Live Response With Ansible - SANS DFIR Summit 2019
Jumping almost blindly into a compromised network can be challenging when you don’t have standard security tooling available. This presentation reviews how ansible, a open-source configuration management tool, was used to perform DFIR at a small company we acquired. Like many small businesses, and even some very large ones, the environment was lacking meaningful security infrastructure or tooling. The gotcha - 1,000’s of Linux servers in multiple colo’s completely separated from the corporate network. This presentation provides an overview of ansible & how it was used for ad-hoc, scalable DFIR including identification of compromised hosts, searching for IOC’s and performing remediation with nothing but a single laptop and some creativity. This talk will add another tool to the arsenal of those who don’t readily have corporate security tooling available on a moment’s notice.
Brian Olson leads the global incident response team at Verizon Media. In this role he is responsible for intrusion detection, threat hunting & incident response functions at Internet-scale with products such as Yahoo, AOL, Huffington Post, TechCrunch and Engadget just to name a few.