BSidesAtlanta 2019 - Xavier Ashe - IOC's - Indicators of Crap
Channel: BSidesATL
Date: 24/06/2019

You should be looking at Indicators of Compromise!” exclaims your CISO, regulator, vendor and mom. No problem, right? You have the most expensive security intelligence vendor and all you have to do is correlate in your expensive SIEM! Well, if you have tried this, then you are laughing with me. Come hear my exploration into implementing IOCs at a major US insurance company and a major US bank. I’ll address the differences in Indicators of Compromise vs Indicators of Attack. I will show you how not to use the MITRE ATT&CK framework, plus some tips on how it use it well. My goal is to save you from falling into the same pitfalls when dealing with Indicators of Crap.

Xavier Ashe is currently the VP of Security Engineering at SunTrust. He is a Georgia Institute of Technology alumnus and has 25 years of hands-on experience in information security. Working for various security vendors and consulting firms for the last 15 years, including IBM, Gartner, and Carbon Black, Xavier has been focused on helping secure companies of all sizes. Xavier was the first hire at the startup Drawbridge Networks, where he was instrumental in bringing the first microsegmentation solution for servers and workstations to market. Mr. Ashe holds many industry certifications, including CISM, CISSP, ITIL, SOA, and others.