Nicolas Collery
Last known affiliation: DBS Bank
Bio: Nicolas Collery has been in the security field for over 19 years, focusing on fighting cybercrime. Passionate about forensics, malware analysis, and now simulating attacks focusing on real-adversaries’ tactics, techniques and procedure to assess the capability to prevent, detect and respond. He has presented at multiple conferences and security events in Singapore featuring various applications of Bitscout, including bypass of proprietary full disk encryption, cloud forensics and more. He is one of the active contributors and supporters of the project. Nicolas now leads the active defence services at DBS Bank headquartered Singapore which comprises the threat intelligence, penetration testing, vulnerability assessment and red & purple teaming practices. He is a primary incident responder for DBS Computer Emergency Response Team (DBSCERT). Nicolas also leads application security in DBS to maintain the high standards expected by its customers. The focus of his team is to empower the bank to release applications at a fast pace and using modern technologies, while ensuring security.
Vitaly Kamluk 🗣 | Nicolas Collery 🗣
Abstract (click to view)
This workshop aims to share knowledge of live triage and analysis of remote compromised systems to assist incident response, digital forensics, or malware discovery and in-place analysis. There are many other applications of the techniques and tools that the participants are encouraged to explore on their own.
Although the knowledge shared during the workshop can be applied independently of the tools proposed, it starts with the attendees building their own toolkit for remote threat reconnaissance. It features Bitscout, a project based on a collection of free open-source software for Linux, that is extendable with any set of tools the analyst wants to embed before or in the middle of the operation.
Incident response to live cyberattacks requires silent navigation through compromised assets, sometimes in large distributed networks. The popular approach relies on EDR or other live agent-based solutions. However, the activation of security agents and obvious activities on live compromised systems may trigger alerts of advanced threat actors. Once alerted, a clean-up operation and destruction of evidence can happen. Moreover, offline system analysis may not be easy due to the physical distance to the compromised system or scale of the network. This is where remote stealthy threat discovery with “scoutware”, software for threat hunting and instant system analysis, becomes incredibly useful. Bitscout, used for the workshop, is just one such toolkit.
In addition to working with local virtual machines during the workshop, the attendees will be provided with access to 60+ live servers to be analyzed simultaneously to simulate large-scale compromise – online access will therefore be required.
Nicolas Collery 🗣 | Vitaly Kamluk 🗣
Abstract (click to view)
This workshop aims to share knowledge of live triage and analysis of remote compromised systems to assist incident response, digital forensics, or malware discovery and in-place analysis. There are many other applications of the techniques and tools that the participants are encouraged to explore on their own.
Although the knowledge shared during the workshop can be applied independently of the tools proposed, it starts with the attendees building their own toolkit for remote threat reconnaissance. It features bitscout, a project based on a collection of free open-source software for linux, that is extendable with any set of tools the analyst wants to embed before or in the middle of the operation.incident response to live cyberattacks requires silent navigation through compromised assets, sometimes in large distributed networks. The popular approach relies on edr or other live agent-based solutions. However, the activation of security agents and obvious activities on live compromised systems may trigger alerts of advanced threat actors. Once alerted, a clean-up operation and destruction of evidence can happen. Moreover, offline system analysis may not be easy due to the physical distance to the compromised system or scale of the network. This is where remote stealthy threat discovery with “scoutware”, software for threat hunting and instant system analysis, becomes incredibly useful. Bitscout, used for the workshop is just one such toolkit.in addition to working with local virtual machines during the workshop, the attendees will be provided with access to 60+ live servers to be analysed simultaneously to simulate large-scale compromise – online access will therefore be required.
