2012: p0wnage & Detections

We will present an in-depth analysis of several security incidents from 2012 to showcase the intrusion detection and incident response techniques used at Berkeley Lab, highlighting how our security monitors clearly flagged some compromises while examining why others were missed. We'll also highlight the interesting consequences of detection techniques that result in finding malicious but occasional events and discuss how the analysis we conducted on these incidents provides a basis for attack modeling and the design of new methods for security monitoring and response.