A continuation of the series that we have been doing for close to 10 years now. The freshly updated (as in this week) slide deck will present ole’ school basics, brand spanking new techniques, low tech attacks, crazy blended attacks, and lots of fun stories from the field. All of this in an effort to change the audience’s mindset and way they approach security. Disclosure: This is not a how-to Red Teaming, Pentesting, Security Consulting, etc. boring ass speech (although parts of it will help you in these arenas). This speech is designed to help you wrap you mind around what matters and how you are fucking up. A few quick examples:

 
In this talk, we will examine the various aspects of one of the most successful, large-scale whaling campaigns currently affecting businesses. We’ll start by examining the emails, context, and domains used by the attackers to trick employees. We will also look at the various documents used to trick companies, and how to potentially detect them in your network. But it gets better – using past research and publicly-available tools, we’re going to profile a whaling campaign that stretches across dozens of victims, and hundreds of millions of dollars. We’ll present research spanning over two years across the globe, involving banks from North Carolina to Hong Kong. Lastly, we're going to examine how this evidence led to a recent arrest of one of these scam artists.
Attendees will learn how to utilize open tools to hunt for related malware, documents, and threat actors. They will also learn how to expand knowledge of TTPs into their environment to protect against massive losses such as highly-successful whaling campaigns.

Recorded at NolaCon 2016