BSidesSATX 2021

09:00

An overview of the Insider Threat Information Security specialty career track and how psychological analysis of user behavior can identify data loss/theft from an enterprise. Commercial SIEM monitoring tools, refocused with input from security, human resources, and legal can identify malicious behavior in real time. That said, the input from interviews prior to the digital investigation will highlight key actions to identify what data is at risk.

In the Clouds

Track 3

09:00

45min

How I got Hacked and So Can You!

Chip Thornsburg

How does a Cyber Crime Investigator and Cyber Security Professor get hacked on Social Media? It’s both harder and easier than you might imagine to hack someone who takes online security seriously. Join <redacted> as <they> details a personal social media account breach and the steps required by law enforcement to investigate and uncover the methods and means used by International Cyber Criminals to breach accounts for financial gain.

Understanding and Attacking Delegations in Active Directory

Venkatraman K

Active Directory is used by more than 90% of Fortune 1000 companies, the all-pervasive AD is the focal point for adversaries. The Kerberos delegation feature in Active Directory (AD) is an impersonation type present since AD was introduced in Windows 2000. This Paper would demonstrate a set of attack scenarios for each type of delegations feature of Active Directory.

Who cares if the job description stinks!

Kirsten Renner

I'm mostly kidding, but not really.
I have taught managers for years how to write better descriptions and candidates how to write better resumes, and I will continue to do that. I even spoke at multiple conferences over the last few years for that purpose. But the key is to have a way of getting around and through bad descriptions, because I don't think we can ever really fix that problem completely. In other words, even though those obstacles exist and likely always will, there are ways to g

In the Thick of It

Track 4

09:30

25min

But what about those medium and low vulnerabilities!?

Nikki Robinson

Vulnerabilities are scored by the CVSS calculator and given a score based on several metrics. Let's discuss not only how these vulnerabilities are scored, but that even if they are scored as Low or Medium, they may still be actively exploited. Many organizations do not prioritize these vulnerabilities. This talk is going to give a technical overview of some specific low and medium vulnerabilities, including SQL injection, and how they are used in vulnerability chaining attacks.

In the Clouds

Track 3

10:00

45min

AI in a Minefield: Learning from Poisoned Data

Itsik Mantin

Many security technologies use anomaly detection mechanisms on top of a normality model constructed from previously seen traffic data. However, when the traffic originates from unreliable sources the learning process needs to mitigate potential reliability issues in order to avoid inclusion of malicious traffic patterns in this normality model. In this talk, we will present the challenges of learning from dirty data with focus on web traffic - probably the dirtiest data in the world, and explain

Beg, Borrow, and Steal: Growing a Security Program From 1 to n

David Gilman

For a startup, hiring the first security engineer is a big deal. It's often an even bigger deal for the engineer themselves if they haven't done it before. You're essentially a team of one, serving as your own manager. Congrats on the promotion! Fast-forward a year or three… You've found and fixed some vulnerabilities and managed not to piss off the engineering team too much. But how do you grow the security team and program from 1 to... n?

Common Cloud Vulnerabilities with Walkthroughs

Rodney Beede

Technical walkthroughs of common cloud application and environment vulnerabilities. Demonstrations of vulnerable systems in a cloud, how attackers exploit them, and preventative recommendations.

Operationalizing Purple Team

Jorge Orchilles

This talk picks up after your first successful Purple Team Exercise is complete and teaches you how to continue maturing and improving your security program by operationalizing the collaboration between your security teams (Cyber Threat Intelligence, Red Team, and Blue Team). From testing new TTPs to Detection Engineering and showing value.

In the Clouds

Track 3

11:00

45min

CrimeOps of the KashmirBlack Botnet

ofir shaty, Sarit Yerushalmi

We'll expose the KashmirBlack botnet that infected CMS platforms, using Plug&Play infrastructure to deploy its malicious code, expand and stay undetected. We will take you down the rabbit hole into our journey where we went undercover, deployed a honeypot and participated in the botnet, resulting in the exposure of the Indonesian hacker crew ‘PhantomGhost’.
Explore the DevOps behind the botnet, discuss its purpose and go deep into the bits-and-bytes of the operation and the infection technique

Intro to Reverse Engineering with Ghidra: Taming the Dragon

Christopher Doege

An introduction to reverse engineering binaries in elf and PE formats with Ghidra that goes over first reverse engineering concepts to utilizing ghidra's many features to tackle tasks such as malware analysis, vulnerability analysis, and general reversing.

Lessons Learned - Crash Course in Information Security Management System Implementation

Rose Songer

Implementation and management of an Information Security Management System can seem like a daunting task. This presentation will cover my own lessons learned on multiple ISO 27001:2013 implementations and ongoing management of the ISMS. We will discuss ISMS 101, the must haves of your program, not skimping where it counts, less is more, and how to put a bow on your program. Take my challenges and turn them into your successes.

Master "The Interview"

Paul Guido, CISSP, CCSP

You have worked on your skills, knowledge, abilities and can complete tasks. The resume looks great and you landed the interview. It is time to push forward and master the interview!

In the Thick of It

Track 4