$30 off During Our Annual Pro Sale. View Details »

Japanese Manufacturing, Killer Robots, & Effective Incident Handling

Japanese Manufacturing, Killer Robots, & Effective Incident Handling

The talk I did with @bfist at the SANS DFIR Summit 2017.

Scott J. Roberts

June 23, 2017
Tweet

More Decks by Scott J. Roberts

Other Decks in Technology

Transcript

  1. Japanese Manufacturing,
    Killer Robots, & Effective
    Incident Handling
    With Scott & Kevin

    View Slide

  2. Introduction
    - Who We Are
    - What We’re About
    - What We’re Gonna Share

    View Slide

  3. Who We Are?
    Kevin aka @bfist
    Response Lead @ Heroku
    Scott aka @sroberts
    SIRT Lead @ GitHub
    FOR578 Instructor

    View Slide

  4. WHAT WE’RE ABOUT?
    MAKING INCIDENT RESPONSE MORE
    EFFICIENT WITH SCIENCE ENGINEERING

    View Slide

  5. WHAT WE’RE GONNA SHARE?
    A LOW COST, COLLABORATIVE METHOD FOR MANAGING COMMON
    INCIDENT RESPONSE WORKFLOWS

    View Slide

  6. You’ve Got 99
    Problems
    - Moving up the Maturity Model
    - Enable multiple responders
    - Provide easy to comms to
    stakeholders
    - Incidents come in waves
    - You’re poor and have no $$$

    View Slide

  7. Project Management
    MODEL SLIDE>

    View Slide

  8. JIT
    (Just In Time)
    - Management Theory from
    Toyota
    - Create as Needed/Not as
    Planned
    - Limits Inventory
    - Lots of IR Parallels

    View Slide

  9. Introduction to
    Kanban
    - A factory floor level
    production management tool
    - Spatial representation of tasks
    through a series of phases
    - Adapted to multiple non-
    manufacturing industries

    View Slide

  10. Introduction to Kanban

    View Slide

  11. View Slide

  12. View Slide

  13. Useful For..
    - Short Term (JIT) Tasks Around
    Incidents
    - Long Term Management Task
    for Projects & Continuous
    Output

    View Slide

  14. Warning
    We use the same tool (Kanban)
    BUT…
    We use kanban very differently
    (And that’s cool!!!)

    View Slide

  15. Example

    View Slide

  16. Platforms:
    GitHub Projects
    - Notes, artifacts, and boards in
    one place
    - Assign cards to people
    - Easy API
    - No Built In Templating

    View Slide

  17. GitHub Projects

    View Slide

  18. Platforms:
    Trello
    - Kanban is their main product
    - Full featured GUI
    - Card based discussions
    - Attachable Files
    - Many Integrations
    - Mature API

    View Slide

  19. Trello

    View Slide

  20. Incident Stages
    - Preparation. } Built Here
    - Identification
    - Containment
    - Eradication
    - Recovery
    - Lessons Learned
    }
    Helps Here

    View Slide

  21. Preparation
    - Build template Kanban boards
    for common incidents
    - Start with a column for basic
    information sharing
    - Do you have things that need
    to be done in every incident?

    View Slide

  22. Other Stages
    - Create a column for
    containment, eradication, and
    recovery tasks.
    - Do you need to roll creds for
    this incident?
    - Do you need to revoke
    hardware tokens?

    View Slide

  23. Example:
    Malware
    Incident

    View Slide

  24. Lessons Learned
    - Create a column for lessons
    learned
    - Dumping ground for the retro

    View Slide

  25. Meat &
    Potatoes
    (And Simplicity)
    - 3 Columns
    - In Progress
    - Done
    - Canceled
    - Assign People to Tasks
    - Canceled cards should have an
    explanation

    View Slide

  26. Example

    View Slide

  27. Example: Lost/Stolen Laptop

    View Slide

  28. Workflows:
    System Triage
    - New
    - Live Response Requested
    - Live Response Received
    - Analyzed
    - Remediated
    - Returned

    View Slide

  29. Workflows:
    Compromised
    Resources
    - Malicious Activity Identified
    - Password Reset
    - 2FA Verified
    - User Interviewed
    - Remediated

    View Slide

  30. Workflows:
    Indicator
    Development
    - Backlog
    - Enriched
    - COA: Discovery
    - Detection Created
    - COA: Detection Deployed
    - Detection Deprecated

    View Slide

  31. Workflows:
    Intelligence
    Product
    Development
    - Planned
    - Analyzed
    - Drafted
    - Edited
    - Released
    - Feedback Collected

    View Slide

  32. Automation
    - Templates move you from
    managed to defined
    - Repeatable & Consistent
    - Demonstrate Process
    - Reduce Admin Overhead

    View Slide

  33. Wanna Try It?
    github.com/sroberts/incident-template

    View Slide

  34. Bonus Content:
    The Five Whys
    - More Toyota Stuff
    - Root Cause Analysis
    Methodology
    - Useful Retrospective Technique

    View Slide

  35. Conclusion
    - Kanban helps make
    repeatable yet flexible
    processes
    - Makes communications
    consistent
    - Powerful with a little
    automation

    View Slide

  36. Thanks
    Made with <3
    By Scott (@sroberts) & Kevin (@bfist)

    View Slide