Name: Addressing myths around EDR
Start: 2024-01-05T05:00:00Z
End: 2024-01-05T05:01:00.000Z
Location: BrightTALK
Rating: 0

Join us at Reasons to use Suricata for incident response and threat hunting as we delve into the world of Suricata, a powerful open-source network intrusion detection system (NIDS). In this webinar, we will explore the reasons why Suricata has become a go-to solution for incident response and threat hunting, and how it can effectively bolster your cybersecurity defenses.

Our expert, Tatyana Shishkova, Lead security researcher of Kaspersky Global Research and Analysis Team (GReAT), will provide a comprehensive introduction to Suricata’s capabilities. Gain insights from practical examples and understand how Suricata can be leveraged to proactively detect and neutralize potential cyber threats.

• get to know which threats can be detected using Suricata, and why it is crucial to write effective Suricata rules
• learn more about cases using Suricata for incident response and threat hunting
• discover new life hacks on Suricata

Reasons to use Suricata for incident response and threat hunting

Modern ransomware has transitioned to a Ransomware-as-a-Service (RaaS) model, with many groups sharing common tactics, techniques, and procedures in their attacks, or TTPs. These TTPs, described in MITRE ATT&CK, are like a glue that binds together multiple diverse teams operating at various levels with different priorities.

The Global Research and Analysis team (GReAT) at Kaspersky analyzed thousands of operations made by the different RaaS groups – and outlined the TTPs that the cybersecurity industry should consider in order to deliver a stronger protection for different organizations.

Join this webcast with Marc Rivero, a senior security researcher at Kaspersky GReAT. Marc will delve into the main TTPs used by modern ransomware groups and shed light on how to analyze them and use in attack detection and prevention.
• Kaspersky’s statistics on ransomware evolution
• Attack workflow using MITRE ATT&CK
• Overview of TTPs used by main ransomware groups
• Q&A session

Be aware of ransomware TTPs: applying MITRE to ransomware campaigns

Digital transformation is the integration of computerized technology into all areas of a business. Organizations of all sizes are fundamentally changing the way they operate and deliver value to their customers. However, it’s not always clear to some business leaders what digital transformation really means. 

As the world continues to embrace sustainable energy solutions, it is becoming imperative to address the growing cybersecurity challenges that accompany this technological shift. Join this webinar Safeguarding the future: cybersecurity risks in alternative energy sources as it focuses on key security concerns related to solar power systems, solar power inverter vulnerabilities in particular, grid management vulnerabilities, and the risks associated with remote load balancing management.

In addition to residential applications, alternative energy sources are gaining traction in industrial settings, contributing to the global shift towards sustainable and eco-friendly practices. Industries are increasingly incorporating renewable energy solutions such as large-scale solar power plants, wind farms, and biomass facilities to power their operations.

This webinar will shed light on the vulnerabilities that are currently affecting the renewable energy sector, with a particular emphasis on home solar power generation. Cloud-based applications have become a popular choice for managing solar power systems, providing users with seamless control and monitoring capabilities.

Safeguarding the future: cybersecurity risks in alternative energy sources

Not only do cybercriminals make money by committing cybercrime, but they also expand their operations by offering services to individuals without strong technical skills in malware development. This business model is known as Malware-as-a-Service (MaaS), and it operates on various sites of the "shadow" internet, including the Darknet. MaaS generates stable profits, enabling cybercriminals to maintain a team and continuously improve their services to carry out attacks on companies and individual users.

Through our research, we have identified 97 families of malware that have been distributed in the MaaS format – or "by subscription" – over the last seven years. These families include ransomware, various loaders, backdoors, botnets, and infostealers. In this webinar, Alexander Zabrovsky, Digital Footprint Analyst at Kaspersky, will delve into the inner workings of MaaS in the Darknet and address the most relevant issues:

- How did malware become a full-fledged product, and how did the "subscription" model become a new standard for cybercriminals?
- Why has YouTube become one of the key platforms for distributing malware? Who are traffers, and what is their function?
- Which families of malware are mentioned most often in the Darknet, and how does the Darknet services market depend on the news agenda?

