RSA Conference 2024
2024-05-06..2024-05-09
San Francisco, United States
[RSA Conference 2011, RSA Conference 2013, RSA Conference 2014, RSA Conference 2015 Asia Pacific & Japan, RSA Conference 2016, RSA Conference 2016 Abu Dhabi, RSA Conference 2017, RSA Conference 2018, RSA Conference 2019 DevOps Connect: DevSecOps Day, RSA Conference 2020 DevSecOps & Application Security, RSA Conference 2020: Mobile & IoT Security, RSA Conference 2023, RSA Conference 2024, RSA Conference 2026]
who it's for
security engineers, incident responders, chief information security officers, security architects, application security engineers, cloud security engineers, threat intelligence analysts, security product managers
topics
API exploitation and authorization flaws; passwordless enterprise authentication; software supply chain security; generative AI threat and defenses; detection engineering with Attack Range and Splunk; Active Directory DPAPI and KDS key extraction; container and Kubernetes escape techniques; hardware token and RFID cloning (Flipper Zero); ransomware readiness and assessment frameworks; envelope encryption and HSM key management; cryptography extensions for RISC-V processors; incident reporting and post-incident remediation
| title | author | length |
|---|---|---|
| I’m an API Hacker and Here’s How I Hack Everything from the Military to AI | Katie Paxton-Fear | 41m |
Finds four real bugs: an airport booking API that accepts just a last name and lets anyone edit runway length (missing auth/authorization), a quiz mobile app… | ||
| Securing AI Apps with the OWASP Top Ten for Large Language Models | Gavin Klondike, Steve Wilson | 49m |
OWASP’s Top 10 for LLMs names real exploits and defenses: a volunteer expert group grew from ~200 to ~1,200 contributors, and examples include a Google Bard… | ||
| DPAPI and DPAPI-NG: Decrypting All Users’ Secrets and PFX Passwords | Paula Januszkiewicz | 52m |
Claims a practical break: possession of the domain’s KDS root key or exported PFX private key lets an attacker decrypt every user DPAPI secret (Chrome cookies… | ||
| A Blueprint for Detection Engineering: Tools, Processes, and Metrics | Jose Hernandez, Eric McGinnis | 34m |
Walks through a concrete detection engineering pipeline: use Attack Range to spin up instrumented VMs, run Atomic Red Team atomics to generate labeled… | ||
| RFID: Flippers and Access Control | Ege Feyzioglu, Billy Graydon | 46m |
Flipper Zero reads and emulates common badges (demo shows EM4100: facility 194, card 14292 at 125 kHz), clones tags, and automates complex attacks (MIFARE… | ||
| Going Passwordless for Employees: Secure Modern Authentication at Work | Kristian Burkhardt | 49m |
Accenture transitions 750,000 employees to passwordless and reaches 75–80% of 750,000 users using Windows Hello for Business, Microsoft Authenticator phone… | ||
| Kubernetes Security: Attacking and Defending Modern Infrastructure | Lenin Alevski Huerta Arias, Maximillian vonBlankenburg | 43m |
Shows how attackers move from leaked kubeconfig or cloud creds to running containers, stealing service‑account tokens, then escaping via writable hostPath or… | ||
| How to Keep Your Cool and Write Powerful Incident Response Reports | Lenny Zeltser | 41m |
Shows how incident reports that get read and drive action use concrete specifics: cite the CVE and OpenSSH exploit, show log analysis and PCAPs in an appendix… | ||
| I Screwed Up Threat Hunting a Decade Ago and Now We're Fixing it With PEAK | David Bianco | 50m |
A new framework replaces the old four‑step loop with concrete fixes: adds baseline and model-assisted hunting to hypothesis work, prescribes a three‑phase… | ||
| Key Management 101: DEKs, KEKs, and Credentials Living Together, Oh My! | Karen Reinhardt | 51m |
Explains concrete key practices: DEK wrapped by KEK for envelope encryption, HSM-backed key stores versus software/secrets managers, and cloud choices… | ||
| The Price is WRONG - An Analysis of Security Complexity | Etay Maor | 50m |
Research of over 1,500 organizations and more than 5 trillion network flows shows security system complexity drives the largest dollar increase in breach cost… | ||
| The Art of Cyber Insurance: What's New in Coverage and Claims | Monique Ferraro, Peter Hedberg, Violet Sullivan | 50m |
Overview of concrete changes: cyber policies remain first- and third‑party but now add endorsements like betterment endorsement, system‑failure and contingent… | ||
| The Always-On Purple Team: An Automated CI/CD for Detection Engineering | Stephen Sims, Erik Van Buggenhout | 49m |
A CI/CD-style detection pipeline is built that wires XSOAR + Caldera + Sentinel with Sigma and an LLM to automatically extract TTPs from threat reports, map… | ||
| The End of DevSecOps? | DJ Schleen | 51m |
Argues that security belongs inside engineering workflows and shows concrete automation: a centralized SBOM database collects 15 months of SBOMs at scale… | ||
| A Step-by-Step Guide to Securing Large Language Models (LLMs) | Ravi Ithal | 47m |
Argues that LLM risk reduces to data control and gives a concrete path: inventory LLM apps via cloud provider APIs, run a full enterprise scan with a data… | ||
| You’re Doing It Wrong! Common Security Anti Patterns | Jon Shectman, Mark Simos | 50m |
Common organizational mistakes are named and rebutted with concrete fixes: stop toolapalooza! and silver‑bullet buys, adopt an outcome‑driven SOC that measures… | ||
| Backdoors & Breaches: Live Tabletop Exercise Demo | Jason Blanchard, John Strand | 01h 08m |
Live, interactive tabletop demo of the Backdoors & Breaches card game showing exactly how incidents are built and solved: red cards for Initial Compromise… | ||
| The Evolution of Industrial Cyberthreats: Year in Review Report | Robert Lee | 53m |
Dragos’ year‑in‑review shows OT threats are more reusable and strategic: a capability like Pipe Dream can disrupt many different plants without exploits, and… | ||
| Building AI Security In: MLSecOps in Practice | Diana Kelley | 50m |
Overview of where attackers actually target ML pipelines: a demonstrated MLflow vulnerability takeover lets adversaries alter models and siphon value, and… | ||
| IP Protection and Privacy in LLM: Leveraging Fully Homomorphic Encryption | Benoit Chevallier-Mames, Jordan Frery | 44m |
Claims a practical hybrid method using Fully Homomorphic Encryption and Zama’s Concrete tools to keep user queries private while keeping model weights… | ||
| A Proven Approach on Automated Security Architectural Pattern Validation | Sunil Arora, Parthasarathi Chakraborty | 52m |
Claims an automated validation layer that turns reference architectures and blueprints into machine-checkable manifests and scripts and catches systemic root… | ||
| The Storm-0558 Attack - Inside Microsoft Identity Security's Response | Alexander Weinert | 47m |
An attacker forges tokens using an acquired signing key and reads mail across 22 organizations, 502 consumer accounts by calling an internal API… | ||
| Threat Hunting with Python and Pandas | Matt Dulle, Anthony Talamantes | 45m |
JHUAPL shows a repeatable pipeline that turns raw Splunk/SQL logs into machine‑learned detections: data pulled in chunks, feature extraction in Pandas, Python… | ||
| Gartner's Top Predictions for Cybersecurity 2023-2024 | Leigh McMullen | 49m |
Gartner lists eight specific bets: privacy laws cover most consumers by 2024 yet under 10% of orgs weaponize privacy as a product advantage; cloud failures are… | ||
| Advancing AI Security with Insights from the World’s Largest AI Red Team | David Haber | 45m |
Lakera launches Gandalf.lakera.ai, an always-on red team game that accumulates 1 million players, 40 million interactions and about 25 years of aggregated… | ||
| Operation Cookie Monster & Genesis Market: An International Cyber Takedown | Thomas Gathman, Amanda Knutson | 43m |
Genesis Market operates as a credential-and-device‑fingerprint bazaar selling “bots” that bundle stolen usernames, passwords and a victim’s full digital… | ||
| Responsible AI: Adversarial Attacks on LLMs | Saurabh Shintre, Matt Fredrikson | 50m |
Researchers generate a universal adversarial suffix by running a white-box gradient + discrete optimization across 15–25 seed prompts to force affirmative… | ||
| Beginner’s Guide to Bypassing Modern Authentication Methods to SSO | Dor Segal | 41m |
Shows that FIDO/WebAuthn stops phishing but does not stop session replay inside SSO: using Fiddler TLS decryption plus a browser extension to steal cookies and… | ||
| UEFI Bootkits and Where UEFI Security Fails | Martin Smolar | 42m |
BlackLotus bypasses Secure Boot on fully updated Windows by exploiting a year-old bootloader vulnerability plus missing revocations, with proof‑of‑concept… | ||
| State of the Hack 2024 - NSA’s Perspectives | Rob Joyce, David Luber | 48m |
NSA reports nine plus internet‑facing nine+ edge-device CVEs this year, urges rapid patching, MFA and zero‑trust; cloud attacks surge—Midnight Blizzard and… | ||
| National Security 2030: Social Media and Emerging Cyberthreats | Jenny Reich | 49m |
Argues social media sits at the epicenter of national security change, citing an ODNI 2040 trendset and company totals (about 7.8 billion monthly users across… | ||
| The Anatomy of Cloud Attacks | Ofek Itach, Assaf Morag | 50m |
A cloud honeypot records 250,000 attacks last year and a 50% attack increase, revealing three operations: Kinsing mounts memory‑only payloads, kills… | ||
| Everything Everywhere All at Once: A Guide to Alert Triage and Analysis | Megan Benoit | 42m |
Practical triage workflow that begins with the rule “alert value is inversely proportional to volume” and an alert analysis checklist derived from a MITRE… | ||
| Hiding in Plain Sight: Hunting Volt Typhoon Cyber Actors | Cynthia Kaiser, Morgan Adamski, Sherrod DeGrippo, Andrew Scott | 45m |
Chinese Volt Typhoon actors quietly pre-position on US critical networks for disruption, using living-off-the-land tools like Fast Reverse Proxy (FRP)… | ||
