BSidesSF 2024
2024-05-04..2024-05-05
San Francisco, United States
BSidesSF ·
[BSidesSF 2018, BSidesSF 2019, BSidesSF 2020, BSidesSF 2023, BSidesSF 2024, BSidesSF 2025, BSidesSF 2026]
as the organisers put it
Mar 11, 2024 Join usBSidesSF is taking place on May 4 & 5 with our theme You Can’t Spell Dystopia Without AI. During these two days, we will come together as a community to advance the bo...
| title | author | length |
|---|---|---|
| Opening Remarks | Reed Loden | 16m |
Conference opens with logistics and policies, lists resources, and highlights a few concrete numbers and features: over 50% of talks include AI, a core… | ||
| Navigating the AI Frontier: Investing in AI in the Evolving Cyber... | Chenxi Wang | 43m |
Claims that 200 million companies are experimenting with LLMs and that inference costs block pervasive deployment, demos that convert XDR and email logs into… | ||
| Hook, Line, and Tinker: A Dive into Phishing Campaign Sites | Rick Ramgattie | 29m |
Hands-on exploration shows phishing sites that proxy real logins and solve captchas using automation; testing with Burp Suite and Firefox reveals Cloudflare… | ||
| Beyond Quick Cash: Rethinking Bug Bounties for... | Jayson Grace, Farah Hawa | 30m |
Markets expand from $200M in 2020 to a projected $5.5B by 2027, hackers grow 63% in 2020, and average bounties rise from $2k to $3k, setting context for… | ||
| Skynet the CTI Intern: Building Effective Machine Augmented... | Scott J Roberts | 31m |
A CTI workflow integrates OpenAI (conversational API), LangChain, nltk, GitHub Copilot and regexes to process vendor articles and MITRE ATT&CK mappings for a… | ||
| Protecting data vs systems: practicality, performance, and problems... | Dan Draper | 29m |
Shows a practical design that encrypts every cell with AES-GCM cell encryption and uses envelope encryption with KMS (AWS/Azure/GCP) to store a per-record data… | ||
| Getting over the finish line: Loom Security Journey. | Narayan Gowraj, Nishant Jain | 31m |
Timeline covers 2021–2023 security buildout at Loom: hiring the first security engineer, deploying AWS WAF as a timeboxed anti‑DOS project, running a mature… | ||
| The Secret Life of Secrets | Dylan Ayrey, Hon Kwok | 34m |
A comparison of key designs shows concrete risks and fixes: webhook URLs leak far more because they look like regular links and end up in logs; researchers… | ||
| Security Considerations for Services Using AI Models | Shrey Bagga | 31m |
Services need concrete defenses: prompt injection and many-shot jailbreaking can raise harmful-output probability to 60–80% after ~256 Q&A examples; image… | ||
| Heard you liked access, so we built Access to... | Peter Collins, Elisa Guerrant | 30m |
Discord builds and runs an open source portal called Access that syncs group membership to Okta, exposes Role groups mapped to Okta, and lets owners approve… | ||
| Advanced Persistent Teenagers: Understanding the Lapsus$ Playbook | Benjamin Hering | 31m |
Eight to ten teenagers using low‑cost tools and social engineering breach Microsoft, Okta, Uber and more without zero‑days, buying credentials for $10–$20… | ||
| Combating Generative AI's Privacy Abuses | Trupti Shiralkar, Raji Vanninathan, Nandita Rao Narla, Mohammad Tahaei, Apoorva Deshpande | 45m |
Generative models already leak memorized training data, enable membership inference and prompt‑injection, and face poisoning risks; the panel cites a claim… | ||
| TL;DR: Applying AI to Security | Clint Gibler | 44m |
Survey of concrete experiments and tools: LLMs are used to triage AppSec findings with Semgrep-style rules, run agents that call Nmap Zap Nuclei and other… | ||
| Six Years in Review: Transforming Company Culture to Embrace Risk | Ariel Shin | 40m |
A six-year program transforms company culture so engineers own risk instead of security chasing them, shifting to a democratized vulnerability management model… | ||
