The Importance of Arts and Crafts in ThreatOps
Pete Hay presents visual diagramming frameworks to communicate complex threat intelligence, incident timelines, and multi-stage attack graphs in ThreatOps.
Summary
The Visual Communication Challenge in Incident Response
Cybersecurity analysts frequently struggle to convey complex multi-stage intrusions to non-technical executive stakeholders and cross-functional engineering teams.
Overcoming Divergent Threat Modeling Diagrams
Pete Hay identifies that asking multiple analysts to map the same incident yields conflicting, disorganized diagrams that obscure critical attack paths.
Standardizing ThreatOps Visual Frameworks
The presentation introduces structured visual templates for diagramming adversary campaigns, Kill Chain stages, lateral movement pivots, and infrastructure clusters.
Enhancing Incident Reporting and Decision-Making
High-density, visually intuitive diagrams accelerate executive incident decision-making and improve operational coordination across detection and response teams.
Related talks
Main Stage·22 min
Alex Holden
Alex Holden shares exclusive intelligence on infiltrating, tracking, and disrupting the pro-Russian hacktivist syndicate Killnet.
RSAC Cybersecurity·51 min
Lily Hay Newman · Lesley Carhart · Katie Nickels · Wendi Whitmore
Engineers explore architecture and security mechanisms for Real World Stories of Incident Response and Threat Intelligence.
Blue Team Village·31 min
Project Obsidian
Project Obsidian explains how to extract actionable cyber threat intelligence, TTPs, and indicator clusters from real-time incident investigations.