FIRSTCON21 Virtual Edition 2.0
2021-06-07..2021-06-09
-- online --
| title | author | length |
|---|---|---|
| A Welcome Message | Chris Gibson | 03m |
Overview of concrete changes and scale: FIRST frames three goals — global coordination, global language, policy and governance — and reports active teams in 97… | ||
| Keynote: An Unauthorized Exchange - From Targeted Espionage to the Global Cyber Pandemic | Steven Adair | 01h 09m |
Describes how Exchange zero-days chain an SSRF into remote code execution (the so-called proxy logon sequence), letting attackers trivially siphon mail — one… | ||
| A Playbook for Effective Corporate Communication After a Cyber Security Incident | Jason Nurse | 21m |
Presents a validated playbook that combines academic evidence and real incident reviews into an actionable framework: use prepared statement templates, map… | ||
| A Supply Chain Incident of Major Influence in Israel | Chen Girat | 27m |
A nationwide campaign leverages an Exchange RCE released Feb 11 to breach an electronics retailer and persist for seven months, using Mimikatz, open‑source web… | ||
| Attack Defense Graph Analysis for Supporting SOC and CSIRT Operations | Frank Fransen, Erik Ringdahl | 29m |
SOCCRATES builds an automated Infrastructure Modeling Component that ingests scanners, NetFlow, cloud configs and continuously outputs topology with hosts… | ||
| Attacking Bluetooth LE Design and Implementation in Mobile + Wearables Ecosystems | Sunil Kumar, Nitin Lakshmanan | 24m |
Shows concrete BLE implementation flaws in several popular wearables and consumer IoT devices and demonstrates data exfiltration from a fitness tracker using… | ||
| Breaking the Chain of Trust | Alex Bazhaniuk, Jesse Michael, Mickey Shkatov | 27m |
Shows a real exploit chain: a GRUB parsing bug (BootHole) lets attackers overflow a flex-generated structure to get a write primitive in the bootloader, and… | ||
| Building PPP Resilience Through National Level Cyber Exercises | Antti Nyqvist, Julia Vainio | 26m |
Digipool runs a year‑long programme culminating in a 3-day intensive remote exercise (TIETO20) that puts companies, police, NCSC and broadcasters into a shared… | ||
| The CAIS/RNP Experience in Brazilian General Data Protection Law (LGPD) Compliance | Cleberson Silva, Nicole Rieckmann | 15m |
RNP describes a concrete LGPD program: four operational fronts—methodological support, consulting as a service, internal compliance and training—built around a… | ||
| CGN - Carrier Grade NAT - Carrier Grade Problems | Simon Kenin | 24m |
Carrier Grade NAT centralizes millions of users behind shared IPv4 addresses so 95% of mobile traffic is behind CGN, breaking end-to-end connectivity and… | ||
| Coming Together Under a Pandemic - Case Study on the COVID-19 MISP Information Sharing Community | Andras Iklody, Alexandre Dulaunoy | 35m |
MISP is used to spin up a COVID-19 sharing community: connectors ingest Johns Hopkins and Chinese government feeds, new object templates model health reports… | ||
| Connecting the Dots in a Cyber Pandemic Era | Dana Toren | 20m |
A national CERT links seemingly separate incidents to a single compromised ERP platform used by 70% of cargo companies, uncovering ~90 victims, half direct… | ||
| Considerations in CSIRT Activities in the Risk of Infection with New Real Viruses | Seiichi Komura | 25m |
Survey of 400+ NCA members finds >90% set up telework but ~80% require extra measures; only 10% prepare remote incident handling and 5% run telework incident… | ||
| CSAF 2.0 - A New Start to Automate Advisories | Thomas Schmidt | 25m |
CSAF 2.0 is a JSON-based, machine-readable advisory format (successor to CVRF 1.2) that vendors can publish and asset owners can automatically ingest to match… | ||
| Defense Through Invisibility: Zero Trust Security for the Enterprise | Jason Garbis | 35m |
Claims that TCP/IP’s implicit-trust model fails and that a Software-Defined Perimeter flips connect-first to authenticate-first, making unauthorized hosts… | ||
| Dispatch: Crisis Management Automation for the Entire Organization | Marc Vilanova, Kevin Glisson | 28m |
Netflix builds Dispatch, an orchestration platform that programmatically creates incident Slack channels, docs and tracker resources from a web form or slash… | ||
| DNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter | Barry Greene | 22m |
DNS is an easy, high-return target: criminals run cyclical DDoS extortion waves and ransom probes, map registrar access and use registrar compromise (Sea… | ||
| Don't You Know That You're Toxic? Moving Towards Positive Security Practices w/in Your Organization | Nicole Harris, Sigita Jurkynaite | 33m |
Lists ten concrete toxic behaviors (myth of meritocracy, hero culture, security through obscurity, punitive phishing tests, culture of no, ableist design… | ||
