EXPOSURE: The 5th Annual RSAC SOC Report
summary
RSA Conference wireless traffic is captured via a SPAN feed into virtual DNS appliances and a compact NetWitness cluster, correlated in Splunk with Recorded Future and other intel. Thirty-nine million packets and logs produce 544 unique suspicious binaries, 50 files sent to Threat Grid for sandbox detonation, and a C2 using 404 responses that is traced and taken down the same day with law enforcement. Visibility shows 17,000 Apple devices, ~36,000 clear‑text passwords, 3,600 Slack channels, pervasive POP3 and leaking PAC files; automated Slack alerts and captive‑portal notifications are used for remediation.
AI-written summary · about
chapters (39)
- 0:00Fifth annual SOC report intro
- 1:08Inside RSA Conference SOC team
- 3:14SOC evolution at RSA
- 4:39DNS visibility setup
- 5:20NetWitness as truth source
- 6:23Malware analysis with Threat Grid
- 7:50Automation and threat intel
- 9:18Analyst workflow and hunting
- 10:00Hunting unknown malware
- 11:22Malware detection results
- 12:05Firewall logs and IDS
- 13:08Extended detection and response integrations
- 14:32Network scanning visualization
- 15:34Security operations center infrastructure
- 15:57Traffic stats overview
- 17:00Data destruction commitment after the conference
- 18:03Encrypted traffic trends
- 19:03Clear text password risks
- 20:26Why VPNs and proper security protocols matter
- 21:28C2, crypto mining, phishing
- 22:13Device and app trends
- 23:18Top AI apps at conference
- 24:23Most used websites awards
- 25:05Privacy in dating apps
- 26:50Scanning activity accountability
- 28:39Endpoint tool flaws
- 30:07Exposed sensitive data
- 31:53MFA default misconfigs
- 33:01Privacy in music apps
- 33:21Email protocol risks
- 35:08Insecure IoT cameras
- 36:12Exposed flight info
- 36:53VPN flaws and misconfigs
- 37:35Security best practices
- 37:56Automated security alerts
- 41:32Vendor security collaboration
- 42:14Slack channel monitoring
- 42:57PAC file flaws and legal
- 43:59Q&A
related talks
48mEXPOSURE: The 4th Annual RSAC SOC Report
51mEXPOSURE: The 3rd Annual RSAC SOC Report
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
40mThe NOC Report
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
33mDetecting SSRF events on AWS using Splunk
32mA Case Study of MacOS Supply Chain Compromise
38mThe Black Hat Europe Network Operations Center (NOC) Report