Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating...
Transcript of Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating...
![Page 1: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/1.jpg)
TLP:WHITE
Seeing Clearly and Communicating Effectively to Address Event Overload
Thomas V Fischer
FVT SecOps Consulting
![Page 2: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/2.jpg)
TLP:WHITE
I am …
• Security Advocate & Threat Researcher focused on Data Protection
• 25+ years' experience in InfoSec
• Spent number years in corporate IR team positions
• BSidesLondon Director• ISSA UK – VP of Data Governance
• Contact• [email protected] [email protected] (secure email)• @Fvt• keybase.io/fvt
2
![Page 3: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/3.jpg)
TLP:WHITE
![Page 4: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/4.jpg)
TLP:WHITE
Learning from 1st Responder Lessons Learnt
➢Communications issues
➢Self dispatching & recall
➢Lack of accountability
➢Unclear chain of command
➢Uncertain roles/task assignments
Thanks to Chris Sutherland (ING) for these references
![Page 5: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/5.jpg)
TLP:WHITE
Communication Issues
Unclear if units received dispatch instructions
Portable radio limitations
10 different Call Codes
Lack of situational awareness
Structural collapse
Many firefighters and officers in tower 1 unaware of tower 2
collapse
![Page 6: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/6.jpg)
TLP:WHITE
![Page 7: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/7.jpg)
TLP:WHITE
![Page 8: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/8.jpg)
TLP:WHITE
Visualization enables an
analyst to gain an overview of
data during an investigationSchrenk and Poisel, 2011
![Page 9: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/9.jpg)
TLP:WHITE
![Page 10: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/10.jpg)
TLP:WHITE
• Matching IOC
• Signature Based
• Security/Hunting Analytics
• Stats Methods
• Start of UEBA
• Supervised machine learning
• Incorporate previous signals
HUMAN
Predictive IR
Proactive IR
Thanks to Alex Pinto
![Page 11: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/11.jpg)
TLP:WHITE
![Page 12: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/12.jpg)
TLP:WHITE
Orientation by Framework – Does it Help?
Confidential 12
Recon Inside
Escalation
Obtain Creds
Persistence
Move Laterally
Stage Data
Exfil Data
Hide Footprints
Acquired? Y
N
![Page 13: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/13.jpg)
TLP:WHITE
![Page 14: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/14.jpg)
TLP:WHITE
Key Phases in the Monitoring Process
Collect relevant event data
Fuse events together
Analyse anomalous events
Take appropriate action
Cyber Security Monitoring and Logging Guide
![Page 15: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/15.jpg)
TLP:WHITE
Nothing Better Than A Pair of Eyes
Public
![Page 16: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/16.jpg)
TLP:WHITE
![Page 17: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/17.jpg)
TLP:WHITE
![Page 18: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/18.jpg)
TLP:WHITE
Vis
ual
Inte
llige
nce
![Page 19: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/19.jpg)
TLP:WHITE
Portrait by Kumi Yamashita
![Page 20: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/20.jpg)
TLP:WHITE
![Page 21: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/21.jpg)
TLP:WHITE
Wh
at is
th
is W
ork
of
Art
?
• Is it a painting?
• Is it a sculpture?
• What is it made of?
![Page 22: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/22.jpg)
TLP:WHITE
Learning to frame the
question to elicit the
information to do our jobs
![Page 23: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/23.jpg)
TLP:WHITE
The 4 A’sAssess
Analyse
Articulate
Adapt|Act
Amy Herman, The Art of Perception
![Page 24: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/24.jpg)
TLP:WHITE
Something Gets Lost
• Effective break down between what we see down to what we communicate
• Ability to translate what we wee to others
• Talk about complicated situations to simple situations
![Page 25: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/25.jpg)
TLP:WHITE
Assess
What is in Front of Us
Study Thoroughly
saper vedere
Assess
![Page 26: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/26.jpg)
TLP:WHITE
No Two People See the Same Way
![Page 27: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/27.jpg)
TLP:WHITE“Luncheon on the Grass” by Manet 1863
![Page 28: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/28.jpg)
TLP:WHITE
![Page 29: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/29.jpg)
TLP:WHITE
![Page 30: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/30.jpg)
TLP:WHITE
The Monkey Business Illusion
• So what was the answer?
