Best Practices
Expertise on Demand: How the DC3 Cyber Forensics Lab Supports DIB Incident Response
Luke Hoffman, DC3 DCISE
This presentation will focus on malware reverse engineering and system forensic capabilities offered to support DCISE and the Defense Industrial Base (DIB). It will provide an overview of the Electronic Malware Submission (EMS) portal, including discussions of static and dynamic malware analysis and forensic analysis of compromised assets. Furthermore, the session will cover the use of EMS, including Automated Malware Reports (AMRs), the Application Programming Interface (API) for AMRs for multi-file submissions, and the submission tool for malware used in static malware analysis and reporting. Additional capabilities provided by the Cyber Forensics Lab will also be discussed. This is valuable for understanding the tools and services available to enhance malware analysis and incident response capabilities within the DIB.
Staying (Human) Connected in a High-Tech World
Margaret Swank, DAF Office of Special Investigations
As our world becomes increasingly dominated by computers, AI, and virtual interfaces, the impact on our fundamental biological need for human connection and overall resilience requires further analysis. This presentation explores practical strategies for building resilience into your day-to-day work life, specifically aimed at mitigating the isolating effects commonly experienced by professionals in the cyber field.
Cracking into Culture: Infusing Cybersecurity into the Culture of our Research Enterprise at GTRI
Eric R. Scott, Georgia Tech Research Institute
The Georgia Tech Research Institute (GTRI) is leading the way in integrating robust cybersecurity practices into daily research operations. This presentation highlights GTRI's unconventional methods and targeted strategies for weaving cybersecurity into the fabric of their work, resulting in a cyber-centric culture that enhances research integrity and security.
The Next-Generation SOC
Christopher Crabtree, MANTECH
The traditional tiered Security Operations Center (SOC) model, once a pragmatic solution for managing a high volume of security alerts, is no longer sufficient to counter the sophisticated campaigns of today's threat landscape. This model, which segments analysts by skill level, creates significant operational flaws, including a critical talent drain, crippling inefficiencies, and a dangerous lack of accountability.
At MANTECH we've developed and implemented a modern solution: The Cell-Based Security Operations Center (CBS). This model represents a fundamental departure from the tiered approach by organizing teams into specialized, function-based cells that are empowered with end-to-end ownership of investigations. By fostering deep expertise, promoting continuous collaboration, and adopting an agile, investigative paradigm, the CBS model mitigates the systemic failures of its predecessor; provides a more effective, resilient, and adaptable cyber defense posture; and creates an environment to foster human capital, allowing personnel hands on experience beyond the complexity assigned to tiers in a traditional SOC.
MITRE NERVE Incident and IR Lessons Learned
Roman Brozyna, MITRE Corporation
This presentation provides a walkthrough of a real-world incident involving an advanced adversary infiltration, focusing on the organizational lessons learned. While the technical details of the breach were previously made public, this overview emphasizes the event's relevance, the adaptations implemented since, and key takeaways that any organization can apply to improve its incident response plans and overall cybersecurity posture.
AI-Driven Incident Response: Friend or Foe?
Leidos
Artificial intelligence (AI) is rapidly transforming security teams' ability to detect, investigate, and respond to threats, promising faster, smarter responses. However, attackers are also leveraging these same technologies to evade defenses and accelerate their campaigns.
This panel will examine the double-edged sword of AI in incident response, emphasizing the importance of updating workflows, retraining staff, and building robust governance frameworks to prepare for AI integration. Attendees will gain valuable insights into the practical applications of AI, emerging risks, and the essential organizational steps needed to safely and effectively harness its power.