Real World Stories of Incident Response and Threat Intelligence
summary
Panelists walk through concrete incident-response lessons from 3CX: CrowdStrike flags a supply‑chain compromise via malicious DLLs, GitHub removals interrupt attacker infrastructure and likely prevent follow‑on intrusions, and many victims only see initial payloads not full exploitation. They stress repeatable fixes: inventory and segmentation, fix cloud misconfigurations, document exact exfiltrated files, plan responder three-day rotation handoffs, use ISACs and trusted sharing, and acknowledge ransom payments still occur while urging quicker law‑enforcement contact.
AI-written summary · about
chapters (9)
- 0:00Introductions and panel goal
- 4:25Early stages of an incident
- 10:20Intuition and team management
- 16:41Addressing burnout and fatigue
- 21:02Post-incident learning
- 26:13Common security oversights
- 30:31Transparency and sharing
- 34:20Collaboration and partnerships
- 38:58Mentorship and future outlook
related talks
40mIncident Response – How to Give the Advantage to the Hackers!
50mSoftware Supply Chain: Panel on Threat Intel, Trends, Mitigation Strategies
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
27m“Why are they asking me to do this?” or Adventures in IR Land
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
52mLessons Learned from the Summer of Supply Chain Attacks
49mTraining for Incident Response: The Red, the Blue, and the Ugly
27mA Supply Chain Incident of Major Influence in Israel