How to Stop Advanced Persistent Threats from Evading Detection 
Nick Lantuh, President
NetWitness Corporation
Presentation Abstract:
Many of today's network advanced persistent threats are evading detection by your perimeter defenses - whether you know it or not. That's because most organizations have developed an over-reliance upon perimeter-based, network-layer focused point solutions that require signatures or profile-based foreknowledge of a given technical threat. As proven through numerous serious security breaches over the last few years, most signature and log-file-based security solutions are already entirely obsolete, and solutions based upon statistical analysis of netflows and other network-layer telemetry provide limited and incomplete network visibility.
This session focuses on the true nature and sources of today's most difficult threats, and describes solutions, both technology and operations- related, required to solve this problem. The speaker will illustrate actual technical case studies from the commercial and public sector to describe an effective operational plan of action consisting of the use of automated reporting and alerting, and interactive threat analysis applications built upon a distributed full packet capture and session reconstruction infrastructure. The session will demonstrate techniques that will enable your organization to detect and stop designer malware, zero-day attacks, and non-signature-based threats to improve overall network visibility, and to detect the leakage and exfiltration of valuable organizational data.
Attendees will learn:
- The technical reasons that advanced persistent threats are evading current perimeter-based point solutions such as IDS, log monitoring and flow-based technologies.
- The true nature and sources of threats facing public and private organizations and the gaps in current network visibility.
- Advanced techniques for next generation network monitoring using full packet capture and session reconstruction, and the network visibility improvements provided by this approach.
- Specific examples of adversary exploits (demonstrations) similar to trends observed within organized crime groups and state- sponsored attacks.
Bio:
Nick Lantuh is President of NetWitness Corporation. Prior to this role, Mr. Lantuh was Vice President of the NetWitness Product Group, a Division of ManTech International. Mr. Lantuh brings 17 years of I/T leadership, fund raising & start up experience, ranging from pre-revenue start-ups to Fortune 100. Mr. Lantuh has held leadership roles at organizations such as Cisco Systems, as well as pre-revenue start-ups in the security, software, wireless and networking spaces leading to three acquisitions and an IPO.
