2019 SOC Summit - Action Items

Slide decks for talks available here:
https://www.sans.org/cyber-security-summit/archives/cyber-defense

Youtube Video (duration: 8:35) of these items: https://www.youtube.com/watch?v=W-GGqx-q_Rg

=-=-=- Day 1 =-=-=-

Keynote: Lessons Learned Applying ATT&CK-Based SOC Assessments
Action Item: Plan for an ATT&CK based assessment to identify coverage, internal or third party.

Use Case Development Utilizing an ARECI Chart
Action Item: Identify Gaps in coverage using ARECI charts built from use cases.

Use Cases Development as a Driver for SOC Maturation
Action Item: Tune down the noise.

A SOC Technology/Tools Taxonomy – And Some Uses for It 
Action Item: Compare your deployed SOC infrastructure to the proposed taxonomy.

Mental Models for Effective Searching
Action Item: Minimize time spent at the blank search bar by developing effective capability.

Managing Security Operations in the Cloud
Action Item: Familiarize yourself with cloud defenses available and integrate into the DevOps cycle to leverage them.

Virtuous Cycles: Rethinking the SOC for Long-Term Success
Action Item: Autonomy, Mastery, Purpose. Skills, Empowerment, Creativity, Growth. Automation->Efficiency->Metrics

2019 SANS SOC Survey Preview: Live Simulcast
Action Item: Download and read the 2019 SOC Survey when it comes out.


=-=-=- Day 2 =-=-=-

How to Disrupt an Advanced Cyber Adversary
Action Item: Focus on Network Awareness, Cyber Hygiene, and proper Device Configuration.

Breach -> ATT&CK -> Osquery: Learning from Breach Reports to Improve Cross-platform Endpoint Monitoring
Action Item: Whatever you choose to instrument your endpoints with, learn the granular differentiation of the host that will made detection and hunting meaningful.

Shared Security Services: How to Adjust to an Ever-growing Landscape of Security Operations Center Responsibilities
Action Item: Tell a good story about your SOC, and your internal collaborators.

The Call Is Coming from Inside the House: How Does Your SOC Respond When Attackers Are On-Site?
Action Item: Make people disappear. Think about how the physical matters.

How to Literally Think Like an Attacker to Become a Better Defender
Action Item: Think

Arming SecOps with a Special Forces Targeting Process
Action Item: Advance your thinking using intelligence

The Case for Building Your Own SOC Automations
Action Item: Automate good capabilities, that you already have or want. SOAR tools not required.

Rapid Recognition and Response to Rogues
Action Item: Know thy network (as much as you can).

This Will Never Work: Tales from Disappointingly Successful Pen Tests
Action Item: Demonstrate weakness to drive improvement. Take time to laugh.

New Orleans Recommendations

( Updates in 2018-02: Add these to your list: Willa Jean, Mammoth Espresso, Doris Metropolitan, Lattitude 29, Spitfire Coffee, Paloma Cafe  )

Since we're in the CBD, my favorite nearby places Cochon (but I really like butcher, it's less formal), Peche, Compere Lapin, August ($$$), Willa Jean, Juan's Flying Burritto (CBD location), Carmo, Luke on St. Charles, (great happy hour)...

Nearby for coffee: Revelator Coffee

Nearby for wine: Keife & Co, W.I.N.O

Nearby bar for hangout: Lucy's Retired Surfer, Vic's Kangaroo 

Stuff I'm going to check out this trip in the area that has opened recently: Bakery Bar, Espiritu, 

Magazine Street - Starting from Calliope, and running uptown, Magazine is a funky shopping district with lots of interesting independent stores. Check out Juan's Flying Burrito for awesome creole Mexican food. Cheap, filling, and good quality. (And loud music.) Lilette is expensive fine dining near Louisiana Avenue.

If you're uptown, check out Oak Street. Zotz is a cool coffee shop. For dinner, you can try Jacquesimo. It's a little pricy, but decadent new orleans style food. If you want that same type of food for cheap, Crabby Jack's on Jefferson Highway is run by the same guy. My favorite there is     Blackened Gulf fish with crabmeat remoulade sauce. Their Duck & Andouille gumbo is pretty damn good, too. Freret Street between Jefferson and Napoleon has become a culinary wunderbar. Amazing because when I lived there it was dangerous and all boarded up. Breakfast at bearcat cafe is excellent. High hat is New Orleans style. Ancora Pizza is well regarded.

