~/conference

RSAC 2021

Name: RSAC 2021
Start: 2021-05-17
End: 2021-05-20

date:2021-05-17..2021-05-20

location:-- online --

website:https://www.rsaconference.com/usa

series:RSAC Conference · 7 editions

editions:[RSAC 2018 Asia Pacific & Japan, RSAC 2019 Asia Pacific & Japan, RSAC 2020 Asia Pacific & Japan, RSAC 2021, RSAC 2022, RSAC 2023, RSAC 2025 Conference]

tags:[security]

title	author	length
Analyzing Windows Malware on Linux: Getting Started Tips and Examples	Lenny Zeltser	40m
Shows step‑by‑step Linux-first malware triage using REMnux with a real sample.exe (SHA‑256 provided), starting with TrID/file and ClamAV that flags it as… Talk on
Top Active Directory Attacks: Understand, then Prevent and Detect	Jeff McJunkin	40m
Covers concrete AD failures and fixes: email phishing causes 90%+ breaches, internal access plus privileges lets attackers win fast (example: 65 minutes to… Talk on
A Case Study of the Capital One Data Breach	Anchises Moraes, Nelson Novaes Neto	40m
Technical postmortem of the 2019 Capital One breach maps attacker steps (SSRF against a misconfigured WAF, stolen internal creds, exfiltration from ~700 S3… Talk on
Death to CIA! Long live DIE! How the DIE Triad Helps Us Achieve Resiliency	Sounil Yu	40m
Argues that prioritizing the DIE triad (Distributed, Immutable, Ephemeral) instead of CIA makes attacks irrelevant rather than merely detectable, and shows… Talk on
Cyber Resilience: Say What?	Kristy Westphal	40m
Cyber resilience means measurable ability to recover from attacks: examples cited include Zoom’s credential stuffing and exposed passwords, a ransomware… Talk on
What's New with the CIS Controls v8	Russell Eubanks, Randy Marchany	40m
Version 8 condenses the previous 20 controls into 18 controls, elevates data discovery and protection to control 3: data protection, and adds a dedicated cloud… Talk on
Cloud Threat Modeling - from Architecture Design to Application Development	Randall Brooks, Jon-Michael Brook	40m
Threat modeling for cloud systems aims to identify the actual attack surface and prioritize defenses using concrete artifacts: Microsoft Threat Modeling and… Talk on
Cybersecurity Metrics Development for Board and Risk Committee Reporting	Richard White	40m
Shows how 300–350 raw metrics are condensed into a vetted set mapped to cost, maturity, risk and explains a repeatable timeline: assess for two weeks, draft… Talk on
CVSS Scores Are Dead. Let’s Explore 4 Alternatives	Allan Liska	40m
CVSS is a snapshot, not a risk score, so teams drown in alerts: public counts rise from 6,000→18,000/year and Microsoft advisories from 400→1,500 (2016–2020)… Talk on
Quantum Computing: One Weird Trick to Break RSA Encryption	Anastasia Marchenkova	40m
Claim: Shor's algorithm can reduce factoring of RSA-sized keys from trillions of years classically to about 100 seconds on a large fault-tolerant quantum… Talk on
Windows Kernel Patch Protection - Achilles Heel: PatchGuard	Arush Agarampur	40m
Claims a reproducible design flaw in Windows Kernel Patch Protection that lets kernel code disable PatchGuard’s crash response by hooking kernel memset and… Talk on
FAIR Controls: A New Kind of Controls Framework	Jack Jones	40m
A new controls framework called FAIR-CAM models controls as interconnected loss event/variance/decision controls with granular functions—avoidance, deterrence… Talk on
Tool Time: Building Your Cybersecurity Architecture Planning Toolbox	Ed Moyle, Diana Kelley	40m
Recommends a practical, repeatable architecture process that uses free/open-source tools (with a licensing caveat for Eramba) to measure effectiveness… Talk on
Android Rootkits: Analysis from Userland and Kernelland	Dinesh Venkatesan, Aditi Bhatnagar	40m
Tooling and results: a userland rootkit uses LD_PRELOAD to hide an app icon and a .so loaded from /data; the team builds Smart Alec (Frida-based) to capture… Talk on
Infosec Makeover: Love it or Leave it, Product Security is Here to Stay	Jen Trahan, Wiktor Szymański	40m
Claims measurement finds 19% of Fortune 100 actively hiring product security and about 50% of mainstream tech recruiting roles; product security maps… Talk on
The Rise of the BISO Role	Manuel Chowrimootoo	40m
Created a BISO practice from scratch inside a telecom: launches a service catalog, runs a “cyber roadshow” to 20+ teams, and builds intake (mailbox → Excel… Talk on
WPA3 – Advancements in Wireless Security	Stephen Orr	40m
Wi‑Fi Certified devices must support WPA3 since July 1, 2020, and new features include Enhanced Open (OWE) which adds unauthenticated encryption to stop… Talk on
My Phishing Kit Burnbook	Zack Allen	40m
Year of kit research shows phishing kits sell like SaaS: one Indonesian ecosystem centered on 16Shop powers thousands of sites (URLScan ~8,000 16Shop domains… Talk on
Ransomware: Creation, Detection, and Response	Aaron Rosenmund	40m
A Golang ransomware called Ironcat is built for training and accidentally leaked; it encrypts files with AES, drops a spoofed ransom note and batch backdoors… Talk on
Get Rich or Get Hunted Trying: Uncovering Large Scale Fraud Operations	Tal Darsan, Danna Pelleg	40m
A demonstrated Evilginx reverse proxy captures live session tokens and cookies, lets attackers refresh the real site, change the password and lock out the… Talk on
Biohacking: The Invisible Threat	Len Noe	40m
Demo shows subdermal implants (FlexNext, VivoKey Spark 2, FlexM1 Magic 1k) carrying NFC/RFID/MIFARE data and a community-built SBC “Peg-Leg” with… Talk on
WebAuthn 201: How to FIDO	Christiaan Brand	40m
Covers practical steps to add phishing‑resistant and passwordless logins using FIDO2/WebAuthn and CTAP, with concrete API calls, browser behavior and device… Talk on
Reducing Payment Fraud with SWIFT Customer Security Controls Framework	Cheri McGuire, Brett Lancaster, Bill Hoffman, JF Legault	40m
SWIFT launches a Customer Security Program after the 2016 Bangladesh heist and requires annual attestation, independent assurance and supervisory follow-up… Talk on
Cybersecurity Operations Center Technology Taxonomy	Christopher Crowley	40m
A practical, exhaustive SOC technology inventory is proposed, listing 30–40 specific tech types (EDR/HIPS, network IDS/IPS, SIEM, malware sandbox… Talk on
ISE-Skating: Lessons Learned in Bypassing Network Access Control	Anthony Ralston	40m
Shows a reproducible ISE-Skating bypass that takes under a minute by inserting a hub/unmanaged switch or a disguised UPS + Raspberry Pi between supplicant and… Talk on
Evasion, Poisoning, Extraction, and Inference: Tools to Defend and Evaluate	Beat Buesser, Abigail Goldsteen	40m
Open-source Adversarial Robustness Toolbox (ART) demonstrates concrete attacks and defenses: attribute inference on the nursery dataset yields ~70% accuracy… Talk on
Learning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32	Brian Robison	40m
Demonstration shows two real OceanLotus/APT32 fileless attacks: a DDE field and a macro-laden resume that never writes payloads to disk but loads a PowerShell… Talk on
Building Secure and Reliable Systems at Scale	Heather Adkins	40m
Argues that security and reliability are inseparable and gives concrete Google-era fixes: replace fragile VPNs with SSL-based BeyondCorp (pioneered 2011) to… Talk on
Hunt and Gather: Developing Effective Threat Hunting Techniques	Tim Bandos	40m
Threat hunting focuses on concrete signals and tools not vague promises it uses Sysmon v13.01 for endpoint telemetry and free Sysinternals AutoRuns plus… Talk on
Your Metrics Suck! 5 SecOps Metrics That Are Better Than MTTR	John Caimano, Kerry Matre	40m
MTTR is the wrong KPI for analysts because it incentivizes speed over correct investigation; replace it with actionable measures like Events Per Analyst per… Talk on
The UDS Security Model of the Tesla CAN Bus and Battery Management System	Patrick Kiley	40m
Reverse engineering reveals how the Ludicrous retrofit is delivered: physical surgery (replace pyro fuse, contactors, recalibrate current shunt) plus BMS… Talk on
Applying Artificial Intelligence to the Incident Response Function	Roy Katmor, Udi Yavo	40m
Pipeline turns detections into normalized artifacts, sandbox enrichment, classifier-driven scoping and response; models include a <10MB edge random forest that… Talk on
From Zero to Hero – How Cisco Deployed Zero Trust in Five Months	Brad Arkin	40m
Cisco deploys Zero Trust to over 100,000 users and 120,000 devices in five months by replacing VPN with a network gateway, issuing device and user certificates… Talk on
DBOM and SBOM: New Options For Better Supply Chain Cybersecurity	Jennifer Bisceglie	40m
A clear distinction emerges: SBOMs are machine‑readable lists of components (average >100 parts per product, some with thousands) using standards like SPDX… Talk on
Discord, Generation Z’s Hacking University	Brook Chelmo	40m
