The State of Incident Response by Bruce Schneier

The last of the protection-detection-response triad to get any real attention, incident response is big business these days. I plan on stepping back and looking at both the economic and psychological forces that affect incident response as both a business and a technical activity. Nothing seems to be able to keep sufficiently skilled and motivated attackers out of a network. Can incident response save the day?

[@opensourcetools]

The blackhat admins (or whoever does the video) should re-upload this with just the video portion as fullscreen since he is not using any slides.

[@Nodws]

talk starts at 26:00 :p

[@justaguy5381]

Thanks!

[@CaseyAnthonyVEVO]

To @6:43 I would suggest that "high skill, high focus" could also embody an insider threat or organized crime. But I guess it all has to do with the arena in question as well as the end game of the attacker.

[@kenichimori8533]

Pope comment Thanks.
Arigato!!

[@jjames1977]

It's scary that some commentators are arguing that cyberwarfare requires a traditional military response, because the origin point of a cyber-attack is trivial to fake.

[@OtherTheDave]

J Candy I thought the original point was that cyberattacks could be executed remotely with no immediate danger to the attackers or special equipment? Seems like faking your identity is an obvious precaution against retaliation (to the point where it should probably just be assumed), but not really the point.