BEGIN:VCALENDAR
CALSCALE:GREGORIAN
PRODID:-//Apple Inc.//iOS 6.1.3//EN
VERSION:2.0
BEGIN:VTIMEZONE
TZID:Europe/Amsterdam
BEGIN:DAYLIGHT
DTSTART:19810329T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:19961027T030000
RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=-1SU
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DESCRIPTION:A timely reaction to security incidents is without doubts important. And wh
 ile the techniques of digital forensics can come pretty close to perfect fo
 r single-host systems with small hard drive capacity\, things can get easil
 y messy with 10+ systems\, a mixture of operating systems & mobile devices 
 of various brands\, or gigabit network traffic that is partly encrypted.\n\
 nThis talk contains two parts. For one\, the do's and don’ts for incident
  response from a forensic examiner’s point of view. Is it better to pull 
 the plug\, or gracefully shut the machine down\, how to capture network tra
 ffic\, and what to do if the machine is still running and you’d like to i
 mage the RAM. In particular\, I’ll present a few methods how to capture n
 etwork traffic for small networks that don’t have a dedicated monitoring 
 port available\, and what to do with them. Secondly\, a list of things that
  went wrong when reality kicked in and good intentions do more harm than go
 od. This will include the problems of tool dependency for specific tasks\, 
 free log aggregation using graylog and why there is no such thing a s a fre
 e lunch\, GRR and the riddle for the perfect toolchain.\n
DTEND;TZID=Europe/Amsterdam:20170805T204000
DTSTAMP:20170804T093754Z
DTSTART;TZID=Europe/Amsterdam:20170805T194000
LAST-MODIFIED:20170804T093748Z
LOCATION:Pa
SEQUENCE:0
SUMMARY:An academic's view to incident response - Martin Schmiedecker
TRANSP:OPAQUE
UID:6e4cc66d-2edc-41ab-9d9b-6ec921e0944d@frab.sha2017.org
URL;VALUE=URI:https://program.sha2017.org/events/316.html
BEGIN:VALARM
ACTION:DISPLAY
DESCRIPTION:Reminder
TRIGGER:-PT1H
UID:892E9AFE-D07F-4542-8891-3D4F5D3A9730
X-APPLE-DEFAULT-ALARM:TRUE
X-WR-ALARMUID:892E9AFE-D07F-4542-8891-3D4F5D3A9730
END:VALARM
END:VEVENT
END:VCALENDAR