Discord hosts communities that buy malware modules with customer support, use cryptocurrency (Bitcoin → Dash/Monero → PayPal) for cashout, and treat Discord… Talk on
The Attacker’s Guide to SSO and Passwordless Technologies	Asaf Hecht	40m
Demonstrates concrete attacks against Windows Hello and browser SSO in hybrid Azure setups, using Mimikatz to extract Kerberos tickets and showing… Talk on
Into the Mind of an IoT Hacker \| How to Protect IoT Networks & Devices	Itzik Feiglevitch, Justin Sowder	40m
Typical enterprise of 5,000 employees contains about 20,000 IoT devices and a 500‑bed hospital about 10,000 devices; public scans (Shodan) show ~25,000… Talk on
Post-Quantum	James Howe, Thomas Prest, Thijs Laarhoven, Corentin Jeudy	40m
Survey extracts concrete rules: lattice signatures use TPSF/ATPSF instantiations (Falcon, Wave) to get provable security; many early implementations fail from… Talk on
Security-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started	Cindy Blake	40m
Practical checklist that codifies security into CI/CD: six practical steps for testing source and execution, infrastructure and IaC, micro‑networking and the… Talk on
AppSec’s Future and the Rise of the Chief Product Security Officer	Joshua Corman, Chris Wysopal	40m
Claim: classic AppSec no longer scales and organizations must create a Chief Product Security Officer role to manage productized software, supply chains and… Talk on
Blockchain Security Guarantees and Exploits	Adrian Bednarek	40m
Scans of 34 billion keys produce 732 private keys tied to 57,000 on‑chain transactions, but no large untouched balances; one automated actor consolidates loot… Talk on
CISO Leadership: Building Your Personal Action Plan	Frank Kim	40m
Provides concrete frameworks and a timeline: use the CISO Mind Map and a three-column security leadership matrix (boss/manager/leader) to restructure team… Talk on
Project 2030: Scenarios for the Future of Cybercrime	Dr. Victoria Baines, Rik Ferguson	40m
A published white paper maps hundreds of patents and media items plus an invite‑only survey of over 100 practitioners into three 2030 scenarios for New San… Talk on
Zero Trust, Zero Pain: A Practical Implementation with Intrinsic Security	Pere Monclus, Shawn Bass	40m
VMware cites Forrester research and outlines an actionable Zero Trust stack: per‑app tunnels to replace device VPNs, PoPs/SASE points to normalize… Talk on
WAF Made Easy	Micah Brown	40m
A reproducible method claims deployment of 30 WAFs in under one quarter using a build‑tune‑support pipeline: plan with an implementation guide, cold‑build… Talk on
How You Can Ask the Right Questions to Succeed with Your Security Projects	Lenny Zeltser	40m
Explains concrete question patterns that improve security projects: use open-ended probes like please tell me about your approach to classifying information to… Talk on
Ethical AI: Addressing Bias & Algorithmic Fairness	Sherin Mathews, Amanda House	40m
Demonstrates concrete tools and results: examples include a historical admissions dataset that admits twice as many men as women, face‑generation biases from… Talk on
The Game of Cyber Threat Hunting: The Return of the Fun	Xiaokui Shu, Dr. Jiyong Jang	40m
Kestrel is an open source hunt language that composes Kestrel hunting language patterns and docker-hosted analytics to shift focus from query craft to… Talk on
How to Build a Long-term XDR Architecture Strategy	Allison Clelan	40m
XDR combines endpoint, network and cloud telemetry to cut alert and tool overload by automating detection, investigation and response; recommended foundation… Talk on
Job Search 2021: Interview Skills & Resume Workshop	Camille Stewart, Brent Nohl, Christine Klema, Paula Dancil, Carrie Patrick, Sarah Le Roy	58m
Panel gives a tactical playbook: craft a three‑phase narrative do, validate, exude (turn “painted my mom’s house” into a project‑managed scope/budget/vendor… Interview on
The Resilience Business Case: Three Case Studies	Wolfgang Goerlich	40m
Three case studies show how resiliency wins with specifics: a money manager converts an audit finding and a fragile call‑tree plan into a prioritized recovery… Talk on
Cyber Risk Management Programs: Bringing Clarity to Cybersecurity	Lisa Donnan	40m
Panel summarizes concrete risk practices: use NIST Cybersecurity Framework and MITRE ATT&CK to map gaps, run continuous vulnerability management plus… Talk on
Managing Access Entitlements & Their Lifecycle in a Multi-Cloud Environment	Victoria Almazova, Anmol Singh	40m
Conference claims that 80–85% of organizations have multi‑cloud and about 50–55% are actively executing; managing entitlements shifts from ad hoc to… Talk on
The Scientific Method: Security Chaos Experimentation & Attacker Math	Kelly Shortridge	40m
Security chaos engineering applies the scientific method to attacker math by building decision trees that map attacker choices and defender mitigations… Talk on
Attacking Kubernetes Clusters Through Your Network Plumbing	Nir Chako	40m
Demonstrates concrete attacks: ARP/MAC spoofing via flannel lets a compromised pod intercept DNS replies despite kube‑proxy DNAT; dropping NET_RAW or strict… Talk on
Cryptography in Distributed Systems	Hamidreza Khoshakhlagh	40m
Claims a secret-shared q-SDH accumulator with constant-size witnesses that uses MPC (SPDZ or Shamir) so all updates and witness creation run in constant time… Talk on
Expert's Take On Hacker Burner Phones, Automation and Hardware	Keith Rebello, Mark Loveless, John Gleason, Sam Levin	39m
Three short, specific briefings: a step‑by‑step burner‑phone OPSEC playbook—buy with cash, register via ProtonMail + ProtonVPN, order to an Amazon Locker, use… Talk on
So You Want to Be an Expert Witness	Lauren X. Topelsohn, Hoyt L. Kesterson II	01h 00m
Practical roadmap for becoming an expert witness: how attorneys search, hire, and prepare experts; the Daubert factors that gatekeep admissible opinions… Talk on
Why 5G Demands a New Approach to Cybersecurity	David Grady	40m
5G claims: sub-5 ms latency, up to 10 Gbps throughput and 10 TB/km2 device density, plus edge MEC and network slicing that let security run at the edge as… Talk on
Hot Topics in Cyber Law 2021	Michael Aisenberg, Catherine Barrett, Lucy Thomson, Stephen Wu	01h 00m
U.S. policy pivots to supply chain and AI: EO 14017 and related orders reboot federal tech advice and target semiconductors, software and batteries; GAO adds… Talk on
Building Cyber Resilience - Considerations for CISOs	Tamer Charife, Abeer Khedr, Reem F. Al-Shammari, Biju Hameed, Arwa Alhamad	50m
Banking systems with 15 million customers and oil infrastructure supplying 93% of national income face widening attack surfaces from cloud, OT/IT convergence… Talk on
Adversary Simulation: Close the Gaps in Your Security Posture	Jake Williams	40m
Practical guide to building a repeatable adversary simulation program that maps specific attacker TTPs to measurable outcomes: use MITRE ATT&CK and the APT3… Talk on
Building Red Team Capability	David Wolpoff, Rob Fuller, Philip Martin	33m
Red teaming is an operational capability that emulates true attackers: no scripted scope, objective‑focused attempts to gain access, and checks whether… Talk on
Compliance Made Easy—Simplify Your Approach to Privacy	Mike Green, Kelly Hood	40m
Demonstrates how organizations leverage the NIST Privacy Framework and community crosswalks (CCPA, ISO, NIST CSF) to consolidate hundreds of requirements into… Talk on
What’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech	Matthew McWhirt, Michael Burns	40m
Attackers pivot between on‑prem Active Directory and Azure AD by abusing hidden roles, directory sync accounts and service principals with key material to gain… Talk on
MITRE ATT&CK® as a Framework for Cloud Threat Investigation	Jasdeep Basra, Tanu Kaushik	40m
A survey of 325 enterprises surveyed finds 81% use ATT&CK with 63% using the cloud matrix, and 44% at intermediate or advanced implementation; only 39%… Talk on
The Road to End-to-End Encryption	Max Krohn	40m
Zoom publishes a GitHub white paper, prototypes a first end‑to‑end encrypted meeting, and ships E2E to paid and free users in Oct 2020 release. Phase one uses… Talk on
A Primer: Getting Started with MITRE Shield	William Hill, Stanley Barr	40m
MITRE Shield presents a practical framework that maps defender actions to ATT&CK techniques and turns deception into measurable intel: examples include running… Talk on
Me, My Adversary & AI: Investigating & Hunting with Machine Learning	Jess Garcia	40m
Project uses real production data (100 servers, 30 days, ~220k scheduled-task events and ~24M file-timeline rows), harmonizes diverse tool outputs with a HAM… Talk on
Defend Forward: Moving Toward Coordinated Active Cyber Response	Shane McGee, Andrew Epstein, Kimberly Keifer Peretti, Randy Sabett	01h 00m
