Too many organizations take an "it'll never happen to me" approach when it comes to log collection.  This approach meets compliance needs and facilitates everyday business while ignoring the actual threat landscape.  When doomsday arrives and it's time to respond to an advanced targeted attack, these organizations learn the hard way that they are logging the wrong data.  One method for avoiding this scenario involves applying a common attack model and "decorating" each stage of the model with data sources useful during incident response.

Back to BSides Augusta 2015 video list