When good tools go bad meets bias - an Incident Response walkthrough where we thought our world was on fire!

Once upon a time at work we had a really bad day. We were having an all staff get together when we observed servers on our internal network being exploited. We assembled our “A Team” consisting of Defensive and Offensive Specialists and started the incident response.

This is the tale of what happens when people and tools do bad things, and you don’t check your bias. The next 3 hours were a lesson in how we capture data as incident responders, knowing your tools, understanding biases, and ultimately understanding that the mixture of coincidence, timing, legitimate and illegitimate activity make for a very complicated tapestry of information to sort through.

This session is aimed at anyone who responds to security incidents. We are all human and make mistakes, this session has several.

We will show you the timeline of the events, how we approached the response, what we found and more importantly what we did wrong, what we overlooked and the biases that contributed to those decisions.