<img src="/media/bsidessatx-2024/img/sugarskull-2019_200h_KQlJRqW_bnpuecT.png" id="event-logo" alt="The event's logo">

Competitions & Competencies: or “How to Hack your way into the Cyber Workforce!”

Chip Thornsburg

Despite more than 3 million unfilled cybersecurity jobs worldwide, recent college and university graduates are struggling to enter the workforce. Experienced IT workers struggle to make the jump to cybersecurity roles. What does it really take to make a successful transition to the cyber workforce? Chip shares the results of surveying 150 IT hiring managers and supervisors on attitudes about hiring. Including the role of participation in cyber competitions and “hacking challenges."

09:00

Home Labs for fun and !profit (Put your home lab on your resume!)

Kat Fitzgerald

Oh sure, you read all those posts about "My Home Lab" with all the pictures of 19" racks in a garage or basement. But seriously, how can you truly utilize your home lab, not just to learn, but to boost your career and help you get noticed as being that "Unique Individual" that a company really wants to hire! Come join this talk to learn about building a Home Lab on a budget AND using it to really get ahead. Your lab should be an advantage and a fun learning experience without breaking the bank.

09:00

The Digital Trust Journey: From Key Generation to Signed Certificate

Carl Mehner

This talk explores the creation process of a digital certificate,
used for identity in protocols such as TLS, a critical element for secure online interactions. After submission to a Certificate Authority (CA) there are still many more steps that are necessary before the certificate is ultimately signed and returned to the requester. In this session we will dive into the processes that go into providing trust with digital certificates on the Internet.

10:00

Cyber Safeguarding Through Folklore: Engaging Elementary Students in Digital Citizenship Education

Dr. J

This presentation offers a fresh perspective on imparting digital citizenship education to elementary students by integrating traditional folklore into cyber teachings. Weaving captivating tales and timeless wisdom with essential cyber safety principles empowers young learners to navigate the digital landscape responsibly. This approach aims to foster a deeper understanding of online risks and encourage proactive strategies for safe and ethical online behavior.

10:00

Embarking on Your INFOSEC Journey in Military City USA

Alec Kaden Higgins

This presentation provides a roadmap for starting a career in InfoSec, highlighting the importance of both technical and soft skills, various educational pathways, and the rich tapestry of career opportunities within the field. It stresses the significance of hands-on experience, certifications, and community engagement. Attendees are encouraged to embark on continuous learning and networking to navigate the evolving cybersecurity industry.

10:00

From soup to nuts: Building a Detection-as-Code pipeline

David French

This presentation is for security practitioners who are interested in learning about the fundamentals of Detection-as-Code and how to build a CI/CD pipeline to automate the management of detection rules in security tools.

Core concepts and benefits of Detection-as-Code will be covered before walking through the process of building and implementing a CI/CD pipeline. A practical threat detection use case will be utilized throughout the presentation before testing it end-to-end.

10:30

Access control done right the first time

Tim Clevenger

I discuss tips and tricks for a successful physical access control (badging) system based on my five year stint at a vendor where I installed, repaired and upgraded systems installed by my employer and other vendors

11:00

DPAPI - The Spice of Encryption

Jacob Villarreal

In this presentation, we will explore Window’s Data Protection API (DPAPI) to gain an understanding of how it works and how it is exploited to dump credentials. DPAPI is utilized to encrypt data on a Windows system and is used by various applications like Chrome and Edge’s password managers. We will explore the code and requirements used for data encryption and decryption. Along with ways to abuse DPAPI, such as establishing Domain Persistence through extracting Domain Controllers’ Backup Key.

11:00

Navigating the Shadows: The Crucial Intersection of KYC, AML, and Cyber Threat Intelligence

Jonathan Gonzalez

This session delves into the indispensable role of financial concepts such as Know-Your-Customer (KYC) and Anti-Money Laundering (AML) in predicting and effectively addressing key areas of the cyber threat landscape. We will highlight the critical need for cybersecurity expertise in comprehending and countering the complex landscape of digital threats, and the current status quo of merging these two worlds.

11:00

Seeing Outside In: Mapping Your External Attack Surface

Arcadio Aguilar

While your internal network gleams under the watchful eye of security tools, lurking in the shadows lies a vulnerable reality: your external attack surface. Unseen servers, forgotten cloud instances, and misconfigured applications - all potential footholds for attackers - remain hidden in the vast expanse of the internet. This presentation arms you with the tactical expertise to illuminate these hidden assets using the power of potent reconnaissance tools.

11:30

30min

Lunch (UC Cafeteria)

Track 1 (UC Conference Rm A)

12:00

30min

Lunch (UC Cafeteria)

Track 2 (Moody Rm 101)

12:00

EDR Internals for macOS and Linux

Kyle Avery

Endpoint security agents for Windows have been explored in great detail, but their counterparts for other operating systems are largely undocumented. This talk will focus on the telemetry sources available to EDR agents on macOS and Linux to understand how they detect malicious behavior and identify opportunities for evasion.

12:00

Nation-State Threats in the Open-Source Software Supply Chain

Ross Bryant

Nation-state actors are actively targeting software developers in open-source software. You will learn in this talk about two recent npm campaigns attributed to a North Korean state-sponsored cyber threat group, the Lazarus Group. Software developers armed with these details of their motivations and evolving tactics are better equipped to defend themselves from this serious threat. This talk is intended for all audiences. No prior knowledge of malicious code or malware is assumed.

