Fun fact, on average, it takes a company around seven months, that's 200
days, to discover an attacker is in their infrastructure.
So today, we're going to be looking at a cybersecurity defensive strategy to
help reduce the time to response when a breach occurs.
Hello, everyone. My name is Mike Woolard, and welcome to
my course on looking at ways to use PowerShell for active
defense. By the 200‑day mark, even 100 or 30‑day point,
the attacker has likely worked through multiple systems,
exfiltrated terabytes of data, and inserted backdoors throughout to maintain
a foothold for as long as they need. A breach of any level is never ideal,
but limiting the time and adversaries in your network will help limit the
damage and make it easier to remove them.
In this course, we're going to cover the principles of active defense.
What does the cybersecurity defensive strategy even mean, and why should blue
teams deploy active defense techniques in their environment?
We'll then walk through a few techniques and demos. Some of these traps
you can set to catch wandering eyes in your systems.
Finally,
we'll talk about how you can use PowerShell for incident response and audit
your network and system to discover vulnerabilities and keep your systems
in compliance with your desired secure state.
So let's get started. Next, we're going to talk about
what do we even mean by active defense?