Defend forward means pushing disruption earlier by combining government authorities and private telemetry from ISAOs/ISAOs-style groups, not unchecked… Talk on
Purple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up	Dan Houser	40m
Details two practical bypasses and concrete defenses: a repeated spoofed-call attack against Azure-style phone-push MFA (caller ID spoof + annoying prerecorded… Talk on
RSAC College Day Panel - Exploring Cybersecurity Job Opportunities	Mike Gordon, Andrea Abell, John Scimone	40m
Panelists say cybersecurity hiring outstrips available talent by millions and urge practical evidence of skill: build home labs, join collegiate hacking teams… Talk on
From the Fry Pan to the Fire—Personal Liability for CISOs and InfoSec Pros	Aravind Swaminathan, Mark Weatherford	01h 00m
Real-time review of recent probes (Uber, Yahoo!, Equifax) links specific criminal theories—false statements, securities and wire fraud, obstruction… Talk on
Smart IoT: IoT Botnet Attacks on Power Grids Exploiting Their Weak Points	Tohid Shekari, Dr. Raheem Beyah	40m
Claim: a geographically distributed IoT botnet that flips high‑wattage devices at 150,000 bots and targets weak network nodes identified from ISO websites and… Talk on
Managing Privacy and Cyber In A Pandemic: Lessons Learned For 2021 & Beyond	Ericka Johnson, Aaron Charfoos	01h 00m
Companies collecting pandemic data face concrete numbers and legal traps: 76% asked employees to notify of diagnoses, 53% ask travel, 23% take temperatures… Talk on
Protests, Pandemics, and Privacy: The Rise of Surveillance States	David Cole, Niloo Howe	40m
China deploys facial recognition, Nanny apps that scan Quran verses, and QR-based Alipay Health Code gates that issue green/yellow/red access; Xinjiang sees 1… Talk on
Trusted Internet of Things Device Onboarding and Lifecycle Management	Susan Symington, William Polk, Murugiah Souppaya	40m
Current provisioning leaves networks open and devices hijackable; with 40 billion devices expected by 2025 the session argues for scalable, automated… Talk on
Malware Reverse Engineering with PE Tree—OSS Inspired by COVID	Tom Bonner	40m
PE Tree is an open source Python/PyQt5 tool (based on pefile and capstone) that can dump executables from memory, scan IDA/Rekall/Ghidra databases, and rebuild… Talk on
Master Class ICT: A Cyber Case Law Review 2021	Richard Aldrich, Julie Bowen	01h 00m
Covers concrete rulings and open fights: Van Buren: narrowing CFAA liability for “improper purpose”, the pending Mondelez v. Zurich dispute over whether… Talk on
Three’s Company: Unpacking and Settling in with Three NIST Frameworks	Christina Sames, David Weitzel, Julie Snyder	40m
Compares three NIST frameworks and shows how to turn 108 CSF subcategories and a 450‑control RMF baseline into actionable priorities using Daisy chart mission… Talk on
Authentication and Key Exchange	Jacques Traoré	40m
A systematization analyzes 12 papers and proposes a compact, syntax-first model for group key exchange that captures asynchronous messaging, flexible… Talk on
Multi-Cloud Security Monitoring and CIS Benchmarks Evaluation at Scale	Susam Pal, Prasoon Dwivedi	40m
A plugin-based monitoring system uses cloud provider APIs to pull resource JSON, normalize it into a cloud-independent com/ext/raw model, index to… Talk on
Navigating the Biometric Anatomy	Chris Hydak	01h 00m
A Microsoft legal team builds a review framework: a working definition of biometric data, an inventory of uses, and risk buckets keyed to unique identification… Talk on
Cyber’s Past, Present, and Future: The Truth is Stranger than Fiction	Nicole Perlroth	40m
Panelists trace concrete failures and fixes: a Russian group called Sandworm triggers Ukrainian power outages and a worm called NotPetya $10 billion that… Talk on
Election Security: Lessons from the Front Lines	Cynthia Kaiser	40m
Panel summarizes concrete outcomes from 2020: Maricopa County (4th largest) documents three election cycles, hourly incident reporting starting 5:00 AM… Talk on
Beyond Endpoint Security Using Osquery at Scale	Prasoon Dwivedi, Prateek Kumar Nischal	40m
An open audit framework built on osquery + Linux audit framework standardizes agent behavior, bootstraps via TLS plugins, and ships a PKI-backed signed… Talk on
Securing Tesla and Mobileye from Split-Second Phantom Attacks	Ben Nassi, Dr. Yisroel Mirsky	40m
Researchers demonstrate split-second phantom attacks that remotely project images (drone or hacked digital billboard) to trigger real-world ADAS: Mobileye 630… Talk on
DHS CISA Strategy to Fix Vulnerabilities Below the OS Among Worst Offenders	Thomas Ruoff, Boyden Rohner	40m
CISA declares a national effort to remediate vulnerabilities below the OS, naming UEFI as worst offender after citing the 2015 Ukrainian grid compromise… Talk on
Using Threat Modeling to Improve Compliance	Adam Shostack	40m
Claim: mapping PCI line items to explicit threats reveals PCI emphasizes process and management threats (outdated firewall rules, retained auth data, missing… Talk on
How I Hacked Your Website and You Didn’t Even Know	Siddhesh Yawalkar	40m
A live Magecart-style demo uses ZAP to map third-party supply chains, injects a 5-line payload into a demo analytics script and exfiltrates login fields to a… Talk on
The Value of CyberSec Certifications: A Holistic View	Don Donzal, Sara Pickering, John Hammond, Sam Levin	41m
Panelists argue that certifications matter differently by career stage: entry-level gain Network+, CCNA, Security+ or beginner pentest creds like eJPT to pass… Talk on
Serverless Architecture Security Patterns for Securing the Unseen	Jabez Abraham	40m
Shows a live lambdashell.com demo where captured AWS access key secret and session token let an attacker use a Lambda execution role to write CloudWatch logs… Talk on
How 2020 Vision Has Blurred Attorney Client Privilege in Incident Response	Andrea Hoy, Ronald Raether, Corey White, Ashley Taylor	01h 00m
Andrea Hoy, Founder and Virtual Chief Information Security Officer, A. Hoy & Associates, LLC Ronald Raether, Partner, Troutman Pepper Corey White, Founder and… Talk on
An Existential Crisis for Global Data Flows: Privacy and Security Issues	Bret Cohen, Dr. Gabriela Zanfir-Fortuna, Alexandra Ross	01h 00m
July 2020’s Schrems II decision annuls Privacy Shield and forces companies to treat transfers under standard contractual clauses as lawful only after a… Talk on
Are Password Managers Improving our Password Habits?	David Ng, Stuart Schechter	40m
Study recruits 2,491 initial respondents then filters down to 109 validated dashboards from desktop-capable users. About two thirds report using some form of… Talk on
Forecasting Threats is Way Easier Than You Think	Chris Cronin	40m
Claim: forecasting breach likelihood is practical by measuring tendencies, not exact probabilities. Uses the Veris Community Database CSV (≈9,000 incidents… Talk on
Supply Chain Resilience in a Time of Techtonic Geopolitical Shifts	Andrea Little Limbago	40m
Global trade plunges in Q1–Q2 2020 and COVID accelerates decades‑long fragility: supply chains reveal thousands of opaque suppliers, concentration in China and… Talk on
Taking Flight – 3 Experts Discuss Aerospace Cybersecurity	Gabe Mounce	16m
Claims that avionics hubs can route malicious updates hinge on a few constraints: attacks need physical access to LRUs, must hit address locations on buses… Talk on
How the BEC Threat Landscape is Evolving and What We Can Do About It	Crane Hassold	40m
FBI figures and Agari data show BEC causes roughly 40% of cybercrime losses and $26B+ from 2016–2019 (about $708M/month); 2020 BEC losses hit $1.9B while… Talk on
Through Your Mind’s Eye: What Biases Are Impacting Your Security Posture?	Lynda Grindstaff	40m
Claims that cognitive biases systematically skew security decisions: high-profile stories (SolarWinds) drive risk assessments while common threats (ransomware… Talk on
Telehealth Cybersecurity: Secure Remote Patient Monitoring Ecosystem	Nakia Grayson, Sue Wang, Steven Waite, Axel Wirth	40m
Project produces a tested RPM Reference Architecture built with 10 industry collaborators, maps controls to NIST Risk Management, Cybersecurity and Privacy… Talk on
Beyond Public Buckets: Lessons Learned on Attack Detection in the Cloud	Nick Jones, Alfie Champion	40m
Practical checklist and a working toolchain: an open-source framework Leonidas runs attacker TTPs as code against AWS, generates Sigma rules, and executes a… Talk on
Hot Topics in Misinformation: Election 2020, COVID 19, and More	Isabella Garcia-Camargo	40m
Summary of concrete findings and tools: investigators identify at least 12 foreign information operations but find most viral election harm comes from domestic… Talk on
Research on New Vectors of UDP-Based DDoS Amplification Attacks of IoT	Wenmao Liu	40m
Honeypot logs and internet-wide scans show specific UDP services (WS‑Discovery, CoAP, Ubiquiti, OpenVPN, ADDP/DHDiscover) produce huge amplification when… Talk on
