- BE USTLP:CLEAR
99 Bottles of Trust on the Wall: Approaches to Building Convivial Communities
Trey Darley
Tom MillarTrey Darley (Liaison, BE), Tom Millar (CISA, US)
Trey Darley has been a long-standing member of the FIRST community, and has served a variety of volunteer roles, including a term on the FIRST board, during which he co-founded the FIRST standards committee. Trey is well known for his work on open cybersecurity standards like STIX/TAXII and others. He's also been aligned with the Langsec faction for many years. Trey's patron saints are Grace Hopper, Evi Nemeth, and Paul Erdös.
Mr. Millar has served in CISA since 2009, working to strengthen the nation's cyber defenses and resilience against emerging threats. His work has included increasing the level of public, private and international partner engagement, and supporting initiatives to improve information sharing, such as the standardization of the Traffic Light Protocol. As the Branch Chief of Cyber Resilience within the Cyber Security Division, he oversees CISA's architectural cybersecurity assessments, the Cybersecurity Performance Goals program, and training and standards for assessment performance. Prior to his cybersecurity career, he served as a linguist with the 22nd Intelligence Squadron of the United States Air Force. Mr. Millar holds a Master's of Science from the George Washington University and is a Distinguished Graduate of the National Defense University's College of Information and Cyberspace.
In the face of increasing threats to the stability of the Internet and our other critical infrastructure, it's crucial for FIRST community members to know how to best build and leverage their personal networks to collectively respond to all types of incidents, especially those that seek to disrupt our supply chains and national critical infrastructure. In this presentation, attendees will learn how to make the most of their FIRST membership by building stronger connections with their community partners, creating strong trusted relationships that go deeper than simply being part of a shared workspace or a mailing list.
- JP
Accountability framework against violation of Information Sharing Standards
Hendrik AdrianHendrik Adrian (LACERT/LAC Tokyo, JP)
Hendrik Adrian (Rick) is a seasoned cybersecurity expert with degrees in Electrical Engineering and Computer Science. Beginning in IT security with UNIX systems, he later led Japan’s antivirus industry for six years and pioneered UNIX data protocol filtration for 11 years. For over a decade, he has worked at LAC Cyber Emergency Center, representing FIRST Team LACERT and co-chairing CTI and NETSEC SIGs. He also supports IPA programs, speaks globally, trains professionals, and co-founded malwaremustdie.org to unite experts against malware.
The talk focuses on preventing misinterpretation of the Traffic Light Protocol (TLP), particularly in the context of the updated TLP version 2 published by FIRST. It emphasizes that TLP is not a classification scheme and lacks a clearly defined accountability framework, despite the fact that misuse can result in real-world consequences, typically handled on a case-by-case basis. To address this gap, the talk highlights ISO/IEC 27010:2015, a standards-based version of TLP that incorporates accountability mechanisms. Organizations can adopt ISO alongside TLP v2 to strengthen governance and ensure consequences for violations. Furthermore, the talk stresses the importance of developing a structured playbook to handle alleged violations of TLP v2 fairly and consistently. Since the official TLP v2 documentation, including its new Use Cases, does not specify accountability processes, the proposed playbook would provide legitimacy, transparency, and fairness in enforcement, ensuring violations are managed through standardized and reliable procedures.
Accountability framework against violation of Information Sharing Standards
August 20, 2025 09:00-10:00
- PL USTLP:CLEAR
Airflow Beach Cleaning - Supply Chain Security with Community in Mind
Jarek Potiuk (Apache Software Foundation, PL), Michael Winser (Alpha-Omega, US)
The “Airflow Beach Cleaning” project explores an innovative approach of dealing with Open Source Software Supply Chain problems. This is a collaborative effort between Alpha-Omega fund, Python Software Foundation, Apache Software Foundation and Apache Airflow PMC.
Jarek and Michael will share their learnings from running the cleaning exercise for about 6 months and will encourage other Open-Source project maintainers as well as those who fund security efforts to scale that approach within the whole Python ecosystem.
Link to slides:https://go.xwind.io/vulncon-beach-cleaning
Jarek Potiuk is an Engineer with a broad experience in many subjects - Open-Source, Cloud, Mobile, Robotics, AI, Backend, Developer Experience, Security, but he also had a lot of non-engineering experience - building a Software House from scratch, being CTO, organizing big, international community events, technical sales support, pr and marketing advisory but also looking at legal aspects of security, licensing, branding and building open-source communities are all under his belt.
With the experience in very small and very big companies and everything in-between, Jarek found his place in Open-Source world, where his internal individual-contributor drive can be used to the uttermost of the potential.
Michael Winser is a 40 year veteran in the software industry, with over 25 of those years at Google and Microsoft. He co-founded Alpha-Omega while at Google. Michael is an industry expert in software supply chain security, software development, and developer ecosystems. In addition to Alpha-Omega, Michael works with corporations and open source organizations to develop and execute on their security strategy. Michael is also a Security Strategy Ambassador for the Eclipse Foundation.
- USTLP:CLEAR
Alpha-Omega: What We've Learned From Funding Open Source Security Over the Past 3 Years, What's Ahead
Michael Winser (Alpha-Omega, US)
Since its inception, Alpha-Omega has granted over $8M to various open source security efforts. This presentation will explore how we do it, the lessons learned, and how it's shaping our vision for a secure and sustainable open source ecosystem.
Alpha-Omega is an open source fund, established in February 2022, funded by Microsoft, Google, and Amazon, and with a mission to protect society by catalyzing sustainable security improvements to the most critical open source software projects and ecosystems. The project aims to build a world where critical open source projects are secure and where security vulnerabilities are found and fixed quickly.
Link to Slides:https://docs.google.com/presentation/d/1_9KiqTZFFgUwA7nZ9awDH2dH-rFtUVI-QlAmuIDLhv4/edit
Michael Winser is a 40 year veteran in the software industry, with over 25 of those years at Google and Microsoft. He co-founded Alpha-Omega while at Google. Michael is an industry expert in software supply chain security, software development, and developer ecosystems. In addition to Alpha-Omega, Michael works with corporations and open source organizations to develop and execute on their security strategy. Michael is also a Security Strategy Ambassador for the Eclipse Foundation.
- TLP:AMBER
Analysts & Agents & Antipatterns: Let's talk about AI and the SOC
Samantha Christoff
AI is often being sold as a "human replacement" by many security vendors, however, is this new technology really secure in an environment where we have known bad inputs? In this session we'll dive into the problems of AI that aren't often talked about by the vendors selling them to uplevel your SOC. Let's discuss how easy it is to jailbreak an AI agent, how AI agents are changing the way SOC analysts work (not always for the better), and solutions to new and old security problems. Come with questions, I promise I won't use chatgpt to answer them.
This presentation is for FIRST Members only, authentication is required onFIRST Portal to preview the video.
Analysts & Agents & Antipatterns: Let's talk about AI and the SOC
September 17, 2025 09:00-09:30
- ROTLP:CLEAR
Applying Cybersecurity Regulations and Industry Standards to Open Source Projects
Luci Stanescu (Canonical, RO)
"Information security standards and regulations are constantly gaining more traction and adoption, in an effort to counter-balance the expanding cybercriminal “business sector”. However, these are, understandably, often devised on the assumption that they will be implemented within enterprises, which are centrally managed and have well-defined boundaries. Nevertheless, open source software has become ubiquitous within enterprise infrastructure and consumer products, with little consideration given by regulators or standards bodies.
With open source projects acting as suppliers, often with a governance structure that’s not defined in detail, the question of the suitability of cybersecurity regulations and industry standards within the OSS context becomes increasingly relevant. While organisations such the Open Source Security Foundation (OpenSSF) are making a huge difference by providing best practices, tools and information, these would also need to be recognised by regulators and standards bodies in order to bridge the gap with the enterprises’ burdens. This talk explores the beneficial aspects that can be learned from regulations and standards to further improve the security posture of OSS projects, as well as the requirements which are difficult to map in this context."
Luci Stanescu is Security Engineering Manager at Canonical, part of the team responsible for the security maintenance of Ubuntu and the Canonical PSIRT. With almost 20 years of professional experience, he is passionate about making information security matter and an advocate for not treating cybersecurity regulations and standards as a tick-box exercise.
- PLTLP:CLEAR
Artemis: How CERT PL Improves the Security of the Polish Internet
Krzysztof ZającKrzysztof Zając (CERT PL, PL)
Senior Threat Analysis Specialist at CERT PL, currently working on automated vulnerability discovery techniques. Before becoming a security specialist, he was a software engineer with more than ten years of experience. Teaches offensive security at the University of Warsaw. Formerly a CTF player, playing with the p4 CTF team. Likes cats and bad puns.
Since the beginning of 2023, CERT PL has been periodically scanning more than 900 thousand domains and IP addresses of universities, hospitals, government institutions, schools, banks and other organizations, and detecting hundreds of thousands of vulnerabilities and misconfigurations (including high-severity ones, such as SQL Injection, in important entities).For that task we built a custom tool: Artemis (https://github.com/CERT-Polska/Artemis). It checks various aspects of website security and builds easy-to-read messages informing organizations about the scanning results.During the presentation, I will show how Artemis works, what we are looking for, and most significantly - lessons we've learned during our large-scale scanning project. As the tool is open-source, I will touch upon how to set up your own scanning pipeline.
- NOTLP:CLEAR
Automated ATT&CK Technique Chaining
Martin EianMartin Eian (mnemonic, NO)
Dr. Martin Eian is a Researcher at mnemonic. He has more than 20 years of work experience in IT security, IT operations, and information security research roles. In addition to his position at mnemonic, he is a member of the Europol EC3 Advisory Group on Internet Security. He has previously worked as the Head of Research at mnemonic, as an Adjunct Associate Professor at the Norwegian University of Science and Technology (NTNU), as a Threat Intelligence analyst at mnemonic, and as an Information Security Specialist at Nordea. He holds a PhD in Telematics from NTNU (2012). His current research topics are threat intelligence automation, quantitative cyber risk analysis, vulnerability measurements and analysis, and alert aggregation and contextualization. He has previously presented at the FIRST Annual Conference, the ONE Conference, and at Black Hat USA Arsenal.
Incident response teams need to determine what happened before and after an observation of adversary behavior in order to effectively respond to incidents. The MITRE ATT&CK knowledge base provides useful information about adversary behaviors, but provides no guidance on what most likely happened before and after an observed behavior. We have developed methods and open source tools to help incident responders answer the questions "What did most likely happen prior to this observation" and "What are the adversary's most likely next steps given this observation". To be able to answer these questions, we combine semantic modeling of subject matter expert knowledge with data-driven methods trained on data from computer security incidents.
- TWTLP:CLEAR
Aztronomy: Establishing the Foundation of Attack Path Analysis in Azure
Tung-Lin LeeTung-Lin Lee (Cycraft, TW)
Tung-lin Lee is a cybersecurity researcher at CyCraft Technology, specializing in network and cloud security. He has presented at several industry conferences, including HITCON ENT, ROOTCON, InfoSec Taiwan, and CyberSec.
In our journey of developing an attack path analysis tool for Azure, we encountered several obstacles, primarily derived from outdated and unclear documentation of Entra APIs which is partially mitigated by the amazing open-source project Bark. However, the issue was further compounded by API permission misalignments across different APIs, such as the Provisioning API and Azure AD Graph API.In addition, the rising prevalence of research into undocumented APIs reveals a neglected attack surface. Moreover, we discovered that the token redemption mechanisms behind the Azure Portal present additional attack vectors. By manipulating the mechanisms, threat actors would abuse multiple undocumented APIs & expand Microsoft Graph permission scopes after obtaining a single refresh token.To address these risks, we are developing an open-source framework for precise identity risk assessments in Azure and laying the groundwork for building safer security solutions.
- USTLP:CLEAR
Best Practices for Data Privacy Breach Response: Lessons Learned from Social Media Case Studies
Anne Connell
Lauren CooperAnne Connell (Carnegie Mellon University, US), Lauren Cooper (Carnegie Mellon University, US)
Anne Connell is a member of the technical staff at Carnegie Mellon University (CMU). Anne has over 20 years of experience in software development, privacy program development, resilience management, and instructional design. Anne’s research focus is to address privacy and cybersecurity concerns in a manner that protects organizations as well as individuals and complies with regulations. Anne’s contributions include framework development for implementing privacy standards, creating methodologies for cybersecurity assessments, data breach incident response, and social media risk, and building custom cybersecurity training solutions. Anne holds certifications in CISSP and CIPM. Anne is an instructor of Privacy in the Digital Age at the CMU Heinz College of Information Systems and Public Policy, and is an active speaker on youth online safety and social media. Anne holds a bachelor's degree in Information Systems and a master's degree in Human and Computer Interaction from Carnegie Mellon University.
Lauren Cooper is a member of the technical staff at Carnegie Mellon University. She began her career in IT operations, before shifting her focus to information security. She earned her MS in Information Security Policy and Management from Carnegie Mellon University, where she was a Scholarship for Service awardee, a competitive scholarship program sponsored by the United States government. Her favorite areas of research include privacy, community approaches to cybersecurity, security of 5G and future networks, cybersecurity strategy, security by design in complex systems, and understanding and integrating human factors in security and privacy.
Organizations employ social media platforms for a variety of communication purposes, including sharing industry news and generating website traffic. According to the Pew Research Center News Platform Study, 6 percent of U.S. adults say they at least sometimes get news from social media. The almost instantaneous speed of social media to reach a broad audience makes it a communication outlet well adapted for dissemination of information about data breaches and response status, as well as for combatting misinformation. Many threat actors have found success manipulating social media to target organizations with the intent to damage, disrupt, or destroy trusted communications channels, brand reputation, or financial standing. Communication on social media about an organization's data breach or disclosure can have far-reaching consequences. Management's understanding of how to navigate the aftermath of such a breach is essential to its success in preserving and building the organization's real-world reputation and security. In this presentation we will spotlight case studies using evidence gathered from social media, and conclude with specific and practical data breach incident response recommendations (best practices) how organizations can address data privacy breaches and disclosures proactively.
- USTLP:CLEAR
Beware of Geeks Bearing Gifts - Media Effects Used in Influence Operations (part 2)
Krassimir Tzvetanov, PhDKrassimir Tzvetanov, PhD (Purdue University, US)
Over the past decade, the term "fake news" has become overused and divisive, prompting many to dismiss it outright. This raises questions about how this narrative benefits society—or even aids adversaries. Discussions around "active measures" often miss the mark, failing to grasp the broader implications of such tactics. In today’s information age, traditional cautionary warnings evolve into modern ones like “Beware of geeks bearing gifts,” underscoring the potential manipulation of seemingly benign messages.
This presentation will explore reflexive influence operations, techniques that exploit messaging to align segments of a target audience with adversary objectives. By examining second- and third-order effects, the discussion aims to reveal how such operations succeed in reshaping perceptions and achieving strategic goals. Examples illustrating these tactics will also be provided..
Beware of Geeks Bearing Gifts
January 2, 2025 09:00-10:00
- LUTLP:CLEAR
Beyond CVEs: Mastering the Landscape with Vulnerability-Lookup
Alexandre DulaunoyAlexandre Dulaunoy (CIRCL, LU)
Alexandre Dulaunoy enjoys when humans are using machines in unexpected ways. I break stuff and I do stuff at CIRCL.
Although CVEs are a cornerstone of vulnerability management, they often present an incomplete view of the security landscape. Vulnerability-Lookup, a new open-source project developed by CIRCL, overcomes this limitation by providing a comprehensive and enriched vulnerability intelligence platform that extends beyond basic CVE data. This platform aggregates and correlates data from various sighting sources, such as exploit databases, vulnerability scanners, product advisories, and community contributions, offering a more complete picture of vulnerability threats. We will demonstrate how this richer level of detail enables security professionals to move beyond simple patch management and implement proactive, actionable, risk-based strategies.
- JPTLP:CLEAR
Broken Seals, Broken Trust: Flaws and Defences in the Certificate Ecosystem
Yuta Sawabe
Rintaro KoikeYuta Sawabe (NTT Security Holdings, JP), Rintaro Koike (NTT Security Holdings, JP)
Yuta Sawabe is a SOC analyst at NTT Security Holdings, where he is primarily involved in log analysis and malware analysis. He previously worked on malicious domain names. His is an Information Processing Society of Japan JIP Special Paper Winner (2019). He has spoken at Botconf, HITCON, JSAC and CODE BLUE in the past.
Rintaro Koike is a security analyst at NTT Security Holdings. He is engaged in threat research and malware analysis. In addition, he is the founder of "nao_sec" and is in charge of threat research. He focuses on APT attacks targeting East Asia and web-based attacks. He has been a speaker at VB, SAS, Botconf, AVAR and others.
It is not uncommon for malware and malicious files to carry code signatures, which have become a traded commodity in cybercrime forums. This presentation begins with an overview of the current state of malicious code-signing certificates, including an examination of how these certificates are bought and sold in such forums.Our research uncovered unusual behaviours among sellers dealing in malicious code-signing certificates. By exploiting these behaviours, we successfully predicted the potential misuse of certain code-signing certificates several months in advance. This presentation will detail our methodology, the findings of our analysis, and propose practical measures to combat these sellers.Through this presentation, attendees will gain a comprehensive understanding of the current landscape of malicious code-signing certificates, experimental approaches to address the issue, and effective defence strategies. This knowledge will enable SOC, IR, CSIRT, and other cybersecurity professionals to take proactive measures against malware and malicious files bearing fraudulent code signatures.
- USTLP:CLEAR
Building a PSIRT for a Standards Organization
Jim Duncan (Jim Duncan, US)
Standards groups should have a policy for handling alleged flaws in their "product" and in upstream code, if any, that they modify and include in their own product. However, few such organizations have a well-defined process and policy. There are many challenges, the least of which is that the participants are competitors (as mentioned previously) and it will be inferred that agreeing to a PSIRT policy and process for a standards group will imply a loss of controlover the intellectual property. This presentation will highlight the unexpected challenges of establishing a PSIRT within a standards organization with a goal of helping others to bootstrap and run a vulnerability-handling mission for other standards groups.
