HolisticInfoSec.io’s Russ McRee speaks regularly on information security topics in the hope of sharing knowledge and resources with a wide audience.
Past Events
(ISC)2 Security Congress DFIR Redefined: Deeper Functionality for Investigators with R
October 29, 2019
Secure Iowa Conference 2019 Keynote
October 8, 2019
Derbycon 7 DFIR Redefined: Deeper Functionality for Investigators with R
September 2017
BSides Augusta 2017 Keynote
September 16, 2017
Emcee at Microsoft’s BlueHat v14, Redmond, WA, October 10, 2014
Presented Find It, Fix It: Moving Threat Intelligence Beyond Data Brokering at BlueHat v14 Defender’s Day, Redmond, WA, October 8, 2014
Presented C3CM: Defeating the Command, Control and Communications of Digital Assailants at DerbyCon 4.0 in Louisville, KY, September 26, 2014
Presented C3CM: Defeating the Command, Control and Communications of Digital Assailants at SANSFIRE 2014 in Baltimore, MD, June 2014
Presented From the Perspective of a Hacker at Emerald Down III: 2014 Cyber Security Workshop, Auburn, WA, April 1, 2014
Presented C3CM: Defeating the Command, Control and Communications of Digital Assailants at the CTIN Digital Forensics Conference, Seattle, WA, March 26, 2014
Presented Understanding Web Application Security Attacks for Investigators at the CTIN Digital Forensics Conference,Seattle, WA, March 24, 2014
Emcee at Microsoft’s BlueHat v13, Redmond, WA, December 12, 2013
Presented Why I Don’t Sleep at SecurityWeek/Trend Micro Security Event, Bellevue, WA, December 5, 2013
Presented Memory Analysis With Volatility at SecureWorld Expo, Seattle, WA, November 13, 2013
Presented Memory Analysis With Volatility at ISSA International Conference 2013, Nashville, TN, October, 9, 2013
Presented Memory Analysis With Volatility at Microsoft Security Response Alliance 2013, Redmond, WA, July 11, 2013
Presented Memory Analysis With Volatility at SANSFIRE 2013, in Washington, DC, June 18, 2013
Presented Memory Analysis With Volatility at SecureWorld Expo in Portland, OR, June 6, 2013
Presented Memory Analysis With Volatility at the Cloud Focus Group (ISSA & CSA), Microsoft Campus, March 21, 2013
Presented Memory Analysis With Volatility at the CTIN Digital Forensics Conference, March 15, 2013
Emcee at Microsoft’s BlueHat v12, Redmond, WA, December 12, 2012
Presented Evil Though the Lens of Web Logs at the ISSA International Conference in Anaheim, CA, Thursday, October 25, 2012.
[Presented Evil Though the Lens of Web Logs at Microsoft Security Response Alliance Summit 2012 on Thursday, July 12, 2012.
[Presented OWASP Top 10 Tools and Tactics at SANSFIRE 2012 in Washington, D.C. on Tuesday, July 10, 2012.
[Presented Evil Though the Lens of Web Logs at RSA 2012 , March 2, 2012.
[Presented OWASP Top 10 Tools and Tactics at SecureWorld Expo Seattle in Bellevue, WA on Thursday, November 17, 2011.
[Presented OWASP Top 10 Tools and Tactics at the ISSA International Conference in Baltimore on Friday, October 21, 2011.
[Presented Visualizing APT: Analyzing the Zeus Attack against Government and Military at the Rochester Security Summit in Rochester, NY on October 5th, 2011.
Russ participated in a panel discussion specific to forensics and cloud IR at the Black Hat Executive Briefings at Black Hat Las Vegas, August 2nd, 2011, 4 pm.
[Presented Incident Response in Increasingly Complex Environments on Tuesday February 22nd at 11:30 to the ISSA Alamo Chapter in San Antonio, TX.
[Conducted a breakout session at the RSA 2011 eFraud Network Forum, Malware-Proof: Building Resistant Web Applications, February 14, 2011, 2:10-3:10 pm.
[Presented Incident Response in Increasingly Complex Environments at the ISSA International Conference. September 16, 2010, in Atlanta, GA.
Presented Visualizing APT: Analyzing the targeted attacks against government, military, and industry at the ISSA Puget Sound August 2010 Membership meeting, August 19, 2010, City University, Bellevue, WA.
Presented Incident Response in Virtual Environments: Challenges in the Cloud, with Bryan Casper, at the 22nd Annual FIRST Conference in Miami, on Thursday, June 17, 2010.
Presented Visualizing APT: Analyzing the Zeus attack against government and military to the Washington State HTCIA on April 16, 2010.
Presented Securing Your Company’s Web Presence to ISACA Puget Sound on March 16, 2010.
Presented Visualizing IDS output: Tools and Methodology at RSA 2010, March 5, 2010.
Presented IT Infrastructure Threat Modeling at the ISSA Puget Sound August chapter meeting, August 20, 2009.