| Fight Smarter: Accelerate Your SOC with AI Discovered Attacks | Mike Nichols, James Spiteri | 49m |
Elastic shows an actual pipeline: ingest alerts (including SentinelOne), run retrieval augmented generation against a vector store, and collapse 114 noisy… | ||
| Securing Software Supply Chain: Problems, Solutions, and AI/ML Challenges | Viswanath Chirravuri | 45m |
Argues that malicious libraries matter more than CVEs because malware runs immediately, not just when exploited, and shows a proof‑of‑concept model that… | ||
| Cloud Security Novice to Native in 10 Steps: A CNAPP Approach | Shai Morag | 40m |
Claims a CNAPP unifies CSPM, CWPP, CIEM, KSPM and CDR into one platform and walks through 10 steps across discovery, risk management and scale. Demonstrates… | ||
| Harnessing the Strengths of Neurodivergent Staff for Cybersecurity | Rick Doten | 50m |
Claims a large proportion of cybersecurity staff are neurodivergent and that the real locus is executive‑function differences (not character): time blindness… | ||
| 10 Key Challenges for AI within the EU Data Protection Framework | Valerie Lyons | 53m |
Conference session lists ten concrete problems uniting the AI Act and GDPR and shows why they collide: differing scopes and fines (up to 35 million under the… | ||
| Costume Jewelry: How Capital One Uses Tokenization to Protect Data | Andy Ozment | 43m |
Capital One builds a custom tokenization engine that preserves format, detokenizes on demand, and serves roughly 15k TPS / 160B ops per month while keeping… | ||
| How AI Is Changing the Malware Landscape | Vicente Diaz | 41m |
VirusTotal deploys an LLM-based Code Insight over a subset of its ~50 billion-sample corpus and finds LLMs often explain scripts where AVs miss them: exploit… | ||
| Your Cybersecurity Budget Is a Horse’s Behind | Ira Winkler | 47m |
Argues that cybersecurity budgets copy last year’s numbers instead of optimizing value, and demonstrates math-based alternatives using Monte Carlo, graph-flow… | ||
| You Can't Measure Risk | Andy Ellis | 51m |
Argues that most security risks are not truly measurable and that measurement often confuses probability with loss, using CVSS and FAIR as concrete examples… | ||
| Cybersecurity for “Have Nots” | Jake Williams | 50m |
Walks through a practical low‑budget enterprise stack that actually works: EDR as table stakes (commercial or Wazuh if none), network sniffing with Security… | ||
| Building Your Quantum-safe Future with Crypto-agility | Jai Arun, John Buselli | 50m |
IBM lays out a concrete migration path: NIST-approved candidates Kyber, Dilithium, Falcon, Sphinx are imminent, U.S. law pushes critical infrastructure toward… | ||
| Creating an AI Security and Incident Response Team | Lauren McIlvenny, Gregory Touhill | 46m |
Carnegie Mellon CERT builds an AI Security and Incident Response Team, soft-launching in August and formally launching in October to triage reports from prompt… | ||
| CISOs Under Indictment: Case Studies, Lessons Learned, and What’s Next | Gadi Evron, Charles Blauner, David Cross, Joe Sullivan | 50m |
Panel recounts concrete outcomes: regulators use misstatements as their enforcement tool, one CISO is indicted and none are jailed, SEC and state attorneys… | ||
| All You Need Is Guest | Michael Bargury | 49m |
Claim: EntraID guest accounts let outsiders enumerate tenants, bypass DLP and extract credentials stored by Power Apps, yielding full SQL and blob dumps… | ||
| Everything Everywhere All at Once: The European ID Wallet Ecosystem | Norbert Pohlmann, Arno Fiedler, Kim Nguyen | 48m |
EU law revises eIDAS to require each member state to issue a European digital identity wallet by 2026, covering ~200–240 million citizens, backed by ~30… | ||
| Why Outer Space Is the Next Frontier for Cybersecurity | Patrick Lin | 48m |
Argues that cyberattacks are the likeliest mode of conflict in orbit and presents an NSF project that generates ~100 novel scenarios using a 5×20 scenario… | ||
| 2024 Edition: Cybersecurity Standards Scorecard | James Tarala | 51m |
Research compares about 94 standards by ingesting each PDF into a JSON serverless database, normalizing roughly 400 safeguards, and scoring comprehensive… | ||
| Achieving Quantum Readiness: A Comprehensive Approach | Frank Michaud, Matt Stephens | 46m |
Claims that public-key crypto (RSA, DH, ECC) will be broken lead to concrete steps: inventory keys, prioritize long-lived device identities (10–50 year… | ||
| What Hacking the Planet Taught Us About Defending Supply Chain Attacks | Douglas McKee, Ismael Valenzuela | 49m |
If you want actionable defenses, this shows a repeatable product security testing method that maps dependencies, runs basic enumeration and targeted reverse… | ||
| The Cybersecurity of Smart ‘Adult’ Toys, or Lack of It | Ken Munro | 34m |
Research shows specific failures: Android apps create temporary images on SD cards and use default Bluetooth PINs like 0000, allowing local takeover of Lovense… | ||
| Secure and Privacy by Design Converge with Threat Modeling | Christopher Romeo | 50m |
Argues that secure and private by design needs concrete choices not slogans, and shows a repeatable workflow: pick a memory-safe language and modern framework… | ||
| Training for Incident Response: The Red, the Blue, and the Ugly | Bryson Bort, Lesley Carhart | 49m |
Advocates run through concrete steps: start with purple team drills that pair detection with attack playbooks, move from tabletops to live tests using tools… | ||
| Establishing a Data Perimeter on AWS | Liam Wadman, Tatyana Yatskevich | 38m |
Shows a concrete data perimeter framework for AWS: three sub-perimeters (identity, resource, network) enforced with VPC endpoint policy, resource-based policy… | ||
| Privacy Past and Present: A Father-Daughter Look at Data Privacy Evolution | Caitlin Sarian, Ronald Sarian | 51m |
Claim: privacy law starts with the 1890 Warren & Brandeis article sparked by instant photography and then evolves through Fourth Amendment cases—Katz, Jones… | ||
| Hacker’s Perspective on Your Infrastructure: Lessons from the Field | Paula Januszkiewicz | 51m |
A live red team demonstrates how trivial misconfigurations become domain takeover: a scheduled task escalates a local user into Domain Admin, password spray… | ||
| Living with Chronic CFIUS: Foreign Investment Review Security Imperatives | Joshua Gruenspecht, Ken Mendelson | 47m |
CFIUS now routinely expands beyond ownership to mandatory filings for TID businesses, with the 2022 executive order prioritizing supply chains, AI, quantum… | ||
| From Chatbot to Destroyer of Endpoints: Can ChatGPT Automate EDR Bypasses? | Daan Raman, Erik Van Buggenhout | 49m |
Claims that LLMs can automate EDR bypasses get tested by a working pipeline called CalderaGPT that chains CalderaGPT agents (Microsoft AutoGen) to OpenAI… | ||
| The ART of Probable: Test with AI, Atomic Red Team, and Threat Metrics | Brian Donohue, Adam Mashinchi | 50m |
Claim: combine generative AI with open-source testing and public reports to produce prioritized, actionable validation tests and detection analytics… | ||
| Shades of Purple: Getting Started and Making Purple Teaming Possible | Mathew Everman | 43m |
Purple teaming means pairing red and blue to test and fix real gaps: start with team gap analysis and tabletops, run Backdoors and Breaches or a free CTF, then… | ||
| Identity-Based Encryption | Parhat Abla, Huiwen Jia | 31m |
The work gives two concrete advances: a lattice IBE with a master public key of omega log(n)/loglog(n) matrices by a compact LWE homomorphic equality test… | ||
| Enhancing Space Cybersecurity: Securing Space Systems from Cyber Threats | Manan Dalal, Tahara Dawkins, Mieke Eoyang, Erin Miller, Nick Leiserson | 51m |
Panelists lay out concrete risks and fixes: the Viasat incident and ongoing nation‑state jamming/spoofing show attackers target the ground segment as the… | ||
| Connecting the Dots: Threat Intelligence, Cyber Incidents, and Materiality | Sierra Stanczyk, Allison Wikoff | 46m |
New SEC rule forces disclosure within four days from determining materiality, and PwC’s Global Threat Intelligence team (35 analysts across 11 countries)… | ||
| Steering Clear of Danger: Decrypting the Realities of Remote Car Hacking | David Brumley | 51m |
Explains how remote car takeovers actually work: fuzzing a GENIVI-based connection manager using a Mayhem docker image reproduces the Pwn2Own exploit that… | ||
| Agents of Chaos: Hacktivism Spreads Fear, Disinformation, and Propaganda | Alexander Leslie | 47m |
Data-driven overview of hacktivism showing 250,000 references in a year and ~75,000 references tied to the Ukraine war; analysis argues most claims are noise… | ||
| Seatbelts for Web App (Security Headers) | Scott Helme, Tanya Janca | 52m |
Claims that a few browser headers can stop many attacks, with demos and real-world scans (Report URI shows low adoption). Concrete fixes: HSTS with preload to… | ||
| Geopolitics and Cyber Risk in 2024 and Beyond | Sarah Cleveland, Lior Div, Bilyana Lilly | 49m |
Russia treats cyber as information warfare constrained today by focus on Ukraine, a mass exodus of talent (0.5–1.0M people left, roughly 10% of IT labor), and… | ||
| Moving Security Architecture from Art to Engineering | Mark Buckwell | 50m |
A repeatable method is presented: a set of artifacts and layered diagrams that move security from guesswork to repeatable engineering, including system… | ||
| Dynamic Analysis of MacOS Malware Using SpriteTree | Jaron Bradley | 50m |
SpriteTree parses ES logger captures (macOS Ventura+) into a readable process graph, rebuilding fork/exec lineage with the Responsible PID and a TrueTree… | ||
| My Resilient Career: How to Do More than Just Survive in Security | Helen Patton, Lokesh Pidawekar | 50m |
Opens with a concrete layoff: a 15‑minute calendar invite turns into “paid but non‑working” status and months of job hunting, then shows how to limit that… | ||