What Was I Thinking?: Bungled Breach Responses	John Hauser, Ann Marie Mortimer, Brian Levine	01h 00m
Session gives concrete takeaways: company Slack and texts routinely surface in discovery, incident response reports are usually discoverable unless carefully… Talk on
Are You Really You? Higher Assurance Identity Proofing to the Rescue!	Lorrayne Auld	40m
Explains how to get from policy to practice using NIST SP 80063A with concrete steps resolution validation verification, required evidence types for IAL2 vs… Talk on
Confidential Computing Across Multiple Clouds and Platforms: Project Enarx	Mike Bursell, Nathaniel McCallum	40m
Project Enarx claims to run sensitive apps on untrusted hosts by combining WebAssembly, Rust and hardware TEEs (currently SGX and AMD SEV, Intel TDX planned)… Talk on
Zero Trust: Regaining Trust in a Remote Work World	Macy Cronkrite	40m
Remote work pushes the perimeter into unknown networks so SIEMs need different reference data and long‑term logs; claim: assume breach and prevent lateral… Talk on
Who You Gonna Call: The Quest for a National Data Breach Reporting Law	Aruna Viswanatha, Luke Dembosky, Tonya Ugoretz, Adam Hickey	55m
Congress is still debating a single federal breach-reporting law while the current landscape remains a 50 state + 4 territorial patchwork and Europe uses GDPR… Talk on
It's Been a Privilege to Serve You–a Mock Hearing	April Falcon Doss, Kimberly Keifer Peretti, Laurel Beeler, Julie Lewis	01h 00m
A vendor chosen after a June pen test suffers a Labor Day ransomware attack that encrypts systems and causes six weeks downtime; the same vendor’s firm then… Talk on
Cybersecurity Controls: It Isn't Just Technical Controls That Need Testing	Glauco Sampaio	40m
Claim: continuous control monitoring tests the whole control lifecycle — rule match, log delivery, automation and human playbook — not just code scans… Talk on
Uncovering Covert Channels in Your IoT Networks	Chet Hosmer, Michael Raggo	40m
Claims a working open‑source detector called MPA Python analyzer that parses PCAPs or live traffic, correlates Modbus Transaction/Unit/Function IDs, and raises… Talk on
AI vs AI: Creating Novel Spam and Catching it with Text Generating AI	Younghoo Lee	40m
Uses DistilGPT-2 fine-tuned as a classifier and a PPLM-based attribute model to generate labeled SMS; trains on UCI SMS corpus with a tiny seed of 200 samples… Talk on
Traveler’s Protection Guide: Low Tech Physical OPSEC for a High Tech Job	Marco Preuß, Dan Demeter	40m
Recommend full disk encryption with BitLocker/FileVault or VeraCrypt, use GPG with 4k keys for email (people send ~30–40 emails/day), move private keys to a… Talk on
"S"ecurity Convergence of Cyber, Fraud, and Physical Specialties	Susan M. Koski	40m
Argues that merging cyber, fraud, and physical operations reduces blind spots by building a common data plane (SIEM → big‑data) and a fusion center for shared… Talk on
A Punch to the Supply Chain: Fighting Back to Resilience	Jennifer Bisceglie, Robert Brese, Phil Venables, Edna Conway	40m
Panel argues enterprises must map, monitor and model multi‑tier supply chains, use open‑source intelligence and industry sharing, and run tabletop wargames and… Talk on
Multi-Cloud Anomaly Detection: Finding Threats Among Us in the Big 3 Clouds	Brandon Evans	40m
Shows how to detect cloud breaches by using native audit logs across AWS, Azure and GCP: enable VPC/VNet flow logs and API audit logs, persist them (recommend… Talk on
Developers Dislike Security: Ten Frustrations and Resolutions	Chris Romeo	40m
Lists ten frustrations developers voice (loud tools, false positives, gatekeeping, no time, shifting guidance) and gives concrete fixes: security coaching… Talk on
Creating the Next Cyber Generation - Lessons Learned from the NSA and UWF	Diane M. Janosek, Esq., CISSP	40m
Federal programs and a university coalition scale hands‑on training: GenCyber 154 camps run in 44 states plus DC and Puerto Rico serving ~5,000 K–12 students… Talk on
Patterns for Encryption in Hybrid Cloud	Mark Buckwell	40m
Practical pattern set for hybrid cloud encryption that names concrete components and tradeoffs: cloud key managers, an single-tenant HSM partition (FIPS… Talk on
Security: The Hidden Cost of Android Stalkerware	Lukas Štefanko	40m
Analysis covers 86 Android apps analyzed, gathered from Play Store installs and other sources, with 158 exploitable issues found in 58 apps (67%) and over… Talk on
Hacker’s Paradise: Top 10 Biggest Threats When Working From Home	Paula Januszkiewicz	40m
Demonstrations show macro-triggered PowerShell downloading a reverse shell, a DLL-hijack persistency that escalates to SYSTEM, and an SMB relay using… Talk on
Hooked By Phisherman: Quarterbacking Breach Response with Law Enforcement	Mark Sangster, Catherine Lyle, Justin Daniels, Jodi R. Daniels, Marc Debrody	01h 00m
A phishing link leads to an Office365 credential theft, ransomware encrypts files and posts a $5 million demand, and responders must choose between restoring… Talk on
Beyond Living-Off-the-Land: Why XP Exploits Still Matter	Jean-Ian Boutin, Zuzana Hromcova	40m
Claim: attackers bring and exploit older signed Windows binaries such as a Windows XP wdigest.dll plus an XP rundll32 to run shellcode that reuses code gadgets… Talk on
Responding to Disinformation and Influence Campaigns	Melissa O'Leary	40m
Anecdotes show false identity hijacks search results (a same‑name smear requiring a take-down process), nation‑state campaigns that forge documents and get… Talk on
Internal AppSec Awareness and Education	Tiffany Long, Nikki Brandt, Marisa Fagan, Tom Hudson	39m
Seven-minute lightning advice condenses reproducible steps: buy an LMS with admin tools and HR integration, customize training to the top vulnerabilities… Talk on
Zero Trust in a Post-pandemic World	Bret Arsenault, Rob Lefferts	40m
Microsoft describes a practical Zero Trust rollout centered on healthy devices, strong identity and persistent telemetry, using Windows Hello for Business… Talk on
Ransomware Threat Landscape	Adam Meyers	40m
CrowdStrike reports tracking 154 adversaries and shows ransomware shifting from commodity malware to targeted operations using access brokers, Emotet/Dridex… Talk on
Cryptanalysis I	Marloes Venema	40m
Three short results: implementation of Simon on IBM-Q16 15‑qubit device up to 7‑dim shows non‑orthogonal measurement mass (tau grows with dimension), proposes… Talk on
Top Seven AI Breaches: Learning to Protect Against Unsafe Learning	Davi Ottenheimer	40m
Seven concrete failure modes: machine translation flips gender on simple Hungarian and Finnish sentences (Hungarian gender flips, Finnish names change with… Talk on
Protecting What Matters Most – Tools for Managing Risk	Tom Conkle, Greg Witte, John Manchester, Leilani Lauger	40m
Panelists argue organizations must map cybersecurity into enterprise risk management using practical artifacts: NISTIR 8286 guidance, a maintained risk… Talk on
Getting Started With SASE: Connect, Control and Converge With Confidence	Meg Diaz	40m
Cloud shift and remote work drive replacing MPLS backhaul with cloud-delivered networking and security, claiming direct internet access improves latency but… Talk on
Applied MPC	Nigel Smart	40m
Three concrete contributions: a protocol that runs PageRank over partitioned bank graphs using Secure PageRank via MPC with fixed-point arithmetic and an… Talk on
Ten Things to Include in Remote Work IT Risk Assessments	Alyssa Pugh	40m
Lists ten concrete remote-work risks and fixes: unauthorized data exfiltration (asks whether sensitive files are encrypted at rest, in transit, and… Talk on
Navigating the Unknowable: Resilience through Security Chaos Engineering	Aaron Rinehart, Jamie Dicken	40m
Chaos Engineering applied to security—Security Chaos Engineering—is framed as proactive experiments that inject small failures to reveal control drift and… Talk on
Beyond Endpoints: A Case for Open XDR	Lauren Horaist	40m
Security stacks stay scattered and costly so the argument is for an open XDR approach that centralizes and normalizes telemetry across vendors, applies… Talk on
Why Resilience Has Become A Cybersecurity Superpower	Lisa Young	40m
Argues that resilience is an emergent capability not a product, broader than business continuity and dependent on disciplined risk identification over control… Talk on
Who Owns Your Data?	Steve Black	40m
Maps regulatory regimes across 120+ countries and argues that recent laws effectively turn data into property, using Lucas v. South Carolina Coastal Council… Talk on
Monitoring Strategy for the Coming Space 5G Network	Theresa Suloway, Nick Tsamis	40m
Claims that DHS CDM-style architecture maps to Space 5G, with a reference design using Elastic Stack and Kibana to ingest logs. Defines two concrete threats… Talk on