Unveiling the Darknet's Malware-as-a-Service model

Cybercriminals tend to be secretive and act without disclosing their identity. However, when it comes to ransomware negotiations, the victim and the attacker have to “meet” face-to-face. Moreover, by the time the two sides meet to discuss the price, the attackers have already gained control of a company’s data or network – that puts the victim in a weak position.

What does it like to negotiate with someone who is trying hard to get a ransom whilst remaining in the dark? What can you expect from such negotiations? In this webcast, Marc Rivero, senior security researcher, GReAT at Kaspersky will observe various tactics used by ransomware groups, explain how the companies are trying to negotiate with these cybercriminals, and what outcome such negotiations may have.

In this webinar, you will learn:
- What Ransomware as a service (RaaS) model is
- What a data leak portal in RaaS terms is
- About ransomware negotiations: stages, means of communication
- What to do if you have been reached by a ransomware group
- Q&A session

Ransomware groups negotiation tactics: what you need to know

In today's media landscape, we consistently encounter news of companies falling victim to cyberattacks, resulting in the exposure and sale of their data on the dark web. The wide array of data available on the dark web market, including internal databases, infrastructure access, and compromised accounts, presents a pervasive problem that affects businesses of all sizes. These breaches and related incidents don’t only disrupt operations and damage reputations, but they can also result in substantial fines and legal consequences.

According to Kaspersky, nearly half of the organizations that faced data breach incidents in 2022 lacked contact person responsible for handling such incidents. About one-third either failed to react, denied the incident, or showed indifference to their data being traded on the dark web. Only a few were adequately prepared to respond.

At our upcoming webinar, Anna Pavlovskaya, an expert at Kaspersky Digital Footprint Intelligence, will present a comprehensive guide to setting up a system that monitors dark web threats and navigating the aftermath of an incident. You will gain insights into:

- Structuring the incident response process, including the approach, necessary steps, and the specific roles assigned to the team members responsible for the process.
- Identifying the types of data commonly offered for sale on the dark web and understanding the differing response strategies based on these data categories.
- Effective communication with the media, customers, partners, shareholders, top management, and other parties involved.
- Strategies for rapid incident identification, investigation, response, and recovery from an incident or preventing it from occurring.

Responding to a data breach: a step-by-step guide

The sensitive data stolen from companies during a cyberattack often ends up on darknet markets. With the rise of the cybercrime as a service business model, we observe that not only data obtained from attacks is for sale but also for the information necessary to organize that attack.

Once an attacker gains access to the infrastructure of an organization, they can then sell that access to other advanced cybercriminals, such as ransomware operators. The price for accessing potential victims’ systems is relatively inexpensive when compared to the possible damage to the targeted business. In fact, the average cost for access to a company’s systems lies between the range from $2000 to $4000. Meanwhile, such attacks result in significant financial and reputational losses to the attacked organization and may even cause suspension of work and disruption of business processes. SMBs and enterprises are both key targets of such attacks.

Yuliya Novikova and Sergey Shcherbel, security experts at Kaspersky, shed light on how a company’s data and the information on their systems is sold on darknet markets.
In this webinar you will learn:
- Which types of company data are most widespread on dark markets
- Which criteria cybercriminals use to evaluate the price for organization’s data
- How to keep your data protected

Dark market for corporate data: how cybercriminals sell access to your company

Modern cars employ a wide array of communication interfaces. Some, like Bluetooth and Wi-Fi, directly engage users, while others, such as RDS and GPS, provide user-facing services, and still others, like CAN and Ethernet buses, ensure the proper functioning of the car's internal systems. These interfaces contribute to the extensive flow of data within the car, forming its data flow graph. Within this graph, they serve as the "entry points" for malicious attackers seeking access to the vehicle. However, tampering with them does not necessarily lead to the loss of the car's security features.

In this webcast, cybersecurity experts, Alexander Kozlov and Sergey Anufrienko from Kaspersky's ICS CERT, will delve into the automotive security. Together, we will examine:

- We'll explore which interfaces attackers tend to favor when targeting cars and the reasons behind their choices.
- We'll focus on the techniques attackers employ when conducting attacks through specific interfaces, with an emphasis on classical techniques.
- We'll discuss how to defend against these threats and evaluate the feasibility of reducing associated risks.

