SANS Community Nights are a great way to stay in touch with your local cybersecurity community and to hear the latest in technical wizardry, industry intelligence, and thought leadership from our amazing instructors.
Join us at:
Munich Marriott Hotel
Berliner Str. 93, 80805 Munich
View the agenda below:
Tuesday 15th October 2024
17:30 – 18:00
Registration and Drinks
18:00 – 19:00
2024 SOC Survey - Highlights and Deep Drive
Christopher Crowley
19:00 – 20:00
QUIC and Furious
Bojan Zdrnja
Abstracts:
2024 SOC Survey - Highlights and Deep Drive
In its 9th year, the SOC Survey continues to be a valuable source of peer comparison. Crowley will review key findings from this year's survey: SOC capabilities, funding, staffing, and challenges. He'll discuss how SOCs use Threat Intelligence, and what technology gets good grades, and which seem to be failing to fulfill their promise. After about 30 minutes of executive summary style review of findings, he'll delve into details using the public release data from the survey responses. This includes a quick fundamentals review of the setup for jupyter notebook, pandas, and seaborn. Then using this environment he'll discuss analysis considerations starting from data cleaning issues and moving into more advanced analysis. He'll also provide instructions and code samples that would allow attendees to answer their own questions from the released data. Attendees can download the python Jupyter notebook and data set to follow along during the presentation, or work on afterward. The release of the survey data started from a 2018 question, when one of the readers asked something to the effect, "I work at an enormous company, and I really only want to see what other enormous companies in the financial sector answered in the survey." At the time, Crowley did some additional analysis to help answer that question. But realized that many readers likely had their own variation on that question. This session gives you the headlines, but also the skills to get into the details if you choose. Or, you can come watch and laugh along with him as he typos his way through the python and pandas code.
QUIC and Furious
The QUIC protocol has slowly (pun intended) made its way into our networks. While most people are vaguely aware that QUIC is used with HTTP/3, the amount of supported protocols keeps increasing every day – today we can use DNS over QUIC (DoQ) as well as the dreaded SMB over QUIC (thanks Microsoft!). As these new protocols are being pushed into our client applications (sometimes without us being even aware of the change), new attack vectors are being opened. The default encryption and complex nature of QUIC, while beneficial for privacy and data integrity, also provide a shield for malicious activities, making it harder for network administrators and security professionals to detect and mitigate threats. In this presentation we will dive a bit deeper (as much as time allows) into the QUIC protocol to see why it is so interesting. We will also analyze the three most used cases with HTTP/3, DoQ and SMB over QUIC to see both how attackers can (ab)use these protocols, and what defenders can do to identify and perhaps prevent such misuse.