| Autonomous Hacking Systems - Future Risk or FUD? | Justin Hutchens | 49m |
Claim: scaled LLMs can autonomously run live hacking campaigns. Built an automation loop that connected GPT-4 to OS (using PyAutoGUI to drive terminals)… | ||
| How Large Language Models Are Reshaping the Cybersecurity Landscape | Elie Bursztein | 46m |
Argues that large models (Gemini, GPT/Claude equivalents) both lower attacker barriers and scale defenders by deploying a LLM rater for content moderation… | ||
| Batloader or FakeBat? Unraveling Competing MaaS Operations | Spence Hutchinson, Ann Pham | 46m |
BatLoader and FakeBat (aka EugeneLoader) deliver MSIX signed packages via Google search ads that use tracking templates and cloakers to hide malicious landing… | ||
| AI Governance: The Security Perspective | Jonathan Dambrot, Caitlin Fennessy | 52m |
IAPP reports 500+ professionals surveyed, 70% of companies deployed AI, and fewer than 30% had an AI governance function (expected to rise to ~60%); Cranium AI… | ||
| AI, the Software Supply Chain, and Other (Not So) Puzzling Pieces | Jacob DePriest | 37m |
Live demos show concrete wins and gaps: Copilot-powered fixes spot and patch an SQL injection in-editor, push protection blocked secret (CosmosDB) before a… | ||
| Building Your Roadmap to Cyber Resilience – Five Things You Can Do Today | Jennifer Minella, Alex Sharpe | 45m |
A practical roadmap maps seven concrete steps: governance and budget authority through a cyber resilience executive, sustain the program, inventory the… | ||
| Private Web Search with Tiptoe | Burt Kaliski, Alexandra Henzinger | 40m |
Tiptoe claims cryptographic query privacy: servers learn nothing about queries or returned URLs by combining semantic embeddings and an additively homomorphic… | ||
| Unveiling the 2024 Data Breach Investigations Report (DBIR) | Chris Novak | 50m |
Report aggregates 30,000 incidents and over 10,000 breaches from 94 countries into a 100‑page DBIR and finds exploitation up 180% year over year, 68% of… | ||
| Homomorphic Encryption | Marc Joye, Tabitha Ogilvie | 47m |
A public-key variant of TFHE replaces bulky encryptions of zero with a convolution-based LWE ciphertext format, shrinking the public key from >500 KB to about… | ||
| The State of Venture Capital in Cybersecurity | Mark Hatfield, Yoav Leitersdorf, Chenxi Wang, Nadav Zafrir, Dave DeWalt | 50m |
2023 funding drops from $242B to ~$170B while 42% of deals are seed, investors push back on inflated 2021–22 valuations and favor repeat founders; risk… | ||
| Flying Under the Radar - New Security Evasion Techniques | Tal Darsan, Etay Maor | 52m |
Demonstrations show attackers chaining concrete evasion steps: phishing kits validate cards with Luhn/BIN checks, deliver one‑time pages and randomized… | ||
| Use Generative AI to End Your Love/Hate Relationship with DLP | Heidi Shey | 51m |
Argues that DLP must be an approach not a single product, mapping controls to concrete Gen AI scenarios: DLP as an outcome for BYO public tools, embedded… | ||
| Smashing the Stack: Let’s Make It Less Fun And Unprofitable! | Bob Lord, Dan Wallach | 50m |
Memory-unsafe bugs remain the dominant real-world cause of serious vulnerabilities: industry data show 60–70% of high-severity bugs trace to memory corruption… | ||
| The 2024 Ransomware Threat Landscape: What's Fueling the Epidemic? | Eric Chien, Vikram Thakur | 37m |
Symantec threat hunters show ransomware now favors scanning internet‑facing servers (Exchange, Citrix, VPN appliances) and living‑off‑the‑land tools rather… | ||
| Cloud and Platform Agnostic Security Posture Management (xSPM) | Sunil Arora, Parthasarathi Chakraborty | 50m |
Humana builds a homegrown cloud posture engine that codifies blueprints/manifest files, runs targeted checks (top 10–50) via Azure Event Grid, Azure… | ||
| Building a Cloud Security Flywheel: Lessons from the Field | Shaun McCullough | 51m |
Start by enabling centralized Activity Logs (CloudTrail across AWS Organizations or Azure Activity Logs) and forward them to long‑term storage and a SIEM, then… | ||
| Navigating the AI Frontier: The Role of the CISO in GenAI Governance | James Christiansen, James Routh | 48m |
Claims that CISOs must lead an AI governance program with a working committee, a use-case intake process, and observability into who uses which models (vendor… | ||
| Now You’re in Role: The Fearless CISO | Daniel Gorecki, Jessica Robinson | 46m |
Covers actionable first‑100‑day moves: verify inherited state with an independent assessor, define risk appetite and tolerances, and map obligations to a… | ||
| SBOMs for Evil: From Software Supply Chain Documentation to an Attack Path | Larry Pesce | 49m |
SBOMs turn into attack playbooks when enriched with CVE and threat data: an uploaded OpenWrt firmware yields 1,563 findings with 38 high and 10 critical, flags… | ||
| How to CTF Infra - Beyond the Challenges and Flags | Jayesh Singh Chauhan, Max Gartman | 39m |
Runs a cloud CTF framework used for six years and publishes the Terraform/Packer code on GitHub; platform runs CTFd on AWS with S3, RDS MySQL, ElastiCache… | ||
| Harmonizing IT and OT Security in the Era of Convergence | Bryson Bort, Jennifer Minella | 50m |
Claims IT/OT differ in goals and tooling: inventory via passive scanning plus physical walkdowns, not trusting CMDBs; active, careful fingerprinting and… | ||
| The One About Controls | Sriram Lakshmanan | 32m |
Argues that effective security comes from a controls lifecycle that identify, select, implement, validate, refine and from choosing controls against standards… | ||
| AI: Law, Policy, and Common Sense Suggestions to Stay Out of Trouble | Behnam Dayanim | 01h 00m |
Covers history and working definitions of AI, cites SEC settlements that forced companies to stop claiming AI use, and shows concrete failures—fake legal cases… | ||
| To Patch or Not to Patch OT— A Risk Management Decision | Ahmik Hindman | 39m |
Industry control sites run decades-old PLCs (one customer still uses PLC-5 hardware ~35–40 years old) while Dragos reports a 50% jump in manufacturing… | ||
| Beyond the Hype: Research on How Cybercriminals Are Really Using GenAI | Vincenzo Ciancaglini, David Sancho | 51m |
Trend Micro research finds one genuine criminal LLM attempt — WormGPT trained on GPT‑Neo‑J, launched March–June 2023 then shut down Aug 8 — while most… | ||
| Spooky Action at a Distance: Generating Waves over the Wire for Novel C2 | Aaron Rosenmund | 49m |
A new tool called QuantumCat encodes data as timing, size and port changes rather than payloads, using Scapy/Ethernet/ICMP/UDP/TCP (QUIC-friendly) to send… | ||
| Crush Cred Stuffing: A Method for Neutralizing Credential Stuffing Attacks | Alex Gatz | 37m |
Shows a repeatable method that turns logs into actionable signals: compute frequency distribution across IP, ASN, TLS JA3/JA3S, user‑agent, endpoint and… | ||
| Outpacing the Pacing Challenge: Cyber Command's Strategic Scaling | William Hartman | 43m |
USCYBERCOM claims concrete scaling actions: a Constellation with DARPA pipeline to push lab tech to the field, an AI task force deploying GPU-enabled hunt kits… | ||
| Dead Man’s PLC: Ransoming the Physical World via Operational Technology | Ric Derbyshire, Charl van der Walt | 50m |
Dead Man’s PLC presents a concrete extortion method that targets the engineering workstation to inject malicious logic into PLC projects, using Siemens TIA… | ||
| Keeping Up with the Algorithms: A Journey in Artificial Intelligence | Jon Miller, Jason Clinton, Theresa Payton, Joseph Szczerba | 49m |
Panelists state compute invested in AI keeps rising at 4–7x year‑over‑year, projecting 16–50x growth in 12–24 months; Anthropic’s Claude 3 Opus is cited as… | ||
| Data Heist: How Stolen Information Becomes a Hot Commodity | Vincenzo Ciancaglini, David Sancho | 32m |
Analysis compares 16 infostealers by data actionability (A=crypto, E=screenshots), scores features 5–1 and multiplies by VirusTotal visibility so RedLine ~2M… | ||
| Don't Worry About Your Toilet...I'm Just Hacking It | Benjamin Schmerler | 39m |
A hacked IoT toilet seat becomes a concrete demonstration: the team reverse engineers Bluetooth and Wi‑Fi devices, toilet seat heats up on demand and cycles… | ||
| Securing and Governing Generative AI: Learnings from Microsoft | Brian Fielder | 45m |
Microsoft treats generative AI like any critical platform: require data classification and labeling (now at 95% coverage on SharePoint), centrally inventory AI… | ||
| Data-Driven Cyber Indicators of Malicious Insider Threat | James Doodson | 48m |
Study uses 100 real employees tasked to find, collect and remove sensitive internal documents; analysis finds 24 exfiltration techniques (nine used mainly by… | ||
| Why Source Code Exfiltration Is the Biggest Blind Spot in Insider Threat | Joe Payne | 43m |
Research shows 75% saw source code leave their network in 30 days and security teams admit 83% would be held accountable while many developers quietly push… | ||
| Teaching Software Engineers to Threat Model: We Did It, and So Can You | Jamie Dicken | 48m |
New Relic builds a self‑service threat‑modeling program that trains 100+ engineering teams across ~800–900 services using custom LMS content (Articulate 360)… | ||
| A Walkthrough: AppSec Tool Selection, Procurement, and Implementation | Maria Mora | 44m |
Five concrete steps guide selection: understand need and landscape, vendor evaluation, procurement, implementation and operationalization, with a vendor… | ||
| Outta Luck: Security Lessons from Crypto Forums | Rachel Parker Solem | 37m |
Claim: crypto communities develop stronger grassroots security because losses are irrecoverable and members build rapid, practical defenses. Evidence: Pixelmon… | ||
| Life after the Breach: A Survivor's Guide | Patricia Titus, Russell Ayres, John Carlin, Tim Crothers | 51m |
