Name: Reasons to use Suricata for incident response and threat hunting
Start: 2024-07-30T05:00:00Z
End: 2024-07-30T05:00:57.000Z
Location: BrightTALK
Rating: 4

Join us at Reasons to use Suricata for incident response and threat hunting as we delve into the world of Suricata, a powerful open-source network intrusion detection system (NIDS). In this webinar, we will explore the reasons why Suricata has become a go-to solution for incident response and threat hunting, and how it can effectively bolster your cybersecurity defenses.

Our expert, Tatyana Shishkova, Lead security researcher of Kaspersky Global Research and Analysis Team (GReAT), will provide a comprehensive introduction to Suricata’s capabilities. Gain insights from practical examples and understand how Suricata can be leveraged to proactively detect and neutralize potential cyber threats.

• get to know which threats can be detected using Suricata, and why it is crucial to write effective Suricata rules
• learn more about cases using Suricata for incident response and threat hunting
• discover new life hacks on Suricata

Reasons to use Suricata for incident response and threat hunting

While some of the existing cybersecurity solutions already provide Endpoint Detection and Response functionality for small and medium business, implementation of EDR in these organizations can cause doubts. Kaspersky’s long-term experience in the development and implementation of EDR Solutions found the following has frequently raised concerns:

• EDR is just a “better antivirus”;
• This technology is only suitable for large enterprises as it is meant to discover sophisticated threats that don’t target small companies;
• EDR is a sophisticated solution that requires security staff - trained in detection and response;
• EDR provides capabilities for full response and remediation;
• EDR becomes shelf ware very quickly.

Are these concerns fair? Join this webinar to find it out and decide if EDR technology fits your company’s need

Addressing myths around EDR

Hardly a day goes by without yet another organisation falling prey to a cyberattack or data breach that has led to reputational and financial losses. The security landscape will get even more tumultuous, with APAC organisations expected to continue facing tough security challenges arising from the shortage of talent, new cloud vulnerabilities and the proliferation of surreptitious malware. Against this backdrop, security operations have become more challenging, driving organisations to consider new approaches that improve the timeliness and accuracy of threat detection while automating response actions. 

Hear from the panel experts in Cybersecurity Frontiers: Crafting Future-Ready Defenses in a Connected World as the panellist shares how you can build a resilient culture and prepare for future challenges.

Cybersecurity Frontiers: Crafting Future-Ready Defenses in a Connected World

In an age where cybersecurity threats are becoming increasingly sophisticated and dynamic, a holistic approach to threat detection and response is imperative. Extended Detection and Response (XDR), with its all-rounded threat detection and response capabilities, offers a powerful solution to address the evolving threat landscape in the world of containers. Explore the synergy between XDR and container security, offering a comprehensive strategy to understand threat detection and response in container security, and how XDR can be a game-changer in the cybersecurity strategy.

This event is a must-attend for security professionals, CTOs, CISOs, IT leaders, and anyone interested in staying ahead of the curve in the ever-evolving cybersecurity world. Join us to explore how XDR can be your ally in protecting containerized applications and securing your digital infrastructure.

XDR and Container Security: A Holistic Approach to Threat Detection and Response

Let’s Dive into the threat landscape as Vitaly Kamluk, Director, Global Research & Analysis Team focused on emerging threats, technological impacts, strategic defenses, regulatory considerations, and building a resilient cybersecurity posture.

Threat Landscape in APAC and Globally

Join this webinar, Elevating Cyber Resilience: Unveiling the Power of XDR as Ilya Markelov, Head of Unified Platform Product discusses XDR implementation strategies and future prospects. The presentation educates and encourages organizations to adopt XDR to strengthen their cybersecurity defenses in an increasingly complex threat landscape.

Elevating Cyber Resilience: Unveiling the Power of XDR

Join this webinar to get actionable information that will help you plan and develop your own security operations strategy and will guide you towards practically proven solutions. During the webinar, Roman Nazarov, Head of SOC Consulting at Kaspersky, will provide a comprehensive review of our consulting services – SOC Maturity assessment and SOC Framework development – and share informative insights based on successfully completed projects, including:

• The most common SOC services and their dependence on customers’ business areas
• Typical internal SOC processes and organizational structure and what influences them
• Common issues in security operations and how they’re mitigated

Kaspersky Security Operations Center provides consulting services for customers who aren’t ready to outsource their operations to a Managed Detection and Response team but want to develop internal security operations practices.

SOC consulting projects: common methodology and insights

In 2023, Kaspersky Managed Detection and Response (MDR) received more than 314,000 alerts worldwide. Kaspersky team processed these alerts and accumulated as anonymized customer cases to provide information about the current threat landscape. Sergey Soldatov, Head of Kaspersky Security Operations Center, will discuss the nature of the identified incidents and highlight the most common tactics and techniques attackers used.
- Who are your potential attackers?
- How do they operate today?
- How can their activity be detected?