12:30

30min

Lunch (UC Cafeteria)

Track 3 (Moody Rm 102)

12:30

Offensive Security Awareness

Phillip Wylie

Offensive security is an essential part of a cybersecurity program, but it is often misunderstood, which could lead to not achieving the goals of an organization. An example of a lack of understanding is requesting the wrong type of assessment, such as an adversary emulation instead of a pentest.

13:00

Doubling down on Compliance: Deep Dive into relevant 2024 Cybersecurity Regulations including NYDFS, SEC, & Others!

Dirce E. Hernandez

Companies face pressing new cybersecurity and cyber risk reporting rules from the NYDFS, SEC & other regulatory reporting agencies. Top of mind items includie material incident disclosure within days. With multiple regulators expecting timely action, effective risk and incident management requires not only insight and agility, but also a partnership across IT/Cybersecurity Compliance and Enterprise risk management functions.

13:00

Women in Cybersecurity: The Digital Rosie

Women’s Society of Cyberjutsu, Alamo Chapter, Edith Pena, Geneva Knott, Susan Markose, Hollis Cantrell

In recent years, the field of cybersecurity has grown exponentially, becoming increasingly vital in safeguarding our digital infrastructure. However, amidst this growth, one demographic remains underrepresented – women. Despite their capabilities, talents, and contributions, women in cybersecurity still face barriers and stereotypes. It's time to illuminate their pivotal role in fortifying our digital world and recognize them as the unsung heroes of cyberspace.

13:30

LLMs for Beginners

JR Hernandez

LLMs are going to destroy the world but until they do let’s try to understand how they work. The goal of this presentation is to explain to a script kiddie the underlying technologies of how LLMs work. The hope I have for this talk is that understanding LLMs will demystify the buzzwords around AI and help you use this technology in new and innovative ways. -> Please read complete abstract in the notes section.

14:00

Cybersecurity Career Ambassadors - A NIST NICE Community of Interest

Karl Sickendick

Cybersecurity Career Ambassadors are building a community of leaders motivated to educate people about cybersecurity and cybersecurity careers. You showed up at BSides - you are motivated by cybersecurity. You are the person we're looking for. Come learn about this program sponsored by NIST's NICE, a program that has White House-level attention.

14:00

DNS and Attack Surface Management

Paul Guido, CISSP, CCSP

Your company has total control over your DNS records and systems exposed to the Internet. Tightly managing these resources will protect your brand and your systems.

14:30

The Fault in Our Metrics: Rethinking How We Measure Detection & Response

Allyn Stott

Your metrics are boring and dangerous. Recycled slides with meaningless counts of alerts, incidents, true and false positives… SNOOZE. Even worse, it’s motivating your team to distort the truth and subvert progress. This talk is your wake-up call to rethink your detection and response metrics. You’ll get a practical framework for developing your own metrics, a new maturity model for measuring capabilities, and lots of visual examples of metrics that won’t put your audience to sleep.

14:30

Threat Modeling Intro for Security Architecture

Brennan Crowe

Overview of how to integrate threat modeling as part of annual governance and release security architecture reviews.

15:00

Domain Persistence- Detection, Triage, and Recovery

Joshua Prager

This presentation will discuss offensive tradecraft that establishes elevated persistence within an Active Directory environment. We will discuss offensive and defensive considerations covering the operational flow of technique execution. Additionally, we will provide guidance on detecting, triaging, and recovering from identified domain persistence techniques.

15:30

Hunting Fileless Malware with Treesitter

David McDonald

Obfuscated, fileless malware poses a significant challenge to automated detection systems and wastes valuable time during manual analysis. This challenge occurs as the many layers of obfuscation must be unraveled before the true malicious payload is revealed. In this talk, research will be presented that demonstrates how the tree-sitter parser generator library can be used to write scalable, accurate, and attributable detections for malicious Powershell and Bash payloads.

15:30

VRM 201: Effectively Assessing Vendor AI Risk

Chris Honda

When assessing AI-related risk, do we include our vendors' use of AI? We don't have to reinvent the VRM wheel: we just have to consider some new factors. How in the world do we assess AI risk, and where do we start? We will discuss these questions, new tools, and creative approaches such as (and not limited to)the NIST AI RMF, ISO standards 23053 and 42001, contractual considerations, and legislation like the EU-AI Act to help reduce AI risk in the VRM process.

16:00

A New Architecture for Data Security to Free Incident Responders from False Positives

Rob Quiros

Incident detection today is based on protecting the conduit to protect the data inside. Lack of correlation between APIs and data has lead to high false positive rates that are inundating incident response teams. We present a new approach to data security incident detection and response that avoids correlation with the goal of maximizing the real incident to false positive ratio. This approach is particularly useful with APIs that feed RAG and fine tuning models in generative AI.

16:00

Start Early, Stay Safe: The Crucial Role of Cyber in Education

Frank Hall

Start Early, Stay Safe: The Crucial Role of Cyber in Education proposes early cyber safety education in schools & homes through interactive methods. Aimed at educators, parents & children to address growing cyber threats.

16:30

Unpacking Data Security Posture Management (DSPM)

Coop, Jennifer Fite

Data Security Posture Management (DSPM) is gaining attention and traction within the data security. What are the challenges that DSPM attempts to address? How is it different from traditional data security? This session will cover DSPM current state, reference frameworks, and lessons learned from DSPM related projects.