DFIR SUMMIT 2012: A Look Back

     Last week was the SANS Digital Forensics and Incident Response Summit in Austin, Texas.  I have to say the summit was probably my favorite conference experience I have had thus far.  It was a great mix of networking and content.  Your days are filled with spectacular information and you are still provided with a lot of opportunity to meet new people and discuss.  Plus, if you're active in the #DFIR twitter space, then it was an excellent opportunity to actually meet many of the people who use it.  I would highly suggest that, if you the ability to attend the summit.  I hope to be back in the coming years.

     As I mentioned, days at the summit are filled with a lot of great content from the speakers at the conference.  I have to say my favorite presentation, personally, was When Macs Get Hacked from Sarah Edwards.  This was simply because it was something I have yet to really see or research and provided a great baseline of knowledge where to look for information and various tools to utilize.  This presentation went very well with Andrew Cases's talk on Mac Memory Analysis with Volatility.

     Nick Harbour gave an EXCELLENT talk on Anti-Incident Response, that I really enjoyed a lot.  His talk was pretty technical and provided a lot of insight into the mind of an attacker.  Jeff Hamm's presentation on Carve for Records Not Files provided a lot of good information that should be considered in an investigation.  Event records very well may be much easier to carve for than an entire event log file.  Where a file is likely to miss all the information, carving for a fragment of that information is a lot simpler and may be just as useful.

     Cindy Murphy, this years Forensic 4Cast Examiner of the Year,  gave an amazing keynote to open the summit.  I thought it was very interesting and insightful.  If nothing else, I think a lot of people left the talk inspired and proud to be a part of this community.  Mike Viscuso's ending talk on Security Cameras - The Corporate DFIR Tool of the Future was also very interesting and, at least personally, gave a lot to think about the future of investigations and what that brings with big data.

     This is just a small sample of what the Summit offered, after all there were two tracks going the whole time (I couldn't make it to everything).  The presentations are posted already on SANS website here:  http://computer-forensics.sans.org/community/summits.  I highly recommend that you go through and take a look for yourself.  I really enjoyed the Summit, meeting everyone was awesome and it was nice to be around people that share the same passion (it's reinvigorating).

B-Sides Detroit Security Conference

B-Sides Detroit was this weekend, woke up early and headed out to Detroit with a couple of buddies for the con for the day.  Got there bright and early and I got really excited when I saw this:

The conference was being held in a semi-warehouse/studio apartment building and it was actually really cool.  Considering this conference is FREE, it wasn't a big deal and it actually added a nice bit of personality to the con.  I should mention for free you get the speakers, a super awesome t-shirt (see below), and lunch (at least the day I attended).

The quality of the speakers were kind of hit or miss for me.  All of them had prevalent information; however, I thought that the some of it was kind of basic and others were more technical (which peaks my interest a bit more.).  Again, this con was free and there were a lot of great enthusiastic people around to chat up and socialize with even on the conferences USTREAM.  The event was very low-key and didn't press any vendor products at you, which is always a plus.  To help pay for the event they had a nicely priced snack bar with some excellent beer to choose from.

Overall, I thought my B-Sides experience was amazing!  I would recommend that anyone check one out, as they host them all over the country and they're growing in popularity.  The environment promotes and encourages new ideas as enthusiastic security professionals gather to talk about the subject they hold a deep passion for.  This con had a personality all in its own and you can't help but like it.

________________________________________

A little background on my experience to gain perspective to my review.  As you can guess from reading this blog I am a undergrad student of 'Information Assurance' here in Michigan.  I have come to love the security field over the last year or two.  The only other conference I've attended was the Minnesota High Technology Crime Investigative Association conference a few months back.  I enjoyed that experience quite a bit, but as it was law enforcement centric it lacked the passion I found in Detroit.