Presented CSRF: Yeah, It Still Works with Mike Bailey at Defcon 17 on Saturday, August 1, 2009.
Provided a guest lecture at University of Washington’s Certificate Program in Information Systems Security , specifically on the topics Practical Crytography: TrueCrypt and Web Application Security Flaws (May 21, 2009).
Participated in a panel discussion at the Ziff Davis Enterprise Security Summit 2008 on October 21, 2008 at the Fairmont Olympic Hotel in Seattle, WA. Details here .
Presented The XSS Epidemic: Discovery, Disclosure, and Remediation to the Puget Sound chapter of the ISSA on August 23, 2008.
Presented The XSS Epidemic: Discovery, Disclosure, and Remediation to the Washington Technology Industry Association Security Special Interest Group on July 14, 2008. Details here .
Presented Malcode Analysis Techniques for Incident Handlers at the 20th Annual FIRST Conference in Vancouver, B.C. on June 25th, 2008. Details here. Slides here .
Presented The XSS Epidemic: Discovery, Disclosure, and Remediation at the 2008 ISSA NW Regional Security Conference on April 23rd, 2008, in Olympia, WA. This presentation was the result of a great deal of research for the April 2008 toolsmith of the same approximate title. The most disturbing finding during this process was the discovery of yet another batch of Hacker Safe branded sites that are certainly not. Refer to the blog post and video for more information.
Russ gave an overview of RAPIER during a SANS Ask The Expert Webcast, Malcode Analysis and Response: Proficiency vs. Complexity on March 20th, 2008. “The threat landscape changes constantly, driven in part by the “bot economy” and changing malcode techniques. In response, incident handler techniques must keep pace. This presentation will cover the use of RAPIER, a security tool built to facilitate first response procedures for incident handling. It is designed to acquire commonly requested information and samples during an information security event, incident, or investigation. RAPIER automates the entire process of data collection and delivers the results directly to the hands of a skilled security analyst. From detection and discovery, capture and containment, count on a useful discussion meant to further your incident response practices.” You can listen to the stream and/or view the slides here.
Russ offered Malcode Analysis Techniques for Incident Handlers at SecureWorld Expo Seattle 2007 : _The threat landscape changes constantly, driven in part by the “bot economy” and changing malcode techniques. In response, incident handler techniques must keep pace. This presentation will cover tools and methodology useful to handlers, analysts, and administrators. From detection and discovery, capture and containment, count on a useful discussion meant to further your understanding of the information security practitioner’s greatest bane._Slides available below.
Russ taught SANS Stay Sharp Google Hacking and Defense on July 19th, 2007 in Bellevue, WA. SSP-GHD offers a “fundamental understanding of technical defense measures to uncover unintended information disclosures, close common holes in web servers and Internet connected devices as well as clean up the exposures discovered.”
3rd Annual ISSA Northwest Regional Security Conference May 11th, 2007. Covered toolsmith highlights.
WSA Security Sig, April 2nd, 2007. Covered toolsmith highlights.
Extrusion Detection with Aanval and Bleeding-Edge Snort at SecureWorld Expo Seattle, October 10, 2006. Details here.
Covered Aanval and Bleeding Snort for the Seattle Snort Users Group on June 6, 2006, at the South Seattle Community College. In an age of compliance, it is hugely beneficial to have the capacity to draw the majority of network security information from one platform. Use of Aanval can offer much information about outbound traffic, in particular, via the use of Bleeding Edge Snort rules to capture both IM and spyware traffic, as well as policy violations and information leakage. Russ presented the use of Aanval as an IDS and Network Monitor, covering the use of Aanval and Bleeding Edge Snort rules for malware detection and policy enforcement at Linuxfest Northwest 2006 in Bellingham, WA, April 29th, 2006
Russ’ article, SELinux, Apache, and Tomcat, A Securely Implemented Web Application Server, was published in Sys Admin, the journal for UNIX and Linux systems adminstrators, in the January 2006 issue. The article covers the use of SELinux, iptables, mod_jk, and mod_security to build a secure web app server.
Russ participated in the Seattle SecureWorld Expo as a panelist on the IT & Physical Security Convergence panel. Seattle SecureWorld Expo took place October 19-20, 2005 at Meydenbauer Center.
Russ was privileged to address an audience of extraordinary scientists and researchers in the field of intrusion detection at RAID 2005 - The 8th International Symposium on Recent Advances in Intrusion Detection held in Seattle September 7-9. The presentation was a short, simple one, designed to motivate further discussion at poster sessions held after the presentations to the audience as a whole.
Guest Blog Posts
Microsoft Internet Explorer Blog: Statistical Validation of the IE8 XSS Filter
[Microsoft Malware Protection Center Threat Research & Response Blog: Another Reason to Avoid Piracy
Presentations
Extrusion Detection with Aanval & Bleeding Edge Threats