Real World Stories of Incident Response and Threat Intelligence

### Overview At RSA Conference, moderator Lily Hay Newman (WIRED) hosted an incident response and threat intelligence panel featuring Lesley Carhart (Dragos), Katie Nickels (Red Canary), and Wendi Whitmore (Unit 42, Palo Alto Networks). Drawing on extensive careers spanning industrial control systems, managed detection, intelligence operations, and government investigations, the speakers pulled back the curtain on front-line cyber defense. The discussion covered initial incident handling, investigative mindsets, responder burnout, neglected security basics, threat sharing dilemmas, and the next generation of security professionals.

### Key Topics - **Navigating the First 24 Hours:** Initial reports are frequently noisy, inaccurate, or incomplete. Whether tracking supply chain incidents like 3CX or responding to urgent client alerts, responders must balance rapid action with healthy skepticism, separating verified evidence from early panic. - **Mindset and Responder Burnout:** Effective responders rely on skepticism, curiosity, and calm. High-stakes incidents often require responders to act as stabilizing forces for panicked clients. Sustained incident tempos risk burnout, requiring proactive rotation management in incident response plans. - **The Overlooked Basics:** While advanced threats receive substantial public attention, adversaries routinely exploit basic security hygiene failures, such as unsegmented networks, outdated asset inventories, and misconfigured cloud assets like open S3 buckets with default passwords. - **Threat Intelligence Sharing and Attribution:** Information sharing across private industry, ISACs, competitors, and government bodies (e.g., CISA JCDC, NSA Cybersecurity Collaboration Center) significantly accelerates containment. However, organizations must carefully scope what they share early to avoid retracting false details.

### Technical Details & Real-World Cases - **3CX Supply Chain Incident:** The incident highlighted how public and community intelligence sharing limits harm. After CrowdStrike identified malicious DLLs and flagged infrastructure hosted on GitHub, rapid takedowns helped sever intrusion chains before adversaries could deploy broad secondary stages. - **Evidence-Based Analysis & Hypothesis Testing:** Panelists stressed applying the scientific method during investigations: actively trying to disprove hypotheses rather than seeking confirmation bias, and qualifying assessments explicitly (e.g., assessing an infection based on specific DLL evidence rather than declaring total compromise blindly). - **Extortion and Tracking Stolen Data:** In ransomware and pure extortion incidents, tracking exact file-level theft and timestamps is crucial. Without precise records, victims struggle to determine whether new extortion demands involve fresh intrusions or re-extortion using previously compromised data. - **State-Sponsored vs. Criminal Attribution:** In initial response phases, prioritizing attribution to specific nation-states can distract from immediate containment. Because well-funded criminal groups now possess capabilities rivaling nation-states, responders focus first on TTPs, lateral movement patterns, and malware capabilities.

### Takeaways Organizations should formalize responder shift rotations and handoffs within their incident response plans to mitigate burnout. Routine fundamentals—asset inventories, updated network maps, cloud access controls, and multi-factor authentication—prevent the vast majority of intrusions. Finally, building pre-existing relationships with law enforcement, industry peers, and ISACs before a crisis ensures actionable, trusted communication during active attacks.