May 18 @ 5:30 pm – Zachary Vaughn on Combating Insiders and Novel, Unknown Attacks with AI: A Real US Government Case Study

Register: This is a Hybrid meeting. A dinner meal will be served (Meal menu TBD). [LINK FOR REGISTRATION] IN PERSON & ONLINE ZOOM, Location 6th floor of 11955 Freedom Drive, Reston, VA 20190. Registration closes on Monday 05/15/2023.

Abstract: With the proliferation of generative AI models adversaries have gained yet another tool with which to probe, infiltrate and exploit systems supporting and protecting our national security. Methods of compromise and toolsets will more rapidly change and evolve. Vectra AI’s unique, security-led approach to apply specific AI/ML algorithms mapped to tactics, techniques and procedures employed by cyber criminals has allowed Vectra to successfully surface unique and novel Insider Threat activities that evade current tooling and superficial, math-led approaches. Learn how Vectra detects Insider Threats without the need to install agents or break and inspect traffic while operating in completely air-gapped environments and direct analyst focus to the signals that matter without flooding them with noise.

During the session, the attendees will gain a better understanding of a real-world attack simulation completed within the Federal Government. The team will discuss the approach that the malicious insider actor used to circumvent traditional detection and ML-enhanced cyber tools with a TRUE low-and-slow approach where the malicious users lived off the land, and ultimately staged the exfiltrated of multiple gigabytes of data – all of which was detected by Vectra. AI-assisted correlation and scoring of the threat and certainty of the successive attacker behaviors versus simple anomalies and signatures was able to catch the actors before they had the opportunity to inflict damage.

About the Speaker: Zachary Vaughn is the Director of Federal Security Engineering at Vectra AI. He has been supporting Federal agencies for over 16 years in areas such access and identity management, web and application security, virtualization of key infrastructure, and network security.