16
![Page 31: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/31.jpg)
TLP:WHITE
Analyse
What is important?
What do I need?
What don’t I need?
Analyse the elements observed
Inattentional
blindness
Analyse
![Page 32: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/32.jpg)
TLP:WHITE
ArticulateArticulate the facts succinctly
Remove assumptions
Also what don't you see
Explain what you have seen and communicate it
Assumptions
Danger! Danger!
Articulate
![Page 33: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/33.jpg)
TLP:WHITE
Adapt|ActFormulate questions to address
the seeming inconsistencies
Observations inform perceptions and perceptions
inform inferences
Step back take another lookPerspective
Adapt
![Page 34: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/34.jpg)
TLP:WHITE
Take an Action Based on What we See and Communicate
![Page 35: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/35.jpg)
TLP:WHITE
Did you see …
Public35
Renshaw’s Cow
![Page 36: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/36.jpg)
TLP:WHITE
René Magritte Time Transfixed
Summarise the picture
But what did you leave out?
![Page 37: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/37.jpg)
TLP:WHITE
Giu
sep
pe
Arc
imb
old
o -
The
Veg
etab
le G
ard
ener
![Page 38: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/38.jpg)
TLP:WHITE
El castillo de Jorge Méndez Blake
![Page 39: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/39.jpg)
TLP:WHITE
![Page 40: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/40.jpg)
TLP:WHITE
![Page 41: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/41.jpg)
TLP:WHITE
![Page 42: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/42.jpg)
TLP:WHITE
![Page 43: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/43.jpg)
TLP:WHITE
![Page 44: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/44.jpg)
TLP:WHITE
Contextual or Situational Awareness
![Page 45: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/45.jpg)
TLP:WHITE
Where are you now?
How do you proceed?
Are you comfortable about what you are seeing?
What else is around you?
What are the problems I am aware of?
![Page 46: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/46.jpg)
TLP:WHITE
Choice of words in both spoken and written language is important
![Page 47: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/47.jpg)
TLP:WHITE
Present Your Ideas
• In a way your reader can understand and build a picture
• Lead with the key fact, to• Seed your findings• Build a clear summary
• Begin with an action verb
• Highlight the impact
![Page 48: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/48.jpg)
TLP:WHITE
Keep it Succint
• Write a sentence
• Re-evaluate it
• Shorten it
• Get to the point faster
![Page 49: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/49.jpg)
TLP:WHITE
Be Precise
• Remove
• Clutter
• Assumptions
• unnecessary/irrelevant details
• Highlight the important information
![Page 50: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/50.jpg)
TLP:WHITE
![Page 51: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/51.jpg)
TLP:WHITE
In Conclusion
Understand how you come across
both figuratively and literally!
There are things you are seeing that are right in front of your eyes...
Have you gone back and told your colleagues, and re-evaluated
how did I miss that?
It was right there?
![Page 52: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/52.jpg)
TLP:WHITE
In Conclusion
Collaborate
Here is my issue, here is my problem.
Is there something that I might be missing?
Do you know something that i don’t
![Page 53: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/53.jpg)
TLP:WHITE
In Conclusion
Don’t reach for what you want to see
Be accountable for you observations
Jump to a conclusion; document how you get there
![Page 54: Seeing Clearly and Communicating Effectively to Address Event … · 2019. 6. 19. · Communicating Effectively to Address Event Overload Thomas V Fischer FVT SecOps Consulting. TLP:WHITE](https://reader034.fdocuments.net/reader034/viewer/2022052018/6030b158c2edee126a222f85/html5/thumbnails/54.jpg)
TLP:WHITE
@Fvt
› [email protected] [email protected] (secure)
› keybase.io/fvt
56
“If you change the way you look at
things, the things you look at change”
Dr. Wayne Dyer