Advanced Incident Remediation Techniques

Explore advanced incident remediation techniques for large network breaches in this 46-minute conference talk presented by Steve Armstrong at the 44CON Information Security Conference. Learn about alternative methods to the traditional one-by-one infected host removal, including "mass remediation" and "outrunning the attacker." Discover the necessary conditions for successful implementation, such as team composition, target profile, network structure, and attacker behavior. Gain insights into scaling these techniques, required resources, and potential attacker responses. Benefit from real-world experiences and lessons learned from both successful and unsuccessful implementations. Delve into topics like the UFP problem, wiping infected systems, active attacker profiles, typical incident timelines, and emerging trends in incident management. Explore strategies for protecting intelligence, deploying agents, and distinguishing between penetration testing and red team activities. Examine scenarios involving sector-synchronized isolation, mass simultaneous system remediation, and hostile asset recovery. Understand the importance of full visibility, decisive action, and strategic intel management in effective incident response.