Video
Missed seeing the NOC at Black Hat?
Watch the Grifter interview with Brad Little
What makes the Black Hat NOC work?
The Black Hat Network Operations Center is a live, high-pressure environment. Security teams monitor activity, investigate suspicious behavior, and help keep the network running while the event is underway.
In a conversation with Brad Little, Neil “Grifter” Wyler, Coalfire’s VP of Defensive Services who has run the Black Hat NOC for more than two decades, explains what makes the operation effective, how the team works together, and why its methodology translates to other environments.
What happens inside the NOC
Every router, switch, firewall, and access point in the venue is pulled and replaced with dedicated gear. The network is stood up in days and torn down in hours. Roughly 25,000 attendees connect to it, many actively practicing what they learned in class that morning. This year, the internal servers were under attack 15 minutes after the network came up.
Once the network is up, the NOC operates as a full SOC. Roughly 285 million informational alerts crossed the wire this year. 17.1 million were classified as threats, and 323 were actually malicious. Most organizations hunt for a needle in a haystack. At Black Hat, it’s a needle in a needle stack. Hunters, analysts, and threat intelligence teams run the full incident lifecycle around the clock for the length of the show, hunting anomalies rather than chasing every alert. The technology changes from one environment to the next, but the methodology holds.
Could a NOC model help your team?
The NOC offers a real-world example of security operations under pressure. We’re exploring how the people, processes, and expertise behind that experience could translate to different customer environments.
The right approach will depend on your goals, team, environment, and operating model.
Explore the conversation
Have questions about the NOC, what makes it work, or how the model might apply to your environment?
Tell us what you’d like to learn more about, and a team member will follow up.