Findings highlighted in this webinar will help you to be aware of existing attack techniques and protect businesses from the growing number and complexity of real-life threats.

MDR Report Analyzing the state of the global threat landscape

Not only do cybercriminals make money by committing cybercrime, but they also expand their operations by offering services to individuals without strong technical skills in malware development. This business model is known as Malware-as-a-Service (MaaS), and it operates on various sites of the "shadow" internet, including the Darknet. MaaS generates stable profits, enabling cybercriminals to maintain a team and continuously improve their services to carry out attacks on companies and individual users.

Through our research, we have identified 97 families of malware that have been distributed in the MaaS format – or "by subscription" – over the last seven years. These families include ransomware, various loaders, backdoors, botnets, and infostealers. In this webinar, Alexander Zabrovsky, Digital Footprint Analyst at Kaspersky, will delve into the inner workings of MaaS in the Darknet and address the most relevant issues:

- How did malware become a full-fledged product, and how did the "subscription" model become a new standard for cybercriminals?
- Why has YouTube become one of the key platforms for distributing malware? Who are traffers, and what is their function?
- Which families of malware are mentioned most often in the Darknet, and how does the Darknet services market depend on the news agenda?

Unveiling the Darknet's Malware-as-a-Service model

In large companies, the sheer volume of information resources makes their attack surface significantly larger, compared to smaller businesses. Numerous factors contribute to this exposure, including networks spread across various locations that are consolidated into a single infrastructure, mergers and acquisitions with companies possessing lower security levels, outdated hardware and software, and more.

The level of preparedness for a potential incident directly impacts the effectiveness of the response and allows you to mitigate the attack’s impact. In this webinar, you will learn how to enhance incident responses for large-scale networks. Konstantin Sapronov, Head of Global Emergency Response Team at Kaspersky, will provide you with the following practical insights on:

• Optimizing incident response processes beyond mere scaling up by increasing personnel and systems involved
• Understanding incident response from a management perspective and why it should be an ongoing, cyclical process
• Exploring key principles for a successful response, emphasizing the significance of not only technical skills but also quality processes and soft skills
• Unveiling the limitations of backups in mitigating the consequences of an incident and discovering effective strategies to address them

Securing The Fort: How to master cyber incident response in a large company

This presentation will cover the methodology and measures organizations could take to prevent ransomware. It represents real-world practices, based on ransomware attacks statistics and deep analysis of ransomware groups TTPs.

• The most popular intrusion paths can be locked out
• Little efforts can cause significant problems for the spread of ransomware
• There are several ways to reduce the risk of your infrastructure being encrypted
• Light in the darkness: Is it possible to recover after encryption?

Ransomware Prevention Strategies

In today's digital landscape, phishing and social engineering attacks have become increasingly sophisticated, posing significant threats to organizations worldwide. According to Kaspersky's 2023 report, spam accounted for an alarming 45.60% of global email traffic. Furthermore, a staggering 77% of companies have fallen victim to cyber incidents in the past two years, with 21% of these incidents attributed to employees succumbing to phishing attacks.

Beyond the mere inconvenience of sorting through spam, these attacks can lead to severe consequences. From compromising confidential data to incurring substantial financial and reputational damages, the implications are vast. Additionally, recipients risk losing personal funds to scam messages, underscoring the urgency for robust email security measures.

Join us for this enlightening webinar where Kaspersky's experts, Anna Lazaricheva and Alexander Rumyantsev, will delve into the most prevalent and current email threats observed over the past year.

• Understand the diverse forms of spam and email threats plaguing organizations today.
• Explore real-world examples and case studies highlighting the impact of phishing and social engineering attacks.
• Discover the advanced features of Kaspersky Security for Mail Servers (KS for Mail Server), designed to combat sophisticated email threats effectively.

Email security: Top threats and how to counter them

In today's media landscape, we consistently encounter news of companies falling victim to cyberattacks, resulting in the exposure and sale of their data on the dark web. The wide array of data available on the dark web market, including internal databases, infrastructure access, and compromised accounts, presents a pervasive problem that affects businesses of all sizes. These breaches and related incidents don’t only disrupt operations and damage reputations, but they can also result in substantial fines and legal consequences.

According to Kaspersky, nearly half of the organizations that faced data breach incidents in 2022 lacked contact person responsible for handling such incidents. About one-third either failed to react, denied the incident, or showed indifference to their data being traded on the dark web. Only a few were adequately prepared to respond.