Practical checklist: inventory assets, prioritize patching after finding scanners that miss detections, and add compensating controls; run tabletop muscle… | ||
| Securing AI: There Is No Try, Only Do! | Saurabh Shintre | 45m |
LLMs suffer concrete failures: prompt‑injection and optimization attacks let adversaries override system instructions; pretrained data from Common Crawl and… | ||
| Unveiling the Secrets of Codesys V3: ZeroDays, Forensic Artifacts and More | Ori Perez, Maayan Shaul, Vladimir Eliezer Tokarev | 40m |
Research discloses 31 zero days in CODESYS V3 impacting millions of devices and demonstrates concrete tooling and exploits: Binwalk and IDA + IDAPython reveal… | ||
| Bugs on a Plane: Implementing a Bug Bounty in an Airline IT/OT Environment | Elizabeth Wharton, Casey Ellis, Richard Szymborski | 49m |
An airline moves from a public VDP to a Bugcrowd-run bug bounty, running a VDP for almost two years then an eight‑month bug bounty that surfaces 13 critical… | ||
| Navigating M&A Security Challenges: A Deep Dive into a Case Study | Marc Aguilar | 50m |
Case study follows a four-week due diligence on a 15,000-employee acquirer buying an eight-country target, using a cybersecurity rating, internal threat intel… | ||
| All Good Things: End of Life and End of Support in Policy and Practice | Allan Friedman | 51m |
CISA frames end-of-life as security support — a predictable, effective response to new security risks — and proposes machine-readable data (OpenEoX under… | ||
| Old McDonald Had a Server Farm—A I, A I, Oh!—A Mock Trial | Hon. Laurel Beeler, Ruth Bro, Daniel Greenwood, Hoyt L. Kesterson II, Kristin Madigan | 49m |
A mock trial stages a privacy clash where a gossip AI trained on broad web plus dark‑web dumps tells a live show that a famous fighter secretly collects dolls… | ||
| How the Cookie Crumbles: What OSINT Tells Us About Dark Web Cookie Sales | Emerald Sage | 40m |
OSINT research shows stolen cookies sold on dark web consistently available and used to bypass MFA, with the EA compromise cited as a concrete example where… | ||
| How to Safely Deploy AI Copilots | Brian Vecci | 51m |
Operational plan shows specific steps to enable Microsoft Copilot for 365 while reducing risk: map every OneDrive/SharePoint location and permissions, apply… | ||
| Progress in Standardizing Cryptography Extensions for RISC-V Processors | Richard Newell, Nicolas Brunie, Andrew Dellow, Graeme Hickey | 50m |
RISC-V now includes ratified scalar and vector crypto extensions, an entropy-source interface and a guaranteed list of constant-time instructions; vector ops… | ||
| How to Take Cookies from the Cookie Monster: Genesis Market Takedown | John Fokker | 35m |
April 2023 law enforcement disruption targets Genesis Market, a browser cookie marketplace that sells full profiles — 450,000 profiles in the showroom and… | ||
| A New Era of Fraud: What Role Can Cyber Play? | Rich Agostino, Jodie Kautt | 39m |
Target combines cybersecurity and online fraud teams and applies cyber threat intelligence and engineering to five concrete problems: refund fraud (Noir-style… | ||
| Closing the Gap: Monetary Quantification of Cybersecurity for the Board | Laura Schaffner | 45m |
Provides a downloadable QuantiSec model that maps NIST 2.0 and ISO 27001 controls into balance sheet, income and cash‑flow lines so boards see monetary impact… | ||
| Techniques to Evolve Risk Governance and Comply with SEC Cybersecurity Rule | Jim Mirochnik | 47m |
Argues that legal defensibility requires assessing harm to others using DoCRA (duty of care) not just internal CIA scores, cites adoption (10+ states, ~140,000… | ||
| Rethinking How to Address Juvenile Cybercrime Today to Protect Tomorrow | Cynthia Kaiser, Casey Coleman, Abby Deift, Floor Jansen, William McKeen | 44m |
Juvenile cybercrime often starts as gaming or “digital graffiti” then escalates; the CSRB Lapsus review shows low‑cost tactics plus persistence cause major… | ||
| Private Sector's Power Play: Shaping AI and Cybersecurity Policy | Kevin Mandia, Lisa Kaplan, Alethea Matthew Olsen, Alex Stamos | 52m |
AI acts as an accelerant: nation‑state espionage and theft scale faster, influence ops use doppelganger networks and spoofed domains routed through VPNs to… | ||
| Catch Me if You Can: Hunting Cloud Exfiltration Using Anomaly Detection | Craig Chamberlain | 48m |
Summarizes practical results: a sanitized 25,000-row CloudTrail dataset and Jupyter notebooks that run a pyod ensemble and K‑means, plus Pandas deduping that… | ||
| Project Power Up: Fighting Electronic Warfare to Keep Ukraine's Grid Safe | Joseph Marshall, Taras Vasyliv | 49m |
Ukraine needs reliable grid time under GPS jamming and Project Power Up installs a modified Industrial Ethernet 5000 switch that implements a PTP holdover… | ||
| Cybersecurity’s Next Legal and Policy Frontier: Software Liability | James Dempsey, Nick Leiserson, Bruce Schneier | 51m |
March 2023 national cybersecurity strategy pushes legal liability onto software makers and the White House breaks the strategy into 27 strategic objectives and… | ||
| National Cyber Strategy, Roadmap for a Secure Cyber Future: Year in Review | Melinda Rogers, Drenan Dudley, Liesyl Franz, Eric Goldstein, Cynthia Kaiser | 47m |
The panel reviews concrete execution: the strategy spawns an annual implementation plan with 69 initiatives and a version two update adding three new agency… | ||
| Quantum Cyber Risk: How Deep and How Wide? | Colin Soutar, Ken Durazzo, Michael Jenkins, Christian Lowry, Graham Steel | 44m |
Panel argues NIST will publish FIPS mid to late July and that the real work is testing drafts, running inventories and protocol updates now; expect 60–70% of… | ||
| Herding Certs - How to Automate Certificate Management | Tobin Zimmerer | 49m |
Claims certificate inventories already dwarf user IDs (machine identities 45:1) and a client has ~1,000 public certs and roughly a million internal ones; two… | ||
| Cloud-Enabling the Electric Grid with Consequence Driven Approaches | James Briones, Emma Stewart | 46m |
The DOE–lab project produces a Ciruss framework and an online assessment that scores 11 consequence types, generates RFP-ready questions and a radar maturity… | ||
| FUD vs. Reality: Bracing for an AI-Powered Threat Landscape | Jessica Lyons, John Dwyer, Srinivas Tummalapenta, Allison Wikoff | 45m |
Panelists report concrete changes: adversary goals remain the same but AI lowers barriers — a $1 voice clone in 10 minutes, and access to <$100/month… | ||
| Techniques for Automatic Device Identification and Network Assignment | Rodney Moseley | 41m |
Claims an operational path: consolidate fragmented inventories into a single database that reduces 128-column scan outputs with 60+ blank fields to actionable… | ||
| Balancing Accessibility, Security and AI: Design Inclusive Security Tools | Abhilasha Bhargav-Spantzel, Aditi Shah | 51m |
Claims that AI plus inclusive design makes security usable for disabled defenders, with concrete demos: a blind analyst runs code in a screen-reader-accessible… | ||
| Permissions: Centralized or Decentralized? Both! | Sarah Cecchetti, Pieter Kasselman | 51m |
Argues organizations should use three concrete policy layers — central policy store, application local policies, and distributed cached policies — and shows… | ||
| The Art of Threat-Informed Sharing: Real-life Use Cases from NSA | Morgan Adamski, Josh Zaritsky | 41m |
NSA Cybersecurity Collaboration Center describes operationalizing intelligence into action with 800 collaboration channels and sharing to about 1,000 partners… | ||
| The Canary in the Coalmine of Cybersecurity: Fraud as a Warning Sign | Eward Driehuis, Jacqueline Nijzink | 40m |
Mobile channels produce measurable criminal innovation: unique mobile-malware families grow exponentially, over a third do device takeover, and groups like… | ||
| RDI: A Free and Easy Framework for Ransomware Readiness Assessment | Ben Edwards, Edgar Rojas | 43m |
A free web app at rdishield.com offers a structured ransomware readiness checklist that identifies 45 controls mapped to seven common MITRE ATT&CK… | ||
| Hackers vs. Devs - Attacking Dev Tools and Infrastructure | Ofer Maor | 41m |
Attackers focus on developer infrastructure rather than custom code, with one firm seeing only three custom‑code incidents in 4.5 years while ~50% of breaches… | ||
| Ransomware Resilience: Holistic Defense for SOC Leaders | Jithin Nair, Neelima Rustagi | 37m |
2023 ransomware activity grows ~55% year-over-year with LockBit and ALPHV dominant, rise of affiliate initial-access brokers, supply‑chain hits and… | ||
| Securing Cisco's Supply Chain - Cyberattacks and Intellectual Property Loss | Aditya Verma | 45m |
Cisco says over 80% of networking gear relies on its hardware and its supply chain handles 1.5 million orders last year across 600+ suppliers and 143,000… | ||
| The Next Application Security Frontier: AI-Ready API Defense | Charles Herrin, Byron McNaught | 51m |
APIs already dominate traffic and risk—92% of attacks target APIs on one provider—so expect exponential growth as Generative AI both magnifies attack volume… | ||
| Detecting Website Intrusion and Account Compromise with Machine Learning | Robin Franklin Guha | 39m |
Describes a deployed ML pipeline at Meta that detects pre- and post-login misuse using an isolation forest plus local outlier factor ensemble, real-time… | ||
| Avoid Being Accidentally Offensive (Guys Guide to Being An Ally) | Joseph Blankenship, Jeff Pollard | 51m |
Claims that accidental exclusion fuels low diversity, backed by quick data: industry ~76% male so a random five-person group is ~25% likely to be all-male, a… | ||
| Secure Modern Data Lakes - A Primer | Sandeep Chandana, Gautam Kanaparthi | 49m |
Modern data lakes host hundreds of sources and explode in scale — speakers cite ~400 sources per enterprise, sevenfold workload growth, 5+ petabytes in one… | ||
