Where automation ends and people begin

FIRST/TF-CSIRT Seminar

Tuesday — January 29th, 2013 09:30

We all want a magic button that fixes our network security problems. Automated tools can improve a weak computer security posture by preventing new infections and disrupting command and control channels. In reality, though, the scope of these tools will always be limited to the most basic of attacks. A strong security posture requires not only automated equipment, but people to program the equipment and to act on its output. Cisco CSIRT has taken a pragmatic approach where automated equipment better serves the purpose of providing intelligence to highly-trained IT staff, rather than attempting to replace the security staff altogether. This talk focuses on the philosophy that Cisco CSIRT uses to protect its own network.

Presenters

• Gavin Reid (Cisco Systems)

  Gavin manages the Computer Security Incident Response Team for Cisco Systems. His team has global responsibility for investigation on all security monitoring, events and incidents.