So Your CFO's Phone Has Been Pwned: A DFIR Journey

Your CFO’s phone has malware on it. Okay. Cool. Cool, cool, cool. Of all the phones in the company, you got the one attached to banking apps, executive email, Slack, expense accounts, password resets, MFA prompts, travel plans, investor conversations, and a metric ton of other things nobody remembered to put in the incident response plan. I’ve spent a lot of time lately writing about what Censys can do before an alert: detection engineering, threat hunting, and…

Diamond Model