BSides Atlanta 2023

Jason Lawrence


Session

10-14
16:00
50min
Threat Hunting on Budget - Using OSS to Hunt for the Unknown
Jason Lawrence

In today's digital landscape, organizations constantly face the challenge of protecting their networks and assets from myriad cyber threats. With limited resources, staying ahead of sophisticated adversaries is a challenge. In this talk I will highlight the benefits of utilizing open-source software (OSS) to conduct effective threat hunting on a budget. Threat hunting is a proactive approach to identifying and mitigating potential cyberattacks before they escalate into full-blown incidents. This process involves detecting malicious activities, anomalies, and intrusions that may have evaded traditional security measures. However, commercial threat-hunting tools can be expensive, putting them out of reach for many organizations with constrained budgets. Open-source software offers a cost-effective alternative to commercial tools, enabling organizations to enhance their cybersecurity posture without breaking the bank. OSS provides a wide range of customizable solutions that can be tailored to meet specific organizational needs. Additionally, the collaborative nature of open-source communities fosters continuous improvement and innovation, ensuring that OSS tools remain up-to-date and effective against emerging threats. We will discuss some of the more popular OSS tools for threat hunting, like Security Onion, Wazuh, and ELK Stack. These solutions offer robust network analysis, intrusion detection, and log management capabilities. By integrating these tools, organizations can gain comprehensive visibility into their networks, allowing them to detect and respond to threats more effectively.

Room 300