Logs Out: An IR Mystery - LitMoose

Opening Keynote

Join us for an afternoon who-dun-it – an environment has been murdered and the logs have a secret to tell. You have been invited to the conference room, a few will get a gift from a Mr. Admin, and you all have something in common. Was it Mrs. Peacock in the DC with the reverse shell? Or maybe Colonel Mustard in the ESXi cluster with vCenter creds? Help solve the mystery before it’s too late, and the auditors arrive!

The Fight For the Future - Dave Kennedy

Closing Keynote

Cybersecurity continues to expand, mature, and find its own way. This talk will dive into what we all can do to shape this industry, make it our own, and make a difference in making the world a safer place. We’ll dive into the struggles in technological solutions with crafty adversaries and ease of tooling and weaponization as well as what we can do to combat various threats. This talk will go into how past, present, and future generations contribute to the success of this industry and how working together we can make a huge difference in what future generations look like. With technological progression moving at a rapid rate – newer technologies taking form, our roles will only expand to the defense of civilization and well-being. This industry is truly in a unique spot in history, and we can all play a role in how it turns out for the positive. This will of course, be Back to the Future themed with many references to hoverboards, DeLorean’s, and flux capacitors.

Defending Beyond Defense - Catherine Ullman

Assumptions burn defenders every day. Perhaps the most pernicious one is that systems and their controls will always work as designed. Best practices in security may be good guidelines, but unfortunately also suffer from these same blind spots. For example, best practice recommends the use of LAPS for local administrator account passwords of domain-joined computers, yet misconfiguration of active directory can turn it from a protective control into a vulnerability. 

But what if there was a way to challenge these assumptions up front? The best way to dismantle these types of assumptions is to experience how deeply flawed they are. There is no better way to gain first hand experience into this perspective than immersion in the offensive security space. In this talk we'll explore how to immerse yourself in the offensive security world to obtain this knowledge without needing to change careers or obtain additional certifications. 

By being more informed about offensive security, defenders are better able to recognize relevant intel, understand existing threats, and more readily discover attacker behavior. Join me as I discuss how there's more to defending than just defense, and how you can find and engage with the amazing resources that are out there waiting to be explored.

What is a firewall? Understanding common security tools and concepts - Zach Raizen

The goal of the presentation is to focus on  "raising the bar" for everyone around concepts and tools that are standard within the information security field. I want to ensure that even less technical security teams and business teams understand what is being referred to when IT or Security mentions they are using these tools and what the key benefits and limitations are. By broadening the understanding of these, I think it helps us all work together to develop even stronger security solutions and identify solutions which don't inhibit necessary functions.

We all use firewalls, VPNs, antimalware solutions, WiFi, cloud services, and IoT devices as a part of our everyday lives, either knowing about them or not. There is a lot of misleading information out there on what will keep you safe, and instead of busting myths, I want to educate people on the strengths and limitations of these solutions so they know what to look for and how to gauge the level of protection they may need or get, based on their own risks.

When management asks you: “Do you accept Agile as your lord and savior?” - Daniel Lagos

So you’ve been told that your organization is going to implement Agile methodologies across ALL of IT, and not just in development. And you’ve been given the responsibility to implement it in Security Operations, and without a clear plan or measurable objectives other than “make the team more efficient”. 

While one can complain that someone in the C-Suite heard of the book “Scrum: The Art of Doing Twice the Work in Half the Time”, you still have a job to do. So the basics of Project Management, Agile, Scrum & Kanban are covered and how one can shoehorn these concepts into working in an operations context. Oh, and there will also be some finagling of where DevOps stands regarding Agile and Operations.