Join us for this webinar, where we'll equip you with the knowledge and tools to not only comprehend the ever-evolving landscape of automotive security but also to safeguard your modern vehicle effectively.

Overview of modern car compromise techniques and methods of protection

In large companies, the sheer volume of information resources makes their attack surface significantly larger, compared to smaller businesses. Numerous factors contribute to this exposure, including networks spread across various locations that are consolidated into a single infrastructure, mergers and acquisitions with companies possessing lower security levels, outdated hardware and software, and more.

The level of preparedness for a potential incident directly impacts the effectiveness of the response and allows you to mitigate the attack’s impact. In this webinar, you will learn how to enhance incident responses for large-scale networks. Konstantin Sapronov, Head of Global Emergency Response Team at Kaspersky, will provide you with the following practical insights on:

• Optimizing incident response processes beyond mere scaling up by increasing personnel and systems involved
• Understanding incident response from a management perspective and why it should be an ongoing, cyclical process
• Exploring key principles for a successful response, emphasizing the significance of not only technical skills but also quality processes and soft skills
• Unveiling the limitations of backups in mitigating the consequences of an incident and discovering effective strategies to address them

Securing The Fort: How to master cyber incident response in a large company

In an age where cybersecurity threats are becoming increasingly sophisticated and dynamic, a holistic approach to threat detection and response is imperative. Extended Detection and Response (XDR), with its all-rounded threat detection and response capabilities, offers a powerful solution to address the evolving threat landscape in the world of containers. Explore the synergy between XDR and container security, offering a comprehensive strategy to understand threat detection and response in container security, and how XDR can be a game-changer in the cybersecurity strategy.

This event is a must-attend for security professionals, CTOs, CISOs, IT leaders, and anyone interested in staying ahead of the curve in the ever-evolving cybersecurity world. Join us to explore how XDR can be your ally in protecting containerized applications and securing your digital infrastructure.

XDR and Container Security: A Holistic Approach to Threat Detection and Response

In the rapidly shifting world of advanced persistent threats (APTs), tranquility is a rare sight. Leveraging their profound expertise, which includes tracking of hundreds of active APT campaigns, experts from the Kaspersky Global Research and Analysis Team (GReAT) will unveil their insights into the evolving threat landscape in the upcoming year.

Join Kaspersky for this webinar, where you will:
• Receive a detailed analysis of which of GReAT’s predictions from the past year have proven accurate and the underlying factors that contributed to their success or divergence.
• Be given forecasts regarding upcoming trends in the realm of APT activity.
• Gain insights into the protective measures to counter the ever-evolving threats effectively.

Speakers:
Igor Kuznetsov, director
David Emm, principal security researcher
Marc Rivero, lead security researcher
Sherif Magdy, senior security researcher
Dan Demeter, senior security researcher
Global Research and Analysis Team, Kaspersky

2024 Advanced persistent threat predictions

In 2022, Kaspersky Managed Detection and Response (MDR) received more than 400,000 alerts worldwide. Kaspersky team processed these alerts discovered by the service and accumulated as anonymized customer cases to provide information about the modern threat landscape and the most common adversarial techniques.

Join this webinar as Sergey Soldatov, Head of Kaspersky Security Operations Center, will highlight the results of MDR's operations occurred in 2022, including observations on:
• The most attacked industries
• The nature of high severity incidents
• Tactics, techniques and procedures used by attackers
• The most popular detection scenarios and an average threat detection rate

Findings highlighted in this webinar will help you to be aware of existing attack techniques and protect businesses from the growing number and complexity of real-life threats.

MDR analyst report: The latest statistics on global cyber-incidents

Global Endpoint Detection and Response adoption is on the rise, making it a de-facto standard for many organizations. Everybody has heard about it, but sometimes it’s hard to determine what you need for a particular task: EPP or EDR.

