Click here to send us your ideas and feedback on Blueprint! Many of us with the typical IT and security backgrounds might not have the slightest idea what to expect when we hear the terms “this product uses advanced machine learning…”, but that claim certainly conjures up a lot of skepticism due to the opaque nature of the algorithms in many of these products. In this episode we discuss what AI and ML are best used for, and what they can, can’t, and shouldn’t be used for with guest Dave Hoelzer....
Jul 12, 2022•51 min•Ep 27•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! While malicious insiders are a threat that most of us would like to imagine we might never have to deal with, it’s still one of the cyber threats you must realistically consider and plan for. But how do you identify malicious intent and potential attacks from those already inside our network that have legitimate access to our data? Check out this episode where James Rowley lays out what you need to consider when it comes to insider thre...
Jul 12, 2022•1 hr 1 min•Ep 26•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! With ransomware and other highly disruptive attacks on the rise, there are few systems more important to defend than our critical infrastructure and ICS equipment. How should we think about defending these systems vs our typical IT network though? In this episode, Dean Parsons is here to give us that answer. Our Guest - Dean Parsons Dean brings over 20 years of technical and management experience to the classroom. He has worked in both ...
Jul 12, 2022•58 min•Ep 25•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! It's a special mailbag episode from John Hubbard! After two seasons, John asked the listeners what questions they had for him. He touched on the current XDR trend, how other teams can support SOC activities, defining security mindset, and more. PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Courses for SOC Analysts and Leaders: SEC450: Blue Team Fundamentals - Security Operations and Analysis LDR...
Jul 01, 2022•21 min•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! In this solo episode to wrap up season 2, John discusses some of the key takeaways from the guests interviwed throughout this year, and has some very exciting news for all blue teamers on a brand new GIAC certification. ;) Link: (GIAC GSOC LINK HERE) John is a Security Operations Center (SOC) consultant and speaker, a Certified SANS instructor, and the course author of two SANS courses, SEC450: Blue Team Fundamentals - Security Operatio...
Jun 08, 2021•23 min•Ep 23•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! We all need solid, well though-out playbooks to help standardize our respons to common threat scenarios. In this episode we speak with Thomas Detzner and Mark Morowczynski about the brand new set of Microsoft incident response playbooks that were just released. This is a brand new effort to meticulously document prerequisites, investigation steps, and remediation process for common scenarios most commonly seen by the Microsoft incident ...
Jun 01, 2021•43 min•Ep 22•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Compliance and audit checks can be painful, and that's before you introduce additional cloud services and technology. In this episode featuring AJ Yawn we discuss some incredibly useful and actionable cloud security concepts and tools that can help your team boost visibility and reduce user permissions to help prevent breaches before they happen. In addition, we discuss what a good compliance audit should be, and how to turn audits...
May 25, 2021•57 min•Ep 21•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! There are numerous ways to test your SOC's detection and prevention capabilities, but not all are created equal. Each has their own strengths and weaknesses, and can be done on a different time scale.This week, we focus on arguably one of the most important - adversary emulation. In this episode we speak with Jamie Williams from the MITRE ATT&CK team about why adversary emulation is important, how it works, how you can get star...
May 18, 2021•50 min•Ep 20•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! PowerShell may seem intimidating, but it can be one of the most amazing and useful tools at your disposal...if you know how to use it. In this episode, we have Josh Johnson, author of the new SANS course "SEC586: Blue Team Operations - Defensive Powershell" giving you a masterful crash course in: - The importance of PowerShell - How PowerShell works, and how to set yourself up to use it - Blue team use cases for log analysis, ...
May 11, 2021•50 min•Ep 19•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! This episode is all about vulnerability management - both the technical and human aspects. Looking to start up a new vulnerability management team? Drowning in vulnerabilities to fix and don't know where to start? Struggling to get system owners to take action? Trying to find ways to communicate the importance and status of your patching efforts? Check out this episode with vulnerability management expert Chris Baker for answer the...