| EXPOSURE: The 5th Annual RSAC SOC Report | Steve Baer, Steve Fink, Jessica Bair Oppenheimer | 44m |
RSA Conference wireless traffic is captured via a SPAN feed into virtual DNS appliances and a compact NetWitness cluster, correlated in Splunk with Recorded… | ||
| Data Backup and Recovery: An Unexplored Corner of Zero Trust | Jason Garbis | 49m |
Proposal adds four concrete maturity functions to the CISA model—Zero Trust Data Resilience, access from backup management to source systems, access to backup… | ||
| Shielding the Clouds: Advanced Cyber Defense in Hybrid Environments | Craig Connors | 46m |
Claims an architecture that pairs eBPF kernel probes with AI to translate a single intent-based policy language into enforcement across endpoints, network… | ||
| Redefining Threat Modeling: Security Team Goes on Vacation | Jeevan Singh | 48m |
Claims a training-heavy, multi-year program that gets engineers to run 80% self-serve threat models while security focuses on the remaining 20%. Piloted at… | ||
| Leveraging MacOS's Networking Frameworks to Heuristically Detect Malware | Patrick Wardle | 49m |
Claim: host‑based macOS monitoring finds malware by spotting unauthorized network activity. Uses private NetworkStatistics.framework and Network Extension to… | ||
| Bye-Bye DIY: Frictionless Security Operations with Google | Lorenz Jakober | 39m |
Google demonstrates a move away from DIY SecOps by shipping curated detections from Mandiant and VirusTotal visibility, matching 12 months of telemetry to… | ||
| The Good, the Bad, and the Bounty: 10 Years of Buying Bugs at Microsoft | Aanchal Gupta, Katie Moussouris | 45m |
Microsoft celebrates a decade of bug bounties with concrete practices: 60 million paid over five years, awards to 1,000+ researchers across 45 countries, and… | ||
| Top 10 Security Products That Would Be Elevated or Eliminated by GenAI | Teza Mukkavilli, Gopi Ramamoorthy | 44m |
Ran the same prompt across OpenAI, Microsoft, Perplexity and Gemini and surveyed ~120 leaders with 70 responses, finding 31% plan AI in ops; Perplexity even… | ||
| The Importance of Identity-Centric Security in 2024 | Vivin Sathyan | 53m |
Demo shows an attacker using vssadmin create shadow to copy NTDS.DIT + SYSTEM from a live DC, then feeding extracted hashes into crackstation.net to recover… | ||
| The Evolving Role of Emojis in Investigations and Data Security | Julie Lewis | 49m |
Emojis become investigable data: a custom database combines UTF‑8 hex lookups with APIs (X/Twitter) and Chet's AI emoji analyzer (OpenAI prompts) to do… | ||
| Navigating Third-Party Risk in OT Environments | Christopher Walcutt | 45m |
Claims that remote access for real‑time troubleshooting creates the biggest OT exposure, contracts often strip owners of control, and you need keystroke… | ||
| Bridging Gaps in Cybersecurity for “Target-Rich, Cyber-Poor” Organizations | Matthew Grote, Adrien Ogee, Sarah Powazek, Emily Skahill | 51m |
CISA’s JCDC frames the problem as millions of “target‑rich, resource‑poor” organizations—local schools, small hospitals, water utilities and NGOs (refugee aid… | ||
| Securing Sexuality: Rewiring the Most Intimate Connections | Stefani Goerlich | 47m |
Claims that childhood surveillance rituals like Elf on the Shelf normalize lifelong monitoring and fuel an intimacy crisis, cites 49.6% bots of web traffic… | ||
| They Hide, We Seek: Leveraging Global Partnerships Against Our Adversaries | James Baker, Brett Leatherman, Lorna Mahlock, Matthijs Van Amelsfort, Theresa Payton | 48m |
Panelists describe concrete wins: Operation Medusa eradicates Snake, a 20‑year FSB implant, and joint efforts like Operation Dying Ember or the LockBit… | ||
| Getting Serious: Critical Disruptions/Thinking/Responses (& Rumors of War) | Joshua Corman, David Etue | 51m |
Criminal attacks are already degrading water, food, power and hospitals, with Change Healthcare’s outage affecting 94% of US hospitals surveyed and a reported… | ||
| Criminal Minds: World’s Most Wanted Cybercriminals Interview Insights | Samantha van de Ven | 41m |
Analysis of 57 interviews from 41 unique actors across 29 media outlets finds repeated themes: 22% self-taught via videos/tutorials, widespread use of scanners… | ||
| Voice Security - Get Up to Speed on This Attack Vector | Mark Voorheis | 45m |
Explains that digital signing via STIR/SHAKEN reduces spoofing but fails when calls traverse PSTN because signatures drop and it needs end‑to‑end IP; describes… | ||
| Bear Necessities: Ukraine's Experience Facing APTs, Building Resilience | Maksym Darkin, Nazar Tymoshyk, Douglas White | 47m |
Ukraine documents that APTs combine cyber and kinetic strikes — notably a January 2024 barrage of 300+ missiles and 200+ drones — while operators compromise… | ||
| The Language of the Business: Applying Behavior Science for Risk Management | J. Wolfgang Goerlich | 49m |
Risk management is a psychological problem: relationships and communication determine whether controls stick. Cited study of ~5,000 respondents across 20–30… | ||
| Security Challenges in Direct Threat Environments | Kelly Fletcher, Manuel Medrano | 47m |
Custom alert big yellow taxi on G5 telemetry detects a pattern that leads to an IP and a seized VPS; analysis finds a stolen Microsoft certificate used to mint… | ||
| Countering Cyber Threats, Digital Fraud and Theft in the Retail Sector | Christian Beckner, Ryan Miller, Suzie Squier | 42m |
Panel shows retail losses driven by gift card tampering and large-scale organized retail crime tied to transnational gangs using Telegram/WhatsApp and… | ||
| Quantum Safe Computing for Telecommunications | Blair Canavan, Ray Harishankar, Paul Hopkins, Emma Smith | 51m |
Panel lays out a practical roadmap: industry consortium work with Vodafone, IBM and Nokia runs a Post Quantum Telco Network Task Force, publishes a heat‑map… | ||
| AI-equipped Threat Actors Versus AI-enhanced Cyber Tools: Who Wins? | Shiladitya Sircar | 53m |
Claims a defensive path rather than rhetoric: use the public EPSS exploit probability model plus environmental telemetry to rank CVEs, spotting long… | ||
| Common Good Cyber | Michael Lashlee, Craig Newmark, Camille Stewart Gloster, Megan Stifel, Philip Reitinger | 53m |
Nonprofits that scan and fix internet-wide problems run on razor-thin budgets — examples include Shadowserver and unpaid maintenance of datasets like MITRE… | ||
| Oh, the Possibilities: Balancing Innovation and Risk with Generative AI | William Rankin, Shayla Treadwell | 50m |
A practical path for using generative AI: start with blacklist-everything-first and force exceptions, vet vendors for transparency about training data, update… | ||
| Global Threat Overview | Alex Stamos | 50m |
Global cyber risk is driven by supply‑chain compromises (SolarWinds, RSA SecureID, XZ backdoor), cloud‑hybrid attack paths and commoditized offensive tools… | ||
| AI in Cyber: Is the Cyber Profession Ready for Its Impact? | Clar Rosso | 46m |
ISC2 surveys about 1,200 cyber professionals and reports concrete results: 41% see increased threats (13% known AI-driven), 56% expect parts of jobs to become… | ||
| Protecting Machine Identities: USPTO and Certificate Automation | Leone Atchison | 50m |
USPTO automates certificate lifecycle with Venafi TPP as its command center in Azure, discovering about 10,000 servers (85% found initially) and integrating… | ||
| AI Foundations: Mitigate Risks and Boost SOC Efficiency | Mikiann McIntosh, Sally Vincent | 44m |
Demoing ChatGPT, Google Gemini, Inoreader and Jupyter notebooks shows concrete limits: LLMs hallucinate, freemium ChatGPT (3.5) cites training only to Jan… | ||
| CloudSec Hero to Zero: Self-Obsolescing Through Prolific Efficiency | Chris Farris, Rich Mogull | 51m |
Claim: 90% of cloud incidents follow a small set of attack sequences (exposed creds, public buckets, misconfig) and simple fixes buy time. Deploy a CSPM… | ||
| Accelerators in Cybersecurity: Seizing Opportunity in a Shifting Landscape | Jennifer Addie, Jason Chen | 49m |
MACH37 traces to 2013 and reports supporting over 85 cybersecurity startups with 85% still in business and 64% raising follow‑on capital; accelerators run… | ||
| No More Secrets in Cybersecurity: Implementing ‘Radical Transparency’ | Michael Daniel, Eric Goldstein, Suzanne Spaulding, Carl Windsor | 51m |
Industry data shows CVEs exploited in under five days, down from about eight days a year earlier, driving the Secure by Design pledge and calls to disclose… | ||
| Changing from Probability to Prioritization Method in Risk Measurement | Glauco Sampaio | 43m |
Proposes replacing probability with a product-focused prioritization framework that combines vulnerability scans, pentests, code scanners, threat intel and… | ||
| SBOMs: Navigating the Evolving Landscape of Software Bill of Materials | Manoj Prasad | 35m |
SBOMs move from optional to legally required in the US and EU (US executive order May 2021, FDA medical device rule 2022) so vendors must produce… | ||
| Inside Payback: Using Metrics to Demonstrate Insider Risk Program Value | Randy Trzeciak, Brett Tucker | 46m |
Organization has analyzed about 4,000 insider incidents and publishes 120+ reports; examples include a demoted engineer stealing >$1B in IP, DMV staff selling… | ||
| Containers Everywhere: Advanced Threat Actors Heavily Leverage Them | Nelson Gamazo Sanchez | 44m |
Analysis of the PurpleUrchin campaign shows a container-first criminal infrastructure: 23,000 GitHub accounts and over 1.5 million container executions via… | ||
| Burnout in Cyber: The Intersection of Neuroscience, Gender, and Wellbeing | Peter Coroneos, Kayla Williams | 51m |
Devo reports a 200-person survey where 83% reported breaches linked to burnout and Cybermindz finds burnout rates higher than frontline healthcare, with global… | ||
| State of the CISO 2024: Doing More With Less | Nicholas Kakolowski, Steve Martano | 49m |
