Incident response at EDU's is a target rich environment; this allows for lots of opportunities to test tools and techniques. By analyzing your incidents statistics and your IR team's metrics, you can start to pinpoint gaps in your program. We will review historical stats, incident details, and discuss how we reduced discovery time and investigation time at the University of South Carolina. These lessons can be applied to your environment to improve your IR program.

Tom Webb has 16 years of experience in IT and 12 years dedicated to security. Tom has worked for state law enforcement and in the education sector. He is currently employed by the University of South Carolina as the director of security operations. His role includes leading a team that performs: incident response, forensics investigations and vulnerability management. Tom has a B.S. in Information Management from the University of South Carolina. He holds various certifications including the GSE. Tom also volunteers for the SANS Internet Storm Center.

@twsecblog

Back to BSides Augusta 2016 video list