Digital Forensic Survival Podcast

Latest Episodes:

DFSP # 309 - Insider Threats Jan 18, 2022

Show notes

This week I cover insider threat, which is sort of a gray area between traditional investigations and DFIR investigations.

DFSP # 308 - Cloud Access Controls Jan 11, 2022

Show notes

This week I’m talking about identity access controls commonly encountered in cloud environments. These come up during DFIR investigations and high-level awareness, at the least, is necessary for analysts in order to be effective during investigations. These are the things that may be part of root cause, part of the attack escalation, or part of mitigation will remediation. This week all cover the basics to help with your incident response preparedness.

DFSP # 307 - Career Strategy Checkup Jan 04, 2022

Show notes

This week is my advice for conducting a career critique as well as to plan for the future - or at least for 2022. I do this episode every year at this time with the intention of helping newer analysts maximize their efforts to achieve the desired career goals in both the short term and long term.

DFSP # 306 - Lateral MM Fast Triage 5 Dec 28, 2021

Show notes

This week we continue with the Windows fast triage series and talk about lateral movement evidence that may be found in DC records.

DFSP # 305 - CSA Cloud Threats 8 Dec 21, 2021

Show notes

This week is a continuation of the threats to cloud computing miniseries. We are stepping through the top 11 threats to cloud computing as identified by the Cloud Security alliance. When you are protecting cloud assets or investigating breaches of cloud assets, there is a lot to keep in mind. You must remember the standard security infrastructure, the new cloud infrastructure as well as any changes to the standard infrastructure that could be affected for your investigation. The top 11 threats to cloud computing help identify where you, as an analyst, should prioritize your time both as a starting point and how you use your limited time for continuing education.

DFSP # 304 - Detecting File Poisoning on Linux Dec 14, 2021

Show notes

This week I review a great method to detect file poisoning on Linux using all native commands.

DFSP # 303 - Mac Artifacts with SUMURI Dec 07, 2021

Show notes

This week SUMURI's Steve Whalen (a.k.a. 'MacBoy') talks Mac artifacts

DFSP # 302 - Lateral MM Fast Triage 4 Nov 30, 2021

Show notes

This week we continue with the Windows fast triage series and talk about lateral movement evidence that may be found in logon event records.

DFSP # 301 - OSDFCON 2021 Nov 23, 2021

Show notes

This week Brian Carrier of Basis Technology joins me to talk about OSDFCon. The DFIR community relies on open source tools and the conference is a great way to get exposure to new tools and to learn how to use them. There's a great lineup this year with something for everyone. Registration is free for everyone.

DFSP # 300 - Case Study Ocean Lotus Nov 16, 2021

Show notes

This week is a case study where we look at an actual attack strategy and compared it against standard triage methods to see how well they hold up. In this episode I break down some attack methods attributed to APT32, also known as Ocean Lotus, and we’ll see how standard triage techniques hold up against the attack chain.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Digital Forensic Survival Podcast

Related Podcasts

Links

Stay Connected