| Startups: SOC 2 ... Now or Later? | Elyse Libetti | 30m |
Argues that early SOC 2 adoption pays off: one startup moves from zero to SOC 2 Type II in as little as 30 days, while another takes over a year; a realistic… | ||
| WhizBangLambdaFix: where AWS Misconfigurations... | Lily Chau, Lakshmanan Murthy | 32m |
An AWS Lambda framework that auto-remediates misconfigurations uses CloudTrail + EventBridge triggers, two minimal cross-account IAM roles and per-playbook… | ||
| Titans of Scale: Strategies to Scale Security in Expanding Organizations | Mukund Sarma, Jeevan Singh, Ariel Shin, Jacob Salassi, Julia Knecht | 43m |
Panelists describe concrete wins and failures: a democratized vulnerability management flow that routes SLA extension approvals to directors/VPs and cuts P1… | ||
| LLMs at the Core: From Attention to Action in... | Fotis Chantzis, Paul McMillan | 37m |
Open-sourced tools automate SDLC reviews, access requests and bug‑bounty triage: a Slack SDLC bot scans design docs and raised a risk score from 4 to 7 when… | ||
| Reinventing ETL for Detection and Response Teams | Josh Liburdi | 29m |
Claims that traditional security ETL leaves analysts writing 40-line SIEM queries and suffering data decay, illustrated by Luminati’s 8M+ IPs with ~11% daily… | ||
| Insecurity protocols: an overview of modern authentication | Eric Chiang | 30m |
Covers concrete failures and real tools: JWTs suffer a decade‑old alg none library flaw and fragile custom crypto; OAuth2 uses auth code + token exchange with… | ||
| Snow Nor Rain Nor Dependency Confusion: How to... | Jessica ‘Zhanna’ Malekos Smith, Justin Engler | 30m |
Used an automated confused script to scan internal repos and find 984 npm packages vulnerable to dependency confusion, then target a non-blocking lint package… | ||
| Please Pick Up: Crafting and Executing Successful Vishing Attacks | Jason Puglisi | 31m |
Vishing uses OSINT to find direct phone numbers and gated documents then call with a tight pretext and spoofed phone numbers to extract internal details… | ||
| LLM Privacy Paradox: Balancing Data Utility... | Rob Ragan, Aashiq Ramachandran | 01h 27m |
Experiment mixes LotR text with 5,000 synthetic PII generated via GPT then expanded with Gretel, and fine‑tunes models like GPT-2. When each record is repeated… | ||
| Attacking & Defending Supply Chains. How we got Admin in your Cloud,... | Mike Ruth | 44m |
Shows concrete attacks across GitHub Actions, Buildkite and Terraform: a freshly created repo or PR can run pre-merge RCE to memory-dump org secrets and the… | ||
| From Hacking to C-Suite: Navigating the Labyrinth of Security Careers | Caroline Wong, Nicole Grinstead, Anna Westelius, Swathi Joshi, Tanvi Vyas | 46m |
Panelists trace concrete pivots: moving from Java dev to NSA‑accredited security masters, from incident response at a consultancy with monthly client trips to… | ||
| Temporary Access to the Cloud: A Case Study | Tomas Rabczak | 45m |
Chime builds a temporary-access service on Okta that uses SCIM-based provisioning, Postgres, Slack reviews, Panther for audit logs, Tines for emergency alerts… | ||
| Decoding Fraud: The Evolution and Impact of Netflix's... | Aditi Gupta, Yue Wang | 30m |
Netflix builds a three-layer metrics framework ( operational/business/C-level ) that pulls distributed telemetry into over 20 tables/pipelines, uses anomaly… | ||
| Effective building blocks for securing... | Shrikant Pandhare, Sagiv Sheelo | 31m |
Snap moves from cluster‑per‑service to shared Kubernetes clusters across AWS and GCP by building an opinionated service mesh with Envoy sidecars, a custom… | ||
| Securing Azure Open AI apps in the Enterprise | Karl Ots | 32m |
Practical inventory of what enterprise Azure OpenAI actually offers: Microsoft provides a Cloud Security Benchmark with 35 controls but only 7 are implemented… | ||
