ShmooCon 2013: Ten Strategies of a World-Class Computer Security Incident Response Team

For more information and to download the video visit: http://bit.ly/shmoocon2013 Playlist ShmooCon 2013: http://bit.ly/Shmoo13 Speaker: Carson Zimmerman Today's Computer Security Incident Response Team (CSIRT) should have everything they need to mount a competent defense of the ever-changing IT enterprise: a vast array of sophisticated detection and prevention technologies, a virtual sea of cyber intelligence reporting, and access to an exploding workforce of talented IT professionals. Yet most CSIRTs continue to fall short in keeping the adversary—even the unsophisticated attacker-- out of the enterprise. Why is this? In this talk, the presenter will offer some observations on what it takes to do Computer Network Defense well in the modern IT enterprise. He will present ten fundamental qualities of an effective CSIRT that cut across elements of people, process, and technology.