Tag Archives: Acribia

SOC Forum 2017: How I Learned to Stop Worrying and Love Massive Malware Attacks

Today I spoke at SOC Forum 2017 in Moscow. It was a great large-scale event about Security Operation Centers. 2,700 people registered. Lots of people in suits šŸ˜‰ . And lots of my good fellows.

SOC Forum 2017 Alexander Leonov

The event was held inĀ Radisson Royal Congress Park. There were three large halls for presentationsĀ and a huge space for exhibition/networking.

I would like to mention Š° stand of Positive Technologies. They have shown today their new PT Security Intelligence PortalĀ with dashboards for executives and joint service with Solar Security for providingĀ GosSOPKA functionality. Some stands were dedicated to Russian governmentĀ Information Security initiatives: GosSOPKA, BDU FSTEC vulnerability database and FinCERT of the Central Bank of Russia.

During my presentation, I was talking how massive malware (ransomware) attacks can be useful for an organization. Quite a provocative topic, right? šŸ˜‰ I meant it in the sense that all the hype around malware attack can help Information Security team to do the the following things:

  • Establish useful policies, like mandatory Windows host reboot after patch installation
  • Ban some convenient, but dangerous functionality, like smb file sharing between workstations
  • Implement useful processes, like system hardening (e.g. against mimikatz) or continuous processing of CERT (FinCERT) bulletins

Continue reading