MITRE ATT&CK Framework Overview | MITRE ATT&CK Framework Vs Cyber Kill Chain

[@umershahbaz2318]

Excellent delivery of content , this explains the presenter has strong grip in information security domain .

[@umersayyam4947]

Very outstanding presentation, it covers approximately all the topics that are on top priority in the industry and needed to be understand.

[@numanmaavia8575]

very informative session. thanks GISPP and especially thanks to organizer sir Shahzad subhani for organizin such a valuable sessions.

[@arsalananwar3397]

good content and very informative session

[@Chsultan5125]

A very informative and comprehensible presentation. A must watch even for non cyber security guys like me. The presenter was able to present in a manner that a novice like me could understand it as well. Hats off 👏👏👏

[@GISPPACADEMY]

Glad you liked it!

[@janjua2012]

Very informative session. It seems that presentor had a deep knowledge of the topic and conveyed it quite effectively and efficiently

[@GISPPACADEMY]

Glad you liked it

[@showkatmeer5474]

👍, Really nice session Sajjad Bhai , bring more sessions like this.

[@bilalmazhar100]

Great content and very informative session

[@GISPPACADEMY]

Glad it was helpful!

[@ganimohammed7863]

Bhaiya masha Allah it will help us.... May Allah bless you with more knowledge

[@abdulghafoor6085]

Very Nice

[@1parag]

Good Job Sir...

[@GISPPACADEMY]

Please check video description for slides link. Also if you like the video, gives us a 👍 and subscribe to the channel.

[@dhaliguitar2568]

Great presentation sir!! And for the most part I felt that you sound very much like Amitabh Bachchan.. it's like learning Cyber-security from Big-B :)

[@mhradeel6310]

Thankx for informative video

[@GISPPACADEMY]

Thanks for liking

[@muhammadatif2199]

I am from usa i would like to learn SOC

[@tallorder00]

Defense in depth is not dead per say if a user clicks spearphishing mail, or of your security controls are not patched or harden..it's problem of security management. Without defense I'd depth you cannot design any security system or control... One example people who had harden there window server for ransomware prevents encryption of sensitive extensions so the impact is reduced We don't do service level hardening or customisation which reduces impact

[@GISPPACADEMY]

Very good feedback indeed 👍 👍 👍

[@cookiemaster1049]

Actually the point was related to layered security model that is also use in defense in depth. can you please tell me what was the reason ransomware attacks are so much successful these days what is defense in depth is doing to stop ransomware attack ? have you ever handled any spear phishing attacks ? two factor authentication bypass ? password sprays , Webshells , incase you are not much aware of such attacks then defense is depth is dead here, Also how zero days are catered by defence in depht ? any idea about Supply chain attacks why defence is depth cant help you against Log4j vulnerability ? why solar wind Orion update was compromised by a legitimate certificate and malware dll why defense and depth IDS IPS cannot able to detect that attack for months to C&C domains ? please shed some insights ?

[@tallorder00]

@@cookiemaster1049 I guess to speak on security you cannot be blinded by attacker mindset only, real protection comes when you understand security management is not just about security jargons or attacks vectors you mentioned. Defense in depth is a principle it's not a rule or exe that you can run on any sys and it will give you defense in depth/breadth. It's a mindset which you cannot have or gained if you have attacker only mindset. Infact most people would not know what difference between defense in depth vs breadth. Secure architecture like zero trust model of real existence or proof of defense in depth also micro or nano segmentation are part of modern networks secure design. Do you have examples or case study where these attacks failed? Did of all N number of systems that were attacked ...were all breached. ? Those that were not compromised you have a root cause of data. Seeing a glass half full or half empty but you need to have certain cognitive and analytical intelligence to debate the topic without bias and incomplete data. All you assumed that all systems are green day, means ripped for attack and compromise ..you have no idea how secure systems are designed and engineered...it's just like saying of that bullet proof jacked failed one time out 1000...let's throw out protection features of jacket all together. Are all MFA insecure are they inherently insecure or were deployed as insecure? At time of heartbleed there were companies who had customized ssl libraries and we're safe from breach? You know why and what promoted to change these libs?

[@asifnasimsatti4172]

I want to know presenter name?

[@GISPPACADEMY]

Check video description

[@tallorder00]

On 21:28 you self contradict yourself you said no defense in depth No access control No antivirus etc So you are justifying need of defense in depth here?

[@GISPPACADEMY]

Thanks for the feedback. Defense on depth is certainly necessary but if it is not configured well then it might provide a false sense of security. Thanks for your valuable comments.

[@cookiemaster1049]

its just an example for example using keygen to crack office 2016 ,this is quite norm in each organization and i found AV report such incidents and usually system admins are found doing such activities . crackers and Free vpns , torrents and even Crypto mining is practices by employees in companies.

[@tallorder00]

@@cookiemaster1049 normal and secure are two different things...like I have worked in organizations where the CD/DVD plus USB slots were removed from all workstations. It's about level of risk you are willing to accept..and for that risk you have to pay the price. Keygen etc is norm but there are dozens of control to pervent such practice..supply chain can be secure through IT auditing software that keep check on licensing misuse and asset management. But if your admin are involved in same game then whom is to blame?