Jim Duncan pioneered CSIRT & PSIRT practices, and has over forty years experience in incident response.
- USTLP:CLEAR
Building the Blueprint: Designing Effective Storyboards for Cybersecurity Tabletop Exercises
John HollenbergerJohn Hollenberger (Fortinet, US)
John Hollenberger is a cybersecurity consultant with seventeen years of experience in web- and host-based vulnerability assessments, incident response, digital forensics collection, PCI compliance, and Data Loss Prevention with a primary focus on proactive incident response consulting services. John is also the co-author of Cybersecurity Tabletop Exercises: From Planning to Execution.
In his current position, John is a Lead Consultant of Proactive Services, conducting training exercises in Incident Response fundamentals, developing and facilitating tabletop exercises, and reviewing and creating Cybersecurity Incident Response Plans for large corporations, small businesses, and non-profit organizations. John currently holds the following degrees and certifications: BA, CISSP, CISA, CISM, CRISC, GCIH, GWAPT, and Security+.
Storyboarding plays a pivotal role in the successful planning and execution of cybersecurity tabletop exercises, which are designed to assess incident response and decision-making within an organization. A well-constructed storyboard acts as a blueprint for the exercise, providing a clear, structured roadmap that guides participants through various injects and decision points. It ensures clarity, consistency, and focus throughout the exercise while outlining objectives, challenges, and potential outcomes. The storyboard's key components include: objectives, which define the purpose and learning goals; scenarios, which describe the unfolding events tailored to the objectives and roles; injects, or planned events that drive the narrative; and key issues, critical junctures where decisions impact the exercise's progression. By incorporating these elements, a storyboard helps create dynamic, engaging simulations that reflect real-world challenges, encourage collaboration, and improve preparedness. This talk will provide participants with the tools to craft their own effective storyboards for their organization's cybersecurity tabletop exercises.
Storyboard-Template.pdf
MD5: 95fd747d8ac16bbec1d5fe88fd76cb84
Format: application/pdf
Last Update: June 24th, 2025
Size: 19.82 Kb
- PLTLP:CLEAR
Building Trust Through Proactive Security - Key Parts of the Trusted Software Supply Chain
Przemysław RoguskiPrzemysław Roguski (Red Hat Product Security, PL)
As security concerns continue to grow in the software industry, customers seek assurance that the software they rely on is built securely. While applying security patches is essential, it is equally important to understand the proactive measures taken throughout the development process to ensure that our software is built securely and is compliant with regulatory requirements and industry security standards.
Red Hat follows a comprehensive Secure Software Development Lifecycle (SDLC) framework to improve software security during the entire software lifecycle, mitigating risks, including vulnerabilities, before products are released to production and ensuring that customers can trust Red Hat’s products. We also use an end-to-end build and release environment, which uses SLSA (Supply-chain Levels for Software Artifacts) framework as a guide for reinforcing and gating the build process to better secure and fortify your software supply chain against various threats.
Przemysław “Rogue” Roguski is a Security Architect at Red Hat who specializes in shift-left security initiatives included in build and release processes. He contributes security analysis work on Red Hat OpenShift and other OpenShift-related products. He also designs security solutions and processes across Red Hat Product Security.
He is focused on the security data improvements, especially security data usability in the vulnerability management process and production of attestation data as a part of the Secure Software Development Lifecycle (SDLC) work to address security issues proactively.
An active participant of various upstream and downstream security initiatives and projects like CWE UEWG, OASIS OpenEoX Technical Committee, CISA VEX Working Group and Red Hat Vulnerability Scanner Certification program.
- DE USTLP:GREEN
Burnout: Detect, Investigate, Respond, Recover, Prevent
Désirée Sacher
Carson ZimmermanDésirée Sacher (Finanz Informatik, DE), Carson Zimmerman (Microsoft, US)
Désirée Sacher-Boldewin works as Head of Operational IT Security at Finanz Informatik (DE). She has been in the cyber security industry for 20 years and in various Security Operation positions and published papers and talks about optimizing processes. She can be found on GitHub and on Twitter as @d3sre.
Carson Zimmerman has been working in and around security operations centers (SOCs) for over 20 years. Carson is a Principal Security Researcher at Microsoft, working to elevate SOCs around the globe through industry-leading security capabilities. He co-authored 11 Strategies of a World-Class Cybersecurity Operations Center, available at mitre.org/11Strategies.
Carson and Desiree -- both industry veterans, both used to high stress roles -- have bailed from excellent security jobs because they burned out. Emotional outbursts, damaged family relationships, lost job opportunities, degraded health, weight gain, the list goes on. We've seen our close friends experience resume generating events because they pushed themselves past their limit. Don't let this happen to you. There's a lot more to dealing with burnout than just "get some rest" and "take breaks". An easy ops tempo for one person is an unsustainable death march to others; everyone is different.Burnout has impacted all of us, but almost no one's talking about it. We are. In this talk, we will give you the tools you need to prevent, detect, investigate, respond, and recover from burnout. Combating burnout and stress is not just your responsibility; your coworkers and your boss have a role too -- we will cover both. By the end of this talk, you will have a better understanding of how burnout is different than ordinary stress, how it impacts your body and your mind, and what you can do about it.
- US
Comprehensive Overview of the European Cyber Resilience Act
Becky Hepper, Jyoti Wadhwa (US)
Becky Hepper has been part of Seagate’s Product Security Office for the past three years, driving best-in-class product security practices that protect Seagate’s products, safeguard customer data, and foster a trusted product lifecycle. With over 20 years of experience in software engineering and four years in technical leadership, Becky brings a strategic, data-driven approach to building secure, resilient products. Most recently, she led the successful effort to certify Seagate as a member of FIRST, officially joining the global community on August 21, 2025.
Jyoti Wadhwa is a seasoned cybersecurity and transformation leader with 20+ years of global experience driving enterprise and software security at scale in positions such as Global Head of Product and Cloud Security at NetApp, and Cyber and Mission Leader at Booz Allen Hamilton. Jyoti has led cross-continental teams to deliver high-impact security outcomes across cloud infrastructure, application portfolios and AI security initiatives. A certified CISSP, HCISPP and AWS CCP with an MIT Executive Certificate in Transformative Leadership and an MBA in Information Systems, she is deeply committed to advancing innovations with governance, building high-performing teams and shaping the future of security in the AI era.
Key Takeaways:
- Understand comprehensive compliance strategies.
- Learn about the impact on businesses and consumers.
- Explore future directions and potential global influence.
Comprehensive Overview of the European Cyber Resilience Act
August 29, 2025 09:00-11:00
- USTLP:CLEAR
Context Matters: Qualitative Insights into Developers’ Approaches and Challenges with Software Composition Analysis
Elizabeth LinElizabeth Lin (North Carolina State University, US)
Software Composition Analysis (SCA) is an important part in the software security lifecycle. Establishing the individual software components and versions that make up an application allows for identifying and remediating vulnerabilities. However, SCA tools have not kept up with the ever growing number of new vulnerabilities each year. Developers are flooded with vulnerability alerts and often struggle to quickly remediate critical issues with external components.
We conducted 16 interviews with developers to investigate their processes and challenges around using SCA in their software projects. Interviews covered how SCA tools are integrated into workflows, how reports are interpreted and acted upon, and what challenges were encountered. We find that SCA tools are most often integrated into build pipelines and that users report that information in SCA alerts is too generic and lack context. Based on our findings we conclude that context matters throughout the SCA process, including for evaluating impact, when to trigger SCA scan runners, and how to integrate and communicate tool findings.
Elizabeth Lin is a PhD student at North Carolina State University. She is currently part of the WSPR lab, focusing on security research and tools used by developers.
- DE USTLP:GREEN
Crypted Hearts: Exposing the HeartCrypt Operation
Jerome TujagueDaniel Bunce (Palo Alto Networks, Unit 42, DE), Jerome Tujague (Palo Alto Networks, Unit 42, US)
Daniel Bunce is a Principal Malware Reverse Engineer at Unit 42 within Palo Alto Networks. He's mostly focused on analyzing malware linked to incident response cases, reverse engineering malicious code and identifying the TTPs used by cybercriminals.In addition to his professional role, Daniel is invested in the development of reverse engineering courses. He designs and delivers training programs such as Zero2Automated, which aim to educate and prepare individuals interested in the field.
As a dedicated malware reverse engineer at Palo Alto Networks' Unit 42, Jerome specializes in uncovering the mechanics behind cyber threats, focusing on both crimeware and APT malware. Each day involves a deep dive into disassembled code or building custom scripts to extract IOCs that support defensive efforts. Outside of reverse engineering, I love music (building my vinyl collection), weight training, and reading sci-fi or fantasy books.
In June 2024, Unit 42 began tracking a new Packer-as-a-Service operation, self-titled "HeartCrypt", which was sold across several forums and Telegram accounts. Through our research, we've identified over 2,000 malware samples packed with HeartCrypt, comprising over 45 malware families in the last 10 months. The malware families packed by HeartCrypt range from commodity malware such as Remcos and LummaStealer, to pre-ransomware deployment tooling leveraged by high-level ransomware group affiliates, such as BlackSuit and Hive Ransomware.HeartCrypt provides threat actors with a low-cost entry of only $20 USD per "crypt", and a moderately sophisticated approach to malware payload crypting, which explains the high adoption rate over the past several months. Elements of polymorphism, control flow obfuscation, and EDR/AV evasion techniques are present within HeartCrypt, and while the core packer is rudimentary in nature, it is highly successful in evading both scantime and runtime anti-malware scanners.This talk will explore the inner workings of HeartCrypt, covering its evasion techniques, obfuscation methods, and development timeline - from the early stages, to its use in recent LummaStealer Fake Captcha campaigns. We'll conclude by examining the threat actor behind this packer-as-a-service, specifically focusing on sales channels and underground forum activity. We'll also be sharing YARA rules developed to track every sample of HeartCrypt so far.
- USTLP:CLEAR
CVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
Julia Turkevich
Rina RakipiJulia Turkevich (CISA, US), Rina Rakipi (CISA, US)
CVE (Common Vulnerabilities and Exposures) records are the unsung heroes of the cybersecurity world. But are yours up to the task? This session will dive into how CVE Numbering Authorities (CNAs) can level up their CVE record submissions to create a lasting impact on the global cybersecurity landscape. From enriching CVE records with critical details like Common Weakness Enumeration assignments and Common Vulnerability Scoring System scores to ensuring timely and accurate data, we’ll explore the best practices that make all the difference. Whether you're a CNA or part of the cybersecurity community, this talk will show you how improving the quality of CVE records can strengthen defenses and enhance threat detection across the digital ecosystem. Get ready to take your CVE game to the next level and be a champion of cybersecurity!
Rina Rakipi specializes in cultivating strategic partnerships to enhance vulnerability programs through Secure by Design principles at the Cybersecurity and Infrastructure Security Agency (CISA). As a leader of the Secure by Design Alert publication series, she is dedicated to mitigating recurring vulnerabilities at scale in software products, fostering a more secure technological landscape for the nation. Rina also plays a key role in driving the enhancement of the CVE Program, ensuring that CVE records are complete, accurate, and published in a timely manner to improve cybersecurity resilience across the nation. Previously, she served as a lead technical editor and writer for major joint cybersecurity publications for the Agency. Rina holds a Bachelor of Artsin International Relations from Michigan State University and a Master of Engineering in Cybersecurity Policy and Compliance from the George Washington University. Much of her work falls at the intersection of the two increasingly interconnected disciplines.
Julia Turkevich leads CISA’s CVE Numbering Authority (CNA) Recruitment efforts. As a member of the Vulnerability Response and Coordination Branch in CISA-CSD-Vulnerability Management (VM) subdivision, Julia works to advance maturity across the cybersecurity ecosystem, particularly in the critical infrastructure, industrial control systems (ICS), and medical device sectors. Since becoming a Root in the CVE Program in 2020, CISA has announced over 50 new CNA Partners and continues to actively recruit CNA partners that are committed to proactive and responsible vulnerability disclosure.
CVE-Glow-Up-.pdf
MD5: 427e58e74093c000b30ce6c044b73e16
Format: application/pdf
Last Update: April 21st, 2025
Size: 3.09 Mb
- USTLP:CLEAR
CVSS v4.0 By The Numbers
Nick LealiNick Leali (Cisco and CVSS SIG Chair, US)
CVSS v4.0 has been with us for a little over a year, and quite a bit of data exists out there to tell us about how vulnerability scores may change between CVSS v3.1 and v4.0 assessments.
If you are concerned about the impact that adopting CVSS v4.0 will have on your environment, interested in learning about how the numbers may change, or if you want to craft a narrative using math to either push for v4.0 adoption or avoid it entirely, then this talk is for you! I will go through an analysis of the changes between CVSS v3.1 and v4.0 scores, giving you the context necessary for understanding how adoption may impact vulnerability disclosure and vulnerability management.
In addition to the numbers, we'll discuss some of the shortcomings of CVSS v4.0 and how you can use the standard to its full extent. You can even use the tool I developed to create this talk to look at CVSS v3.1 and v4.0 data in your own environment!
Nick Leali is a current CVSS SIG co-chair, currently working on improving the adoption of CVSS v4.0 to make transition to the new version of the standard easier for vendors and consumers.
Nick works for Cisco as a PSIRT incident manager.
CVSS-SIG-VulnCon-2025.pdf
MD5: 1e8e3ef166dabacada90cc5ee66e5fba
Format: application/pdf
Last Update: April 14th, 2025
Size: 1.19 Mb
- US
Cyber Incident Simulation: “Can You Piece Together the Attack?”
Khushali Dalal (Juniper, US)
Senior Product Security & Cyber Risk Leader | PSIRT | Vulnerability Management | Incident Response
Khushali Dalal is a cybersecurity professional specializing in Product Security, PSIRT, and vulnerability management. She leads complex security investigations, drives remediation with engineering teams, and improves security processes through automation and risk prioritization. She also contributes to industry standards as part of the CVSS v4.0 working group and serves as Chair of the Women of FIRST SIG.
In this collaborative exercise, participants will walk through a realistic cyber incident scenario. You’ll analyze clues, identify the breach, determine response actions, and practice critical incident communication. No prior cybersecurity experience is required — just curiosity and willingness to participate.
Cyber Incident Simulation: “Can You Piece Together the Attack?”
November 3, 2025 09:00-11:00
- JPTLP:CLEAR
Detection Engineering 101 : Establishing a Structured Approach to Detection Engineering
Tomohisa IshikawaTomohisa Ishikawa (Tokio Marine Holdings, JP)
Tomohisa is a Distinguished Cyber Security Architect at a global insurance company, bringing a wealth of expertise across diverse domains of cybersecurity. His professional experience spans global security strategy, security architecture, detection engineering, security operations, threat intelligence analysis, and digital forensics and incident response (DFIR). He has also been involved in red teaming and delivering security training. Tomohisa holds a Doctor of Engineering degree and a broad array of industry-recognized certifications, including CISSP, CSSLP, CCSP, CISA, CISM, CDPSE, and PMP.
Beyond his corporate responsibilities, Tomohisa has made significant contributions to the cybersecurity community. He has served as a speaker, a Cybersecurity Expert Advisor to the Ministry of Internal Affairs and Communications (MIC) in Japan, and a member of the national IT exam committee. He is also a translator and author. Tomohisa has spoken at international conferences such as SANSFIRE 2011 & 2012, DEFCON 24 SE Village, and FIRSTCON23, as well as numerous domestic conferences in Japan. As an author, he has written a book on threat intelligence in Japanese and translated seven security books published by O'Reilly Japan.
Detection Engineering (DE) is a vital aspect of modern cybersecurity operations, aimed at enhancing detection and response capabilities to address the ever-evolving threat landscape. This session presents a structured approach to DE, centered around the Detection and Response Development Lifecycle (DR-DLC) and supported by key frameworks and methodologies. These include the three techniques for improving detection capabilities, the HOPE framework, the VECTOR framework, the 3M+C framework, and three essential metrics (Time, Efficiency, and Coverage) for evaluating and managing an effective DE program. Together, these tools and processes enable a systematic approach to conducting DE and building a robust program.The key takeaway for attendees is a set of actionable strategies and thought toolbox to implement and refine DE practices. Participants will gain practical insights into structured processes and standardized methodologies, equipping them to enhance their organization's detection engineering capabilities effectively.