At our upcoming webinar, Anna Pavlovskaya, an expert at Kaspersky Digital Footprint Intelligence, will present a comprehensive guide to setting up a system that monitors dark web threats and navigating the aftermath of an incident. You will gain insights into:

- Structuring the incident response process, including the approach, necessary steps, and the specific roles assigned to the team members responsible for the process.
- Identifying the types of data commonly offered for sale on the dark web and understanding the differing response strategies based on these data categories.
- Effective communication with the media, customers, partners, shareholders, top management, and other parties involved.
- Strategies for rapid incident identification, investigation, response, and recovery from an incident or preventing it from occurring.

Responding to a data breach: a step-by-step guide

As the frequency of cyberattacks continues to rise, the ability to swiftly and effectively reverse-engineer malware is paramount. To equip you with the skills needed, we are re excited to invite you to our webinar that delves into the depths of Ghidra – an indispensable tool for InfoSec professionals widely used for malware analysis.

The experts will showcase Ghidra's capabilities through the analysis of the Calypso malware. Throughout the session, our Kaspersky Global Research & Analysis Team (GReAT) experts, Igor Kuznetsov and Georgy Kucherin, will share practical tips and tricks, emphasizing effective analysis of functions utilizing structures and function pointers.

Here’s what our experts will cover during the webinar:
Introduction to Ghidra and its significance in reverse engineering.
Live demonstration: Analyzing the Calypso malware with Ghidra.
Tips and tricks for efficient reverse engineering.
Overview of our newly released online training course “Advanced malware reverse engineering with Ghidra”.
Advanced topics: API function hashing, decompiler scripting, and extending Ghidra's capabilities.
Don't miss out on this opportunity to elevate your reverse engineering skills and gain insights from our experts.

Take Your Reverse Engineering to Another Level with Ghidra

Despite all the technological advancements, human factor remains one of the most significant vulnerabilities – as the evolution of the threat landscape is less about sophisticated code and more about ingenious scenarios. The problem is even more acute as there is a significant shortage of qualified cybersecurity specialists in the market. Our latest insightful webinar explores the critical role of human factors in cybersecurity and share strategies to mitigate these risks effectively.

Join Kaspersky expert Oleg Gorobets, as he shares valuable insights and practical advice on enhancing your organization’s defenses and will delve into the following topics:

● Human vulnerabilities: the most common non-IT and IT/InfoSec professionals’ errors and intentional information security policy violations that led to security breaches and how they can be exploited by cybercriminals;
● The impact of InfoSec professionals’ shortage on an organization’s cybersecurity;
● Monotonous work and burnout of InfoSec professionals as the obstacles to reliable company's cyber protection;
● Breakdown of common cyber incidents that occurred over the last two years due to human factors in companies around the world;
● Finding a fitting solution: attention turns to tech and automation.

Don’t miss this opportunity to enhance your cybersecurity knowledge and learn how to effectively mitigate human risks!

Cybersecurity's human factor – more than an unpatched vulnerability

In the AI domain, individuals often find themselves taking a stance. Some argue that AI's technological advancements revolve around control and power, while others highlight its convenience. Simultaneously, the cybersecurity community remains wary of AI's potential to disrupt the threat landscape, possibly causing upheaval in defense organizations globally.

At the same time, the regulatory framework for emerging technologies is in its early stages of development, navigating uncharted territory during its formative development stages. This adds complexity to the discourse, as the ethical, legal, and societal implications of AI are yet to be fully addressed.

In this webinar, Kaspersky's experts and Prof. Dr. Dennis-Kenji Kipker of cyberintelligence.institute will delve deep into the multifaceted current influence of AI on cyber threats and the privacy landscape. While our Kaspersky expert illuminates technological intricacies, Prof. Dr. Dennis-Kenji Kipker will navigate the intricate landscape of AI laws and regulatory trends.Furthermore, our panel will scrutinize the pivotal AI developments of 2023 and provide insights into the forecast for the upcoming year. Our roundtable is joined by:
- Dennis Kipker, Research Director, cyberintelligence.institute, Frankfurt am Main
- Vladislav Tushkanov, Research Development Group Manager at Kaspersky’s Machine Learning Technologу Research Team
- Victor Sergeev, Incident Response Team Lead at Kaspersky’s SOC Technologies Research and Development Team
- Vladimir Dashchenko, Security Evangelist, Kaspersky’s ICS team

The Future of AI in cybersecurity: what to expect in 2024

• Explore the power of Extended Detection and Response (XDR) as a proactive defense strategy against evolving cyber threats.
• Discover how XDR can fortify your defense mechanisms and enhance your cybersecurity posture.

Defend with XDR Strategies

Insights into the 2024 Threat Landscape: Gain a deep understanding of the threat landscape and its implications as we uncover the latest trends, emerging threats, and cyber risks.

Dive into 2024 Threat Landscape

Be aware of ransomware TTPs: applying MITRE to ransomware campaigns

Kaspersky APAC

Cyber Security

Threat Hunting

Suricata

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Reasons to use Suricata for incident response and threat hunting

Presented by

About this talk

More from this channel