Demystifying Decentralized Fair Models for Federated Machine Learning	Subarna Rana, Sharmistha Chatterjee	40m
Claims a practical pipeline that blends PySyft-based federated training with additive secret sharing and differential privacy (Laplace/Gaussian) to produce… Talk on
His Power Level is Over 9000! Vulnerabilities in Solar Panel Controllers	Waylon Grange	40m
Mobile apps are mono builds that call a native binary to compute an MD5+CRC installer password from a device serial, firmware packages sit in an open S3 bucket… Talk on
Colorful AppSec - Red, Blue, or Purple?	Pedro Umbelino, Luis Gomes, Tanya Janca, Erez Yalon	39m
Red teams run realistic attack exercises that go beyond bug bounties to probe APIs, mobile apps, infrastructure and business logic, uncovering risks that lack… Talk on
Critical DNS & Domain Name Security Intelligence to Thwart Cyberattacks	Ihab Shraim, David Conrad	40m
ICANN and CSC detail concrete findings: 325,000+ COVID‑related domains appear since Jan 2020, 64% on .COM, ~75% on gTLDs, 645+ fraudulent online stores selling… Talk on
The Zero Trust Challenge for Hybrid Cloud: Truths vs Myths	Bill Malik	40m
Hybrid cloud needs identity‑centric Zero Trust for real‑time authorization, SASE as the cloud‑deployed instantiation, and process automation to stop human… Talk on
Under the Unfluence: the Dark Side of Influence	Ron Woerner	40m
Shows concrete attack paths and defenses: romance scams cost $200M reported in 2019 and often seed business email compromise, Verizon finds ~50% of breaches… Talk on
Are Pentests Relevant with Bug Bounties	Joseph Mlodzianowski, Omar Santos, Phillip Wylie	39m
Pen testing stays necessary for compliance, internal network and OT/ICS checks, social engineering and deep source‑code or zero‑day hunts, while bug bounties… Talk on
Personal Threat Models and, Speculatively, Privacy Governance	Bethan Cantrell	40m
Claim: simple, repeatable personal threat modeling lets users map risks and choose actions using four basic steps: establish awareness via a trust boundary… Talk on
How to Ruin your SOC in 5 Easy Steps	Ben Smith	40m
Five actionable failure modes: rely only on SIEM logs instead of logs + network + endpoint visibility (use XDR); keep incident procedures in outdated binders… Talk on
Invisible Security: Protecting Users with No Time to Spare	Josiah Dykstra	40m
Argument for shifting security burdens to automated defenses with concrete results: operating systems and apps use automatic updates to patch the majority of… Talk on
Who Stole My 100,000 Dollars’ Worth Bitcoin Wallets - Story of HoneyTokens	Tan Kean Siong	40m
Describes a 90-day experiment that plants 10 Testnet wallets worth about $100,000 in total (Testnet coins) inside bait zip files and watches who steals them… Talk on
Digital Identities - 21 PKI Pitfalls and How Best to Avoid Them	Tim Callan, Jason Soroko	40m
Lists 21 concrete PKI mistakes and fixes, with examples like RSA 2048 and ECC 256 as current key standards, and incidents (O2, Equifax) tied to expired… Talk on
In the Crosshairs: The State of Security in SLTT and SMB Organizations	Tony Sager	40m
State and local governments, SMBs and their MSPs share fragile defenses: surveys of a 11,000+ member ISAC and assessments show controls 1,5,9,11,14 are… Talk on
Three Ways to Manage Risk and Digital Transformation During a Pandemic	Michael Jabbara	40m
Visa shows digital volume +40% while physical payments drop ~20% early in the pandemic and later digital stays ~30% growth as physical returns to breakeven… Talk on
Burnout—The Greatest Threat to Your Organization’s Security	Chloe Messdaghi	40m
Security burnout causes measurable risk: 94% of US CISOs work > contracted hours, 74% of orgs have ad hoc or no incident plans and successful breaches spike… Talk on
Displacing the Dollar: Is Crypto Robust Enough to be the New Reserve Currency?	Kenneth Geers, Kathy Wang	40m
Conclusion: cryptocurrency faces technical and operational limits that keep it from supplanting the dollar in the near term. Key specifics: Bitcoin handles a… Talk on
Weak Links in Cloud IAM - Never Trust. Always Verify!	Nathaniel Quist, Chien-An (Jay) Chen	40m
Red team exercise reproduces two real attack paths: an IAM PassRole with Resource "" lets a developer account attach admin service roles to EC2/Lambda/ECS and… Talk on
Strengthening Resilience of Positioning, Navigation, and Timing Services	Jim McCarthy, James Platt	40m
U.S. critical infrastructure is highly dependent on GPS and GNSS and a complete loss can cost $1 billion a day; weak open signals are trivially jammed with a… Talk on
Building Trust in Supply Chains	Shingo Hane, Asahiko Yamada	40m
Claims a Cyber‑Physical Security Platform that models production with a VCP model, collects sensor logs and operational steps, and compiles digital evidence to… Talk on
Security Policy Management in the Hybrid Cloud	Sattwik Gavli	40m
Companies face 81% cloud adoption while 72% report cloud security concerns and most breaches trace to misconfigurations. A centralized security policy… Talk on
What are Faster Payments and Why Should a Security Practitioner Care?	Peter Tapling	40m
The US is introducing the first new core payment rails in 40 years: RTP is live and FedNow is coming, both using the credit push model and delivering… Talk on
Breaking the Box: How Emerging Technology Can Close the Cyber Skills Gap	Diana Kelley, Deveeshree Nayak	40m
Claims that gamification, behavioral analysis and bug bounty programs tangibly increase hireable experience, with concrete paths like DEFCON CTF wins and… Talk on
Building a Global Cyber Rating - How to Objectively Rate Cyber Capabilities	Jack Freund, Derek Vadala	40m
Proposal builds a blended Global Cyber Rating that combines five data streams — outside‑in scans, inside‑out telemetry and API queries, management… Talk on
A Review of the Ransomware Threat Landscape	Jen Miller-Osborn, Shannon Vavra, Phil Reiner, Michael Daniel	40m
Unit 42’s data shows ransomware economics explode: average ransom tripled to $312,493, the largest known payment rises to $10M and demands top $30M. Criminals… Talk on
We’re All in this Together: Technology Abuse and Design	Erica Olsen, Natalie Dolci, Jennifer Landhuis, Tom Ristenpart	40m
Covers concrete problems and fixes: explains 1000% increase in stalkerware during the pandemic, shows how common tools like Find My iPhone misuse and spyware… Talk on
Is Your Organization’s Confidential Data Really Confidential?	Michael Ekstrom, Anne Townsend	40m
Claims that average breach cost is $3.86M and that two NIST/NCCoE guides (1800-23 ID-PR and 1800-29 DRR) provide deployable architectures and tested builds… Talk on
Modern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?	Mike Jankowski-Lorek	40m
Demoed exploits show MFA and modern auth failing in practice: a compromised endpoint with Meterpreter and a SOCKS proxy lets an attacker pivot over VPN (works… Talk on
Attack & Defend: Protecting Modern Distributed Applications and Components	Johannes Ullrich, Jason Lam	40m
Browser devtools + curl reveal a JWT sent to the app; copying that token and posting it to the backend port (bypassing the Kong gateway) returns the same data… Talk on
The State of the Union of DevSecOps	Shannon Lietz	40m
Overview of current state: industry adoption shows Gartner: 20–50% adoption and strong vendor growth (unicorns like Snyk), but real gaps remain — tooling… Talk on
Gula Tech Foundation Data Care Grant Competition Awards: $1M at Stake	Isabel Guly, Philip Green, Deborah Plunkett, Tom Quitter, Forty Siget, Douglas Simon M.D., Michael Fang, Kelsey F. Hunt	39m
Gula Tech Foundation awards $1M across seven nonprofits, with four runners‑up ($100K each) and 3rd/2nd/1st at $150K/$200K/$250K. Notable specifics: CIAS at… Talk on
How Risky Is Cybersecurity Insurance?	John Pescatore, Benjamin Wright	40m
Cyber-insurance reduces but does not eliminate losses: example small breach of 28,000 records produces about $3.0M total damage, $1.4M invoiceable recovery and… Talk on
Incident Response – How to Give the Advantage to the Hackers!	James Christiansen, David Estlick	40m
Practical incident-response war stories with concrete takeaways: ransomware demands tied to business-impact decisions and the recommendation to get a Coinbase… Talk on
Inside the Mind of the SUNBURST Adversary	Marco Figueroa	40m
An adversary compromises the SolarWinds Orion build chain to inject a backdoor that signs and ships with legitimate updates, successfully reaching 18,000… Talk on
ComPriSec: A Weird Word for a New World	Ron Woerner, Warren Fish, Robert LaMagna-Reiter, Lisa McKee	50m
Panel defines ComPriSec as the overlapping work of compliance, privacy and security and gives concrete steps: map data, applications, assets and services… Talk on
Flying to DevSecOps with a USAF Cyber Weapon System - Year 1	Dr. Mark Peters	40m
