The First 48: It's Not Ransomware...Yet

Live incident response continues to be a weakness in large organizations. Incident commanders are making decisions without understanding the larger impact of the investigation which can lead to attacker success. This Lab will provide a hands-on environment to help attendees learn how to shift from accidently enabling attackers to making informed decisions that disarm them and eradicate enterprise threats. This session will follow Chatham House Rule to allow for free exchange of information and learning. We look forward to participants actively engaging in the discussion, and remind attendees that no comment attribution or recording of any sort should take place. Pre-Requisites: General understanding of how APT groups operate Basic knowledge of defending an enterprise network This is a capacity-controlled session. If added to your schedule and your availability changes, please remove this session from your schedule to allow others to participate.