computer Security Incident Response Team.mp4

Similar Presentations:

• BSidesLV 2017 / From SOC to CSIRT
• NolaCon 2022 / 11 Strategies of a World-Class Cybersecurity Operations Center
• Black Hat Europe 2021 / Building Better CSIRTs Using Behavioral Psychology