- GHTLP:GREEN
Developing a Sectoral CERT Ecosystem
Stephen Cudjoe-SeshieStephen Cudjoe-Seshie (Cyber Security Authority, GH)
Dr. Albert Antwi-Boasiako is a cybersecurity expert and author and served as the first Director-General of the Cyber Security Authority (CSA) of Ghana. Prior to his appointment into public office, he founded the e-Crime Bureau in 2011, the first cybersecurity and digital forensics firm with a dedicated digital forensics lab to be established and operate in West Africa.He graduated from the University of Trento in Italy for his undergraduate programme and the University of Portsmouth in the United Kingdom for his postgraduate programme, receiving cum laude and distinction respectively. Dr Antwi-Boasiako completed his PhD studies at the University of Pretoria, introducing the Harmonised Model for Digital Evidence Admissibility Assessment (HM-DEAA) as a ground-breaking contribution to digital forensics standardisation.Dr. Albert Antwi-Boasiako led the institutionalisation and development of Ghana’s cybersecurity which progressed from 32.6% in 2017 when he was first appointed to 99.27% in 2024, as reported in the ITU’s GCI, ranking Ghana in Tier-1, a role model country for cybersecurity development globally. He has conducted cybersecurity related consulting and assignments for international and local organisations including the UNODC, UNCTAD, the EU, Commonwealth Cybercrime Initiative (CCI) of the Commonwealth Secretariat, Global Commission on Internet Governance (GCIG)/Royal Institute of International Affairs (Chatham House) and the Inter-Governmental Action Group against Money Laundering in West Africa (GIABA).He has received numerous local and international recognitions and awards for his contribution to cybersecurity development with the latest being the Trailblazer Award from ISACA - Accra Chapter, for his pioneering role in national and continental cybersecurity leadership and development as well as the Cybersecurity Excellence and Partnership Award from SMART Africa and the Kingdom of Morocco in recognition of his exceptional leadership and significant contributions to the African cybersecurity development.Dr. Antwi-Boasiako recently published a book, The 10 Commandments for Sustainable National Cybersecurity Development – Africa in Context: Practical Lessons and Good Practices. The book – currently available in English and French, highlights the practical imperatives that nations – which are currently building their cybersecurity systems, must implement to develop a sustainable cybersecurity ecosystem, drawing experiences from the African continent and global best practices. Dr Antwi-Boasiako also has publications covering information technology, cybersecurity, cybercrimes, data protection and digital forensics.Dr. Antwi-Boasiako is also the founder of the Education for Development (E4D) Foundation, a not-for-profit organisation established to support the education of the underprivileged in Ghana.
Stephen Cudjoe-Seshie is a versatile Technology Manager with nearly two decades of experience in ICT infrastructure strategy, planning, design, deployment, and operations. He currently works as the Ag. Deputy Director-General, Cyber Security Authority (CSA), and is responsible for the Authority’s technical operations encompassing the national CERT operations, critical information infrastructure protection, cybersecurity technology standards development, law enforcement liaison activities, and IT services.Prior to this, he was the Head, National Computer Emergency Response Team (CERT-GH) at the CSA, where he managed operations of the 24/7 cybersecurity incident/cybercrime reporting Points of Contact (PoC), coordinated cybersecurity incident response in collaboration with relevant stakeholders and operated cyber threat intelligence function to detect potential, imminent, or actual threats, vulnerabilities, or incidents affecting Ghana’s cyber ecosystem and provided oversight for the establishment and operations of sectoral Computer Emergency Response Teams.He was also the Head, Data Network, AirtelTigo, where he led capacity planning, dimensioning & optimisation, network design, and solution engineering while ensuring a resilient data network within a managed service structure. He also drove release management and evolution of mobile packet core network and overall IP network infrastructure in line with business strategy, CAPEX, and OPEX targets. He worked at Vodafone, Ghana for 14 years, rising to the position of Manager, Transmission & Transport where he managed the planning, design, dimensioning, and deployment of national and international network transport as well as overlay IP infrastructure to drive business objectives in line with strategy, CAPEX, and OPEX targets.Mr. Cudjoe-Seshie holds an MBA in Engineering Management from Coventry University, UK and a Bachelor of Engineering (Hons.) in Electronics Engineering from the Multimedia University, Malaysia.He holds several professional certifications such as the Certified Information Systems Security Professional (CISSP), Associate Certified CISO (EC-Council), CompTIA Security+, Enterprise Architecture: The Open Group Architecture Foundation (TOGAF) 9 Certified Architect, Project Management Professional (PMP) and has been Accredited Cybersecurity Professional (Tier 1) in Governance Risk and Compliance (GRC), Managed Security Services (MCS) and Training by the Cyber Security Authority of Ghana.He has a publication titled “Cloud Computing: The Emergence of Application Service Providers (ASPs) in Developing Economies” in the International Journal of Emerging Technology and Advanced Engineering. He is also a co-founder and current President of the Ghana Chapter of the International Information Systems Security Certification Consortium (ISC2) and previously served as a Board Member of the Ghana Internet Service Providers Association (2020-2022).
This presentation will discuss considerations for developing a Sectoral CERT ecosystem as part of the wider national cybersecurity strategy and highlight some key learnings from Ghana's approach.
- FRTLP:CLEAR
Distribution Builders Meet VEX (Virtual)
Marta Rybczynska (Ygreky, FR) (FR)
The Yocto Project allows embedded vendors to build their custom Linux (and not only) distributions from scratch, so from the source code. This talk explains the challenges we faced when adding support for multiple vulnerability databases and trying to express our "VEX-like" data as VEX.
Marta Rybczynska has a network security background and 20 years of experience in Open Source. She has been working with embedded operating systems like Linux and various real-time ones, system libraries, and frameworks up to user interfaces. In the recent years she has worked in Open Source security, setting up best practices and processes. She is currently helping Eclipse Foundation as a Technical Program Manager for the Security Team, where she is managing the vulnerability reporting process.
- USTLP:CLEAR
Don’t Forget the Little Guy: Vulnerability Management in Operational Technology
Alex Assante (Network and Security Technologies, US), Kylie McClanahan (Bastazo, US)
What comes after coordinated vulnerability disclosure (CVD)? When the issue is confirmed and the advisory is published, what comes next?
Vulnerability management is a mature and robust—if imperfect—process in information technology (IT). The same process, though, poses unique challenges for engineers, technicians, and security teams in operational technology (OT) environments. The difficulties faced in the OT space may not be widely known or understood by vulnerability researchers and IT security professionals. Understanding these differences is key to securing operational environments, which, along with being ever more connected, are also increasingly interdependent with IT systems.
Kylie and Alex will present a view of vulnerability management in OT environments, examining this process in practice at electric utilities. Their presentation will include current approaches, the regulatory requirements specific to the space, data needs, and the unique challenges posed by OT environments."
Alex Assante, Security Consultant at Network + Security Technologies Inc. (NST), is an innovative lead in cybersecurity and critical infrastructure protection with a focus on the development and maintenance of cyber and information security programs. In his current role, Alex supports analysis of technical vulnerabilities in IT and OT environments, reviews and documents cyber security processes, and prepares entities for audits by collecting and validating the quality of evidence artifacts. He is also experienced in the creation of cross-standard mapping tools and integrating corresponding controls from various security frameworks. He grew up in and around the cybersecurity and Industrial Control Systems (ICS) space which ignited his passion for national and critical infrastructure protection and led him to where he is today. Alex is a graduate of Westminster college with a degree in computer science. He holds GIAC Critical Infrastructure Protection (GCIP) and the GIAC Response and Industrial Defense (GRID) certifications.
Kylie McClanahan, Chief Technology Officer (CTO) at Bastazo, is a forward-thinking leader with expertise in cybersecurity and critical infrastructure. With nearly a decade of experience in the electric utility sector and as a PhD candidate in Computer Science (expected May 2025), Kylie plays a pivotal role in advancing cybersecurity solutions for operational technology. At Bastazo, she focuses on leading the technology teams to develop Bastazo’s platform to address vulnerabilities, ensuring the resilience and safety of critical infrastructure. Kylie is passionate about protecting vital systems, advocating for practical solutions, and bridging the gap between research and real-world application. Kylie also holds a GCIP certification from GIAC, the only certification available for the NERC CIP standards.
- LT LVTLP:CLEAR
Engaging with the Media to Foster Cybersecurity Resilience
Zivile Necejauskaite
Madara KrutovaZivile Necejauskaite (NRD Cyber Security, LT), Madara Krutova (Latvia's CERT.LV, part of the National Cybersecurity Centre, LV)
Zivile Necejauskaite is the Director of Marketing and Communication at NRD Cyber Security, a Lithuanian cybersecurity technology consulting and incident response company. With over 15 years of experience as a communication specialist, she has focused the past 7 years on the cybersecurity sector, specialising in impact, change, and crisis communications. In her role, Zivile actively engages with media professionals to enhance public understanding of cybersecurity issues. She has moderated and hosted cybersecurity panels and events both in Lithuania and internationally, including co-hosting the Cyber Defence East Africa conference. Through her efforts, Zivile contributes to strengthening cybersecurity resilience by fostering informed public discourse and promoting best practices in the digital landscape.
Madara Krutova is the Senior Communications Specialist at CERT.LV, Latvia’s national Cyber Incident Response Institution. With over six years of experience at CERT.LV, she plays a key role in public-facing cybersecurity communication.She has helped develop and launch several national awareness campaigns and is part of the core team behind CyberChess, the Baltics' leading cybersecurity conference.Madara supports CERT.LV experts in preparing for media appearances and handles both local and international media inquiries. She also creates clear, accessible content on topics like phishing, romance scams, email security, and shares timely alerts on social media about current fraud schemes and vulnerabilities.Through her work, she helps make cybersecurity more understandable and accessible to the public, strengthening digital resilience across Latvia.
Engaging with the media is an essential yet underutilised strategy for fostering cybersecurity resilience. This presentation explores approaches from Latvia and Lithuania, showcasing how different entities can collaborate with media to enhance public understanding of cybersecurity. Latvia's CERT.LV, part of the National Cybersecurity Centre, prioritises providing accurate, evidence-based information to media outlets, addressing the public's reliance on news portals for cybersecurity knowledge. In contrast, Lithuania, lacking a centralised cybersecurity awareness body, provides opportunities for other cybersecurity ecosystem members like NRD Cyber Security to foster media engagement initiatives. The company emphasises educating journalists through collaborative press releases and informal events to counter misconceptions and promote constructive narratives on cybersecurity. By sharing experiences and insights, this session highlights effective tactics to cultivate productive relationships with media professionals. These efforts aim to shift media focus from sensationalised reporting to fostering informed discussions, ultimately empowering the public to adopt cyber-resilient practices.
- JP USTLP:CLEAR
Establishing a Global Community of Practice on Coordinated Vulnerability Disclosure (CVD)
Tomo Ito
Justin MurphyTomo Ito (JPCERT Coordination Center, JP), Justin Murphy (DHS/CISA, US)
Working on CVD at JPCERT/CC for 9 years, Tomo currently leads the Global CVD project of the organization, which aims to contribute to the global CVD ecosystem stability through collaborations with the stakeholders from different parts of the world.
Justin Murphy is a Vulnerability Analyst with the Cybersecurity and Infrastructure Security Agency (CISA). He helps to coordinate the remediation, mitigation, and public disclosure of newly identified cybersecurity vulnerabilities in products and services with affected vendor(s), ranging from industrial control systems (ICS), operational technology (OT), medical devices, and traditional information technology (IT) vulnerabilities. Justin is involved with many other vulnerability management related efforts, including CISA's Software Bill of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) work, and he serves as a co-chair for the OASIS Common Security Advisory Framework (CSAF) and OpenEoX Technical Committees. Justin is also the co-founder of the Global Community of Practice on Coordinated Vulnerability Disclosure (Global CVD-COP). Justin is a former high school mathematics teacher turned cybersecurity professional and has a M.Sc. in Computer Science from Tennessee Technological University, and a B.Sc. degree in Statistics from the University of Tennessee (Knoxville).
As global cyber threats become increasingly sophisticated and widespread, Coordinated Vulnerability Disclosure (CVD) serves as an essential, structured approach for timely and effective communication of vulnerability information among the affected stakeholders. The recently established Global Community of Practice on CVD (CVD-COP) is an important initiative aimed at encouraging collaboration among governmental entities and national CERTs in their roles as third-party CVD coordinators. This presentation will explore the motivations behind the CVD-COP's formation, emphasizing the critical need for CVD as a good global practice and an essential risk reduction activity.We will outline the community's key activities, including developing best practices and training materials, facilitating knowledge and experience sharing, and promoting international cooperation among stakeholders. These efforts aim to establish harmonization and enhance the effectiveness of CVD across the globe.The presentation will also review the challenges faced by the CVD-COP, such as varying levels of understanding among participants and the complexities of different governance criteria. Addressing these issues is crucial for achieving the community's objectives and realizing the benefits of harmonization for CVD practices globally. The presentation will facilitate an interactive discussion, inviting audience input on how the community can optimize its support for the vulnerability management ecosystem. By inviting participants to share their insights and experiences, we hope to identify strategies that can strengthen the CVD-COP's effectiveness and foster a collaboration among global stakeholders, including security researchers, vendors, and downstream users, ultimately promoting a more secure vulnerability management ecosystem.
- ILTLP:CLEAR
Evading in Plain Sight: How Adversaries Beat User-Mode Protection Engines
Omri MisgavOmri Misgav (Independent, IL)
Omri is an independent security researcher with over a decade of experience in the field. Previously, he headed a security research group in Fortinet's FortiGuard Labs, focused on OS internals, malware and vulnerabilities. Omri joined Fortinet following enSilo's acquisition, where he was the security research team leader and spearheaded the development of new offensive and defensive techniques. Before that, He led the R&D of unique network and endpoint security products for large-scale enterprise environments and was part of an incident response team, conducting investigations and hunting for nation-state threat actors. Omri is a past speaker in various conferences such as DEF CON, AVAR, BSideLV, BSidesTLV and others.
Following the largest global IT outage in history on last July, which disrupted numerous services and industries, many took to the public stage to advocate against allowing endpoint security vendors to design and deploy agents that are kernel-based, even prompting regulators to weigh in.User mode-based engines are already integral piece of many endpoint-oriented security solutions from different malware analysis tools to various commercial products like AVs, EDRs, sandboxes and more. This kicked off research to map the entire threat landscape to assess the impact of the proposed design shift. Analyzing and reverse-engineering over 40 different malware families and open-source projects yielded an in-depth understanding and insights into attackers' tradecraft.This talk will explore all the unique tactics and techniques which malware authors and red teamers have developed to beat user mode-based protection engines, showcasing their very fundamental design flaw: the reliance on the same execution environment that is intended to be protected. The talk will also highlight drawbacks of the various methods and provide a detection scheme focusing on runtime and forensics indicators to give a leg up to CISRTs, malware researchers and detection engineers facing this issue.
- USTLP:CLEAR
Exploited CVEs of 2024: Lessons for Vendors and Defenders
Patrick GarrityPatrick Garrity (VulnCheck, US)
In 2024, over 750 CVEs were confirmed as exploited in the wild for the first time. This talk will focus on the trends and patterns observed in these known exploited vulnerabilities, offering comprehensive analysis to empower both vendors and defenders.
Key Takeaways: Insights into 2024 exploited CVE trends and patterns. A look at how known exploitation maps to common vulnerability metadata. A deep dive into examples of last year’s exploited vulnerabilities and how to identify risks before exploitation occurs. Recommendations on how vendors and defenders can get early indicators that a threat actor might exploit a vulnerability.
Patrick Garrity is a security researcher at VulnCheck where he focuses on vulnerabilities, vulnerability exploitation and threat actors. Patrick has spent the last decade helping building Cybersecurity companies including Duo Security, Censys, Blumira, Nucleus Security and VulnCheck.
- GHTLP:CLEAR
FIRST CORE Session | Enhancing Trust within Africa CSIRT Communities Using the “Carrot and Stick” Principle
Eric AkumiahEric Akumiah (FIRST, GH)
Eric Akumiah is an Africa Regional Liaison for the Forum of Incident Responds and Security Teams (FIRST) based in Accra. With extensive experience in cybersecurity policy, strategy, and implementation, Eric has played a pivotal role in shaping Ghana’s cybersecurity landscape. Prior to his current role, Eric served as the Cybersecurity Lead at the Ministry of Communications, Ghana (2012–2016), where he was instrumental in establishing the foundational elements of Ghana’s cybersecurity architecture. He led a team of local technical experts to develop Ghana’s first Cybersecurity Policy and Strategy, whichwas approved by Ghana’s Cabinet in November 2016. He was the technical Point of Contact for the establishement of the Ghana national CSIRT by the ITU/IMPACT team after which he manage the team for three years.
Eric Akumiah is an Africa Regional Liaison for the Forum of Incident Responds and Security Teams (FIRST) based in Accra. With extensive experience in cybersecurity policy, strategy, and implementation, Eric has played a pivotal role in shaping Ghana’s cybersecurity landscape. Prior to his current role, Eric served as the Cybersecurity Lead at the Ministry of Communications, Ghana (2012–2016), where he was instrumental in establishing the foundational elements of Ghana’s cybersecurity architecture. He led a team of local technical experts to develop Ghana’s first Cybersecurity Policy and Strategy, whichwas approved by Ghana’s Cabinet in November 2016. He was the technical Point of Contact for the establishement of the Ghana national CSIRT by the ITU/IMPACT team after which he manage the team for three years. Currently, Eric works for the FCDO-funded Africa Regional Liaison Initiative as an advisor and trainer for national CSIRTs across the Africa region.
- NZTLP:CLEAR
FIRST CORE Session | Getting People to Listen to Your Alerts
Hadyn GreenHadyn Green (FIRST, NZ)
Hadyn Green is a Principal Communications Advisor for FIRST. A former journalist and communications expert from CERT NZ and NCSC NZ, he is using the knowledge gained from his prior work to shape how best to communicate with local populations about global cybersecurity issues.
An overview of the work being done in cybersecurity communications to create alerts and advisories that will be read and actioned by those who receive them. This covers work done as part of the FIRST A4 project, the international version of the Framework for Communications in a Cybersecurity Incident handbook and also Hadyn's goals for the Communications SIG.
- US CATLP:CLEAR
FIRST CORE Workshop | Cyber Crisis Unplugged: Mastering Tabletop Exercises
John Hollenberger
Douglas SantosJohn Hollenberger (Fortinet, US), Douglas Santos (Fortinet, CA)
John Hollenberger is a cybersecurity consultant with seventeen years of experience in web- and host-based vulnerability assessments, incident response, digital forensics collection, PCI compliance, and Data Loss Prevention with a primary focus on proactive incident response consulting services. John is also the co-author of Cybersecurity Tabletop Exercises: From Planning to Execution.
In his current position, John is a Lead Consultant of Proactive Services, conducting training exercises in Incident Response fundamentals, developing and facilitating tabletop exercises, and reviewing and creating Cybersecurity Incident Response Plans for large corporations, small businesses, and non-profit organizations. John currently holds the following degrees and certifications: BA, CISSP, CISA, CISM, CRISC, GCIH, GWAPT, and Security+.
