Intrusion Prevention Techniques on Windows and Unix
Rich Murphey explores intrusion prevention techniques on windows and unix at DEF CON 11, examining log-analysis and practical defenses.
Summary
Architecture and Background
Rich Murphey - Intrusion Prevention Techniques on Windows and Unix Intrusion Prevention Techniques on Windows and Unix What exactly is intrusion prevention and why the heck should we care?
Vulnerability Analysis
This talk surveys some of the common features of Intrusion Prevention systems, largely constrained by architectural layering of Windows and Unix kernels We then look at a case study of intrusion prevention and discuss how it differs from IDS, Firewall, AV, and others.
Exploitation and Demonstrations
Rich Murphey was a founding core team member of FreeBSD and Xfree86.
Remediation and Defensive Strategies
He received a PhD in Electrical and Computer Engineering from Rice University, was on the Faculty of the University of Texas Medical School in Galveston, and was Chief Scientist at PentaSafe Security Technologies. He is currently Chief Scientist at White Oak Labs in Houston, Texas.
Related talks
Main Stage·52 min
Patrick Wardle
Patrick Wardle provides an advanced guide to Apple's Endpoint Security framework, demonstrating how to build robust, kernel-level telemetry and macOS malware detection.
Creator Stage·43 min
Josh Pyorre
Explores building detection signatures from network transaction timing intervals to identify malicious command-and-control communication.
Creator Stage·55 min
E Tahoun · L Hamida
Demonstrates how open-source data science models cluster heterogeneous security alerts to uncover coordinated multi-stage cyber attacks.