Join Nikita Zaychikov, Senior Product Marketing Manager at Kaspersky, to explore what EDR is really about, how it is different from EPP and when it’s best to use it. 
• EDR and EPP: what is the difference
• Why we need or don’t need EDR: exploring options for different organizations
• EDR myths
• EDR adoption in the world
• Types of EDR

EPP vs EDR: difference, use cases, adoption

This presentation will cover the methodology and measures organizations could take to prevent ransomware. It represents real-world practices, based on ransomware attacks statistics and deep analysis of ransomware groups TTPs.

• The most popular intrusion paths can be locked out
• Little efforts can cause significant problems for the spread of ransomware
• There are several ways to reduce the risk of your infrastructure being encrypted
• Light in the darkness: Is it possible to recover after encryption?

Ransomware Prevention Strategies

Modern cars are no longer just a means of transportation. Their built-in services can manage everything for drivers and passengers alike from seat heating, to using voice-controlled GPS to find a coffee, or make theater ticket reservations. Along with the development of consumer services, driver safety services have also been developed – distance sensors to neighboring cars, speed limit recognition and the eCall safety system, to name a few.

These hi-tech solutions designed to improve the user experience and make your journey safer, are architecturally based on algorithms and technologies that in themselves carry threats to information security. The wider the user experience, the wider the attack surface for an attacker. 

In this webcast, Cyberthreats to modern automotive industry, Sergey Anufrienko and Alexander Kozlov, security researchers at Kaspersky ICS CERT will discuss:

• Threat landscape: how has changed and evolved over the last 10 years
• Top threats the automotive industry is exposed to
• Standards of automotive security
• Trends in automotive security

Cyberthreats to modern automotive industry

IT and OT convergence brings a growing number of connections, equipment and services to industrial organizations. Maintaining control, availability, security and compliance will require a new generation of dedicated cybersecurity solutions. According to IDC Worldwide IT/OT Convergence 2022 Predictions, by 2024, 30% of industrial enterprises will incorporate centralized security management tools to bridge the IT/OT gap. The renewed Kaspersky Industrial CyberSecurity platform comes alongside this trend.
Kaspersky Industrial CyberSecurity (KICS) is a platform of natively integrated solutions for Operational Technology (OT) and Industrial Automation and Control Systems (IACS). It is a blend of products and expert services, catering to securing OT environments from cyber threats. These offerings provide a strategic initiative towards strengthening an enterprise's OT/IACS security landscape across industrial endpoint and network protection with centralized security management. This is powered with training, awareness, expert services, and intelligence. The KICS platform address all the cybersecurity needs of industrial enterprises and critical infrastructure operators. 
Concerned about industrial espionage and minimizing equipment downtime caused by cyberattacks? Join this webinar to learn more about how to protect your industrial infrastructure.

Achieving Cyber Resilience for Industrial and Critical Infrastructure

With the cyber threat landscape constantly evolving, Extended detection and response or XDR promises to dramatically improve security teams’ investigation and response times. But as with any emerging approach, there can be confusion about what XDR is, how it differs from traditional security solutions, and what security outcomes users can expect from it.
In this high-risk digital environment, it’s essential to know how to manage cyber threats coherently and holistically. Security teams need to rely on deeper integration and more automation to stay ahead of cybercriminals.
Join this webinar to learn more about XDR:
• XDR meaning and definition
• How does XDR work?
• Why businesses need XDR
• What are the benefits of XDR?
• Example of XDR use cases

A proactive approach to threat detection and response – Learn more about XDR

While some of the existing cybersecurity solutions already provide Endpoint Detection and Response functionality for small and medium business, implementation of EDR in these organizations can cause doubts. Kaspersky’s long-term experience in the development and implementation of EDR Solutions found the following has frequently raised concerns:

• EDR is just a “better antivirus”;
• This technology is only suitable for large enterprises as it is meant to discover sophisticated threats that don’t target small companies;
• EDR is a sophisticated solution that requires security staff - trained in detection and response;
• EDR provides capabilities for full response and remediation;
• EDR becomes shelf ware very quickly.

Are these concerns fair? Join this webinar to find it out and decide if EDR technology fits your company’s need

Addressing myths around EDR

Endpoint Detection and Response

Cyber Defence

Cyber Attacks

Response Time

Threat Defence

Cyber Threats

Sophisticated Threats

Large Companies

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Addressing myths around EDR

Presented by

About this talk

More from this channel