| One-Click Code Fix: Securing Code Using AI | Chandrani Mukherjee, Joseph Seasly | 29m |
Demonstrates an internal pipeline that uses GPT-4 with zero/single/few-shot prompts and a chain-of-thought prompt pattern to auto-generate fixes, targeting… | ||
| Opening Remarks | Reed Loden | 13m |
Opening remarks summarize logistics and rules: program lists three floors (talks on AMC third floor, Participant Hall on City View fourth), code of conduct… | ||
| Unlocking the Future: AI is the Key to CISOs Top Challenges | Caleb Sima | 44m |
Claim: generative LLMs already address CISO pains by fixing context coverage communication gaps through concrete tools: million‑token context windows (Gemini)… | ||
| Effective Detection in Kubernetes Clusters | Shay Berkovich, Oren Ofer | 30m |
Demo shows initial access from a Jupyter notebook, in-cluster execution of kubectl, deployment of an xmrig miner, extraction of an EKS pod identity token and… | ||
| Finetuning Large Language Models (LLMs) for Security Log Detections | Wilson Tang | 25m |
Shows that an open-source LLM can be fine-tuned to label command-line obfuscation as yes/no using a small curated dataset, huggingface tokenizers and trainer… | ||
| Startup Security, 2nd Edition | Evan Johnson | 31m |
Actionable checklist for the first security hire: spend the first 30 days building relationships, 60 days planning and iterating, 90 days shipping a tangible… | ||
| Beyond Code and Clicks: UX Insights to Security Software | Hon Kwok, Miccah | 28m |
Usability directly changes security outcomes with concrete fixes and tools not platitudes for example the AWS S3 outage from a mistyped command and an AES GCM… | ||
| Beyond Labels: Evolving Data Classification | Rob Oden | 30m |
Roblox runs a risk‑first data classification program for ~72 million daily users and 2.5M developers, aiming to scale to one billion; it prioritizes… | ||
| AiIAM: Transforming the Democratized AWS IAM... | Anthony Scheller, Jorge L Gomez | 29m |
VaporLock (formerly AiIM) is an open‑source service that generates least‑privilege AWS IAM policies from natural‑language forms or by analyzing 90 days of… | ||
| How to Secure Cloud Machine Identities | Komal Dhull, Nathan Brahms | 22m |
Shows concrete fixes: stop long‑lived keys by disable service account key creation (GCP org policy) and use cloud‑managed identities or workload identity… | ||
| PirOps: What 18th-Century Piracy can Teach Us about SecOps | Aron Eidelman | 31m |
Links 18th‑century Caribbean pirate practice to concrete SecOps/SRE tactics: pirates create Articles (ship constitution) that predefine pay, injury… | ||
| GRC Engineering - Bringing GRC to a repository near you | Varun Gurnaney | 32m |
Argues that embedding engineering into GRC removes repeated context switches by shipping either quick scripts or a full audit engine backend service; easy mode… | ||
| Phish & Furious: Campaign Builder Vulnerabilities in a Blink &... | Raae Wolfram | 27m |
Using MailChimp campaign builder, an attacker with ordinary domain credentials (no admin rights) registers an account, changes the display name and sender… | ||
| Army of Proxies! How Netflix scales identity based zero trust... | Grant Callaghan | 30m |
Netflix describes a decade of moving from VPN+SSO to identity-first perimeter, replacing homegrown pieces with off‑the‑shelf and custom components: Kong and… | ||
| Effective security on a tight budget | Felix Matenaar | 30m |
A practical framework prioritizes compliance, consistent hygiene (patching all systems, 2FA, vulnerability management), posture measurement (threat modeling… | ||
| Next-Gen Detection: Harnessing LLMs for Sigma Rule Automation | Dave Johnson | 38m |
A project scrapes 200 threat-intel reports, extracts 624 attack procedures and narrows them to ~183 usable procedures, then compares three LLM strategies: RAG… | ||
