1. Deep Dive into the Blue
VCU Infosec Team

2. My password is Passw0rd

3. Blue Team Advantages Knowledge of internal environment
Network Traffic data
System Event data
Location knowledge of systems and data
Behavioral data
Automated and integrated tools and ability to command other administrative and IT units
Ability to setup and adjust layers of defenses based on threat trends
Blue Team Advantages

4. Blue Team Disadvantages
Asymmetric warfare – In terms of manpower
Take the assumption that 0.1% of all attackers on the Internet are targeting VCU
Need to defend all ways in, versus the attacker
Important to identify what is important
Minimize the ways you can get to the important things
Sometime fighting the internal forces and politics
Importance of organizational culture and hierarchy
Accountability and responsibility
Managing expectations at all levels
Blue Team Disadvantages

5. Basic defenses (Endpoint AV, Firewall, Network Segmentation, etc)
System event and security logs
Network packet captures / flow data
Security Information Event Management Systems
IPS / IDS devices
Behavior Analytics tools (UBA)
User training tools
Internal Policies and Baselines
Tools of trade

6. Example Security Onion Open Source Network Security Monitoring Distro
Based off of Ubuntu
ELSA
Snorby / Sguil / Squirt
IDS engines (Snort / Suricata)
Bro
CAPME (Full Pcap)
Example