Technica Corporation moves a USAF Cyber weapon system (CVAH) from waterfall to DevSecOps and ships three releases in nine months, a 400% release-rate increase… Talk on
Enemy Inside the Gates: Securing the New Battleground	Tom Gillis, Christopher Kruegel	40m
Breaches bypass perimeters so the talk advocates securing East‑West traffic by embedding tiny, software distributed micro-firewalls and IDS/IPS at each service… Talk on
Escalation from Heist to Hostage: Modern Bank Heists 4.0	Tom Kellermann	40m
Survey of 126 CISOs reports concrete shifts: 57% note increased wire transfer fraud, 54% see destructive attacks up 118%, 41% report market strategy espionage… Talk on
Leveraging Suricata in the Enterprise: Shifting from Events to Insights	Eric Leblond, Peter Manev	40m
Shows a concrete workflow that turns Suricata’s raw output into actionable signals using SELKS, Scirius Community Edition, Kibana and VirusTotal. Claims 60k+… Talk on
Faulty Assumptions: Why Intelligence Sharing Fails	Michael Daniel	40m
Claim: intelligence sharing fails because three faulty assumptions drive programs — that CTI is only technical, that everyone should share the same technical… Talk on
Lessons Drawn From Cybersecurity In The Rise of Privacy Tech	Melanie Ensign, Michelle Dennedy, Lourdes M. Turrecha	40m
Privacy tech today mostly automates legal workflows but the real opportunities are developer-facing: shift left into development with tools that scan entire… Talk on
Picking Winners: How the Pandemic Changed Cybersecurity Investing	Rob Sloan, Saam Motamedi, Chenxi Wang, Dino Boukouris	40m
Venture activity pauses briefly in Q2 2020 then accelerates: cybersecurity deal count rises from 420 to 540, a 28% increase and funding climbs to $11 billion… Talk on
Nurture vs. Nature in AppSec: Data-Driven Measurement of DevSecOps	Jay Jacobs, Ben Edwards	40m
Data from Veracode and Cyentia analyzes 132k applications, >1M scans and ~10M findings and shows about 3 in 4 apps have at least one flaw and ~1 in 4 have high… Talk on
WarezTheRemote? Under the Couch, and Listening to You	Ofri Ziv, JJ Lehmann	40m
Exploit demonstrates a man‑in‑the‑middle against the Comcast XR11 voice remote by impersonating the paired X1 box over RF, crashing the box’s Control Manager… Talk on
Cryptanalysis II	Lenka Mareková, Karen Klein, Serge Vaudenay	40m
Reverse-engineering of Bridgefy shows Bluetooth mesh uses Gzip then RSA PKCS#1 v1.5 per-block, letting an attacker perform a compression-oracle style… Talk on
From Existential to Reality: 3 Experts on the Evolution of ICS Threats	Kim Zetter, Wade Chmielinski, Bryson Bort, Ben Miller	26m
Ransomware starts in IT but routinely breaks operations by hitting ERP, HMIs and billing systems that OT depends on, so attackers shift from simple encryptions… Talk on
Lessons From Our Zero Trust Journey: Successes, Failures & Dodging Pitfalls	James Carder	40m
Organization starts Zero Trust in 2017 and completes a four year journey by rearchitecting around Google’s BeyondCorp approach, Okta for IAM, LogRhythm for… Talk on
Your Fraud Metrics Suck, Losing Money and C-Suite Ignoring You – Now What?	Jim Ducharme	40m
Fraud metrics that matter are concrete: show dollars lost and avoided, intervention rates and targets, and customer impact tied to revenue and card… Talk on
Ransomware: New Recipe For An Old Dish	John Fokker, Raj Samani	40m
Ransomware shifts from spray‑and‑pray to professionalized extortion: affiliates recruit via forum job postings demanding Metasploit, Active Directory and… Talk on
Analyst View: How To Manage Info/Cybersec Careers in a Pandemic Recession	David Foote	40m
Data from 3,700 North American employers shows a 3.5–4 million shortfall in cybersecurity roles and a 37% CAGR in hiring demand 2012–2022, with 3.5–4 million… Talk on
OODA Looping in a Turbulent World	Ryan Kovar	40m
Applies the OODA loop to real incidents and shows concrete results: a lab query pulled DNS from a home lab and flagged 726 COVID-related domains that were… Talk on
Evolution of AppSec: Perspectives from a Decade of Building OWASP ZAP	Simon Bennetts	40m
OWASP ZAP is an Apache‑2 open source web app scanner developed over a decade with concrete outputs: daemon mode and API (2011) for automation, WebSocket and… Talk on
Pinata Time: Why We Should All Start Bashing Mules!	Stacie Purcell	40m
Account-opening mule rings surge during the pandemic, driven by unemployment and stimulus fraud, faster payments and abused third-party payout systems; most… Talk on
Culture Matters—Put People at the Heart of Security	Jinan Budge	40m
Argues security must shift from tools to people, showing Forrester survey evidence that leaders spend most time on stakeholders not tech and that 2019… Talk on
How CISA Is Charting a Path Toward Defensible Infrastructure	Joshua Corman, Sounil Yu	40m
CISA maps the CISA Services Catalog into the Cyber Defense Matrix to spot gaps, then evaluates agency posture with five layers: recipes, pantry, grocery store… Talk on
Securing Your Direct to Consumer Identity Strategy	Sarah Cecchetti, Vittorio Bertocci	40m
Direct-to-consumer identity needs concrete choices: require YubiKey Nano 5 support and multiple MFA options but accept SMS for reach; segment users because… Talk on
New Face, Who Dis? Protecting Privacy in a World of Surveillance	Mike Kiser	40m
Argument: adversarial techniques can give individuals agency to break commercial and government facial recognition. Evidence: an Android camera app (Camera… Talk on
Identity Resilience: What Doesn’t Kill You Makes You Stronger	Zulfikar Ramzan	40m
Argues that digital trust depends on three measurable pillars: identity assurance, access assurance and activity assurance, built on RSA-style public‑key… Talk on
A Data Protection Problem: Insider Risk	Mark Wojtasiak	40m
Code42 reports that employees nearly twice as likely to have leaked data since COVID and that 91% lack purpose-built tech to manage it. The concrete solution… Talk on
Shuffling and Friends	Tjerand Silde, Toomas Krips, Giuseppe Vitto	40m
Paper presents a lattice-based verifiable shuffle for known content that combines Baum et al. commitments and Lyubashevsky–Neven verifiable encryption to build… Talk on
AI: Legal and Policy Considerations and Landmines to Avoid	Paul Hastings	40m
Overview of U.S. policy is practical: the FTC issues high‑level AI guidance (2020) while federal strategy focuses on investment (American AI Initiative 2019)… Talk on
Public Health Cyber War Games: How Hackers are Exploiting Healthcare	Caleb Barlow, Robin Ford	40m
Ransomware now causes operational harm, not just record theft: healthcare breaches rise 2,733% over a decade and a patient-facing system outage costs tens of… Talk on
Tales from the Underground: The Vulnerability Weaponization Lifecycle	Mayra Rosario Fuentes	40m
Year‑long monitoring of 600+ English and Russian forums finds Microsoft products account for 47% of requested CVEs, average buyer offers about $2,000, and some… Talk on
Security Champions: Drive Innovation by Creating Future Cyber Workforce	Tanvi Bali	40m
Proposal: build a security champions program that turns one nominee per scrum into a trained, accountable security role using the NIST NICE framework and a… Talk on
Web Attacks and Fraud: Lessons Learned from the Deep End of the Pool	Lori Mac Vittie, Dan Woods, Sara Boddy	40m
Data from billions of automated attacks shows over 50% of breaches now stem from credential stuffing and access abuse rather than classic OWASP bugs; Shape… Talk on
Pandemic & Peril: 3 Experts Unpack Challenges Faced in Healthcare Security	Nina Alli, Vidya Murthy, Sharka ., Caleb Barlow	40m
Three seven‑minute briefs that hit concrete claims and examples: medical device security needs cryptography, behavior monitoring, and vulnerability management… Talk on
Blind Spots: Two Cloud Threats You Didn’t Even Know You Had	Matthew Chiodi	40m
Research finds massive, concrete blind spots: a red team spins up an external account, enumerates public GitHub and Google artifacts, and with a misconfigured… Talk on
Total Security: Investigative Perspectives from Public to Private Sector	Shawn Henry, Mary Galligan, CJ Moses	40m
Argues that security must cover a 360° attack surface—virtual, IT, operational and physical—using threat intelligence to turn attribution (rarely 100% but… Talk on
Lessons Learned from Diverse Paths to Successful Cybersecurity Careers	John Pescatore, Lodrina Cherne, Inno Eroraha, Xena Olsen	40m
Four panelists trace concrete career moves: from hands‑on C/C++ and assembly work to creating automation tooling for Marine Corps security operations, founding… Talk on
Making Sense of the Landscape of Attacks and Defenses Against AI	Elham Tabassi, Paul Rowe	40m
NCCoE and MITRE present a concrete, modular testbed for measuring attacks and defenses on image classifiers, claiming it makes combinatorial experiments… Talk on
