Go offline with the Player FM app!
Megan Roddie - co-author of "Practical Threat Detecion Engineering"
Manage episode 375179655 series 59938
Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers.
Buy here: https://subscription.packtpub.com/book/security/9781801076715
Amazon Link: https://packt.link/megan
Youtube VOD: https://www.youtube.com/watch?v=p1_jQa9OQ2w
Show Topic Summary:
Megan Roddie is currently working as a Senior Security Engineer at IBM. Along with her work at IBM, she works with the SANS Institute as a co-author of FOR509, presents regularly at security conferences, and serves as CFO of Mental Health Hackers. Megan has two Master's degrees, one in Digital Forensics and the other in Information Security Engineering, along with many industry certifications in a wide range of specialties. When Megan is not fighting cybercrime, she is an active competitor in Muay Thai/Kickboxing. She is a co-author of “Practical Threat Detection Engineering” from Packt publishing, on sale now in print and e-book. Buy here: https://subscription.packtpub.com/book/security/9781801076715
https://packt.link/megan ← Amazon redirect link that publisher uses if you want something easier on the notes
Questions and topics:
Of the 3 models, which do you find you use more and why? (PoP, ATT&CK, kill chain)
What kind of orgs have ‘detection engineering’ teams? What roles are involved here, and can other teams (like IR) be involved or share a reverse role there?
Lab setup requires an agent… any agent for ingestion or something specific?
How does Fleet or data ingestion work for Iot/Embedded device testing? Anything you suggest?
How important is it to normalize your log output for ingestion? (app, web, server all tell the story)
Additional information / pertinent LInks (Would you like to know more?):
Unified Kill Chain: https://www.unifiedkillchain.com/
ATT&CK: https://attack.mitre.org/
D3FEND matrix BrakeSec show from 2021: https://brakeingsecurity.com/2021-023-d3fend-framework-dll-injection-types-more-solarwinds-infections
Pyramid of Pain: https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
https://www.securitymagazine.com/articles/98486-435-million-the-average-cost-of-a-data-breach
https://medium.com/@gary.j.katz (per Megan, ‘it’s basically Chapter 11 of the book’)
Show points of Contact:
Amanda Berlin: @infosystir @hackershealth
Brian Boettcher: @boettcherpwned
Bryan Brake: @bryanbrake on Mastodon.social, Twitter, bluesky
Brakesec Website: https://www.brakeingsecurity.com
Twitter: @brakesec
Youtube channel: https://youtube.com/c/BDSPodcast
Twitch Channel: https://twitch.tv/brakesec
459 episodes
Manage episode 375179655 series 59938
Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers.
Buy here: https://subscription.packtpub.com/book/security/9781801076715
Amazon Link: https://packt.link/megan
Youtube VOD: https://www.youtube.com/watch?v=p1_jQa9OQ2w
Show Topic Summary:
Megan Roddie is currently working as a Senior Security Engineer at IBM. Along with her work at IBM, she works with the SANS Institute as a co-author of FOR509, presents regularly at security conferences, and serves as CFO of Mental Health Hackers. Megan has two Master's degrees, one in Digital Forensics and the other in Information Security Engineering, along with many industry certifications in a wide range of specialties. When Megan is not fighting cybercrime, she is an active competitor in Muay Thai/Kickboxing. She is a co-author of “Practical Threat Detection Engineering” from Packt publishing, on sale now in print and e-book. Buy here: https://subscription.packtpub.com/book/security/9781801076715
https://packt.link/megan ← Amazon redirect link that publisher uses if you want something easier on the notes
Questions and topics:
Of the 3 models, which do you find you use more and why? (PoP, ATT&CK, kill chain)
What kind of orgs have ‘detection engineering’ teams? What roles are involved here, and can other teams (like IR) be involved or share a reverse role there?
Lab setup requires an agent… any agent for ingestion or something specific?
How does Fleet or data ingestion work for Iot/Embedded device testing? Anything you suggest?
How important is it to normalize your log output for ingestion? (app, web, server all tell the story)
Additional information / pertinent LInks (Would you like to know more?):
Unified Kill Chain: https://www.unifiedkillchain.com/
ATT&CK: https://attack.mitre.org/
D3FEND matrix BrakeSec show from 2021: https://brakeingsecurity.com/2021-023-d3fend-framework-dll-injection-types-more-solarwinds-infections
Pyramid of Pain: https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
https://www.securitymagazine.com/articles/98486-435-million-the-average-cost-of-a-data-breach
https://medium.com/@gary.j.katz (per Megan, ‘it’s basically Chapter 11 of the book’)
Show points of Contact:
Amanda Berlin: @infosystir @hackershealth
Brian Boettcher: @boettcherpwned
Bryan Brake: @bryanbrake on Mastodon.social, Twitter, bluesky
Brakesec Website: https://www.brakeingsecurity.com
Twitter: @brakesec
Youtube channel: https://youtube.com/c/BDSPodcast
Twitch Channel: https://twitch.tv/brakesec
459 episodes
All episodes
×Welcome to Player FM!
Player FM is scanning the web for high-quality podcasts for you to enjoy right now. It's the best podcast app and works on Android, iPhone, and the web. Signup to sync subscriptions across devices.