A joint IANS and Artico survey of 660 respondents shows only 20% C-level CISOs, a 65/35 split reporting to tech versus business, and about half reporting to… | ||
| Builders and Breakers: Partnering for Secure Elections | Scott Algeier, Casey Ellis, Chloe Messdaghi, Jennifer Morrell | 51m |
A 2023 pilot gives vetted security researchers timed access to prototype voting hardware and finds mostly low‑risk bugs, more hardware tamper and deployment… | ||
| Building a Safer Future: Navigating Digital Currencies in the Modern World | Taushiana Bright, Ajoy Kumar, Philip Martin, Claudia Quiroz | 40m |
Panel outlines concrete actions and recent outcomes: a National Cryptocurrency Enforcement Team launched two years ago, federal takedowns of the Sinbad mixer… | ||
| What Cloud Has Taught about Securing AI in the Future | John Yeoh | 50m |
Claims that cloud security practices transfer to AI with caveats: a shared responsibility model is adapted into seven AI elements, and CSA publishes a LLM… | ||
| CEO Panel: The Entrepreneur Journey to Scale | Robert Ackerman, Debbie Gordon, Robert Lee, Stuart McClure | 55m |
Three companies describe concrete wins: a vendor‑neutral cyber ranges platform that simulates attacks like a flight simulator and sells training POCs; an OT… | ||
| RSAC Security Scholar Poster Pitch-Off | Cecilia Marinier, Jamil Jaffer, Ben Jun, Helen Patton | 47m |
Panel showcases four short research pitches: a deception framework that uses honeypot variants and purpose-built SQL bait to seed and track junk credentials… | ||
| Applying Past Lessons for Intel-Driven Identity Threat Detection | Nicole Hoffman, Michael Marriott | 45m |
Review of incident data shows phishing and account takeover dominate identity attacks, with MFA exhaustion incidents tripling year over year and account… | ||
| Public Key Cryptography | Olivier Blazy, Loïc Ferreira | 36m |
Presents a new identity‑based revocation construction that achieves fully attribute-hiding and function private IPE by first building a predicate‑only zero‑IP… | ||
| The Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing | Rupesh Chokshi | 42m |
Akamai analyzes trillions of connections and finds 29% of web attacks target APIs, with EMEA showing the highest regional share; common incidents include… | ||
| Reasonable Cybersecurity: Oxymoron or Opportunity? | Tony Sager, Brian Ray, Samuel Thumma | 51m |
Panelists argue that “reasonable” security is becoming a legal duty of care and must be made defensible by documenting decisions, not by perfect tech. They… | ||
| RSAC Launch Pad | Hugh Thompson, Sarah Guo, Barmak Meftah, Enrique Salem | 54m |
Three startups show concrete products and measurable claims: Culminate demos an AI investigator that auto-triages every alert, pivots across logs and SSO… | ||
| Risk Profiles: Why Some Employees Attract Danger and Others Dodge It | Masha Sedova | 53m |
Uses Elevate Security customer data covering 67,000 employees to show concrete risk patterns: 75% of managers get at least one phishing email monthly and… | ||
| Quantifying the Probability of Flaws in Open Source | Chris Eng, Jay Jacobs | 49m |
Analysis covers 30,000 GitHub projects used in enterprise apps, compares them to OpenSSF’s 1.2M repo database and finds only 48,000 overlap. Real app scans… | ||
| Reducing Toil in Your AppSec Program | Akira Brand, Jennifer Czaplewski | 45m |
Claims that reducing repetitive AppSec work saves money and morale and gives measurable security gains, then shows how. Uses documentation, developer training… | ||
| The Moneyball Approach to Buying Down Risk, Not Superstars | Rick Howard, Simone Petrella | 52m |
Uses the Moneyball analogy to argue for hiring and training that buys wins by focusing on one measurable first principle: Reduce the probability of material… | ||
| Shifting Privacy In: How Privacy and Security Can Strengthen Each Other | Kim Wuyts | 50m |
Argues that privacy can strengthen security and shows how to integrate them using engineering practices: starts from a claim that combining threat modeling… | ||
| Another Digital ID: Privacy-preserving Humanitarian Aid Distribution | Petros Efstathopoulos, Wouter Lueks | 50m |
Decentralized token system stores entitlements on smart cards with household keys (or smartphones using anonymous credentials), uses PRF-derived one‑time tags… | ||
| Ensuring Intelligence, National Security in a Rapidly Changing Technology World | Dave DeWalt, Mark Warner | 49m |
Claims that China runs roughly 5,500 confirmed IP theft campaigns and that Operation Aurora hit 153 companies with year‑long dwell times drive the argument for… | ||
| Web Side Story: A Privacy Odyssey through Tracking and Fingerprinting | Petros Efstathopoulos, Iskander Sanchez-Rola | 49m |
A measurement platform uses fine‑grain tainting to build a tracking tree and per‑request tracking flows that label initiators, intermediaries and executors… | ||
| Tackling Deepfakes, Wars, and Other Security Threats in the GenAI World | Patrick Huston, Adam Isles, Natalie Pierce, Lucy Thomson | 46m |
Panel details concrete threats and mitigations: hyperreal audio/video enables a $25M fraud via 15 wire transfers, text‑to‑video is live, and watermarking… | ||
| Anatomy of a Vulnerability Response - A View from the Inside | Mohit Arora, Richard Tonry | 52m |
A large-organization case study traces a generic watchdog timer function firmware flaw that forces updates across 500 models, showing one-to-one hardware fixes… | ||
| Cybersecurity Leadership: Mobilize, not Paralyze | Lynn Dohm | 49m |
WiCyS shares a State of Inclusion Assessment built from 1,200 experiences by ~1,000 participants (65% women) and finds women report exclusion at twice the… | ||
| Decoding Gen Z: Cultivating Cybersecurity's Next Vanguard | Jax Scott | 46m |
Argues Gen Z is three times more targeted and susceptible to breaches and shows concrete interventions that worked: a gamified mobile app with 100,000+… | ||
| Beyond Cookies: The Unseen Privacy Risks of Web Analytics | Mitchell Green, Heidi Wachs | 49m |
Claims that many websites and apps are leaking sensitive data via common analytics: hashed form fields sent to social pixels, page titles sent to video… | ||
| Lessons Learned from Developing Secure AI Workflows | Elie Bursztein | 46m |
Google describes SAIF as a practical checklist: concrete risks include data poisoning via user feedback (Gmail spikes from spammers), model backdoors hidden in… | ||
| Small Changes, Big Impact: Securing Our World Through Public Education | Nicole Wong, Alaina Clark, Camille Stewart Gloster, Rachel Tobac | 49m |
Panel describes a concrete public education program: CISA launches Secure Our World with nationwide ad buys and partners (Google, Microsoft, Mastercard, NFL… | ||
| Controlling a Data Footprint – How to Build a Data Disposition Framework | Jordan McClintick, Tobin Zimmerer | 48m |
Claims a workable, incremental way to stop collecting and hoard data: map data elements to owners, pick three retention buckets (under 1 year, 1–3 years, >3… | ||
| Two Steps Forward for SaaS Adoption, One Step Back for Security | Adrian Sanabria | 48m |
Industry spends six times more on SaaS than on cloud and companies often discover 1,241 SaaS apps after a discovery scan, producing surprising telemetry like… | ||
| Headspace's Privacy Operations Center and Vault | Shobhit Mehta, Puneet Thapliyal | 50m |
Headspace builds a Privacy Operations Center to unify governance, product risk review, DSAR handling and training across security, legal and engineering for… | ||
| The Unpatchables: Credential Stuffing Quantification and Classification | Sander Vinberg, David Warburton | 44m |
Analysis of more than 300 billion transactions shows credential stuffing constitutes about 20% average pre-mitigation traffic across 159 aligned customers and… | ||
| Director's Cut: A Dummies Guide to Leading a Global Cybercrime Program | Craig Jones | 52m |
Interpol runs a Global Cybercrime Program with a 2015 Singapore hub, an 80-person team (18–20% vacancies) and regional desks across four bureaus; work ranges… | ||
| The Tie That Binds: Unique Cyber Tools in the Payments Industry | Clarissa Banks, Subra Kumaraswamy, Richard Van Luvender | 51m |
Payments infrastructure handles huge scale and specific tooling: 12,000 transactions per second at one processor, platforms reporting trillions annually and… | ||
| The Human Impact of Cyberattacks: Reframing the Defender Role | Chris Krebs, Bipul Sinha | 54m |
Panel reports 98% report mental trauma after incidents and ~40% of security leaders lose their jobs; forced leadership changes and SEC actions follow breaches… | ||
| Blackjack and Breaches: History of Ransomware on the Casino Industry | Tennisha Martin, Aleise McGowan | 50m |
Casinos collect massive data and attackers exploit weak human and IoT links: license-plate readers, 2,000 cameras, NORA analytics and RFID-enabled chips expose… | ||
| Everything Old Is New Again: Protecting Legacy Systems with Modern Security | Mea Clift, Kristin Demoranville, Malcolm Harkins | 53m |
Panel lists concrete fixes: put scanning stations at factory entrances, asset scan stations at factory entrances, or virtualize old Windows images to isolate… | ||
| ‘Nurturing’ AI: The Story of How an AI Copilot Was Built | Ofir Israel | 37m |
Check Point launches two AI copilots months ago and reports strong customer adoption while describing the engineering: a patented system that auto-generates… | ||
| AI at the Gates: Combating AI-Driven Assaults on the Customer Experience | Nate Kharrl, Julie Yang | 36m |
A real marketplace attack uses task-driven AI agents that mimic clicks, keystrokes and swipes to scale theft, causing a reported $9 million loss. Agents run as… | ||
| RTX Case Study: The Evolution of Vulnerability Discovery | Paul Krier | 51m |
RTX reports securing about 585,000 hosts across 90 countries and identifies roughly 13,000 web entities, of which about two thirds are trivial redirects. The… | ||