Sherlock and Watson Fight Deep Social Engineering	Uri Rivner, Erin Englund	40m
Multiple case studies show criminals trick victims into moving their own money: remote-access scams using TeamViewer, real-time voice scams to harvest OTPs and… Talk on
All Your LAN are Belong to Us. Managing the Real Threats to Remote Workers.	Wicus Ross, Charl van der Walt	40m
Research shows home routers run DNSmasq and contain unpatched flaws and botnet infections including Mariah with peaks of ~500,000 compromised devices, enabling… Talk on
Fighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks	Brian Vecci, Snir Ben Shimol	40m
Shows four concrete breach paths and how to detect them: unpatched gateways (Fortinet and exposed RDP/VPN credentials), on‑prem Exchange ProxyLogon, the… Talk on
Upskilling, Credentials and Soft Skills: Closing the Cyber Workforce Gap	Jonathan Brandt, Caitlin McGaw, Gregory Touhill	40m
ISACA’s 2021 survey of 3,600+ cybersecurity leaders finds 61% understaffed, 50% say applicants aren’t well qualified and only 27% grads well prepared, with… Talk on
COVID Contact Tracing Apps: Balancing Privacy, Security, and Health	Sheila Sokolowski, Dr. Gabriela Zanfir-Fortuna	40m
Most COVID apps use Google/Apple Bluetooth API or Bluetooth protocols like DP‑3T rather than GPS, and countries choose centralized vs decentralized storage… Talk on
The Cyber Solarium Commission: What is Left to Be Done?	Catherine Lotrionte, Paul Rosenzweig, Frank Cilluffo, Tom Corcoran	40m
Panel reviews a 2020 report with over 80 recommendations and 27 provisions codified into law, then lists concrete next steps: stand up a Joint Collaborative… Talk on
MDR: Making Sense of the Veg-o-Matic Buzzword Blender	Diana Kelley, Lisa Lee	40m
Provides a practical taxonomy of MEDR/MTDR/MXDR and spells out four supplier models: bring your own stack, vendor-supplied, vendor-built lock-in, and blended… Talk on
Your Breached Controls May Have Been Reasonable After All	Bill Sampson, James Trilling, Phyllis Lee, David Cohen, Chris Cronin	50m
A new reasonableness formula adds utility to Learned Hand’s cost‑benefit algebra and turns on measurable facts: whether MFA or another control was available… Talk on
Doing the Safety Dance: Will Trusted Execution Environments Protect Us?	Sarah Novotny	40m
Confidential computing uses hardware Trusted Execution Environments to protect data in use and entire application memory, not just keys, and the industry is… Talk on
Measuring the Ethical Behavior of Technology	Cam Geer, Lisa LeVasseur	40m
Me2B Alliance builds a measurable ethical yardstick: a draft spec (v1.0 in ballot) plus a Me2B rules framework validated by ethnographic research and a year of… Talk on
New Normal, New Security? Five Security Trends to Watch in 2021 and Beyond	Nicolas Fischbach, Nicolai Solling	40m
Forcepoint X‑Labs and Help AG identify five concrete shifts: rapid adoption of SASE and risk‑adaptive DLP as security becomes a business differentiator and… Talk on
Mirror, Mirror on the Wall, Human Behavior Reveals it All	Margaret Cunningham	40m
A human-centric systems model maps four changeable components — human behavior, implicit environment, organizational culture, proximity perspective — and uses… Talk on
Extreme Makeover: Privacy Edition	Angelique Carson, Ron De Jesus, Ruby Zefo, Susan Hintze	40m
Panelists describe concrete steps: secure tone from the top then multiply it across product and legal teams; embed privacy checks into the existing security… Talk on
How Governments Can Promote a Secure 5G Ecosystem	Courtney Lang, Scott Charney, Danielle Kriz, Shehzad Merchant	40m
Governments are moving from vendor bans toward holistic risk management, citing ENISA December 2020 guidance and the EU 5G Toolbox while wrestling with supply… Talk on
Building Resilience Standards, Resiliently	Mike Boyle, Jessica Fitzgerald-McKay	40m
Standards history shows concrete wins and stumbles: NIST SP 800-183 expands firmware resilience beyond BIOS, while the Trusted Platform Module (TPM) exists… Talk on
Jill and the BeenSTALKed	Xena Olsen	40m
Commercial stalkerware runs as hidden apps or iCloud access, costs $50–$200 subscriptions, and harvests texts, calls, GPS, photos and deleted messages after… Talk on
Challenge Accepted: 3 Experts, 3 Big Ideas on Supply Chain Security	Alyssa Feola, Beau Woods, Matt Wyckhouse, Allan Friedman	38m
Shows how to make device supply chains auditable end to end: adopt DeviceSecOps with SCA, SAST, DAST, manual pentest and Site Acceptance Tests for final units… Talk on
Super Apps and Digital Wallets: Securing the Unstoppable Force	Lee Cookman, Loren Russon, Neill Campbell, Julie Conroy	40m
Panel argues the pandemic accelerates payment digitization with concrete numbers: 39% tried new digital products and merchants see a 25% e‑commerce jump, while… Talk on
Thank You, Next! Protecting Next-Generation OT Networks	Chris Williams	40m
OT networks now host 10–100x more compute, widespread embedded OS devices like Raspberry Pi, and cloud data lakes, so the Purdue DMZ alone is insufficient… Talk on
Building a CISO Response Strategy to Advanced Threats	Jeff Costlow	40m
SUNBURST shows supply‑chain compromises can live inside networks for dwell time nearly a year, so assume logs and EDR may be tampered and invest in network… Talk on
One 1st Responder to Another - Lessons on Managing Stress from the Trenches	Edward Vasko, Carol Barkes	40m
Cybersecurity teams operate like first responders, and that constant need to be right 100% creates toxic stress that Gallup flags as the worst mental health in… Talk on
The Risk You Never Knew Existed: Security and the Gig Economy	James Christiansen	40m
Gig workers now make up over 50% of global workers, a third of US workers, and 90% say they would freelance, with the gig workforce growing three times faster… Talk on
AI-Powered! Or Is It Just Hype?!	Michael Hadjimichael, Anne Townsend	40m
A lightweight acquisition framework called RX (Relevance, Competence, Cost) assesses whether an AI component is necessary, how well it performs, and what… Talk on
Liberal Democratic Values and the Geopolitics of Technology	Tobias Feakin	40m
Australia publishes a claimed world‑first International Cyber and Critical Technology Engagement Strategy that organizes action around values, security… Talk on
Understanding Impact of Foreign Influence Activities on Research Programs	Allen Phelps	40m
Based on 2,500 insider investigations the claim is that about 5% of employees present an insider-risk vector and roughly 3,000 talent programs pursue Western… Talk on
A Year Spent Virtually: The Lasting Effect of the COVID Pandemic on Privacy	Julie Brill	40m
Panel argues the pandemic accelerates a permanent digital shift and exposes concrete harms: intimate imagery complaints jump 250% rise in Australia, sextortion… Talk on
Zero Trust and Privacy: Moving Security Closer to the Target	Wes Gyure	40m
Claims that one in five consumers avoid brands over data practices and 19% switched to competitors frame a practical zero trust plan: combine telemetry from… Talk on
Getting Cybersecurity Funding from Your CEO: the 5 Critical Steps	Cynthia James	40m
Five concrete steps: tailor the ask to the budget owner and use persona language, make two asks (permission to present strategy and to run an executive… Talk on
The Skeptic's Guide to Using XDR to Get Zero Trust	Greg Young	40m
Claims that XDR is a data lake plus ML/AI and built-in response drive the talk: XDR must ingest EDR, network, email, cloud and CASB/API telemetry, not just… Talk on
Leveraging Human Risk Data to Strengthen Cyber Resiliency	Masha Sedova, Michelle Valdez	40m
Claims a dataset of 4.5 million employee security decisions across ~114,000 people and shows actionable results: non‑contractors and first‑line managers click… Talk on
Due to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible	Rod Soto, Jose Hernandez	40m
They build and run an automated scanner called git-wild-hunt against GitHub, index matches into Splunk and output a results.json file; over eight months it… Talk on
Building Privacy-Resilient Identity	Ankur Patel, Daniel Buchner	40m
Demo shows Azure AD + Microsoft Authenticator issuing W3C Decentralized Identifiers and Verifiable Credentials for remote onboarding, with document… Talk on
Ditching Run-To-Failure as Part of a Winning ICS Strategy	Marty Edwards	40m
Argues that run-to-failure is far more expensive than proactive OT cyber maintenance and that incident response is roughly an order of magnitude costlier than… Talk on
Ticking ‘Cyber Bomb’: Is There a Global Response to Fix Value-Chain Risks?	Craig Jones	40m
Panel argues that global value‑chain risk is fixable only with sustained cross‑sector cooperation and clear legal rules, not just tech tips. Examples: a… Talk on
Cybersecurity for Future Extreme Computing	Anne Fitzpatrick	40m