Douglas Santos is the Director of Advanced Threat Intelligence at Fortinet, bringing over two decades of experience in the cybersecurity field. He combines deep technical expertise with strong communication and interpersonal skills, allowing him to thrive in both technical and business-oriented environments. Doug has a keen understanding of the evolving cyber threat landscape and excels at translating complex security challenges, vulnerabilities, and countermeasures into clear, actionable insights for audiences at all levels. Currently, Doug leads a team of researchers and engineers focused on advancing the state of the art in cyber threat intelligence. Their mission is to proactively identify emerging attack vectors and develop intelligence-driven defenses. As part of this effort, Doug is spearheading Fortinet’s collaboration with MITRE CTID and contributing to projects that enhance threat intelligence standards, tools, and response strategies. These advancements are being integrated across Fortinet’s ecosystem to strengthen global cybersecurity posture. With a proven track record of innovation, leadership, and effective communication, Doug continues to be a driving force in shaping the future of cybersecurity.
Fortinet, is a FIRST Founding CORE Supporter, we are excited to offer this special workshop from the Fortinet team with the #FIRSTCON25 CORE conference track.
Workshop Title: Cyber Crisis Unplugged: Mastering Tabletop Exercises
Workshop Abstract:
In today’s rapidly evolving cyber threat landscape, preparation is key to effective incident response. This workshop is designed to demystify cybersecurity tabletop exercises and empower organizations to respond confidently when cyber incidents strike.
This session will explore the core purpose of tabletop exercises, breaking down what they are, why they matter, and how they can be used to strengthen organizational resilience. Participants will learn how to design, plan, and execute effective exercises tailored to their specific environment. The workshop will culminate in a simulation exercise giving attendees the opportunity to apply their knowledge in a collaborative, low-risk environment.
Whether you're new to tabletop exercises or looking to enhance your existing program, this workshop will provide practical tools, strategies, and insights to help you take your cyber preparedness to the next level.
Workshop instructions: Bring a device with internet access.
- USTLP:CLEAR
Fortifying AI: Hands-On Training in Adversarial Attacks and Defense of AI Systems (Full Day)
John Lopes (TikTok USDS, AU), Vishal Thakur (Atlassian, US) (US)
As AI becomes integral to critical systems, its vulnerabilities to adversarial attacks and data-related weaknesses pose serious risks. This interactive, one-day training is designed for researchers, and security professionals to understand and mitigate these challenges and get ready for the future of AI Security. Participants will gain a comprehensive foundation in AI security, exploring adversarial attack techniques, defense mechanisms, and best practices for building robust datasets.
The training combines engaging lectures, live demonstrations, and four hands-on labs focused on real-world adversarial attack scenarios, including CIFAR-10, IMDB, Fashion-MNIST, and SVHN datasets. Participants will learn to craft adversarial examples, test model vulnerabilities, and implement practical defenses like adversarial training, input transformations, and feature squeezing. All code required for the labs will be provided during the sessions, and attendees will receive pre-configured Google Colab notebooks after the training to continue their learning independently.
A group exercise will simulate securing a facial recognition system, challenging attendees to collaboratively identify threats and apply defenses in a realistic context. By the end of the session, participants will leave with actionable skills, ready-to-use tools, and strategies to enhance the security and resilience of their AI models. This training is ideal for professionals looking to stay ahead in the rapidly evolving field of AI security and robustness.
Learning OutcomesBy the end of the training, participants will:
- Understand key concepts like adversarial attacks, perturbations, and dataset vulnerabilities.
- Learn practical methods for generating adversarial examples using real-world datasets.
- Gain knowledge of defense mechanisms, including adversarial training, feature squeezing, and input preprocessing.
- Apply their knowledge in a collaborative group exercise to secure an AI system in a simulated scenario.
- Leave with actionable skills and pre-configured tools to continue learning and apply defenses in their own projects.
Prior to attending the training, please read the pre-training document linked below.
Vishal Thakur is a seasoned expert in the information security industry, with extensive experience in hands-on technical roles specializing in Incident Response, Emerging Threats, Malware Analysis, and Research. Over the years, Vishal has developed a strong reputation for his deep technical expertise and ability to address complex security challenges. He has shared his research and insights at prominent international conferences, including BlackHat, DEFCON, FIRST, and the SANS DFIR Summit, where his sessions have been highly regarded for their depth and practical relevance. Additionally, Vishal has delivered training and workshops at BlackHat and the FIRST Conference, equipping participants with cutting-edge skills and techniques. Currently, Vishal leads the APAC regional Incident Response function at Atlassian, where he oversees advanced security incident response.
John Lopes is a passionate information security professional with specialist knowledge in digital forensics and incident response (DFIR), cyber threat intelligence and offensive security practices. He has over 20 years industry experience with a proven ability to help organisations defend and protect against cyber threats. John is a member of Institute of Electronic and Electrical Engineers (IEEE), International Information System Security Certification Consortium Inc. (ISC2) and a member of the Information Systems Audit and Control Association (ISACA). He also provides pro-bono information security consulting for one of Australia's largest not-for-profit organisations. John Lopes is currently Director of DFIR at Ankura Consulting. Before joining Ankura, John was a part of the Global Incident Response Team at Salesforce, Cyber Security Manager at Insurance Australia Group, Macquarie Bank and BAE Systems Australia.
Training @ FIRSTCON25
Copenhagen, DK
June 22, 2025 08:30-10:00, June 22, 2025 10:15-12:30, June 22, 2025 13:30-15:30, June 22, 2025 15:45-17:30
- USTLP:CLEAR
From Idea to Open-Source: Building CNA-GURU, a Generative AI Assistant for Security Advisories
Ryan NoletteRyan Nolette (AWS, US)
This presentation will share the story of how an idea born at the VulnCon 2024 conference grew into CNA-GURU, an open-source generative AI assistant to help security professionals manage the complexities of working with security advisories. The speaker will discuss the motivation behind creating the tool, the challenges faced by security teams in keeping up with the volume and complexity of vulnerability reports, and the iterative process of developing CNA-GURU through collaboration with industry peers. The presentation will provide a detailed overview of the tool's features, its evolution from a proof-of-concept to a robust solution, and the techniques and technologies used to build it, including the leveraging of AWS Bedrock. The audience will gain insights into the benefits of using generative AI to streamline security advisory tasks and the potential for such tools to improve the efficiency and consistency of vulnerability management.
Ryan is AWS's Senior Security Engineer for the Outreach Team and CoAuthor of AWS Detective. He has previously held a variety of roles including threat research, incident response consulting, and every level of security operations. With almost 2 decades in the infosec field, Ryan has been on the development and operations side of companies such as Postman, Sqrrl, Carbon Black, Crossbeam Systems, SecureWorks and Fidelity Investments. Ryan has been an active speaker and writer on threat hunting and endpoint security.
- AR ESTLP:CLEAR
From TTPs to Deception: Crafting Strategies
Diego Staino
Federico PachecoDiego Staino (BASE4 Security, AR), Federico Pacheco (BASE4 Security, ES)
Cybersecurity professional with 14+ years of experience as Security and IT consultant. Certified Incident Handler (ECIH) with a degree in Information Security and Communications. Currently works as R&D+i Manager at BASE4 Security, where he leads the company's research and development initiatives. Full Profile: https://www.linkedin.com/in/diegostaino/
Cybersecurity professional with a background in electronic engineering and several industry-recognized certifications. 20+ years of teaching experience at the most prestigious universities in Argentina. 4 published books and +15 peer-reviewed research papers. Has worked in the public and private sectors, including regional roles in global companies. Currently works as Cybersecurity Services Director at BASE4 Security. Full Profile: https://www.linkedin.com/in/federicopacheco/
Defining deception strategies in production environments is a challenge that requires a strategic approach. This session introduces a practical methodology for translating Tactics, Techniques, and Procedures (TTPs) into concrete deception activities applicable to real-world scenarios. We will explore a four-phase process: behavior extraction, criteria selection, mapping TTPs to deception activities, and storytelling design. Attendees will leave with an approach for analyzing cyber threats, identifying adversary behaviors, selecting appropriate deception criteria, and designing narratives to enhance their deception strategies. By the end of the session, participants will be equipped with a guide to begin developing an effective cyber deception plan.
- NOTLP:CLEAR
From Your Gut to a Gold Standard: Introducing the Admiralty System in CTI
Freddy MurstadFreddy Murstad (Nordic Financial CERT, NO)
This interactive presentation introduces the Admiralty System, a framework for evaluating the reliability of information, originally used for intelligence and now adapted for modern Cyber Threat Intelligence. It explores the system's two core concepts: Source Reliability and Information Credibility, enabling participants to critically assess and rate sources and information using practical CTI examples.
Freddy Murstad is the senior advisor for cyber threat intelligence (CTI) at Nordic Finance CERT (NFCERT) and has a specific focus on strategic reporting, as well as training in structured analysis techniques (SAT) and intelligence for CTI professionals in the financial sector. Murstad is educated in intelligence from King's College London with a focus on cyber security and a master's degree in counter-terrorism from the University of St Andrews, focusing on critical infrastructure. In May 2023, Murstad started his PhD education at the Norwegian University of Science and Technology (NTNU) and will research how to implement intelligence methodology into CTI programs and how AI might change how we do intelligence analysis, and thus, how this may change how we use intelligence in CTI.
- IT USTLP:CLEAR
How Do We Leverage CVE Root Cause Mapping and CWE Data to Prevent New Vulnerabilities?
Alexander Bushkin (Red Hat, IT), Jeremy West (Red Hat Inc, US)
How do we better leverage CVE root cause mapping along with CWE data in order to prevent new vulnerabilities from occurring? Spending development time to fix the continued growth of CVEs is not scalable.
Alexander Bushkin: I became enamored by Open Source early in my career; mostly as a business owner and ambassador for other businesses. I joined Red Hat in 2005 and have enjoyed my time helping to expand our customer service, engineering and security efforts. I participate in various industry working groups focused on improving the generation and use of better security data.
- CH
In-Depth Study of Linux Rootkits: Evolution, Detection, and Defense
Stephan Berger (InfoGuard AG, CH)
This talk, "In-Depth Study of Linux Rootkits," will provide a comprehensive examination of the evolution of Linux rootkits, from their inception to the sophisticated variants seen today.
Participants will gain insights into advanced rootkit techniques, effective detection strategies, and the future landscape for defenders. By exploring the historical context, current methodologies, and emerging threats, attendees will have the knowledge and tools necessary to safeguard Linux systems against rootkit attacks.
Beginning with an introduction to the fundamental capabilities of Linux rootkits, this talk traces the history of these malicious tools from their origins to their increasingly sophisticated techniques. It categorizes rootkits into kernel-level, user-mode, and hybrid types, explaining their respective methods for hooking kernel functions, intercepting user-space processes, and combining techniques from both realms. The discussion includes an analysis of rootkit persistence mechanisms and stealth techniques, which allow them to remain undetected.
Next, we shift to detection strategies, starting with signature-based detection, which involves identifying known rootkits through specific patterns but also addresses the limitations of this approach. It explores behavioral analysis by monitoring system anomalies and presents case studies demonstrating the effectiveness of this method. The importance of integrity checking is highlighted, emphasizing the challenges in maintaining accurate baselines for system files and binaries.
Furthermore, this talk reviews advanced detection tools and frameworks, providing an overview of popular rootkit detection tools and practical demonstrations of their use. This comprehensive analysis underscores the ongoing battle between rootkit developers and cybersecurity professionals, emphasizing the need for continuous advancements in detection and mitigation techniques.
Stephan Berger has over a decade of experience in cybersecurity. Currently working with the Swiss-based company InfoGuard, Stephan investigates breaches and hacked networks as Head of Investigation of the Incident Response team. An avid Twitter user under the handle @malmoeb, he actively shares insights on cybersecurity trends and developments. Stephan also authors the blog DFIR.ch, where he provides in-depth analysis and commentary on digital forensics and incident response. Stephan has spoken at numerous conferences, sharing his expertise with audiences worldwide.
- NOTLP:CLEAR
Incident Preparedness Takeaways from 5000 Exercise Participants
Erlend Andreas GjæreErlend Andreas Gjære (Secure Practice, NO)
Erlend Andreas Gjære has studied security and people for 15 years, including six years as a research scientist, with a focus on training, awareness and culture, behavior and incident response. In 2017, he became a tech-founder at Secure Practice, to help people with digital security at scale. He has delivered more than one hundred preparedness exercises across Norway and Denmark, through a tour concept of free events to increase cyber preparedness among thousands of small and medium enterprises, with support from the European Cybersecurity Competence Centre (ECCC), and winning the European Digital Skills Award 2024 for this effort.
Preparedness exercises allow people to engage first-hand with a cyber incident scenario, seeing how they respond to various situations and dilemmas. They help us learn how to better respond to a crisis, but will often highlight risks and vulnerabilities which are possible to immediately convert to preventive mitigations. When multiple companies exercise together, participants can also learn from each other, and even make new security friends.This talk summarizes what we've learned through national cyber exercise tours in Norway and Denmark, where 5000 people who are responsible for IT, security and preparedness from 3500 companies have participated since last year. We will describe key findings from discussions and input across a wide range of sectors, roles and locations participating. You will also learn useful tips and tricks for facilitating your own exercises, to create awareness and good learning moments for all of your colleagues -- whether they are part of an incident response team or not.
- LTTLP:CLEAR
Incident Response: How to Get Others in the Organisation to Care?
Živilė NečejauskaitėŽivilė Nečejauskaitė (NRD Cyber Security, LT)
The presentation will focus on engagement with other stakeholders within the organisation. Effective means of communicating and building relationships with specific stakeholders within an organisation can significantly improve response times and mobilisation in the event of a significant cyber incident and prevent the situation from escalating.
During the presentation we will look at how to map the stakeholders within an organisation, how to group them and how to determine the level of engagement with each group. We will also explore the precise communication examples - potential messages to each stakeholder group to create greater engagement and relevance.
Živilė Nečejauskaitė is a communications professional, specializing in change and impact communication. She is a co-trainer of the ITU Academy course on Cyber Crisis Management. Živilė has co-organized and co-hosted several cybersecurity capacity building conferences in East Africa Region, called "Cyber Defense East Africa", one of which has focused on national cyber crisis management. She holds a Master's degree in Communication for Development from Malma University in Sweden. Živilė has worked in the public and private sectors in Lithuania and abroad, and has focused on cybersecurity capacity building for the past 7 years. Currently, she dedicates her time to building frameworks for communication during a cyber incident.
- NL
Incident Response in Kubernetes Environment
Mahdi Alizadeh (Databricks, NL)
Kubernetes has become a critical component of modern production environments, valued for its scalability, flexibility, and ability to streamline container orchestration. However, its complexity and dynamic nature present unique challenges for security incident response. A compromised Kubernetes environment can provide attackers with substantial computational resources and access, enabling activities such as data exfiltration, intellectual property theft, or cryptocurrency mining.
Incident response in Kubernetes requires specialized knowledge, as traditional security practices often fall short in addressing the nuances of containerized systems. For example, the ephemeral nature of containers, combined with limited logging and monitoring practices and insufficient support from detection tools, makes it challenging to detect, contain and respond to incidents effectively. Many security teams are unfamiliar with Kubernetes-specific attack vectors and lack the expertise needed to respond to breaches in such environments.
This presentation will first provide examples of Kubernetes attack chains and highlight techniques—such as privilege escalation through "bad pods"—that are specific to this environment. It will then review critical logs that should be collected and explain how disk and memory forensics can aid in incident response. It will also discuss the challenges that a team might face during the analysis.
Mahdi Alizadeh has 13 years of experience in computer security, spanning both academia and industry. He earned his Ph.D. in computer security from Eindhoven University of Technology. Throughout his career, he has worked in various security operations teams, serving as a security analyst, detection engineer, and security manager.
- CATLP:CLEAR
Inside the Information Stealer Ecosystem: From Compromise to Countermeasure
Olivier BilodeauOlivier Bilodeau (Flare, CA)
Olivier Bilodeau, a principal researcher at Flare, brings 12+ years of cutting-edge infosec expertise in honeypot operations, binary reverse-engineering, and RDP interception. Passionate communicator, Olivier spoke at conferences like BlackHat, DEFCON, SecTor, Derbycon, and more. Invested in his community, he co-organizes MontrèHack, is NorthSec's President, and runs its Hacker Jeopardy.
Modern information stealers have evolved far beyond simple credential harvesters into sophisticated tools that capture complete digital fingerprints of their victims. This technical deep-dive unveils groundbreaking research into stealer architecture, attack chains, and defensive countermeasures. Through analysis of real-world compromise scenarios, including desktop screenshots captured at infection moments, we reveal how threat actors leverage compromised ad networks and trojanized software for mass deployment. The presentation examines the Operation Magnus takedown, a collaborative effort with ESET and law enforcement, demonstrating the complex infrastructure behind professional criminal enterprises.Building on hands-on experience with stealer log analysis, we detail how modern threats bypass multi-factor authentication, compromise password managers, and extract cryptocurrency wallets. We examine Chrome's application-bound encryption and why, although already circumvented, it creates new detection opportunities. The session concludes with practical defensive strategies and the release of two community resources: a PowerShell framework for automated credential testing against Entra ID and a curated dataset of stealer logs for security research.This presentation equips security practitioners with concrete insights and tools to defend against one of today's most consequential yet underexamined threats.
- USTLP:CLEAR
Investigating Triad Nexus and Pivoting from a Pig Butchering Investment Scam Website into an Entire Malicious Network
Zach EdwardsZach Edwards (Silent Push, US)
This presentation will walkthrough how Silent Push analysts traced pig butchering scams to FUNNULL CDN-hosted money laundering networks, retail phishing campaigns targeting luxury brands, and more. Technical analysis of each step will be provided and explained in-depth as we cover the threat we have dubbed: “Triad Nexus."
