Go offline with the Player FM app!
Cat Self: macOS and Linux Security
Manage episode 337163867 series 2712409
Ever wonder why there’s so little information regarding macOS and Linux-oriented attacks? In this episode, we get the answer from the multi-talented Cat Self - an Adversary Emulation Engineer at MITRE, Cyber Threat Intelligence Team Leader on ATT&CK Evaluations and macOS/ Lead on MITRE ATT&CK Enterprise. We discuss defense tools, attacker TTPs, and what to consider when approaching defense for a macOS and Linux environment, and what trends we can expect in the future for these operating systems. Check out the resources below for links mentioned during this enlightening conversation!
Our Guest: Cat Self
Cat Self is the CTI Lead for MITRE ATT&CK® Evaluations, macOS/Linux Lead for ATT&CK® and serves as a leader of people at MITRE. Cat started her cyber security career at Target and has worked as a developer, internal red team operator, and Threat Hunter. Cat is a former military intelligence veteran and pays it forward through mentorship, technical macOS hunting workshops, and public speaking. Outside of work, she is often planning an epic adventure or climbing mountains in foreign lands.
Follow Cat on Social Media
Twitter: @coolestcatiknow
LinkedIn: Cat Self
Resources mentioned in this episode:
A highlight of new security changes in macOS Ventura:
https://www.sentinelone.com/blog/apples-macos-ventura-7-new-security-changes-to-be-aware-of/
For securing a macOS device, I highly recommend installing Patrick Wardle’s endpoint tools. https://objective-see.org/tools.html My favorites are BlockBlock, KnockKnock, Lulu, & Netiquette.
Cat's “GoTo” blogs
Patrick Wardle Objective-See
Jaron Bradley The Mitten Mac
Howard Oakley The Eclectic Light Company
Cody Thomas Medium
Sarah Edwards mac4n6
Leo Pitt Medium
Christopher Ross Medium
Csaba Fitzl THEEVILBIT Blog
Open Source Projects
Playbooks with Datasets to practice OTRF
Code snippets aligned to MITRE ATT&CK Atomic Red Team
Jupyter notebook environment setup by Anna Pastushko
Virtual environment setup Hold My Beer
Sponsor's Note:
Support for the Blueprint podcast comes from the SANS Institute.
If you like the topics covered in this podcast and would like to learn more about blue team fundamentals such as host and network data collection, threat detection, alert triage, incident management, threat intelligence, and more, check out my new course SEC450: Blue Team Fundamentals.
This course is designed to bring attendees the information that every SOC analyst and blue team member needs to know to hit the ground running, including 15 labs that get you hands
Learn more about SANS' SOC courses at sans.org/soc
53 episodes
Manage episode 337163867 series 2712409
Ever wonder why there’s so little information regarding macOS and Linux-oriented attacks? In this episode, we get the answer from the multi-talented Cat Self - an Adversary Emulation Engineer at MITRE, Cyber Threat Intelligence Team Leader on ATT&CK Evaluations and macOS/ Lead on MITRE ATT&CK Enterprise. We discuss defense tools, attacker TTPs, and what to consider when approaching defense for a macOS and Linux environment, and what trends we can expect in the future for these operating systems. Check out the resources below for links mentioned during this enlightening conversation!
Our Guest: Cat Self
Cat Self is the CTI Lead for MITRE ATT&CK® Evaluations, macOS/Linux Lead for ATT&CK® and serves as a leader of people at MITRE. Cat started her cyber security career at Target and has worked as a developer, internal red team operator, and Threat Hunter. Cat is a former military intelligence veteran and pays it forward through mentorship, technical macOS hunting workshops, and public speaking. Outside of work, she is often planning an epic adventure or climbing mountains in foreign lands.
Follow Cat on Social Media
Twitter: @coolestcatiknow
LinkedIn: Cat Self
Resources mentioned in this episode:
A highlight of new security changes in macOS Ventura:
https://www.sentinelone.com/blog/apples-macos-ventura-7-new-security-changes-to-be-aware-of/
For securing a macOS device, I highly recommend installing Patrick Wardle’s endpoint tools. https://objective-see.org/tools.html My favorites are BlockBlock, KnockKnock, Lulu, & Netiquette.
Cat's “GoTo” blogs
Patrick Wardle Objective-See
Jaron Bradley The Mitten Mac
Howard Oakley The Eclectic Light Company
Cody Thomas Medium
Sarah Edwards mac4n6
Leo Pitt Medium
Christopher Ross Medium
Csaba Fitzl THEEVILBIT Blog
Open Source Projects
Playbooks with Datasets to practice OTRF
Code snippets aligned to MITRE ATT&CK Atomic Red Team
Jupyter notebook environment setup by Anna Pastushko
Virtual environment setup Hold My Beer
Sponsor's Note:
Support for the Blueprint podcast comes from the SANS Institute.
If you like the topics covered in this podcast and would like to learn more about blue team fundamentals such as host and network data collection, threat detection, alert triage, incident management, threat intelligence, and more, check out my new course SEC450: Blue Team Fundamentals.
This course is designed to bring attendees the information that every SOC analyst and blue team member needs to know to hit the ground running, including 15 labs that get you hands
Learn more about SANS' SOC courses at sans.org/soc
53 episodes
All episodes
×Welcome to Player FM!
Player FM is scanning the web for high-quality podcasts for you to enjoy right now. It's the best podcast app and works on Android, iPhone, and the web. Signup to sync subscriptions across devices.