Security BSides London 2017

While their cyber tactics may be continuously changing, bad actors can’t avoid interacting with core components of the internet. These interactions leave a trail that when connected through rigorous threat infrastructure analysis, can reveal the full scale of an attack and provide the information needed to determine the best response. The key to this analysis is access to a variety of global datasets and the ability to correlate and pivot between them in your investigation.

In this workshop, Jeff will look at a range of global datasets and how each can be used to shed additional light on your adversary’s infrastructure. In addition to the more traditional datasets; Passive DNS, Whois and Malware data, he will highlight several datasets unique to RiskIQ; Host Pairs, SSL Cert History and Trackers and show how they can be used to make connections when traditional datasets come up short.  Workshop attendees with use the community version of RiskIQ’s PassiveTotal to gain access to and pivot across these global datasets to investigate several real indicators. 
 L3 Techies, Pentesters, hackers, Any Geek
Requirements: Laptop required. All attendees will register in advanced for a PassiveTotal community edition account with a special promo code boosting their query limit.