2024 Security BSides // Adam Pennington
summary
Five concrete starters cut risk quickly: enable antivirus, backups, MFA, updates, least-privilege everywhere and verify backups are recoverable. Use MITRE ATT&CK as a behavior catalogue (about 500 techniques, 3,000 references) to map mitigations (M1049 etc.) and detections, and borrow community assets—Caldera and Atomic Red Team, Sigma rules, and the Cyber Analytics Repository with ~300 analytics—to test coverage. Focus left‑side techniques (initial access, execution, persistence) and pick threat groups or red‑team emulations to prioritize work.
AI-written summary · about
chapters (14)
- 0:00Introduction and updates
- 1:10Starting with basic security steps
- 13:57What is MITRE ATT&CK
- 17:10Pyramid of Pain explained
- 26:34Choosing your next security move
- 31:51Using existing tools effectively
- 32:12Threat intelligence approach
- 37:46Red teaming for defense
- 40:34Building detections from ATT&CK
- 47:09Adversary emulation with ATT&CK
- 50:00Assessments and engineering security
- 52:29Why small steps matter
- 56:42Q&A on framework updates
- 1:04:26Q&A on red teaming and SMBs
related talks
32mResilient Secure Software Development Through Insights Learned from Adversarial Attack Campaigns
46mBlue Team Security Actual Security work for Actual Developers
40mAdversary Simulation: Close the Gaps in Your Security Posture
01h 03mBe your own Threatbuster!
50mYou’re Doing It Wrong! Common Security Anti Patterns
58mMITRE ATT&CK for Developers
44mSecurity Lessons for Early Adopters
49mTraining for Incident Response: The Red, the Blue, and the Ugly