May 04, 2021•41 min•Ep 18•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! A common question from many defenders is "Which logs are the most important?” In this episode, Mick Douglas and Flynn Weeks join us to describe their What2Log project, which aims to simplify this problem for all of us! Our Guests: Mick Douglas & Flynn Weeks Mick Douglas is the Managing Partner of InfoSec Innovations. He is a SANS certified instructor and is a member of the IANS faculty. In his spare time, he tries in vain to im...
Apr 27, 2021•47 min•Ep 17•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! In today’s episode, John is joined by Anton Chuvakin to discuss current and future security operations technology, which tools are the most important and which are becoming less important over time, the rules of automation in the SOC and how Anton would setup a modern Security Operations Center for a Cloud native organization. Today's Guest: Anton Chuvakin Dr. Anton Chuvakin is a recognized security expert in the field of log manag...
Apr 20, 2021•48 min•Ep 16•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Are you a manager looking to build or improve your SOC? Are you trying to understand how to measure your SOCs maturity or use cases or your threat hunting efforts? If so, today’s episode with Rob van Os is for you. In this episode, we discuss the SOC CMM for SOC maturity measurement, the magma use case framework for building and tracking SOC use cases, and the Tahiti threat hunting methodology for showing ROI on threat hunting. Our Gues...
Apr 13, 2021•50 min•Ep 15•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! What is AppSec, DevOps and DevSecOps? In this episode we discuss why defenders should know more about these terms and what the consequences are of ignoring these new and critical fields. Tanya Janca, also known as SheHacksPurple , is the best-selling author of ‘ Alice and Bob Learn Application Security ’. She is also the founder of We Hack Purple, an online learning academy, community and podcast that revolves around teaching everyone t...
Apr 06, 2021•45 min•Ep 14•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Driving consistency and maintaining a high standard for alert response is a problem all SOCs must face, but how? In this episode, Josh Brower describes his efforts to combine automated detection signature deployment and use case database management into a single, easy to use app for Security Onion. Whether you use Security Onion or not, this episode dives into the design principles and workflow Josh used when designing the new open-sour...
Mar 30, 2021•34 min•Ep 13•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Even if you're not a malware analyst, any blue teamer should be able to do some initial basic malware sample triage. The good news is that this is quite easy to do using freely available tools once you know what is available. Join John in this conversation with Ryan Chapman as they discuss how to reverse engineer malware and why you might want to do so. Our Guest - Ryan Chapman Ryan Chapman works as a Principal Incident Response an...
Mar 30, 2021•1 hr 8 min•Ep 12•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Looking for a new way to approach the difficult problem of measuring and improving your SOC? Check out this episode to hear how to use methods pioneered in the manufacturing and reliability industry to help wrap your head around, and solve this complex issue. You don’t want to miss this episode with Jon Hencinski, Director of Operations at Expel who covers all of this and more. Our guest - Jon Hencinski Jon Hencinski is the Director of ...
Mar 30, 2021•50 min•Ep 11•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Austin Taylor discusses the promise and reality of cyber security-centric data science, and how you can use machine learning for solving practical security problems. Twitter Handles: @HuntOperator | @SecHubb | @SANSDefense All Blueprint Podcast Episodes: sans.org/blueprint-podcast PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Courses for SOC Analysts and Leaders: SEC450: Blue Team Fundamentals - Secu...
Aug 11, 2020•41 min•Ep 10•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Roberto Rodriguez explains the awesome projects and initiatives he is working on to help blue teams perform advanced data collection, analysis, and threat hunting. Twitter Handles: @Cyb3rWard0g | @SecHubb | @SANSDefense All Blueprint Podcast Episodes: sans.org/blueprint-podcast PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Courses for SOC Analysts and Leaders: SEC450: Blue Team Fundamentals - Securit...