| Modus OperandAI: Practical Security for Artificial Intelligence | Shelby Descoteaux, Elizabeth Hubbard, Shawn Powers | 36m |
Southern New Hampshire University reports rapid AI adoption across 200,000 online learners and spins up an Office of AI, then pilots pilot guidelines on campus… | ||
| Ending the Game of Telephone: The Future of Cyber Incident Reporting | Drew Bagley, Moira Bergin, Mike Flynn, Brandon Wales | 48m |
April 4 NPRM proposes a 38‑page rule inside ~470 pages of explanation, after 27 listening sessions and ~140 RFI responses; comment period extends from 60 to 90… | ||
| Cracking the Code: Unveiling Synergies Between Open Source Security and AI | Perri Adams, Omkhar Arasaratnam | 53m |
Session describes AIxCC, a DARPA and OpenSSF competition that requires teams to deliver open source tools which autonomously find and fix vulnerabilities in… | ||
| Avoiding Common Design and Security Mistakes in Cloud AI/ML Environment | Natalia Semenova | 46m |
Covers concrete cloud mistakes and fixes: how Jupyter notebooks with excessive service-account privileges let attackers exfiltrate training data, why to treat… | ||
| SEC Rules on Cybersecurity: Materiality, Preparedness and Board Oversight | Cathleen Anderson, Eben Kaplan | 51m |
CrowdStrike’s tracking of post‑Dec 2023 filings shows many companies file 8‑Ks rapidly while still calling materiality “unknown,” so build an escalation from… | ||
| Lesson Learned - General Motors Road to Modern Consumer Identity | Andrew Cameron, Razi Rais | 49m |
General Motors migrates its multi‑brand login to a single consumer identity platform on Azure B2C/Entra, keeps a dedicated on‑prem profile service, and moves… | ||
| Establishing and Maintaining Device Trust: A Case Study | Yuriy Bulygin, Tim Lisko | 49m |
When DigitalOcean acquires a company, an Eclypsium-based agent pushes Eclypsium agent to existing endpoints to extract and analyze firmware/UEFI and BMC code… | ||
| Secrets Management - Falling into the Pit of Success | Cleve Littlefield | 38m |
A large acquired SaaS shows the scale: ~1,200-line configs with ~25% secrets across 16 prod, 10 staging and 20+ dev environments, 40 teams and 350 developers… | ||
| DevSecOps Next: Navigating the Next Era with Industry Titans | Sid Choudhury, Eyal Dyment, Basheer Janjua | 53m |
Research of a couple thousand respondents and 40,000 article clicks finds less than 20% of orgs doing DevSecOps at scale while ~70% merely dabble; developers… | ||
| A National Initiative for Cybersecurity Advancement | Gregory Touhill | 49m |
A CERT at Carnegie Mellon–led research project called National Initiative for Cybersecurity Advancement argues current tools and one‑off training fail… | ||
| GenAI Opportunities and Challenges: Where 370 Enterprises Are Focusing Now | David Gruber | 30m |
Survey of 370 IT and security leaders reports concrete adoption and control stats: 75% are already using GenAI in security, 86% block access to one or more… | ||
| Phishing LLMs: Reeling in the Machine | Steve Lukose | 38m |
Generative apps share a classic three-tier runtime: API gateway, orchestration (plugins like LangChain and LlamaIndex), and data (often vector DBs), so… | ||
| Deception Is on the Rise, But Is It Time to Unleash Engagement Operations? | Ondrej Nekovar, Jan Pohl | 46m |
Overview of a deployed program that combines honeypots, fake personas on Telegram, MISP for intel sharing and MITRE Engage/HDHD playbooks to hunt and shape a… | ||
| From Aspiring to Achieving: CISO Journeys Unveiled | Dd Budiharto, Larry Trittschuh | 49m |
Two career case studies show concrete moves: a former janitor rises from EDP auditor to CISO of three Fortune 500 oil & gas firms and now runs a fractional… | ||
| Lessons Learned from the Summer of Supply Chain Attacks | Megan Brown, Jennifer Burnside, Erin Joe | 52m |
Summer 2023 shows concrete patterns: an email gateway exploit (Barracuda) uses three malware families and temp file staging to exfiltrate data and hides… | ||
| Beyond Desktops: The Rise and Transformation of Mobile Malware | Gianluca Braga, Nicolás Chiaraviglio | 44m |
Mobile malware evolves from droppers into multi-stage payloads that decrypt and execute in memory, with Joker doing click‑fraud, subscription fraud and spyware… | ||
| Cyber-Informed Machine Learning: End-User Value through Explainability | Jeffrey Mellon, Clarence Worrell | 50m |
Proposes a three-part explainability framework—data-to-human, model-to-human, human-to-model—and shows concrete methods: NetFlow needs cyber-aware feature… | ||
| Regulation on the Horizon: What You Wish Your Lawyer Had Told You About | JJ Jones, Ekaterina Levy, Stacey Schesser | 51m |
Recent enforcement and draft rules change what counts as risk and who can be held liable: the FTC’s Drizly consent decree finds 2.5 million consumers’ data… | ||
| Thwarting the Adversary: Bending the Zero Trust Curve to Defense | Huban Gowadia, Chris DeRusha | 47m |
Federal agencies commit to a three‑year zero‑trust implementation tied to a capability maturity model and measurable proxies: rollout of phishing‑resistant… | ||
| Employee of the Month to Insider Malfeasance | Aaron Reyes | 37m |
Case studies show investigators using forensic disk imaging and FTK on seized drives, remote VPN imaging and Cellebrite extractions, to trace double payroll… | ||
| Symmetric Cryptography 1 | Jiali Shi, Naito Yusuke | 19m |
Defines two new hardness notions epsilon-one regular hashing and epsilon-two AXU in the ideal cipher model and proves HtE and HtXE maintain full k-bit offline… | ||
| Threshold Signatures and Fault Attacks | Giacomo Borin, Dilara Toprakhisar | 47m |
Proposes a parameterized fault adversary model that records number of injections, location and timing precision, bit count, duration and fault type, maps… | ||
| From Panic to Preparedness: California’s New Cyber Audit Regulations | Paul Lanois, Nandita Rao Narla | 50m |
Draft California regs require an annual, board‑reported cybersecurity audit covering 18 components (encryption, access controls, vendor management, incident… | ||
| Bridging the Talent Gap: How Certifications, Upskilling, and AI Can Help | Ron Culler, Keatron Evans | 51m |
Conference claims about a half million open cybersecurity roles and wider five‑million estimates drive a practical playbook: use vendor and vendor‑neutral… | ||
| Signatures 1 | David Joseph, Edoardo Signorini | 46m |
Two constructions: a Merkle-tree batch signatures scheme that buffers many messages, signs the Merkle root with a PQC signer (Dilithium/Falcon/SPHINCS), and… | ||
| Avoiding Legal Landmines: A Review of Recent Cyber Cases | Richard Aldrich, Julie Bowen, Aravind Swaminathan | 50m |
Merck’s NotPetya loss leads to an insurer fight over a $1.4 billion claim and a court ruling that warlike exclusions don’t automatically bar cyber loss… | ||
| Experts May Decide if You Are a Hero or Will Wear Orange | Linda Hsiao, Matteo Tomasini, Keith Wojcieszek, Ronald Raether | 52m |
Panel explains how expert testimony hinges on concrete methods not buzzwords: who qualifies, what logs and artifacts are preserved, and whether dark‑web… | ||
| Art of Possible: Transforming How We Develop the Next-Gen Cyber Workforce | Jennifer Mathis, Seeyew Mo, Joel Rasmus, Camille Stewart Gloster, Ron Culler | 53m |
Federal policy now enables skills-based hiring by removing degree and minimum experience hurdles and running a tech-to-gov hiring event that collects 1,200… | ||
| Project Upskill: Digital Security for High-Risk Communities | Leah McGrath, Trevor Parks, Lance Pierce, Emily Skahill | 49m |
Panel lays out concrete findings and fixes: about two thirds of international NGOs say they lack confidence and underspend on cyber while three quarters report… | ||
| How Visibility and Segmentation Can "Improve Your Sleep" | Trevor Dearing, Thomas Vavra | 50m |
Mondi runs Illumio agent-based microsegmentation across ~110 sites with 10–15k endpoints and about 6,000 external companies accessing systems, mapping flows… | ||
| Red vs. Bank: Surviving a Three Year Red Team | Brenden Smith | 42m |
Three-year continuous red team runs 24/7/365 with an open scope (mainframe excluded), using a point-of-presence device hidden in a tissue box to emulate ceded… | ||
| Searching for a Cyber Unicorn: Is it Possible to Find a Perfect Candidate? | Diana Burley, Sasha O'Connell | 48m |
Employers are hunting for a mythical “cyber unicorn” — entry hires with degrees, long cert lists and prior job experience — and the result is persistent hiring… | ||
| Breaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches! | Ashish Rajan | 47m |
A leaked Terraform state file in a private GitHub repo exposes an IAM user's access keys that allow console login, then use of SSM session manager to access an… | ||
| From Attacks to Action: An Open Community Model to Drive Defensive Choices | Phyllis Lee, Tony Sager | 45m |
The CIS Community Defense Model CIS CDM maps Verizon DBIR attack summaries through MITRE ATT&CK to CIS Controls and Benchmarks, then scores specific safeguards… | ||
| Benchmarking Threat Resilience Metrics aka How Do We Compare to Our Peers? | Kristin Esbeck, Tim Wainwright | 55m |
Industry groups produce compact, repeatable MITRE ATT&CK-based VECTR.io platform test plans (public JSON on GitHub) that focus on 50 test cases derived from… | ||
| New Research Reveals Five New Trends for Cyber Resilience | Theresa Lanowitz | 45m |
New research surveys 1,050 executives surveyed across 18 countries and seven verticals and reports concrete gaps: 74% prioritize innovation over security, 85%… | ||
| Prevention vs. Response - Cybersec Economics in the Modern Era | Ofer Maor | 35m |
Only one third of major breaches are discovered internally, the average breach costs about $4.5M globally ($9M in the US) and takes 277 days to detect and… | ||
| Getting to True Predictive Risk: Will Data Accuracy Thwart AI’s Potential? | Hyrum Anderson, Edna Conway, Andrea Little Limbago, Nadya Bartol | 49m |