| Life in Security - Practitioners in the Wild (Panel) | Shawn Richardson, Nazira Carlage, Jeffrey Carpenter, Katie Moussouris, Caroline Wong | 01h 00m |
Panelists map concrete actions: enable multi-factor authenticate all the things across orgs, invest in basics before exotic tools, and spend 30 minutes doing… | ||
| From 2017 to 2021: Integration of an Operational Situation Awareness Team to a CSIRT... | Lena Elemento, Esther Lyonnet | 28m |
A team created in 2017 embeds operational situational awareness inside the CSIRT, pairs it with operational activity regulation, and produces regular… | ||
| From a Hospital into the Realm of Hades | Alberto Magallon Sabado, Juan Gonzalez | 28m |
Catalonia-CERT traces initial access via Citrix and links it to an initial access broker selling credentials and likely to a ransomware operator, an incident… | ||
| From RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group | Fernando Merces | 27m |
Evolution from commodity RATs into a professional ransomware-as-a-service operation that is active since early 2020 and is placing at least $100 billion of… | ||
| Gaining CISO Support and Improving Security Operations Situational Awareness with Threat Briefings | Angela Wu | 28m |
Threat briefings deliver a compact, actionable summary that fits 5–15 minutes and separates into CISO vs Security Ops formats: one slide for executive impact… | ||
| How to Apply the Machine Learning Appropriate Way for Your Security Operation | Kunihiko Yoshimura | 26m |
S4 integrates 17 tool scores into three similarity dimensions and replaces brittle piecewise linear tuning with logistic regression to auto-tune weights so… | ||
| Improving Internet-Wide Scanning with Dynamic Scanning | Alexandre Dulaunoy | 24m |
Presents techniques for reducing the cost and time of large-scale IPv4/IPv6 Internet scanning used by CSIRTs and CERTs to find vulnerable services and abused… | ||
| Influence Operations | Krassimir Tzvetanov | 38m |
Claims that influence operations use social media mechanics rather than just bots, and that the target is society not lone users. Describes tools actually… | ||
| Practical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA | Mars Cheng, YenTing Lee | 30m |
Penetration tests on seven real ICS/SCADA sites (oil/gas, power, water, manufacturing) find hundreds of firmware and protocol flaws — about 700 CVEs in 2020… | ||
| Practical ISP CSIRT Incident Handling w/ Network Flows, ELK Stack & Cybersecurity Intelligence... | Francisco Badaro, James Shank | 29m |
Community Nimbus service ingests NetFlow/IPFIX/sFlow from autonomous systems, correlates with Team Cymru reputation (hundreds of thousands of malware samples… | ||
| The Rise of the Eternal Botnet | David Sancho | 23m |
Routers are the primary IoT target because they stay online, have usable CPU and gateway access, and criminals reuse a few toolkits — 90% reuse… | ||
| Root Cause Analysis (RCA) in Dell PSIRT | David Spencer | 31m |
Dell PSIRT centralizes a scalable RCA pipeline that maps each vulnerability to a CWE then to applicable SDL controls, automates that mapping, backfills six… | ||
| Scoring Security Vulnerabilities in Medical Devices: Rubric for CVSS | Sumanth Naropanth, Rahul U | 30m |
FDA and MITRE publish an MDDT rubric that adds 31 extended metrics and decision flows to CVSS 3.1, including a PIPS flag for patient‑safety triggers. Deep… | ||
| Simple Method of Automatic Risks Assessment for Web Systems Considering Assets Sensitivity | Mitsuharu Sasaki | 26m |
Proposes an automated risk score that combines published CVSS base scores with an automatically computed asset-sensitivity metric derived from access logs and… | ||
| Step 0 for a Multi-party Vulnerability Coordination is Yet Another Multi-party Vulnerability Coor... | Umair Bukhari | 27m |
Ericsson PSIRT analyzes ~15,000 vulnerabilities a year and flags 3,500+ applicable vulnerabilities across a 500+ product portfolio; a real case involves an… | ||
| Story Telling Through Reports | James Potter, Raja Jasper | 24m |
A financial incident response team converts tribal knowledge into structured narratives using Dan Harmon’s story circle and three reusable templates: a… | ||
| Surviving a Ransomware Attack - Lessons from the Field | Peter Morin | 32m |
Case studies show initial access via RDP brute force into an exposed domain controller, creation of a backdoor admin account, internal scanning with Advanced… | ||
| Towards Real World Cyber Risk (Panel) | Eireann Leverett, Matilda Rhode, Sasha Romanovsky, Jay Jacobs, Luca Allodi | 54m |
A forecasting pipeline predicts total CVE volume up to a year using a serial-number estimator (WWII-style) plus a queuing (Little's law) model, achieving about… | ||
| nothing matches | ||