Zach Edwards is a Senior Threat Researcher at SilentPush, joining the team in 2024, with a focus on understanding and tracking how APT groups are evolving. His expertise includes a deep knowledge of global data supply chains and advertising systems.
Zach is passionate about Data Privacy, is active in numerous communities, and has been involved in high-profile GDPR complaints, including cases against online dating apps and Google auction systems. Zach has presented at high profile events, including a 2023 Blackhat USA session titled, “Kids in the Ad Fraud Crosshair: Why International Threat Actors are Targeting Children to Steal Money from Banks and Major Corporations.” In 2024, Zach has presented at PIVOTcon, Virus Bulletin, and MWISE on various cyber threats."
- USTLP:CLEAR
KPIs for CSIRTs
Logan WilkinsLogan Wilkins (Cisco, US)
In the rapidly evolving landscape of cybersecurity, organizations increasingly rely on effective Cybersecurity Incident Response Teams (CSIRTs) to detect, respond to, and mitigate security incidents. Key Performance Indicators (KPIs) play a crucial role in assessing the efficiency and effectiveness of CSIRT operations. This half-day training class is designed to empower CSIRT professionals with the knowledge and skills to develop, implement, and leverage KPIs for enhanced incident response. The training will cover essential topics, including:
- Understanding CSIRT Objectives: Participants will gain insights into the core objectives of a CSIRT and how KPIs align with these goals. A comprehensive overview will be provided to establish a foundation for KPI development.
- Identification and Selection of Relevant KPIs: Explore a range of KPIs applicable to CSIRTs, considering factors such as incident detection, response times, and containment effectiveness.
- Metrics and Measurement Techniques: Delve into the methodologies for measuring KPIs accurately. Participants will learn how to define and collect relevant metrics.
- Establishing Baselines and Targets: Understand the significance and pitfall of setting baselines and realistic targets for KPIs. Practical examples and case studies will be discussed to illustrate how organizations can benchmark their CSIRT performance.
- Visualization and Reporting: Learn effective ways to present KPI data through visualizations and reports.
Following this training, participants have additional knowledge and tools to help establish a KPI framework tailored to their CSIRT's objectives. This class provides a opportunity for CSIRT professionals to enhance their skills, optimize their operations, and contribute to the overall security posture of their organizations.
Logan Wilkins currently leads a software engineering team in Cisco’s CSIRT, overseeing development programs related to incident detection and response, data management, and security metrics. Within FIRST he is the co-chair of the Metrics SIG and has served as a Candidate Sponsor for multiple groups. In addition to his experience in Cisco’s security organization, Logan has also worked in e-commerce, pharmaceutical drug discovery and was previously a high school teacher, giving countless students their first introduction to Computer Science.
- KRTLP:CLEAR
Lazarus Group Evolved Their Infection Chain with Old and New Malware
Sojun RyuSojun Ryu (Kaspersky, KR)
Sojun Ryu graduated from the 'Next Generation of Top Security Leader Program' (Best of Best, BoB) at the Korea Information Technology Institute (KITRI) in 2013, and holds a Master's degree in information security from Sungkyunkwan University in Korea. Sojun worked at KrCERT/CC for seven years, analyzing malware and responding to incidents, and is one of the authors of "Operation Bookcodes" published by KrCERT/CC in 2020. After moving to S2W, a cybersecurity startup in Korea, he expanded his coverage during his time as a team leader, focusing on not only APT but also on cybercrime. Sojun is now a member of GReAT at Kaspersky and is very focused on APT research.
Over recent years, the Lazarus APT group has distributed their own malware by leveraging fraudulent job opportunities targeting employees in various industries, including defense, aerospace, cryptocurrency, and other global sectors. This attack campaign is called DeathNote campaign and is also referred to as "Operation DreamJob".During our recent investigation, we observed that the Lazarus group had delivered archive files containing malicious files to at least two employees who were engaged with the same organization over the course of one month. The threat actor used a fake job offer sent by an impersonated recruiter.After looking into the attack, we were able to uncover a detailed infection chain, giving us insight into their intentions. Although they used known strategies and malware for initial infiltration, they intentionally introduced new malware to avoid detection by leveraging on the fact that the malware hasn't been used before. They have also stepped up their efforts to actively evade detection by exploiting legitimately compromised websites as C2 servers.
- JPTLP:GREEN
Lessons Learned From Assigning CWE's to Test Items for Security Assessments
Yuichi KikuchiYuichi Kikuchi (Panasonic PSIRT, JP), Takayuki Uchiyama (Panasonic PSIRT, JP)
At the Product Security Center at Panasonic, we have a team dedicated to testing for vulnerabilities in products prior to shipment. The testing activities cover a wide range of products and has been ongoing for around 20 years.
Identifying and understanding vulnerabilities is easier for a security team than for product development teams. To fill this gap, I explored a way to match CWE's with each test item to both enhance the quality of our tests and vulnerability report outputs. In my talk, I will discuss the CWE assignment process I went through for the test items, some internal trends that I identified about our products, and how CWE has been useful when assigning to test items.. Lastly, I will discuss some of the challenges that I encountered during the CWE assignment process and some progress on the review of test items.
Yuichi Kikuchi joined Panasonic in 2019 out of school and joined the vulnerability testing team at the Product Security Center as his first job in the cyber security field.
His daily work involves vulnerability testing various products and devices for Panasonic business units and alongside that work he thinks about better ways to score and classify vulnerabilities.
Takayuki Uchiyama is a member of Panasonic PSIRT and is responsible for product security activities at the business divisions overseas. His main roles include, the handling of vulnerabilities, creating and conducting product security training to product developers and providing assistance to product development teams related to product security as necessary. Aside from his role in Panasonic, Takayuki has been a CVE Board Member since 2016. Prior to joining Panasonic, Takayuki worked at JPCERT/CC, where his main tasks involved the coordination of vulnerability reports with PSIRTs, taking part in various discussions groups related to the identification / analysis / coordination / disclosure of vulnerabilities.
- AUTLP:CLEAR
Let’s Talk About Fitness for Purpose: Comparing and Contrasting the CVE List with OSV.dev
Andrew Pollock (OpenSSF, AU)
Last year the CVE Program turned 25. This year OSV.dev turns 4.
The CVE Program's federated approach enabled scaling of CVE issuance, but failed to implement any meaningful record quality enforcement. This means the data quality problem scales with CNA growth.
This presentation compares the venerable CVE Program's approach with the 4 year old OSV.dev and offers suggestions on how things can be improved.
Andrew Pollock has most recently been a Senior Software Engineer on Google’s Open Source Security Team (GOSST), working on OSV.dev. He is passionate about consistent high quality, machine readable vulnerability metadata for detecting and remediating vulnerabilities in open sourcesoftware. He is based in Brisbane, Australia.
- NL
LLMs are Unreliable for Cyber Threat Intelligence: How LLMs Show Low Performance, Inconsistency and Low Calibration in CTI Tasks
Emanuele MezziEmanuele Mezzi (Vrije Universiteit Amsterdam / Ethikon Institute, NL)
Several recent works have argued that Large Language Models (LLMs) can be used to tame the data deluge in the cybersecurity field, by improving the automation of Cyber Threat Intelligence (CTI) tasks.
We present an evaluation methodology that other than allowing to test LLMs on CTI tasks when using zero-shot learning, few-shot learning and fine-tuning, also allows to quantify their consistency and their confidence level. We run experiments with three state-of-the-art LLMs and a dataset of 350 threat intelligence reports and present new evidence of potential security risks in relying on LLMs for CTI.
We show how LLMs cannot guarantee sufficient performance on real-size reports while also being inconsistent and overconfident. Few-shot learning and fine-tuning only partially improve the results, thus posing doubts about the possibility of using LLMs for CTI scenarios, where labelled datasets are lacking and where precise confidence model estimates are necessary to rely on LLMs predictions.
Emanuele Mezzi is researcher at VU Amsterdam and TNO, where he focuses on the applications of AI to cybersecurity and threat intelligence. Concurrently he is also co-founder and AI Lead Researcher at Ethikon Institute, where he focuses on the development of methodologies to make LLMs explainable and trustworthy. Emanuele holds a BSc in Computer Science from the University of Salerno and an MSc in Data Science from the University of Amsterdam
- RS SETLP:CLEAR
Localization of Transits I Course in the Republic of Serbia
Marko Krstić
Vladimir BoborMarko Krstić (SRB-CERT (RATEL), RS), Vladimir Bobor (SIRT Officer Swedbank CDC, SE)
SRB-CERT has a tradition of organizing cybersecurity related workshops and trainings for different stakeholders in the Republic of Serbia. In order to further educate existing CERTs and to motivate establishment of new ones, National CERT and Cybersecurity Network Foundation with the support of EU project "Cyber Balkans" localized Transits I to Serbian language and incorporate details about legal framework of Serbia. In this talk we will present results of our efforts, as well as approach we took to successfully localize Transits I course.
Marko Krstić completed his bachelor, master, and doctoral studies at the School of Electrical Engineering in Belgrade. He has been working in the field of information technology and security at the Regulatory Authority for Electronic Communications and Postal Services (RATEL) for almost ten years. He is currently serving as the Head of the Cyber Security Division and National CERT Affairs in the RATEL. Marko was part of several projects related to the application of artificial intelligence for children protection on the Internet as well as for digital forensics at the European level.
Vladimir Bobor was born 1971 in Belgrade, Serbia. He has lived in Stockholm, Sweden since 1994. He achieved and B.Sc. in Computer Engineering in 2000 and 2006 his M.Sc. with a specialization in Information and Communication Systems Security from Royal Institute of Technology (KTH) Stockholm. In 2024 he joined Swedbank CDC team as incident handler. He has long experience in Information Security field; Network Security and Computer-Network Forensics. Vladimir was a member of TF-CSIRT Steering Committee from 2014 – 2019; 2020-2023, and is one of initiators of Swedish CERT Forum.
- LUTLP:CLEAR
LUKS Full Disk Encryption Upside-Down
Michael HammMichael Hamm (CIRCL, LU)
A use case where full disk encryption do not do what you expected, and you should be aware of it.
A live demo where I show, what happen with plaintext data, that was stored on the disk before full disk encryption got activated.
Michael Hamm has worked for more than 10 years as Ingénieur-Sécurité in the field of classical Computer and Network Security (Firewall, VPN, AntiVirus) at the research center “CRP Henri Tudor” in Luxembourg. Since 2010, he has been working as an operator and analyst at CIRCL – Computer Incident Response Center Luxembourg where he is working on forensic examinations and incident response.
dfir-kickstart.pdf
MD5: b7a09d5d9dfe2147dcbd9f2183d9fdac
Format: application/pdf
Last Update: January 7th, 2025
Size: 177.47 Kb
Luks.pdf
MD5: 3afa308a3b9a7a3280b3919c3e1d5cff
Format: application/pdf
Last Update: January 7th, 2025
Size: 251.51 Kb
- GB USTLP:CLEAR
Madness of Vulnerability Management in Modern Cloud, Container, How to Win the Battle Practitioners View
Francesco Cipollone
Nate SandersFrancesco Cipollone (Phoenix Security, GB), Nate Sanders (Bazaarvoice, US)
Abstract: Navigating the Challenges of Risk-Based Vulnerability Management in a Cloud-Native World
Since 2015, the advent of containerized environments and modern software development practices has transformed how we build and secure applications. These advancements have redefined the cybersecurity landscape, introducing unprecedented challenges in vulnerability management related to scale, complexity, and data consistency. This panel discussion brings together two leading experts to explore how a risk-based approach can address these challenges, offering actionable insights and methodologies.
Key Topics:
The Inconsistency of Data: Fragmented and siloed security data often hampers efforts to prioritize vulnerabilities effectively. The panel explores strategies to consolidate and normalize data from disparate tools and environments, enabling a unified view that supports informed decision-making.
Vulnerability Management at Scale: Managing vulnerabilities in sprawling, dynamic infrastructures demands innovative approaches. The speakers share insights into automating prioritization and remediation workflows, addressing the unique challenges of containerized and serverless architectures.
Reachability Analysis: Identifying exploitable vulnerabilities through reachability analysis has emerged as a game-changer. The panel discusses how contextualizing vulnerabilities within the software supply chain and runtime environments can help organizations focus their resources on the most critical risks.
Learning Objectives:
Attendees will gain a deeper understanding of:
- How to overcome the barriers posed by inconsistent data in vulnerability management workflows.
- Best practices for managing vulnerabilities across diverse and rapidly scaling environments.
- The value of incorporating reachability analysis into risk-based prioritization to reduce noise and focus on actionable threats.
This panel discussion explores the challenges of risk-based vulnerability management in a cloud-native world, focusing on overcoming data inconsistency, managing vulnerabilities at scale, and leveraging reachability analysis. As organizations navigate complex, dynamic infrastructures, fragmented security data and the sheer volume of vulnerabilities pose significant hurdles. The session highlights strategies for consolidating data, automating prioritization, and contextualizing vulnerabilities within their runtime and supply chain environments. Designed for security leaders, the talk provides practical insights, real-world use cases, and actionable methods to scale and modernize vulnerability management in an interconnected, containerized ecosystem.
Francesco Cipollone is a renowned entrepreneur and CISO, founder of Phoenix Security, an ASPM platform offering actionable, contextual code-to-runtime insights. A multi-award-winning podcast host, author, and global speaker, Francesco is known for his visionary contributions to cybersecurity. He serves on the UK&I Cloud Security Alliance Chapter board and is a faculty member at IANS on application and cloud security. His insights have appeared in Forbes, Helpnet Security, and Hacker Noon, and he has been featured in prominent podcasts like Application Security Weekly and Cloud Security Podcast. Francesco has keynoted at major conferences such as AppSec Cali and Cyber Security & Cloud Expo, and previously led application and cloud security at HSBC and served as Senior Security Consultant at AWS. An avid marathon runner, snowboarder, and whiskey enthusiast, Francesco balances his professional accomplishments with a passion for adventure and fine spirits.
Nate Sanders, also known as mauvehed, has traversed a long and winding career path through hacking, system and network administration, computer security, and leadership. Now leading people across security engineering and security operations, he takes great pride in building teams, developing individuals, and solving business challenges. With expertise spanning vulnerability management, application security, and the ever growing cloud, he combines technical acumen with strong leadership and collaboration skills to drive impactful results. Outside of his professional exploits, Nate is a vocal advocate for mental health, frequently speaking on topics such as ADHD, Autism, CBT/DBT, and EMDR, with a mission to normalize mental health conversations in the workplace and society.
- ROTLP:CLEAR
Managing Vulnerabilities through SSDLC
Luci Stanescu (Canonical, RO)
Canonical has recently implemented a company wide Secure Software Development Lifecycle (SSDLC), that aims to systematically address security concerns, and manage vulnerabilities throughout the companies entire portfolio.
In this talk I will share how these policies allow us to prevent and respond to vulnerabilities, and how this can be achieved with very minimal security team. The lessons learned through this process will be shared, to allow others to better manage their company-wide vulnerability posture, and maximise the results they can achieve.
Luci Stanescu is Security Engineering Manager at Canonical, part of the team responsible for the security maintenance of Ubuntu and the Canonical PSIRT. With almost 20 years of professional experience, he is passionate about making information security matter and an advocate for not treating cybersecurity regulations and standards as a tick-box exercise.
- JPTLP:CLEAR
Maximizing the Potential of AWS-WAF: Fully Automating threat detection with Custom Managed Rules and Proprietary Threat Intelligence
Shota Sugawara
Hirofumi KawauchiShota Sugawara (NTT-ME CORPERATION, JP), Hirofumi Kawauchi (NTT-ME CORPERATION, JP)
Shota Sugawara leads the development and operation of Managed Security Services (MSS) for enterprises and municipalities, focusing on cloud security operations using AWS. His experience includes conducting vulnerability testing and ensuring the security of hundreds of IT systems owned by NTT East, Japan's largest telecom carrier. He is also actively involved in CTF competitions, specializing in Pwnable challenges.
Dr. Hirofumi Kawauchi, SOC Manager at NTT-ME, has over 10 years of experience in cybersecurity. He previously led incident response and vulnerability management at NTT East, Japan's largest telecom carrier. He also worked as a SOC analyst and threat intelligence developer at NTT Security US. Upon returning to Japan, he launched NTT East's Managed Security Service as a tech lead, developing SOC infrastructure. He actively contributes to Japan's telecom industry and cybersecurity education through ICT-ISAC JAPAN, university lectures, and industry events. He has also presented at BSides Las Vegas. He holds CISSP, GCFA, GPEN, and AWS-SAP/SCS certifications. NTT Group Certified Security Principal, PhD in Engineering.
In our SOC, we leverage AWS-WAF to protect numerous client web servers, but we have taken it a step further. By integrating it with our proprietary threat intelligence, we have fully automated the process -- from detecting attacks to investigating and blocking them. In this presentation, we will share how we achieved this through: 1) Setting up custom rules to make AWS-WAF operations more effective and efficient, 2) Implementing an automated detection and blocking system, and 3) Presenting examples of these functions successfully countering actual cyber threats. This presentation will provide practical and actionable insights to enhance your day-to-day security operations.
- DETLP:CLEAR
Modern MISP
Konstantin ZangerleKonstantin Zangerle (KIT-CERT, DE)
Konstantin Zangerle is a member of KIT-CERT since November 2020.He started programming in python when the new thing was called Python 3000.After studying computer science in Karlsruhe, he loves to implement automation at KIT-CERT. In his job, he is fascinated by the fusion of infosec and law.
In 2023 he started to supervise multiple groups of students to implement Modern MISP. Until now, 35 students have been working on the project.
