Abstract: Everyone advocates for threat modeling. Few actually do it. This session aims to close that gap by demonstrating the #misec Attack Path methodology. First, we will select and analyze a security incident. Using threat modeling, we will break the incident down into the path the attacker followed through the network. Second, we will perform a table top exercise to identify the detective and preventative controls along that path. Using a controls assessment, we can determine our actual defense-in-depth for this particular attack. Third and finally, we will create a security exercise that tests the controls along the path. The session will conclude with a discussion of using the Attack Path for incident response drills.

Author Bio: Combined, #misec has given close to a dozen talks on the Attack Path methodology. We have hosted two workshops. This educational talk shares the best of what we have learned in a polished presentation.

Back to Circle City Con 2014 Videos list