Aug 04, 2020•42 min•Ep 9•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Cloud expert Kyle Dickinson discusses common cloud infrastructure attacks, and how you can detect and prevent them before they happen to your organization. Twitter Handles: @KyleHaxWhy | @SecHubb | @SANSDefense All Blueprint Podcast Episodes: sans.org/blueprint-podcast PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Courses for SOC Analysts and Leaders: SEC450: Blue Team Fundamentals - Security Operati...
Jul 28, 2020•42 min•Ep 8•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Mark and Libby share the new technologies in use at Microsoft to dramatically decrease the need for the use of passwords in the enterprise. Twitter Handles: @markmorow | @TruBluDevil | @SecHubb | @SANSDefense All Blueprint Podcast Episodes: sans.org/blueprint-podcast PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Courses for SOC Analysts and Leaders: SEC450: Blue Team Fundamentals - Security Operation...
Jul 21, 2020•42 min•Ep 7•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Dave and Ryan speak with John about resources for training yourself, and the challenges of setting up a large-scale cyber lab to simulate an advanced attack for their Splunk Boss of the SOC competition. Twitter Handles: @daveherrald | @meansec | @SecHubb | @SANSDefense All Blueprint Podcast Episodes: sans.org/blueprint-podcast PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Courses for SOC Analysts and...
Jul 14, 2020•36 min•Ep 6•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Katie Nickels talks about what threat intelligence is, where to get it, what you should expect from it, and how the SOC should be using it. Twitter Handles: @likethecoins | @SecHubb | @SANSDefense All Blueprint Podcast Episodes: sans.org/blueprint-podcast PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Courses for SOC Analysts and Leaders: SEC450: Blue Team Fundamentals - Security Operations and Analys...
Jul 07, 2020•41 min•Ep 5•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Mary Chaney shares what types of laws we should be concerned about. She discusses her thoughts on privacy laws and how that will drive cyber security, and what she’s doing to get more diverse representation in the industry at all levels. Twitter Handles: @MaryNChaney | @SecHubb | @SANSDefense All Blueprint Podcast Episodes: sans.org/blueprint-podcast PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Cour...
Jun 30, 2020•41 min•Ep 4•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Chris Sanders and Stef Rand discuss qualitative research they conducted on how to use divergent or convergent thinking for improving the quality of your analysis. Twitter Handles: @ChrisSanders88 | @techieStef | @SecHubb | @SANSDefense All Blueprint Podcast Episodes: sans.org/blueprint-podcast PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Courses for SOC Analysts and Leaders: SEC450: Blue Team Fundam...
Jun 23, 2020•44 min•Ep 3•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! In our very first guest interview with Mark Orlando, John asks Mark questions to help us re-evaluate our security operations. Twitter Handles: @MarkAOrlando | @SecHubb All Blueprint Podcast Episodes: sans.org/blueprint-podcast PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Courses for SOC Analysts and Leaders: SEC450: Blue Team Fundamentals - Security Operations and Analysis LDR551: Building and Leade...
Jun 16, 2020•34 min•Ep 2•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Hear host John Hubbard share info on his background, his inspiration and goals for this podcast and his insights on ‘The Art of Blue Teaming”. Twitter Handles: @SecHubb | @SANSDefense All Blueprint Podcast Episodes: sans.org/blueprint-podcast PRE-ROLL only! It says lets jump in at the end. Check out John's SOC Training Courses for SOC Analysts and Leaders: SEC450: Blue Team Fundamentals - Security Operations and Analysis LDR551: Bu...
Jun 16, 2020•26 min•Ep 1•Transcript available on Metacast Click here to send us your ideas and feedback on Blueprint! Blueprint brings you the latest in cyber defense and security operations from top blue team leaders. Blueprint is brought to you by the SANS Institute and is hosted by SANS Certified Instructor John Hubbard. Twitter Handles: @SecHubb | @SANSDefense All Blueprint Podcast Episodes: sans.org/blueprint-podcast Check out John's SOC Training Courses for SOC Analysts and Leaders: SEC450: Blue Team Fundamentals - Security Operations and An...
Jun 09, 2020•2 min•Transcript available on Metacast 