Efficient threat intelligence sharing across organisations is crucial for CSIRTs.Different software solutions are available, with MISP being the most commonly used tool.However, using MISP also comes with some challenges and limitations, e.g. MISP only supports MySQL/MariaDB and the OpenAPI specification is incomplete and in parts incorrect.Therefore, in Oct 2023, KIT-CERT started a reimplementation called Modern MISP that serves as a direct replacement, i.e. an existing database can be used, and the API provides the same endpoints.Modern MISP uses a modern software architecture with well-maintained libraries like FastAPI, Pydantic, SQLAlchemy, Svelte, and Celery.Currently Modern MISP supports CRUD Operations for Events, Attributes, Galaxies, Tags, and Users, and will most likely be production ready in April 2025.As Modern MISP tries to focus on widely used features, not all features of MISP will be implemented in Modern MISP.We provide an overview which features are already implemented in Modern MISP, the ongoing development and the plans for the next winter semester starting in October.
- AUTLP:CLEAR
Navigating the Threat Actor Maze: A Tool for Mapping Names, Families and Insights
Dave MatthewsDave Matthews (Avast (Gen Digital), AU)
After getting his PhD in Mathematics, Dave spent the next 25 years consulting for the Australian Government, primarily working with Defence, Intelligence, and Law Enforcement, before moving to CrowdStrike and Gen Digital (which was formed from the merger of Avira, Avast, and NortonLifelock). He has continually worked in Incident Response and Forensics and has had the privilege of helping people during their worst days at work.
He has experience with all aspects of cybersecurity, ranging from attack and defence to incident response and security capability development. He is particularly passionate about digital forensics and incident response, helping people prevent and recover from attacks and breaking down barriers to sharing information.
Overwhelmed with the myriad of Threat Actor names? Fancy Bear vs Forest Blizzard? Wicked Panda vs BRONZE ATLAS? What about malware families? CageyChameleon vs Cabbage RAT? Qakbot vs Pinkslipbot?In this talk, we release a free tool that enables mapping between different Threat Actor naming conventions and malware families. We demonstrate its use and show how it allows for easy offline search of threat actors and published research. It provides rapid access to Threat Actor and malware family information - undoubtedly helpful for your intelligence analysis, research and operational work.
- JETLP:GREEN
Never mind the Pollocks: Aligning Incident Response with Emergency Response Using JESIP
James McLarenJames McLaren (Jersey Cyber Security Centre, JE)
“We should be learning from the way emergency services operate, not reinventing the wheel”. Staff at JCSC who heard this at TRANSITS 1 last April had an almost immediate chance to do this after being invited to JESIP training. This session explains some of the principles behind JESIP, looks at how we might use it for alignment in our context, and seeks to open up a conversation about how it might go elsewhere.
James McLaren, the Senior Analyst at the Jersey Cyber Security Centre, still has no programming chops to speak of after spending 19 years with the UK Civil Service (where he designed and delivered an early Internet security training course in 2001) and eight with a managed security service provider in Jersey - but he is really quite good at acquiring and analysing information, and no slouch at writing about it either. He’s #ActuallyAutistic, makes a mean Hungarian gulyas, and still speaks Russian just about well enough to tell Putin where to stick it.
NMTP-CLEAR-version.pdf
MD5: fdb582a4d19497aeb347d2f04282e2e5
Format: application/pdf
Last Update: January 28th, 2025
Size: 1.07 Mb
- USTLP:CLEAR
No Action Required: CVE for Software as a Service
Art ManionArt Manion (ANALYGENCE Labs, US), Lisa Olson (Microsoft, US), Don Bailey (AWS, US), Michael Coté (Google, US)
Fixing or otherwise mitigating a vulnerability requires action. By someone. For user- or customer-controlled software, this “someone” is the user or customer who performs actions such as update, upgrade, patch, make a change configuration, rebuild, or fetch new dependencies. For software as a service, this “someone” is the service provider, while the user or customer may not need to take any material action. A browser refresh, session timeout, or a new API call uses the fixed software. What does it mean to assign CVE IDs to no-user-action” vulnerabilities? What are the costs and benefits? Is there danger of decreasing the CVE signal-to-noise ratio? How do changes in the CNA Operational Rules apply? A panel of major cloud service CNAs will discuss these questions and more.
Art Manion spends a lot of time working on various aspects of cybersecurity vulnerabilities including coordinated disclosure, measurement, response prioritization, and public policy. Art has led and contributed to vulnerability-related efforts the Forum of Incident Response and Security Teams (FIRST), the CVE Program, ISO/IEC JTC 1/SC 27, and the (US) National Telecommunications and Information Administration (NTIA). Art is the is the Deputy Director of ANALYGENCE Labs where he works closely with the (US) Cybersecurity and Infrastructure Security Agency (CISA). Art previously managed vulnerability analysis at the CERT Coordination Center (CERT/CC).
Lisa Olson is a Principal Security Program Manager at Microsoft, has a lot to do with patch Tuesdays, and a CVE Board member since 2018.
Don "Beetle" Bailey Senior Principal Security Engineer at AWS, previously MITRE, previously U.S. Army.
Michael Coté is a veteran with 82nd Airborne. Lead for Google Cloud VRP and Vulnerability Response which includes publishing CVEs for critical vulnerabilities within Cloud.
- USTLP:CLEAR
Numbers Game: The Case for Quantifying Cyber Threats
Scott SmallScott Small (Tidal Cyber, US)
Most CTI practitioners agree that threat prioritization is essential, but consensus hardly exists onhow to prioritize something as complex as one APT group or ransomware operation over another. This session outlines why, after a decade supporting & consulting 100+ intelligence teams, the speaker firmly believes that quantification is the solution for more consistent & less biased threat prioritization, highlighting a tangible, successful case study from the physical security space (an ongoing U.S. government cargo security program launched in 2001). Then, we will dive into a review of numerous public data sources that can yield value for threat quantification, and a simplified methodology for using that data to generate rank-ordered lists of priority threats.
Scott Small is a security & intelligence practitioner and expert in cyber threat intelligence & threat modeling, open source research & investigations, and data analysis & automation. He currently serves as Director of Cyber Threat Intelligence at Tidal Cyber. Scott has advised enterprise and public sector security teams across maturity levels on technical and strategic applications of intelligence and on using technology to help identify and mitigate organizational risk. Throughout his career, he has briefed and trained large and small audiences and has presented original content at major security conferences, including DEFCON, FIRSTCON, MITRE ATT&CKcon, & BSides, and ISAC & other industry events.
Scott is an active member of the professional security and intelligence communities and a proponent of open-source information for upskilling and strengthening our collective security. In addition to contributing to community projects, he has published independent projects that aggregate and streamline publicly accessible security resources, as well as his own original tools & resources.
- PLTLP:CLEAR
OpenEoX - Unified Machine-Readable Approach to Software and Hardware Product Lifecycle Data Representation
Przemysław RoguskiPrzemysław Roguski (Red Hat Product Security, PL)
To perform various security activities like vulnerability management, license compliance or support model verification, software and hardware customers must rely on various metadata like CSAF, VEX or SBOM data. Unfortunately together with the market expansion it’s getting harder to easily find out and verify specific product lifecycles, especially in a machine readable format and easily accessible way. Almost all vendors publish their products' lifecycle data definitions, but there is no standardization around format and delivery method.
In this talk we will focus on both technical and non-technical aspects of precise product identification, product versioning, support model including target dates. We will discuss how significantly it can help customers with various lifecycle or support scope regulatory requirements and security implications.
Przemysław “Rogue” Roguski is a Security Architect at Red Hat who specializes in shift-left security initiatives included in build and release processes. He contributes security analysis work on Red Hat OpenShift and other OpenShift-related products. He also designs security solutions and processes across Red Hat Product Security.
He is focused on the security data improvements, especially security data usability in the vulnerability management process and production of attestation data as a part of the Secure Software Development Lifecycle (SDLC) work to address security issues proactively.
An active participant of various upstream and downstream security initiatives and projects like CWE UEWG, OASIS OpenEoX Technical Committee, CISA VEX Working Group and Red Hat Vulnerability Scanner Certification program.
VulnCon2025-OpenEoX.pdf
MD5: de46274340135c018475c9c930bf536c
Format: application/pdf
Last Update: April 16th, 2025
Size: 471.11 Kb
- DETLP:CLEAR
Operationalization of Sigma Rules
Thomas PatzkeThomas Patzke (Evonik Industries AG, DE)
Log events appear differently in SIEMs. There are plenty of different taxonomies, possibilities for customization or just migration scenarios that make it challenging to generate queries from Sigma rules that match on events in given log repositories. Processing pipelines are a feature of the open-source Sigma toolchain that offer a solution for these challenges and this workshop shows some real-world use cases for them.
For this workshop, Thomas has released a GitHub repository containing some instructions for installation of the prerequisites that participants need for doing the hands-on exercises.
Thomas has 18 years' experience in information security and has done lots of stuff in this area, from offensive to defensive security topics. Now he is doing incident response, threat hunting and threat intelligence at the Evonik Cyber Defense Team. Furthermore, he is co-founder of the Sigma project and maintains the open-source toolchain (pySigma/Sigma CLI).
- FRTLP:GREEN
Post-Incident Remediation at ANSSI: A Full Scale Effort
Christophe RenardChristophe Renard (Agence Nationale de la Sécurité des Systèmes d'Information, FR)
As the French national cyber-security authority, ANSSI, and more specifically CERT-FR has been handling major cyber-incidents since its inception in 2009. It has also faced the rise of destructive cybercriminal attacks when sensitive services were concerned. As such, we see post-incident impact often lasting years after the initial events. To mitigate this, we have launched a multipronged effort to formalize what is post-incident remediation, improve victims support, and encourage private sector offer. This presentation summarize what we have been doing in the last 3 years on the subject and what we plan to do next.
Christophe Renard has been working in multiple roles in IT for 25+ years, in computer security for 13 years, in incident response for 8 years.
At CERT-FR he heads a team dedicated to assist in victims in regaining control and restoring their information systems after cyber-incidents.
- USTLP:CLEAR
Product Security Incident Response at a Fortune 500 SaaS
Garrett McNamara (ServiceNow, US)
Product security incident response at a SaaS technology company comes with challenges and opportunities different from those at a strictly on prem vendor. Rapid risk-based decision-making is enabled by the ability to measure exposure at scale and monitor for exploitation activity. Challenges include easily discoverable and often wide-open Internet connected attack surface area.
Garrett McNamara is a Product Security Incident Response Team (PSIRT) manager. He has a software development and application security background at multiple tech companies. He has a master’s degree specializing in Intelligence Technologies and a bachelor’s in Information Security. He has spoken internationally and self-published his research through blog posts, news articles, videos, and proof of concept code. He has served on multiple non-profit boards and is currently studying his MBA.
He volunteers as a highly trained search and rescue leader specializing in tracking and cold cases at the request of federal, state, and local law enforcement in Virginia and surrounding states. Garrett works remotely from the mountains in Virginia and the Space Coast of Florida.
- DETLP:CLEAR
Quantum Computers: Should We Worry?
Morton SwimmerMorton Swimmer (Trend Micro, Inc, DE)
The potential threat of quantum computers to computer security first emerged in the mid-1990s with Shor's discovery of an exponentially faster algorithm for integer factorization. This threat has become more tangible with the development of real quantum computers over the past decade. Although the immediate risk has not materialized, it continues to pose a significant challenge to forward secrecy. In this talk, I will explore the fundamental differences between quantum and classical computers and explain how Shor's algorithm undermines cryptographic systems. Additionally, I will provide an overview of the current state of quantum machine learning, which, despite significant advancements, remains limited in its practical applications. Although quantum computers are not yet ready for purposes beyond research, I will discuss the key challenges that need to be addressed to bring them into practical use and highlight important aspects to consider. This presentation aims to offer a balanced perspective on this complex and often misunderstood field, where expectations frequently surpass current achievements.
Dr.Morton Swimmer is a researcher in the Forward-Looking Threat Research (FTR) team in Trend Micro Research. His focus is on future threats, especially Web3, machine learning and quantum computing.His experience in computer security stretches back past 35 years with the founding of the first European malware research lab (VTC) at the University of Hamburg, Germany in 1988 and he has been involved in most of the innovations in security, first at university, later IBM Research and now Trend Micro. Early activities included malware analysis and computer forensics for which he built an early Malware sandbox system in 1992. This led to the development of the Digital Immune System at IBM Research, a fully automated virus analysis and signature generation system. More recently, he has been researching machine learning techniques, probabilistic reasoning and CTI ontologies to automate detection, hunting and mitigation of threats. New research topics also include the nascent Web3 technology stack and quantum computing’s effect on security issues, both positive and negative. He currently organizes the BSidesMunich and Elbsides security conferences.
Morton, a native of New York City, has a Computer Science PhD degree from the University of Hamburg, and currently resides in the Hamburg, Germany area.
- TWTLP:AMBER
Residential Proxies and Cybercrime
Fyodor YarochkinFyodor Yarochkin (Trend Micro, TW)
Dr. Fyodor Yarochkin is a Senior Researcher, Forward-Looking Threat Research Senior at Trend Micro with a Ph.D. from EE, National Taiwan University. An early Snort Developer and Open Source Evangelist as well as a Programmer, his professional experience includes several years as a threat investigator and over eight years as an Information Security Analyst.
In this webinar Fyodor explores the shadowy world of residential proxy services and how they are used by criminals to mask their identities, bypass security measures, and execute illicit activities.
This presentation is for FIRST Members only, authentication is required onFIRST Portal to preview the video.
Residential Proxies and Cybercrime
May 28, 2025 09:00-09:41
- USTLP:CLEAR
Resolution Revolution: Turbocharging Security Ticketing Timelines
Joseph Seasly (Adobe, US), Shruti Datta Gupta (Adobe, US)
Explore how to streamline the resolution of security tickets, including those from PSIRTs and bug bounty programs, by effectively gathering and integratingknowledge from company, product, and expert insights. This session will highlight the role and limitations of AI in the ticket resolution process, enabling more efficient and informed outcomes. Discover how to build a comprehensive system that incorporates continuous feedback loops, driving iterative improvements and ensuring your team is well-prepared to address the complexities of modern security challenges.
Joseph Seasly is currently on the Security AI & Data Engineering team at Adobe. In his former life, he spent 13 years in the U.S. Intelligence Community working in a variety of agencies, technical roles, and missions.
Shruti Datta Gupta is a Product Security Engineer at Adobe where she works in Security AI & Data Engineering. Her current role involves building AI-powered tools to automate security processes and reduce engineering toil. She is passionate about applying AI to solve challenging problems in security and has worked on projects ranging from draining car batteries to predicting attacker behavior in a network, all using AI.“
Resolution-Revolution.pdf
MD5: 5f3a6d64b687b4f026227c96c0bc5ed9
Format: application/pdf
Last Update: April 14th, 2025
Size: 1.21 Mb
- NLTLP:CLEAR
Routing Security for Enterprises: Secure Your Supply Chain
Andrei RobachevskyAndrei Robachevsky (Global Cyber Alliance, NL)
Andrei Robachevsky is a seasoned professional in the field of Internet infrastructure and cybersecurity, currently serving as the Technical Director of the Internet Integrity Program at the Global Cyber Alliance (GCA). In this role, he focuses on developing collaborative approaches to address key cybersecurity shortcomings in the Internet infrastructure, engaging with operators, researchers, and policy stakeholders.
Prior to his tenure at GCA, Robachevsky was the Senior Director of Technology Programs at the Internet Society until February 2024. During his time there, he was instrumental in launching the Mutually Agreed Norms for Routing Security (MANRS) initiative, an industry-led effort aimed at improving the security and resilience of the Internet’s global routing system.
Earlier in his career, he served as the Chief Technical Officer at the RIPE NCC, one of the five Regional Internet Registries (RIRs), where he was responsible for the organization’s IT strategy, including the management of the K-root DNS root server.
Robachevsky has been actively involved in various Internet governance and technical communities. He was a member of the Internet Architecture Board (IAB) from 2010 to 2012 and participated in the Consolidated RIR IANA Stewardship Proposal (CRISP) team in 2014. In November 2024, he was elected to the Number Resource Organization Number Council (NRO NC).
Increasingly the enterprise digital assets are located outside the organization perimeter. Therefore, routing security becomes a critical requirement of security the supply chain. To increase awareness and participation among enterprises, a second, elevated tier of MANRS (https://www.manrs.org) participation is being developed that requires connectivity providers to comply with more stringent provisions and auditing – MANRS+. It creates a stronger business case for routing security for providers while engaging their customers by raising awareness, generating demand, and providing necessary tools for security assurance. It is a compact set of routing security controls and audit requirements that can be embedded in common infosec frameworks and referenced in procurement practices. This talk will talk about strengthening security for enterprises and their connectivity providers.
- DE TWTLP:AMBER
RU - Underground: a quick overview of notable trends and changes
Vladimir KropotovFyodor YarochkinVladimir Kropotov (Trend Micro, DE), Fyodor Yarochkin (Trend Micro, TW)
In this presentation Vladimir Kropotov and Fyodor Yarochkin from Trend Micro discuss with Krassimir Tzvetanov developments in the Russian-speaking cyber underground. The speakers introduce the topic by emphasizing distinctions between “Russian” and “Russian-speaking,” noting that the shared language spans multiple nations and provides cover for cybercriminals to obscure their true origins. The presentation details are sensitive but overall this is a broad overview of the trends observed over the past year within Russian-speaking underground networks, with a focus on evolving behaviors, collaborations, and security implications in recent years.
Vladimir Kropotov is an Advisor and Principal researcher with the Trend Micro Forward-Looking Threat Research team. Active for over 20 years in information security projects and research, he previously built and led incident response teams at Fortune 500 companies. He holds a master's degree in applied mathematics and information security. He also participates in various projects for leading financial, industrial, and telecom companies. His main interests lie in network traffic analysis, incident response, and botnet and cybercrime investigations. Vladimir was a speaker at a variety of cyber security events, including BHEU, BHAsia, HITB, hack.lu, FIRST and others.