Museums: Ogden (regional folk and outsider art), Museum of Modern Art, Contemporary Arts Center. The     D-Day (WWII) museum is supposedly really good. There's also a civil war museum.

Ride the St. Charles Streetcar line uptown to Audubon park, or go on the Canal Streetcar line to Mid-City for City park and the botanical gardens. If you're in Mid-City go to Angelo Brocado's Italian bakery for cappuccino, gelato, and cookies. It's at Carrollton and Canal Street.

Vietnamese food in NOLA is some of the best you can find in the country.  My favorite is Nine Roses. It's on the west bank (of the Mississippi) and a little hard to find, but we have big family style meals with between 5 to 20 people. It's an amazing feast, and ends up being about $25 per person.

For nice quarter restaurants, I suggest Bayona, NOLA (Emeril's place), Pelican Club, Mr. B's, or Palace Cafe. They're all fairly expensive. Tujaque's is old school New Orleans. Have lunch at Napoleon house. Definitely go to K-Paul's (Paul Prudhomme's cajun restaurant).  Find Cochon Butcher (butcher is the cafe style, Cochon is fine dining style) in the CBD (other side of Canal) for lunch. Any of Donald Link's restaurants are great. My current favorite restaurant in New Orleans is Restaurant August.

In the Treme (on the edge of the french quarter) check out Lil Dizzies for great New Orleans fare.

Check out Frenchmen Street. You can go to Snug harbor for burgers and a Jazz show. But, most people go to port of call on Esplanade for burgers. There are several good clubs on frenchmen St.: Maison, DBA, Yuki, etc.

The Bywater has several excellent places. Maurepas Cafe (update: CLOSED), Bacchanal on Poland Ave. Satsuma's for breakfast or lunch, Cake Cafe for breakfast  /lunch.

You can get good coffee at Cafe du Monde, but also Envie at Barracks and Decatur. For excellent espresso drinks, I like Velvet across from Whole Foods on Magazine. There's now a HiVolt uptown also on Magazine by Whole Foods. 

There's the original Hi-Volt on Sophie Wright place(near Magazine in Garden District near that Juan's), Mammoth Espresso and Spitfire in the CBD & Quarter.  Hi-Volt also great breakfast / brunch and baked goods, but they're much better at Sophie Wright location.

Try chickory coffee.

Go to Jean Lafitte's blacksmith shop on lower bourbon St. (go away from Canal St. past all the big clubs like Pat O'Briens and Cat's Meow, and past the gay dance clubs. ) Speaking of Pat O'Brien's, lots of people go there. 

Also, be sure to get to Preservation hall Jazz club before you start drinking one night to enjoy old style New Orleans Jazz. Probably the only place where you'll hear authentic old style.

If you still have time and money, you can check out the bywater. Look at going to Vaughn's. Take a cab, and take a cab back to the quarter / CBD. I would walk or bike from the quarter, but you don't know the area and it is not always safe. The bywater is very funky. May or may not be your thing.

St. Roch Market is a great food stall and has excellent happy hour cocktails.

If you want good beer, go to DBA on Frenchmen Street. 

There's actual Absinthe at the place on Pirate's Alley between the cabildo and the cathedral off of Jackson Sq.

For a good breakfast, go to Cake Cafe in the Marigny (past elysian fields from canal). I think it is on Decatur, but I don't recall. There's also Elizabeth's out in the bywater.

Tipitina's is a famous music club.  

There are a few things in there that didn't involve eating or drinking to do during the day.  Some people still want to go on the disaster tourist stuff.  If you want to rent bikes, go to my friend Bicycle Michael's on Frenchmen St.  Tell him you know me.  He'll probably say something like, a lot of people know Chris.  ;-)

Tune in to WTUL, 91.5FM.  It is Tulane's college radio station.  They've got club and event listings hourly, and you can win tickets pretty easily from them for shows.  Also check out WWOZ, 90.7 IIRC.  They are NOLA cultural station.  They also have club and event listings.