| CISO Series Podcast (Live) | David Spark, Mike Johnson, Steve Zalewski | 48m |
Live audience podcast records candid, actionable takes: Redis changes license so teams can audit but not build or modify (Redis relicensing prevents… | ||
| Pushing Boundaries: Journeys to the top of Security... | Lea Snyder, Devina Dhawan | 46m |
Covers concrete career wins and failures: a three‑month data deep dive that eradicated two largest vulnerabilities at a large company, a solo rollout that… | ||
| Insane in the Supply Chain: Threat modeling for... | Eoin Wickens, Marta Janus | 46m |
Examines concrete attack paths: web-scale data poisoning that flips classifiers with 0.1% poisoned for $60, RAG poisoning achieving 90% success from five… | ||
| Securing Generative AI: Is it all an Illusion? | Rachana Doshi, Michael Samson | 40m |
A team at Salesforce describes threat modeling performed in early 2023 and a practical mitigation set: they implement RAG over a vector DB, require zero data… | ||
| Ransomware and Backups: A Multi-Layered Defense Strategy | Amol Sarwate | 38m |
Ransomware targets backup stores and the presentation lays out a concrete multi-layered defense: strengthen NIST 3-2-1 with prevention, detection, analytics… | ||
| Founders R Us: Tales from recent security CEOs | Leif Dreizler, Brooke Motta, Umaimah Khan, Travis McPeak, Oliver Friedrichs | 46m |
A panel of recent security founders describes what actually worked and what failed: building an early design partner paid Oct 2022 to validate product led to… | ||
| Imperfect Security: Doing Less to Achieve Better Security | Kevin Hanaford | 42m |
Argues perfect security is impossible and recommends a focused, pragmatic program built on four pillars: operate in reality, be efficient, focus on people… | ||
| Faux Data, Real Defense: ML advancements in data synthesis | Arjun Chakraborty | 25m |
Generates adversarial Kubernetes API server audit logs with LLMs using one-shot prompting, evaluates four models by fidelity, reproducibility, and accuracy… | ||
| The road to developers' hearts | Sing Ambikapathi | 20m |
Practical playbook for reducing security friction: establish monthly office hours and async review channels so teams get timely advice; automate repeated… | ||
| AI: Best Janitor or Worst Superhero? | Adrian Sanabria | 35m |
Generative AI is useful now for mundane work: it drafts job descriptions, writes Python to avoid math errors, autofills security questionnaires, creates config… | ||
| Your voice confirms my identity | Ethan McKee-Harris | 33m |
Demonstrates that consumer-grade 11 Labs clones trained on 3–5 minutes or public videos can bypass commercial voice authentication, with a lab sample of 15… | ||
| Cybersecurity meets Generative AI: Automating Your Compliance... | Rafae Bhatti | 32m |
Claim: LLMs can bootstrap compliance ops to cut cost and time by automating mapping, evidence retrieval and draft remediation but require human review… | ||
| Long Live Short Lived Credentials - Auto-rotating Secrets At Scale | Dwayne McDaniel | 30m |
Auto-rotate credentials by putting everything into a single secret manager, writing rotation scripts (AWS rotation Lambdas, Vault/Key Vault/Doppler… | ||
| Please Don't Discard - Security Data | Rishabh Gupta, Hrushikesh Paralikar | 29m |
Snowflake persists security reviews as structured files in GitHub — markdown for risk assessments, XML for draw.io DFDs — then converts DFDs into node and edge… | ||
| 5 security startup pitches to raise money and eyebrows | Maya Kaczorowski | 32m |
Five startup pitches propose concrete products and limits: an AI RAG assistant for vendor questionnaires claiming to cut manual reviews and surface third‑party… | ||
| Closing Ceremony | Reed Loden | 17m |
Conference logistics report with concrete outcomes and counts: 1,900 attendees and 2,682 total participants makes this the largest BSidesSF ever; program… | ||
| nothing matches | ||