Fyodor Yarochkin is a Principal Researcher, Forward-Looking Threat Research Senior at Trend Micro with a Ph.D. from EE, National Taiwan University. An early Snort Developer and Open Source Evangelist as well as a Programmer, his professional experience includes several years as a threat investigator and over eight years as an Information Security Analyst.
This presentation is for FIRST Members only, authentication is required onFIRST Portal to preview the video.
RU - Underground: a quick overview of notable trends and changes
October 15, 2025 09:00-10:30
- BETLP:GREEN
Scaling Vulnerability Management: A Scale-Up's Journey to Enterprise-Grade Security
Niels HofmansNiels Hofmans (Intigriti, BE)
Rapid growth presents unique security challenges for scale-ups. Limited resources necessitate efficient vulnerability management practices to meet stringent security requirements. This presentation details a pragmatic approach to scaling vulnerability management, emphasizing the crucial role of metadata. We will share our journey of building a custom vulnerability management pipeline in Go, integrated with our SIEM system, and demonstrate how enriching vulnerability data with threat intelligence and business context drives effective prioritization. Attendees will gain practical insights intoleveraging vulnerability metadata for actionable security decisions. Our approach centers on a custom-built Go pipeline that seamlessly integrates various vulnerability data sources, enriching them with threat intelligence and business impactassessments. We'll showcase how this data-driven approach informs prioritization and empowers stakeholders throughself-service portals and SIEM dashboards, providing clear visibility into vulnerability trends and remediation progress. This presentation offers valuable takeaways for organizations seeking to optimize their vulnerability management processes and maximize their security posture with limited resources.
Niels Hofmans is the Head of Security at Intigriti, Europe's largest bug bounty platform which connects 125,000+ security researchers worldwide to customers' assets. He manages cloud security, SoC, threat intelligence, application security, compliance, detection & response, infrastructure, incident response & more. When not with his head in the trenches, he spends time writing experimental security tooling or consulting for customers to make the world a safer place.
- NL
Scattered Spider's Cloud Tactics: Understanding the Ransomware Deployment Life Cycle
Arda Büyükkaya (EclecticIQ, NL)
In today's cloud-centric business landscape, cyber threat actors are increasingly targeting cloud infrastructures to conduct high-impact ransomware attacks. This presentation delves into the tactics, techniques, and procedures (TTPs) of the threat actor known as Scattered Spider, with a focus on understanding their ransomware deployment life cycle within cloud environments.
Drawing from in-depth research and real-world case studies targeting the insurance and financial sectors, we will explore how Scattered Spider employs advanced social engineering methods—such as voice phishing (vishing) and SMS phishing (smishing)—to compromise high-privileged accounts like IT service desk administrators and identity administrators. The session will examine their use of SIM swapping to bypass multi-factor authentication (MFA) and gain unauthorized access to critical cloud services and Software as a Service (SaaS) platforms.
We will uncover how Scattered Spider leverages legitimate cloud features, including Cross-Tenant Synchronization in Microsoft Entra ID and federated identity providers, to establish persistent access and escalate privileges within compromised environments. The talk will highlight their use of open-source tools for cloud reconnaissance, their methods for impairing security tools, and their strategies for evading detection—such as utilizing remote monitoring and management (RMM) tools, protocol tunneling, and creating unmanaged virtual machines.
Furthermore, the presentation will dissect Scattered Spider's ransomware deployment strategies targeting cloud Infrastructure as a Service (IaaS) platforms like VMware ESXi. We will discuss their automated deployment tactics, and cloud-native tools to execute ransomware payloads efficiently, making recovery efforts more challenging for victims.
By mapping out Scattered Spider's comprehensive attack life cycle—from initial cloud account compromise to ransomware execution—we aim to equip cybersecurity professionals with actionable insights to bolster their cloud security posture. The session will conclude with prevention opportunities, offering best practices in authentication and account security, cloud environment hardening, and detection queries to identify and mitigate malicious activities.
Key Takeaways:
- Understand the new TTPs used by Scattered Spider in cloud environments.
- Gain insights into the ransomware deployment life cycle within cloud infrastructures.
- Learn how to detect and prevent similar attacks through practical security measures.
- Explore real-world incidents and case studies for a comprehensive understanding of the cloud threat landscape.
Arda Büyükkaya is a Senior Cyber Threat Intelligence Analyst with experience in advanced threat analysis, proactive threat hunting, and incident response. Specialized in tracking financially motivated cybercriminals and nation-state actors. Authored intelligence reports uncovering novel adversary tactics, techniques, and procedures (TTPs), providing actionable intelligence that supports Fortune 500 companies and government entities in enhancing their threat detection and response strategies.
ArdaBuyukkaya.pdf
MD5: 3272b3be6ea9070d5dfe32c70c29ab65
Format: application/pdf
Last Update: April 23rd, 2025
Size: 3.72 Mb
- FR LUTLP:CLEAR
Scoring Vulnerabilities by Leveraging Activity Data from the Fediverse
Cédric BonhommeAlexandre DulaunoyCédric Bonhomme (CIRCL, FR), Alexandre Dulaunoy (CIRCL, LU)
We have observed that vulnerabilities, proof-of-concepts (PoCs), and remediation strategies are frequently discussed online before they are officially published—sometimes from just a few hours to several weeks in advance.
Twitter’s restriction on free API access has impacted many communities that relied on its data. Meanwhile, Twitter is increasingly being abandoned in favor of Mastodon, especially within the infosec community. Consequently a new category of social network is emerging, more decentralized and more challenging to monitor. Of course, our work is not limited to social networks.
Monitoring information and discussions related to vulnerabilities across the web is essential. We believe that enriching vulnerability information before its public release can be highly beneficial for analysts. When people actively seek or exchange information about a vulnerability, it signals that the issue should be prioritized.
Cédric Bonhomme is a seasoned computer scientist with a deep passion for computer security and privacy. From 2010 to 2017, he worked as an R&D Engineer at a research center, specializing in Multi-Agent Systems and Cybersecurity. Since 2017, he has been an integral part of CIRCL, actively contributing to CSIRT operations and the development of innovative open-source software projects. Currently, he serves as the lead developer of Vulnerability-Lookup, driving advancements in vulnerability research and management.
Alexandre Dulaunoy encountered his first computer in the eighties, and he disassembled it to know how the thing works. While pursuing his logical path towards information security and free software, he worked as senior security network consultant at different places (e.g. Ubizen, now Cybertrust). He co-founded a startup called Conostix, which specialised in information security management. For the past 6 years, he was the manager of global information security at SES, a leading international satellite operator. He is now working at CIRCL in the research and operational fields. He is also a lecturer in information security at Paul-Verlaine University in Metz and the University of Luxembourg. He is also the lead developer of various open source tools including cve-search and member of the MISP core team. Besides his activities in cyber-security, he's also fond of generally fixing anything that's broken around the office.
- USTLP:CLEAR
Securing the Future: Navigating AI Vulnerabilities and Evolving Security Practices
Lisa Bradley
Sarah EvansLisa Bradley (Dell, US), Sarah Evans (Dell, US)
As artificial intelligence (AI) becomes increasingly integrated into software products, it introduces new types of vulnerabilities that challenge traditional security practices. This talk will explore how AI-specific vulnerabilities, such as adversarial attacks and model poisoning, necessitate changes in product security vulnerability response. This talk will also propose areas of the AI supply chain that will need to evolve to improve vulnerability management. By examining the unique characteristics of AI supply chain components, vulnerabilities and the evolving landscape of AI security, we will discuss how organizations can adapt their vulnerability management strategies to address these emerging threats. The presentation will highlight current best practices, case studies, and future trends in AI security.
Dr. Lisa Bradley is a distinguished cybersecurity expert and visionary leader, currently serving as the Senior Director of Product & Application Security at Dell Technologies. With over two decades of experience in enterprise-class engineering, including 13 years in Product Security leadership, she has established herself as a trailblazer in product security and vulnerability management. In her current role, Dr. Bradley oversees Dell’s Product Security Incident Response Team (PSIRT), Bug Bounty Program, Dependency Management, and supports Dell’s SBOM initiative.
Outside of her professional life, Lisa enjoys quality time with her three children. She actively participates in cybersecurity speaking opportunities and podcasts, and supports industry growth through contributions such as being a co-author of the FIRST PSIRT Services Framework. Her unwavering dedication to cybersecurity and extensive industry experience make her a leading figure in the ever-evolving landscape of technology and cyber defense, fostering trust and innovation.
Sarah Evans is a security innovation researcher at Dell Technologies on the global CTO research and development team. She leverages diverse experiences as an IT and security practitioner to improve security by design in emerging technologies. Prior to Dell, Sarah has had roles in the finance, defense, manufacturing and education industries. Sarah also contributes to efforts to help secure the open-source software supply chain. These include contribution in SCORED and OpenSSF as Governing Board observer and AIML Working Group. Sarah is based in Denver, Colorado.
- US JPTLP:GREEN
SIG Activities Update (Spring 2025)
Krassimir Tzvetanov, PhD
Hendrik AdrianKrassimir Tzvetanov, PhD (Purdue University, US), Hendrik Adrian (LACERT, JP)
Date: April 21, 2025
This presentation is for FIRST Members only, authentication is required onFIRST Portal to preview the video.
SIG Activities Update (Spring 2025)
April 29, 2025 09:00-09:15
SIG Updates
Special Interest Groups exist to provide a forum where FIRST Members can discuss topics of common interest to the Incident Response community. A SIG is a group of individuals composed of FIRST Members and invited parties, typically coming together to explore an area of interest or specific technology area, with a goal of collaborating and sharing expertise and experiences to address common challenges.
This special session will feature updates from a handful of FIRST's Special Interest Groups. Those interested in learning more about the groups and how to get involved should attend.
The session will feature in-person updates from: AI Security SIG, Automation SIG, CSIRT Framework Development SIG, Cyber Threat Intelligence SIG, Cybersecurity Communications SIG, Human Factors in Security SIG, Malware Analysis SIG, Metrics SIG, Multi-Stakeholder Ransomware SIG, NETSEC SIG, Policy SIG, Security Lounge SIG, Vulnerability Coordination SIG, and Vulnerability Reporting and Data Exchange SIG.
There will also be pre-recorded video updates available from: DNS Abuse SIG, Red Team SIG, Transportation and Mobility SIG, and the Women of FIRST (WoF) SIG.
01-AI-SIG-Update.pptx
MD5: 2524dbbe7d54b230627d0d6d671693bd
Format: application/vnd.openxmlformats-officedocument.presentationml.presentation
Last Update: July 11th, 2025
Size: 42.73 Kb
02-Automation-SIG-Update.pptx
MD5: 4b624c818218868f8017596178ab60ae
Format: application/vnd.openxmlformats-officedocument.presentationml.presentation
Last Update: July 11th, 2025
Size: 76.12 Kb
03-Malware-Analysis-SIG-Update.pptx
MD5: 119320cff800a059549ff174d24c48b7
Format: application/vnd.openxmlformats-officedocument.presentationml.presentation
Last Update: July 11th, 2025
Size: 76.18 Kb
04-CSIRT-Frameworks-SIG-Update.pptx
MD5: d12408c7833f348cf866d651d521258d
Format: application/vnd.openxmlformats-officedocument.presentationml.presentation
Last Update: July 11th, 2025
Size: 710.97 Kb
05-CTI-SIG-Update.pptx
MD5: 3cc56989d86eac94faf1e56f1c0e5f67
Format: application/vnd.openxmlformats-officedocument.presentationml.presentation
Last Update: July 11th, 2025
Size: 599.88 Kb
07-Metrics-SIG-Update.pptx
MD5: 8d2249c6b27fafd845c70ea95f5945cd
Format: application/vnd.openxmlformats-officedocument.presentationml.presentation
Last Update: July 11th, 2025
Size: 44.8 Kb
08-NETSEC-SIG-Update.pdf
MD5: 706aafcf588c61afff2dd7a7de0f6b5a
Format: application/pdf
Last Update: July 11th, 2025
Size: 166.18 Kb
- USTLP:CLEAR
Streamlining Vulnerability Management: The Power of VEX Inheritance in Container Ecosystems
Jessica Butler (NVIDIA, US), Kaajol Dhana (NVIDIA, US)
This talk introduces an innovative approach to parent image detection and management that leverages Vulnerability Exploitability eXchange (VEX) inheritance. The presentation addresses the critical challenges of maintaining secure and compliant container ecosystems in large-scale environmentsby exploring a system designed to track approved parent images, their associated VEX statements, and perform in-pipeline detection and compliance checks.
This groundbreaking method enhances container security by ensuring the use of approved base images while streamlining vulnerability management through VEX inheritance. By automatically suggesting VEX information from parent images to child images, the system significantly reduces falsepositives and focuses attention on truly exploitable vulnerabilities. DevOps teams, security professionals, and incident responders will gain valuable insights into automating parent image tracking, inheriting VEX statements across image layers, and conducting more accurate vulnerability assessments throughout the container lifecycle, ultimately transforming container security postures and accelerating vulnerability triage processes.
Jessica Butler is an engineering manager for NVIDIA’s Product Security Tools team. Her passion is providing an easy button for security tools by designing and implementing internal enterprise applications with a focus on developer integration and support. Jessica has over 18 years of experience and earned her MS in Computer Engineering from Washington University in St Louis. In her free time Jessica enjoys gardening and traveling with her family.
Kaajol Dhana is a software engineer for NVIDIA’s Product Security Tools team. She is interested in container security and providing actionable and insightful reports for teams to be able to remediate security risks. Kaajol has over 5 years of experience and earned her BS in Computer Engineering from the University of Texas at Austin. Outside of work, Kaajol enjoys playing tennis, trying out new restaurants, and traveling with her husband.
Power-of-VEX-Inheritance.pptx
MD5: 1a29cc1e6a572a8d01b2689cfbd9e34b
Format: application/vnd.openxmlformats-officedocument.presentationml.presentation
Last Update: April 14th, 2025
Size: 6.51 Mb
- CHTLP:CLEAR
The Evolving Cybersecurity Governance Landscape: Non-State Actors, the UN Framework and Critical Infrastructure
Serge DrozSerge Droz (FIRST / Swiss FDFA, CH)
Serge Droz is a senior IT-Security expert and seasoned incidentresponder. Today he works as a senior advisor at the Swiss federal department of foreign affairs where he looks the interface between cybersecurity, international law, peace and cyber-diplomacy.He studied physics at ETH Zurich and the University of Alberta, Canada and holds a PhD in theoretical astrophysics. He has worked in private industry and academia in Switzerland and Canada in different security roles, at a national CERT in Switzerland or at Proton for more than 20 years.
Serge is a member of the board of directors of FIRST (Forum for Incident Response and Security Teams), the premier organisation of recognised global leaders in incident response. In this role he actively participates in discussion relating to cyber security at various policy bodies, in particular related to norm building.
Serge is an active speaker and a regular trainer for CSIRT (Computer Security Incident Response Team) courses around the world.
Over the past two decades, states have grappled with regulatory challenges in cyberspace. Currently, most states have committed to the United Nations Framework on Responsible State Behavior in Cyberspace, which primarily comprises soft law norms, confidence-building measures (CBMs), and capacity-building initiatives. Despite widespread adoption, ongoing debates persist regarding the framework's interpretation and practical implications for non-state actors.The Geneva Dialogue, an innovative initiative launched by the Swiss government, addresses this critical gap. This inclusive platform is open to all non-state actors and systematically explores the UN framework's broader consequences. Through the ongoing development of the Geneva Manual, the dialogue meticulously documents the roles and responsibilities of diverse stakeholders, including cybersecurity teams, researchers, and open-source developers. In its last edition the Dialogue focused on critical infrastructre.This presentation will provide an overview of the UN cybersecurity framework, followed by an in-depth, scenario-based discussion of its implications for non-state actors. Notably, the Geneva Manual is conceptualized not as a definitive guide, but as a dynamic, evolving document. Shaped by real-world cases and the collaborative insights of volunteers and practitioners, it represents a novel approach to understanding cybersecurity governance in an increasingly complex digital landscape.
- FRTLP:CLEAR
The Funny Story of Active Directory Backdooring
Sylvain CortesSylvain Cortes (Hackuity, FR)
Sylvain Cortes is an international expert in identity and access management (IAM) and cybersecurity. During his career, he has mainly worked with large organizations to carry out identity or directory governance projects, including authentication processes, inter-OS privilege management, cloud identity management and Active Directory cybersecurity. He has developed a deep expertise in Active Directory security and backdooring concept.Sylvain is the president of CADIM, a French non-profit organization that organizes an annual event in Paris dedicated to identity management and cyber security: www.identitydays.com.Sylvain is a speaker for various events such as: Blackhat, Cloud Expo, IdentityDays, FS-ISAC, aOS, IT Nordics, Les Assises de la Sécurité, FIC, etc.For 18 years, Sylvain has been recognized by Microsoft as a Microsoft MVP on Active Directory & Security.
What is the hardest question to answer after an Active Directory attack? It's very simple: "Do I have a backdoor in my directory after this attack?"In this session, we will present the state of the art regarding backdoors in AD, with concrete examples of simple and advanced techniques working from AD 2003 to AD 2025 and ensuring attackers' group persistence. We will cover AD backdoors in general, then go into detail about backdooring techniques targeting SIDhistory, Managed by, gPLink, GPOs, ACEs, and more.Finally, we'll look at the combination of multiple techniques used to hide leads and make persistent attackers virtually undetectable.