High-performance computing is a specialized, shared system that uses exotic interconnects and software, serves hundreds of users who resist overhead, and faces… Talk on
Better Call Brussels - News on European Cyber Security and eID Regulation	Kim Nguyen	40m
EU lawmakers push a revised eIDAS within months and propose a European Digital Identity that interops with existing national schemes rather than a single tech… Talk on
How Digitizing the Workers Advances the CISO's Goals	Tim Callahan, Chris Sullivan	40m
Aflac and Nymi describe a deployed wearable program that proves identity at the edge, ties physical and logical access together, and feeds a curated privacy… Talk on
Optimizing Operations: Simplification, Visibility, Response and Automation	Joakim Lialias	40m
Claims that integration investment reduces siloed controls and that Cisco centralizes investigations with Investigation Workbench to correlate endpoint and… Talk on
How the Identity Portions of CCPA Regs Put Consumers and Businesses at Risk	Jeremy Grant	40m
California regs let an account holder get data with password-only access, and non‑account requests pass if the business matches two-item KBA for categories or… Talk on
From Zero to Hero at the Edge	Steve Winterfeld	40m
Argues that adopting a SASE platform and a Zero Trust first priority cuts vendor sprawl (cites examples like 500 vendors and a 63‑person shop) by consolidating… Talk on
A Year of Living Dangerously: Resilience After COVID & Killer Hornets	Patrica Titus	40m
Panel recounts concrete operational moves: campus IT sends hotspot-in-parking-lot kits and ships loaner laptops, a university runs 30,000 tests/week while… Talk on
Operational Collaboration: Enhancing Cyber Readiness	Erica Borghard	40m
Conference panel argues the nation lacks a focal system for national‑security‑level cyber readiness and offers concrete fixes: four plausible future scenarios… Talk on
Visible Figures: Bridging the Skills Gap With Inclusion and Equal Opportunity	John Yeoh	40m
Claims a pilot apprenticeship turns people with little or no technical background into fit-for-purpose GRC analysts in seven months, using ISO 27001, CCSK… Talk on
Empowering Hybrid Workforce With Security-driven Networking For All Edges	Nirav Shah	40m
Claims that a unified, security-first platform fixes remote-work gaps by combining SD-WAN with cloud-delivered SASE and an always-on agent for off-network… Talk on
Rebels & Resilience—Why It Pays Off to Break Your Patterns!	Daniel Kroiss, Madita Fuehrer	40m
Claims that breaking organizational habits improves security resilience are grounded in a concrete method: apply Francesca Gino’s rebel talents model to… Talk on
Taking Back Your Brand: New Techniques to Stop Robocallers	Josh Bercu, Mike Rudolph	40m
YouMail operates a sensor network fed by 10 million YouMail users and reports US unwanted calls rising from nearly 60 billion in 2019 to a rebound over 60… Talk on
One Step Ahead: Keeping Security at the Forefront	Anna Wheeler, Kelley Misata, Theo Zafirakos, Michael Sechrist	40m
Ransomware surges in May 2020 lead to a rise in double extortion attacks and prompt creation of a COVID-19 cyber threat coalition that shares indicators and… Talk on
Lessons Learned From Taking Justice Remote During the COVID Pandemic	Jack McCarthy, Sajed Naseem	40m
New Jersey Courts rapidly shifts from near‑100% in‑person to remote, scaling VPN to ~7,500 connections and VDI to 1,500 concurrent sessions, migrating much… Talk on
What is New in California Privacy and What Does it Mean for the Company?	Carla Utter, Lothar Determann	40m
CPRA amends CCPA and creates a new enforcement agency, with major changes effective Jan 1, 2023 (some provisions effective Dec 16, 2020); compliance is… Talk on
A Sustainable Security Workforce Starts at the Local Coffee Shop	Alyssa Miller	40m
Research surveys thousands of job-seekers and hiring managers and analyzes postings to show a systemic mismatch: hiring practices demand CISSP and degrees for… Talk on
How to Prioritize in the New Normal	Bobbie Stempfley, Mike Brannon, Terry Griffith, Mark Weatherford	40m
Panelists report concrete shifts: rapid moves to public cloud, retirement of a mainframe, and expedited infrastructure projects that enable a full work from… Talk on
Your Cyber Journey – You Ain’t Seen Nothin’ Yet	Lisa Lee, Patti Titus, Aimee Larsen-Kirkpatrick, Michelle Dennedy	40m
Panel revisits careers since 2013 and gives concrete takeaways: the public campaign Stop, Think, Connect launches at the White House; a pragmatic book called… Talk on
Open Source as Your Career Catapult	Gregory Bell	40m
Stories about moving from hobby to jobs and companies using Snort, Suricata and Zeek (Bro), building Security Onion into a product with 2 million downloads and… Talk on
End the Battle Between Security and Productivity	Andrew Hewitt, David Holmes	40m
Claim: adopting Zero Trust measurably raises security and productivity by removing friction. Evidence: research shows technology drives ~30% of employee… Talk on
Work Smarter Not Harder: Tips to Approach Cloud Security the Easier Way	Erin Sindelar	40m
Cloud misconfigurations cause most incidents: research cites 65–70% of cloud issues start with misconfiguration and Trend Micro claims 840 million… Talk on
Symmetric Design	Yuqing Zhao	40m
Three short, concrete results: a new small‑state AEAD called FAN claims FAN: 192‑bit state, 128‑bit key, 64‑bit IV, 52‑round init, uses a byte‑wise S‑box and… Talk on
When Your Dashboard Explodes – Do You Care Enough to Send the Very Best?	Elliott Franklin	40m
Case study of a security dashboard that stops being trusted after cloud and sandboxing rules break phishing telemetry, forcing a two‑month pause, internal… Talk on
Municipal Cybersecurity: Building the "Last Mile" of Resiliency	Stephanie Helm, Curtis M. Wood, Jeanne Benincasa Thorpe, Mike Kennealy	40m
Massachusetts describes specific municipal fixes: a state cyber center convenes a monthly working group, funds grants and an office of municipal school… Talk on
How to Guide: Using ISSA/ESG Research Data For Your Benefit	Candy Alexander, Jon Oltsik	40m
Annual survey of 489 respondents finds a real skills gap: 57% report being impacted, 62% report increased workloads, 38% report burnout, and 76% say recruiting… Talk on
Partnering with HR to Build a Culture of Cybersecurity	Steve Luczynski, Valerie Utsey	40m
Security pairs with HR to change behavior, not just push slides: replace annual training with monthly 3–5 minute micro-training, make completion a policy… Talk on
Implementation	Mustafa Khairallah, Arseniy Kharitonov, Gaétan Leurent, Zakaria Najm, Thomas Peyrin, Vesselin Velichkov	40m
Framework reports a modular pipeline that embeds Paar/BP/Tan–Peyrin heuristics, applies local reduction rules and finds what it claims is the current shortest… Talk on
As Worlds Collide: Responding to Cyber Events in a Converged IT/OT Universe	Matthew Dobbs, John Clarke	40m
IT/OT convergence increases attack surface so teams run tabletop games, cyber ranges and capture‑the‑flag exercises to simulate specific failures like… Talk on
Knowledge Glaciers in the Age of Automation and Cloud Native	Emily Fox	40m
Claim: institutional knowledge built over decades is melting because cloud utility models, orchestration and heavy automation consolidate expertise into opaque… Talk on
Multi-Front War: Mitigating Cyber Risk and Maximizing Security	Scott Register	40m
Panelists urge concrete steps: maintain an exercised ransomware playbook, first 72 hours checklist printed offline, isolate infected segments and hunt for… Talk on
Adapt to the New, Unstable Normal: How to Secure the Roaring 2020s	Laura Koetzle	40m
Five pandemic-driven shifts claim long-term impact: customer demand balances safety and convenience (48% of Italians and 40% of Americans want to return to… Talk on
Through the Zoom Dimly: A Year of Remote Audits	Jacob Ansari	40m
Standards bodies (PCI SCC, ISO, A2LA) allow remote assessments with documented exceptions, but PCI PIN/P2PE requires on‑site key operations so a few hours… Talk on
Justified Insomnia – Protecting against Lazy and Sophisticated Cyber Criminals	Charles Eagan	40m
Claims that enterprises must adopt a zero-trust model and practical steps from BlackBerry’s 2021 threat report: a machine learning antivirus (Cylance tech)… Talk on
Transformation of the Digital Leader	Scott Howitt	40m
CIO role shifts from cost controller to innovation leader with concrete examples: Tencent turns WeChat into payments and services, launching virtual red… Talk on
A "Great Equalizer", Until it Isn't: Regional Security in a Global Pandemic	Allie Mellen, Kerissa Varma	40m
Comparative analysis of 17 countries shows concrete outcomes: 40% of enterprises lack a business continuity plan pre-pandemic, Jan–Jul losses to COVID scams… Talk on
nothing matches

-- 277 of 277 talks indexed --