So, mature CIRTs are supposed to have people hunting for APT, right? Don't have a hunt team yet? Don't know what to hunt for, or how or where to hunt? You are not alone. This talk will cover a range of effective and practical techniques that have worked over the years for finding targeted intrusions. This talk will stay focused on ideas that you can take back to your own organization and put in place right away. We will stay away from the more math-y and hypothetical hunting approaches, in favor of simpler yet effective methods that have worked in real world practice.

David has a wide range of IT experience spanning 20 years, serving in a variety of roles in Fortune 10 and Fortune 500 companies, starting in systems programming and large scale systems administration. David has spent the last 10 years focused on IT security. David is currently an Incident Responder with GE-CIRT.

@sharpesecurity

Back to Derbycon 2015 video list