What do you do about that handful of Mac systems on your Windows enterprise network? Blog posts and articles abound of OS X exploits and rootkits on the rise. That small number of Mac systems can yield a foothold or even access to “crown jewels” for an attacker. Our talk is for anyone who needs a quick-start guide and tool set for OS X security automation, especially in the context of a Windows enterprise network. We will discuss how to leverage scripts, open-source security tools, and automation to achieve better hardening and visibility of OS X endpoints in your environment. We want to share our code and experiences to help foster a stronger community of interest among Windows focused teams to close this often overlooked gap in defenses.

We are a security guy and a sysadmin working together to defend a mid-sized Windows enterprise environment with a sprinkling of Mac users and limited resources. A deluge of Suricata alerts for signature "GPL RPC portmap proxy attempt UDP” led us to a developer’s Mac laptop and a practical curiosity about OS X security. Brian Satira is a malware analyst and CISSP, with eight years of experience in security, who likes to solve problems--usually by doing things the stupid hard way so others can learn from his mistakes. Brian has spoken before at FloCon and BloomCon. Nicholas Marple is a system administrator and aspiring infosec professional who enjoys building tools and the challenge of securing systems from attackers. *If Nick is available he may attend to speak or simply attend for moral support if tag-teams aren't allowed.

@R3doubt

Back to BSides Columbus Ohio 2018 video list