Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Japanese Manufacturing, Killer Robots, & Effect...

Japanese Manufacturing, Killer Robots, & Effective Incident Handling

The talk I did with @bfist at the SANS DFIR Summit 2017.

Scott J. Roberts

June 23, 2017
Tweet

More Decks by Scott J. Roberts

Other Decks in Technology

Transcript

  1. Who We Are? Kevin aka @bfist Response Lead @ Heroku

    Scott aka @sroberts SIRT Lead @ GitHub FOR578 Instructor
  2. WHAT WE’RE GONNA SHARE? A LOW COST, COLLABORATIVE METHOD FOR

    MANAGING COMMON INCIDENT RESPONSE WORKFLOWS
  3. You’ve Got 99 Problems - Moving up the Maturity Model

    - Enable multiple responders - Provide easy to comms to stakeholders - Incidents come in waves - You’re poor and have no $$$
  4. JIT (Just In Time) - Management Theory from Toyota -

    Create as Needed/Not as Planned - Limits Inventory - Lots of IR Parallels
  5. Introduction to Kanban - A factory floor level production management

    tool - Spatial representation of tasks through a series of phases - Adapted to multiple non- manufacturing industries
  6. Useful For.. - Short Term (JIT) Tasks Around Incidents -

    Long Term Management Task for Projects & Continuous Output
  7. Warning We use the same tool (Kanban) BUT… We use

    kanban very differently (And that’s cool!!!)
  8. Platforms: GitHub Projects - Notes, artifacts, and boards in one

    place - Assign cards to people - Easy API - No Built In Templating
  9. Platforms: Trello - Kanban is their main product - Full

    featured GUI - Card based discussions - Attachable Files - Many Integrations - Mature API
  10. Incident Stages - Preparation. } Built Here - Identification -

    Containment - Eradication - Recovery - Lessons Learned } Helps Here
  11. Preparation - Build template Kanban boards for common incidents -

    Start with a column for basic information sharing - Do you have things that need to be done in every incident?
  12. Other Stages - Create a column for containment, eradication, and

    recovery tasks. - Do you need to roll creds for this incident? - Do you need to revoke hardware tokens?
  13. Meat & Potatoes (And Simplicity) - 3 Columns - In

    Progress - Done - Canceled - Assign People to Tasks - Canceled cards should have an explanation
  14. Workflows: System Triage - New - Live Response Requested -

    Live Response Received - Analyzed - Remediated - Returned
  15. Workflows: Indicator Development - Backlog - Enriched - COA: Discovery

    - Detection Created - COA: Detection Deployed - Detection Deprecated
  16. Automation - Templates move you from managed to defined -

    Repeatable & Consistent - Demonstrate Process - Reduce Admin Overhead
  17. Bonus Content: The Five Whys - More Toyota Stuff -

    Root Cause Analysis Methodology - Useful Retrospective Technique
  18. Conclusion - Kanban helps make repeatable yet flexible processes -

    Makes communications consistent - Powerful with a little automation