The Pillars of Protection: Fundamental Ways to Protect Organizations Against Cybercrime - Erich Kron

There are a lot of great tools available for cybersecurity defense, however far too often organizations find themselves adding new tools and products without ensuring that the foundational principles of cybersecurity are in place and can bear the load. Without strong pillars to stack these tools on, it becomes far too easy for it all to come crashing down.
In this session, we will look at the underlying base of cybersecurity principles that can help support the other tools in place to help secure organizations. From auditing permissions to segmentation of the network, we will better understand why these things mean so much to keeping an organization secure

"Securing your Azure Cloud: Secrets from a Cloud Penetration Tester" - Edwin David

Is your Enterprise in the Azure Cloud? Has it ever had a penetration test? It’s time to get some answers on problems that are lurking in the cloud and what you can do to protect your cloud assets from attackers. If you cloud has never had a penetration test and you are a blue team defender you will not want to miss this talk. This talk will encompass common attack vectors that are used to gain a foothold into Azure and escalate privileges.

The Pillars of Protection: Fundamental Ways to Protect Organizations Against Cybercrime - Erich Kron

There are a lot of great tools available for cybersecurity defense, however far too often organizations find themselves adding new tools and products without ensuring that the foundational principles of cybersecurity are in place and can bear the load. Without strong pillars to stack these tools on, it becomes far too easy for it all to come crashing down.
In this session, we will look at the underlying base of cybersecurity principles that can help support the other tools in place to help secure organizations. From auditing permissions to segmentation of the network, we will better understand why these things mean so much to keeping an organization secure

How Purple Teaming & subsequent Threat Index Evaluation can boost up the confidence of a CISO? - Rupali Narang

• Performing a full-circle purple team.
• Orchestrated Attacks.
• Evaluate existing security technologies/tools [viz. Web gateway, Perimeter firewalls, micro-segmentation controls, EDR , XDR ].
• Attacks mapped to MITRE framework.
• Risk prioritization for failed Attacks.
• Identify the gaps [viz. Lateral Movements, Incomplete Logs]
• Your Industry Threat Index exposure.
• Fixing the identified gaps.
• Closing the purple -team circle - by re-running the earlier failed attacks."

Bride of Pod People: An Analysis of a WordPress-Targeting Spam SEO Campaign - Courtney Falk

Bride of Pod People is a spam search-engine optimization campaign that targets WordPress sites. The spammers use credential-based attacks to steal existing users’ accounts in order to post spam links, driving web traffic to affiliate advertising networks. This paper documents the current indicators that identify the Bride of Pod People campaign and analyzes how the spam links and redirection operate together.

A World Without Passwords - Andy Jaw

A world without passwords is possible. Password attacks and MFA phishing attacks are on the rise. In this presentation, we'll talk about why we should get rid of passwords, the various configurations for passwordless solutions available to Windows and Azure Active Directory, and how easy it is to get started. We'll go through how to deploy Windows Hello for Business in both cloud or hybrid configurations. We will also discuss how to implement passwordless authentication and phish resistant MFA with Azure Active Directory for Microsoft 365 and Azure AD federated applications.

Old Services, New Tricks: Cloud Metadata Abuse by Threat Actors - Nader Zaveri

Mandiant (Now Part of Google Cloud) has identified exploitation of public-facing web applications by threat actors (UNC2903) to harvest and abuse credentials using Amazon’s Instance Metadata Service (IMDS). Although the threat actor specifically targeted Amazon Web Services (AWS) environments, many other cloud platforms offer similar metadata services that could be at risk of similar attacks. Related threat actor motives and operations are gaining prominence as enterprises continue their migration to cloud hosting services. Mandiant has tracked access attempts by the threat actors to access S3 buckets and additional cloud resources using the stolen credentials. This presentation covers how threat actors performed the exploitation and IMDS abuse, as well as related security hardening guidance on how to detect, remediate, and prevent this type of instance metadata abuse in an organization’s environment. As part of this presentation, we will walk through a demo of the web application that was abused and show how easy it is to obtain credentials if the organization is using the legacy version of IMDS. Then, we will show how by performing the remediation techniques mentioned in the presentation, the organization will be able to block such credential harvesting methods via the instance metadata service.