Panel argues predictive risk needs verified data not just bigger models, showing concrete failures and fixes: LLMs favor common tokens (example peak at 42) and… | ||
| Ensuring Data Defensibility in an Era of Inevitable Breaches | Steve Stone, Martin Walter | 50m |
Data grows ~42% every 18 months, meaning a typical estate (28M sensitive records today) reaches ~175M in five years, so expect to secure a Fortune‑50 scale… | ||
| How Sworn Enemies Found a Truce (Sort of) to Achieve NIST Compliance | Jonall Cobble, Jason Luce | 51m |
Startup maps NIST 800‑53 to CMMC, loses two key engineers, and learns 50% of engineering time is non‑coding while chasing compliance; initially buys vendor… | ||
| Security's Social Problem | Michele Chubirka | 50m |
Security failures stem more from ineffective risk programs and culture than broken tech, with DBIR showing 74% of breaches include a human element. The… | ||
| From Attribution to Accountability: Upholding International Rules Online | Liesyl Franz, Amy Hogan-Burney, Jonathan Horowitz, William Middleton, Megan Stifel | 50m |
Panelists detail specific practices: governments run a three‑step process—technical telemetry and network forensics from national centers, an interagency… | ||
| Remaining Resilient in the Supply Chainpocalypse | Amit Chaudhry, Jignesh Joshi, Larry Wiggins | 48m |
Companies with 15–20,000 software contracts and 2,500–2,700 IT vendors face specific controls: central vendor risk assessments, continuous scanning and CVE… | ||
| Dial-A-CISO Game: 175 Leadership Issues to Choose From | Todd Fitzgerald | 48m |
A live game pulls 40 numbered balls from a 175-episode podcast archive, plays 15–30 second clips, and runs real-time smartphone polls via Pigeonhole; answers… | ||
| Security Trends and the Economics of “Better” | Mary Ann Davidson | 47m |
Regulatory volume is exploding and overlapping rules push teams into checkbox compliance that crowds out higher-value work, not better security. Mandatory… | ||
| Pitfall or Opportunity: GenAI Legal Case Studies Revealing Practical Advice | Katherine Forrest, James Sfekas, Dondi West, JJ Jones | 50m |
A cloud inbox assistant that can pay bills on behalf of users raises concrete risks: meta-prompt and cross-prompt injection attacks, plugins with full inbox… | ||
| Magic Bullets Do Not Exist | Mark Hofman | 50m |
Claims come with numbers: over 200+ vendor evaluations finds many niche tools, fragile integrations and messy APIs; Gartner-style data shows 73% buyer regret… | ||
| Certified Coach Approach: Enhancing Cyber Resilience for Water Utilities | Karen Evans | 49m |
CRI rolls out a Certified CRI Coach pilot for water utilities that focuses on four concrete controls — Passwords+, automatic updates, phishing and removable… | ||
| Join the Mission to Strengthen the Industrial Ecosystem | Dawn M. Cappelli | 50m |
Shows concrete free tooling and programs: a Community Defense Program for water/electric/gas under $100M, an OT‑CERT portal with a self-assessment spreadsheet… | ||
| From Boardrooms to Polling Places: Securing Critical Infrastructure in 2024 | Nadir Izrael | 33m |
Claims that enterprises average 197 days mean time to remediation for critical flaws while exploits weaponize in ~7 days, illustrated by a hospital taken… | ||
| Data-Driven Cyber Policy: From Dream to Reality | Eric Goldstein, James Langevin, Jacob Olcott, James Lewis | 52m |
Government data collection ramps up with CIRCIA incident reporting and a proposed incident form that asks for MITRE ATT&CK mapping so analysts can track TTPs… | ||
| When Lightning Strikes: The Latest Cyber Law Hot Topics | Ted Claypoole, Kimberly Keifer Peretti, Lucy Thomson, Ruth Bro | 47m |
Colorado enacts a neuroprivacy law in Colorado after devices that read attention and brain signals (500+ companies using attention ‘‘hats’’; fMRI still $2M)… | ||
| Coordinated Disclosure for ML: What's Different and What's the Same | Sven Cattell | 51m |
Public red teaming at Defcon uses an eight‑vendor Capture‑The‑Flag (Anthropic, OpenAI, Google, Cohere, Nvidia, Hugging Face, Meta, Stability) with 30… | ||
| Constructions | Islam Faisal, Florian Mendel | 43m |
Ascon here uses a 320‑bit permutation with a 12/6‑round schedule to deliver Ascon MAC/PRF and a short-input PRF that claims 128‑bit security, resists known… | ||
| Is Visibility an Art of Possible or Impossible? | Lu Qiao | 42m |
Argues full visibility is rarely absolute but good enough is reachable by treating logs as a first-class data pillar and building a secure logging program with… | ||
| Security Challenges in the World's Largest Open Finance Ecosystem | Fabio Szescsik | 39m |
Brazil’s open finance ecosystem reports 20 billion API calls since 2022, 27 million consents, 500,000 payments and over 800 registered institutions, and runs… | ||
| The Odd One Out - Unleashing the Power of the Unpopular Opinion | Ilona Simpson | 30m |
Covers concrete leadership moves: uses a Russell Reynolds CISO CALM framework, stresses automation and culture, and shows data work as the prerequisite for AI… | ||
| The Cost of Innovation: Complexities of Software Regulation | Ari Schwartz, Mickey Bresman, Sam Curry, Nick Leiserson | 47m |
The government launches a concrete implementation plan adding 31 initiatives to a prior 69 and explicitly explores a software liability regime to shift costs… | ||
| Innovate Now, Secure Later? Decisions, Decisions… | Mohamad Ali, Ryan Dougherty, Srinivas Tummalapenta | 42m |
IBM Consulting runs 300 gen AI projects and reports a hospital use case that serves 700 more patients a week after deployment, yet a CXO survey of 1,000 shows… | ||
| Navigating Challenges: Perspectives of Information Security Professionals | Curtis Campbell, Shawn Murray, Jon Oltsik | 49m |
Seventh-volume ISSA survey presents specific, repeatable findings: 65% say the job is harder than two years ago because of rising complexity, workloads and… | ||
| Signatures 2 | Lénaïck Gouriou, Yingfei Yan | 47m |
Proposes an ABS scheme that adds delegation of policy by splitting message and policy commitments, proving security by extending Okamoto–Takashima’s indexing… | ||
| What’s In Your Burrito? | Raunaq Arora, Caleb Schwartz | 39m |
Chipotle’s appsec team maps CIS-style controls into SDLC pipelines and proves it works: a two-person team scales by shipping developer golden paths and… | ||
| Ten Legal Issues: SEC Disclosures | Steve Black | 50m |
Covers ten concrete compliance points: the SEC’s item 1.05 forces disclosure of material aspects — nature, scope, timing — plus financial/operational impact… | ||
| Natural Disasters and Cyberattacks: Lessons from Extinction Events | Eric Belardo, Colonel J. Carlos Vega, Elad Yoran | 51m |
Hurricane Ian makes landfall as a category five that drops to a four plus then ushers six feet of surge inland, knocking out power and forcing improvised… | ||
| A Constitutional Quagmire: Ethical Minefields of AI, Cyber, and Privacy | Daniel Garrie | 49m |
Claims that law trails tech by five to ten years and that courts will demand demonstrable processes not platitudes Guides practical defenses for five scenarios… | ||
| Adapting First Order Security Principles to Newer Architectural Trends | Char Sample | 50m |
Argues that old CIA models fail at scale and shows concrete checks: map cloud touchpoints, dig ASNs and routes to find unexpected peering paths, and annotate… | ||
| Navigating Chaos: The Consequences of Compromise in Mixed-Autonomy Freeways | George Gunter, Avesta Hojjati | 50m |
Compromised Adaptive Cruise Control modules accept injected CAN commands and, with a simple randomized deceleration attack, produce stealthy micro‑brakes that… | ||
| Translating National Security Excellence into Private Sector Vigilance | Vishal Amin, Lauren Knausenberger | 48m |
A rapid, concrete playbook: adopt continuous ATO for faster software deployment, treat cloud architecture as the resilient default rather than legacy racks… | ||
| Balancing Employee Sentiment and Metrics for Successful Business Impact | Lynn Dohm, Kristin Dean, Fran Katsoudas, Malcolm Palmore | 46m |
Conference panel reports that women in cybersecurity are five times more likely to face exclusion from managers and peers, and mentorship correlates with… | ||
| It’s an Acquired Taste | Robert Huber, Merlin Namuth | 50m |
Practical playbook for M&A security with real examples: about 20 combined acquisitions, a $250M deal where an outside firm sped due diligence, and a post‑close… | ||
| What a Cloud Bill Can Reveal | Andre Maccarone | 40m |
Shows how cloud billing becomes a forensic signal: use AWS Cost Explorer (daily granularity, group by service/region/tag) to spot a new g3.4xlarge EC2 spike… | ||
| Symmetric Cryptography 2 | Jiqiang Lyu, Yu Sasaki | 39m |
Two results: for 2‑key Triple DES the paper proves a tight multi‑user security bound and shows system security equals 112 − log2 q bits where q is total… | ||
| Leading with Integrity and Resilience: Navigating Values and Adversity | Lisa Plaggemier, Jason Weiss | 49m |
Practical playbook for when personal and corporate values collide: define your principles by ask 30 people five questions (expect 20 useful replies), use three… | ||
| So You Want to Open Source Your Project? Hold Your Horses! | Mike Bursell | 43m |
Argues that going open source requires explicit choices about community, licensing and productization, not just tossing code online. Uses a concrete case… | ||
| Living in a Material(ity) World | Steve Black, Christopher Pierson, James Shreve | 52m |
Reviews SEC rules that force rapid public disclosure once an incident is judged material: four business days for an 8‑K after a reasonably likely materiality… | ||
| Have We Hacked into Inclusivity Yet? | Brian Gant, Lamont Orange | 52m |
Cybersecurity diversity is far from solved: Hispanic representation sits around 4% Hispanic, African American women around 3%, and women broadly range from 14%… | ||
| nothing matches | ||