- USTLP:AMBER
The Human Factor: Psychological Safety in Cybersecurity Frontlines
Cristiana Brafman KittnerCristiana Brafman Kittner (Google Cloud, US)
Cybersecurity isn't just about technology; it’s fundamentally about people. Cybersecurity's human element is undeniable. Recognizing the link between psychology and psychological safety in cybersecurity frontlines, particularly within incident response, is crucial. Research emphasizes the importance of a blame-free culture where individuals can take risks, share ideas, and learn from mistakes, fostering consistent success.
Cultivating psychological safety can be challenging, especially in high-stakes environments like cybersecurity incident response. Strategies to address this include prioritizing people over technology, integrating psychological safety into onboarding, and fostering a culture of trust and transparency. By prioritizing psychological safety, organizations can unlock the full potential of their cybersecurity teams and bolster their defenses against cyber threats. This approach aligns with global perspectives on effective cybersecurity practices, ensuring a resilient and adaptive defense in the face of evolving cyber risks.
Cristiana Brafman Kittner has over two decades of experience in military strategy, weapons analysis, and strategic defense with a focus on cyber threat intelligence. Currently, Cris is the Chief Analyst at Google Cloud's Product Security Engineering and provides enterprise customers across various industries as well as senior executives and government officials with cutting-edge cyber threat intelligence and risk management solutions. She is a subject matter expert in cyber threat intelligence with a focus on Chinese military strategy, particularly on the development of the People's Republic of China's cyber threat landscape and ecosystem. Cris is a board member of The Diana Initiative and Torchlight. In her spare time, Cris is also engaged as a mentor and coach with Girl Security, The Women's Society for Cyberjutsu, and the Executive Women's Forum.
FIRST-HumanFactor_2025.pdf
MD5: ce83e7a49714b9dc0194a99fbbec205d
Format: application/pdf
Last Update: January 15th, 2025
Size: 3.55 Mb
- USTLP:CLEAR
The National Vulnerability Database (NVD) – Where It Is and Where It’s Going (Virtual)
Matthew Scholl
Tanya BrewerMatthew Scholl (NIST, US), Tanya Brewer (NIST, US)
This presentation will discuss the current status of the NVD, as well as short- and long-term goals of the program. Recent developments, developments planned for later in 2025, and goals looking out 2 to 5 years, along with steps that will need to happen to reach these goals, will be discussed. This presentation will also include the current status of NIST’s Vulntology. There will be a Q&A time at the end.
Tanya Brewer is a Cybersecurity Program Manager at the US's National Institutes of Standards and Technology. She manages the National Vulnerability Database (NVD) Program, so folks around the world can know more about publicly disclosed vulnerabilities. She has worked on technical standards and program management in the areas of cybersecurity and privacy for smart grids, electric vehicles, identity management, biometrics, and industrial control systems; cybersecurity education, and workforce training. She has done so with experts from NIST, ITU-T, OECD, SAE, privacy watchdogs, power companies and co-ops, the Department of State, and the U.S. Senate. She blends her background in public policy and cybersecurity to scale complex, multi-stakeholder programs while keeping them approachable to people of all backgrounds. When not managing her team and thousands of vulnerabilities, she is crafting beautiful miniatures or using a stick to turn string into soft and warm beauty.
Matthew Scholl is the Chief of the Computer Security Division in the Information Technology Laboratory at the National Institute of Standards and Technology (NIST). His responsibilities include Cryptographic Standards used by the US Government and the Nation as well as internationally by allies and NATO partners. He is also responsible for Cybersecurity Research and Development at NIST, as well as Cybersecurity Standards and Guidelines used for Federal Agency Security Programs. He leads NIST participation with Cybersecurity National and International Standards Development Organizations (SDOs) and associated conformance testing programs. Mr. Scholl has a Masters in Information Systems from the University Of Maryland and a Bachelors Degree from the University of Richmond.
- USTLP:CLEAR
The Party Isn't Over: Uncovering Konfety's Novel "Evil Twin" Technique
Lindsay Kaye
Gavin ReidLindsay Kaye (HUMAN Security, US), Gavin Reid (HUMAN Security, US)
Lindsay Kaye is the Vice President of Threat Intelligence at HUMAN Security. Her technical specialty spans the fields of malware analysis and reverse engineering, with a keen interest in dissecting custom cryptographic systems. Prior to her work at HUMAN, Lindsay served as Senior Director of Advanced Reversing, Malware, Operations and Reconnaissance as part of the Insikt Group at Recorded Future. She has proposed, won funding for and led research projects, particularly during her time at The MITRE Corporation. Outside of work, Lindsay writes articles on complex cybersecurity issues including data and trends analysis, technical pieces on reverse engineering and TTPs, and discussions on the business of the cybercriminal underground. Lindsay is an internationally-recognized cybersecurity speaker and author. She holds a BS in Engineering with a Concentration in Computing from Olin College of Engineering and an MBA from Babson College.
Gavin Reid serves as the CISO for HUMAN Security, a cybersecurity company specialising in safeguarding enterprises from digital attacks while preserving digital experiences for users. Gavin began his cybersecurity career in information security at NASA’s Johnson Space Center. He later went on to create Cisco’s Security Incident Response Team (CSIRT), Cisco’s Threat Research and Communications (TRAC), and Fidelity’s Cyber Information Group (CIG). Before joining HUMAN, Gavin was the CSO for Recorded Future, responsible for ensuring the protection, integrity, confidentiality, and availability of all customer-facing services, internal operational systems, and related information assets. For over 20 years, Gavin has managed every aspect of security for large enterprises.
Evil twins can be the topic of science fiction, tales of mystery and... advertising fraud? We uncovered a sophisticated ad fraud campaign, that we dubbed Konfety, involving over 250 Android apps in which each benign app distributed via the Play Store had an "evil twin" adware app counterpart - and its corresponding infrastructure. We will explain how Konfety was able to effectively create its own malicious ecosystem, from their ad SDK to their malicious infrastructure that could be started and scaled to support the evil twins at the press of a button to reselling ad inventory to make money, and provide a technical overview of how they did it. While Konfety is an ad fraud campaign, at its core, the distribution of the malicious twin applications was done via drive-by malvertising, broadening the scope and impact of the campaign past the mobile ecosystem. During this talk, we will also explain how we conducted this investigation, and others like it, including how we discovered the novel "evil twin" technique, and provide insight into our investigative framework. We will also provide guidance for how to incorporate threat intelligence and threat hunting investigation techniques into your own organization, even without having a threat intelligence team.
- USTLP:CLEAR
Towards a Minimum Viable Enumeration of Vulnerabilities
Art Manion
Jay JacobsArt Manion (ANALYGENCE Labs, US), Jay Jacobs (Empirical Security , US)
Vulnerability databases come in all shapes and sizes and contain a variety of information elements. Some elements overlap across databases, other elements do not and database records can vary in size depending for example on how many references are included or how much software status (“affected”) is provided. These databases and their elements are intended to support vulnerability management which we organize into four phases: discovery, prioritization, mitigation, and feedback. Which data elements contribute to these phases? More importantly, which are required to enable the first essential phase of discovery? A Minimum Viable Vulnerability Enumeration (MVVE) is the smallest possible number of information elements required to discover (identify and disambiguate) a vulnerability. Without an MVVE element, discovery, and therefore vulnerability management in its entirety, are not possible. This talk will define phases of vulnerability management and how information elements support those phases, with a strong focus on the MVVE necessary for the essential first discovery phase. We map the MVVE to a few well-known vulnerability databases, including CVE.
Art Manion spends a lot of time working on various aspects of cybersecurity vulnerabilities including coordinated disclosure, measurement, response prioritization, and public policy. Art has led and contributed to vulnerability-related efforts the Forum of Incident Response and Security Teams (FIRST), the CVE Program, ISO/IEC JTC 1/SC 27, and the (US) National Telecommunications and Information Administration (NTIA). Art is the is the Deputy Director of ANALYGENCE Labs where he works closely with the (US) Cybersecurity and Infrastructure Security Agency (CISA). Art previously managed vulnerability analysis at the CERT Coordination Center (CERT/CC).
Jay Jacobs is a Co-founder and Chief Data Scientist at Empirical Security and Chief Data Scientist Emeritus at Cyentia Institute. Jay is also the lead data scientist for the Exploit Prediction Scoring System (EPSS) and is co-chair of the EPSS special interest group at FIRST. He is also a co-founder of the Society for Information Risk Analysts (SIRA), a not-for-profit association dedicated to advancing risk management practices where he served on the board of directors for several years. Finally, Jay is a co-author of “Data-Driven Security”, a book covering data analysis and visualizations for information security professionals.
MVVE_VulnCon2025.pdf
MD5: db71e705e10aa4571d203f9011932fd0
Format: application/pdf
Last Update: April 11th, 2025
Size: 1.43 Mb
- INTLP:CLEAR
Tracking the network infrastructure behind industrial scale scams
Swapneel PatnekarSwapneel Patnekar (Shreshta IT Technologies Pvt. Ltd., IN)
The presentation delves into the investigative learnings from tracking and analyzing the network infrastructure supporting industrial-scale pig-butchering (romance baiting), investment, and cryptocurrency scams. We explore the ecosystem enabling these scams, from fraud website templates and malicious Javascript libraries to the tactics, techniques, and procedures (TTPs) leveraged by the threat actors.
Special attention is given to the role of domain registrars and network operators, including how API integrations and cryptocurrency payments are exploited to enable the rapid and large-scale deployment of scam domains.Through this research, we highlight patterns of abuse, infrastructure overlaps, and the operational indicators that can help defenders detect and disrupt these fraud campaigns more effectively.
Tracking the network infrastructure behind industrial scale scams
July 23, 2025 09:00-09:40
- USTLP:CLEAR
UC2 Risk Ruler for CVSS 4.0: Visualizing Vulnerability Severity and Data Confidence (Virtual)
Rob Arnold (Acorn Pass, US)
The UC2 Risk Ruler enhances the Common Vulnerability Scoring System (CVSS) version 4.0 by integrating confidence levels into vulnerability scores, offering a visual representation that aligns numeric scores with qualitative severity labels and data reliability. While CVSS 4.0 offers standardized quantitative scores mapped to qualitative labels, it lacks a built-in mechanism for representing confidence in the underlying data quality, impacting decision accuracy. The UC2 Risk Ruler addresses this gap by aligning CVSS scores with distinct confidence levels—High, Medium, Low, and Unknown—enabling stakeholders to assess the reliability of vulnerability scores in addition to severity. This framework assists decision-makers by reducing "false precision" in low-confidence data, promoting transparency, and facilitating clear communication across technical and non-technical teams. Practical applications include aiding leadership in determining adequate certainty levels for defensible decisions and allowing teams to gauge model sensitivity to confidence adjustments, ultimately refining vulnerability management and supporting robust cybersecurity strategies.
Rob Arnold is a retired Senior Advisor for Cybersecurity and Risk Management at the National Risk Management Center, part of CISA under the U.S. Department of Homeland Security (DHS). He led the creation of the first National Critical Functions Risk Register to help federal leaders prioritize risk management.
Previously, Arnold was CEO of Threat Sketch, specializing in large-scale cyber risk management. He holds a graduate degree in information security from East Carolina University and is CRISC-certified by ISACA.
He authoredCybersecurity: A Business Solution, a guide for small business risk management, and has represented small organizations before Congress. He was a founding member of the ICT Supply Chain Task Force Executive Council, the first chairman of the North Carolina Center for Cybersecurity, and served on advisory boards for multiple universities.
- INTLP:CLEAR
Uncovering the Whispers of an APT Targeting Specific Industries in South Asia
Sathwik Ram Prakki
Subhajeet SinghaSathwik Ram Prakki (Quick Heal, IN), Subhajeet Singha (Quick Heal, IN)
Sathwik Ram Prakki works as Senior Security Researcher at Seqrite Labs, Quick Heal. His areas of research are threat intelligence, APT hunting, delving into dark web and malware analysis. With a background in offensive security and knowledge of OS internals, he is keen on enhancing detections and infrastructure for threat hunting and CTI. Starting his cybersecurity career at C-DAC, under the Ministry of Electronics & IT in India, Sathwik has shared insights on APTs, ransomware and malware ecosystems at conferences such as AVAR, Botconf, c0c0n, and Virus Bulletin.
Subhajeet is working as a Security Researcher in Security Labs at Quick Heal. His areas of focus are threat intelligence, research along with reverse engineering to improve detection capabilities and to aid in further research.
A new campaign targeting various industries such as the Defense Sector in Pakistan and predominantly researchers from Hong Kong has been uncovered. Tracked as Operation Cobalt Whisper, the entire campaign heavily leverages the use of a post-exploitation tool Cobalt Strike, which is deployed using obfuscated VBScript. A total of 20 infection chains have been identified along with additional individual samples, where 18 of them targeted Hong Kong and have two targeted Pakistan where over 30 decoy files have been identified.In this talk, we will explore the technical details of one of the campaigns we encountered during our initial analysis and examine the various stages of the infection chain, starting with a deep dive into the decoy documents. We will then investigate the common Tactics, Techniques, and Procedures (TTPs), such as the use of malicious VBScript and LNK payloads employed by this threat actor across most campaigns. These methods facilitate the in-memory execution of the Cobalt Strike implant, which is delivered alongside these lures in an archive file. At the end, we will explore hunting of its infrastructure that leads us to multiple host-headers of Cobalt Strike beaconing from Chinese ASN and correlation with Bitter APT.
- CATLP:CLEAR
Unmasking MSC Files: A Deep Dive into APT Weaponization, Grim Resource Injection, and AppDomain Manager Hijacking
Hossein JaziDouglas SantosHossein Jazi (Fortinet, CA), Douglas Santos (Fortinet, CA)
Hossein Jazi is a senior threat intelligence specialist at Fortinet, where he contributes as an active researcher with interests in APT tracking, malware analysis, cyber threat intelligence, and machine learning. His current efforts are centred on identifying and monitoring APT activities, along with publishing insightful blogs on their operations. In addition to these projects, Jazi is focused on developing proactive techniques to monitor cyber threat actors' actions and collaborating with various partners to enhance cyber threat research capabilities. He holds a Master's degree in computer science and has over 14 years of experience specializing in cybersecurity and APT analysis.
Douglas Santos is the Director of Advanced Threat Intelligence at Fortinet, bringing over two decades of experience in the cybersecurity field. He combines deep technical expertise with strong communication and interpersonal skills, allowing him to thrive in both technical and business-oriented environments. Doug has a keen understanding of the evolving cyber threat landscape and excels at translating complex security challenges, vulnerabilities, and countermeasures into clear, actionable insights for audiences at all levels. Currently, Doug leads a team of researchers and engineers focused on advancing the state of the art in cyber threat intelligence. Their mission is to proactively identify emerging attack vectors and develop intelligence-driven defenses. As part of this effort, Doug is spearheading Fortinet’s collaboration with MITRE CTID and contributing to projects that enhance threat intelligence standards, tools, and response strategies. These advancements are being integrated across Fortinet’s ecosystem to strengthen global cybersecurity posture. With a proven track record of innovation, leadership, and effective communication, Doug continues to be a driving force in shaping the future of cybersecurity.
As the cyber threat landscape evolves, so do the tactics employed by advanced persistent threats (APTs). With the increasing disablement of macros in Microsoft Office, threat actors have adapted, turning to new methods for malware delivery over recent years. Since early 2022, there has been a noticeable shift away from traditional macro-based attacks toward techniques involving ISO files, HTML smuggling, LNK files, and CHM files. Among these methods, the use of Microsoft Common Console (MSC) files remains underexplored yet has emerged as a powerful tool for malware delivery and persistence in Windows environments.Although initially limited in use, MSC files began gaining significant traction among threat actors in early 2024. Kimsuky was one of the first groups to incorporate MSC files into its campaigns, leveraging various techniques to target victims. Recently, Kimsuky expanded its MSC-based attacks by using Zoom-themed lures, incorporating the legitimate Zoom application to add credibility and increase engagement. Following Kimsuky's example, other APT groups- including Mustang Panda, APT41, and APT Bitter- have adopted MSC files as part of their initial infection strategies. Some of these APTs combine novel methods like Grim Resource Injection and AppDomain Manager Hijacking to enhance the efficacy and stealth of their attacks.These attacks, which use legitimate Windows subsystems and tools to deliver malicious payloads, pose significant challenges for detection. Traditional enterprise security solutions often focus on identifying the aftermath of these techniques- such as the loading of malicious code into legitimate Windows processes- rather than the techniques themselves. Current EDR tools generally provide limited visibility into the full attack chain and tend to rely on known malicious payload signatures or newer detection methods, such as stack-based similarity hashing, to detect frameworks like Sliver, Cobalt Strike, and Metasploit.This technical deep dive will explore how APT groups are exploiting the hidden capabilities of MSC files to conduct stealthy, sophisticated attacks. We'll provide a timeline of MSC file adoption by various threat actors and examine the structure of weaponized MSC files, focusing on advanced techniques like Grim Resource Injection and AppDomain Manager Hijacking, which enable malicious code execution in .NET environments. Recent campaigns demonstrate how APTs are increasingly using these novel techniques to expand their toolsets and evade modern security controls. We'll also discuss detection challenges, showcase a demo of these methods in action, and highlight their implications for current detection mechanisms.
- USTLP:CLEAR
Updates from the CVSS SIG
Nick LealiNick Leali (Cisco and CVSS SIG Chair, US)
During this talk, Nick will present the recent past, present, and near future business of the FIRST CVSS SIG. Topics include the updates from the CVSS SIG over the past year; results from the CVSS SIG survey; and the progress of CVSS v4.0 adoption.
Please bring your questions and requests for examples to discuss.
Nick Leali is a current CVSS SIG co-chair, currently working on improving the adoption of CVSS v4.0 to make transition to the new version of the standard easier for vendors and consumers.
Nick works for Cisco as a PSIRT incident manager.
CVSS-SIG-VulnCon-2025.pdf
MD5: 1e8e3ef166dabacada90cc5ee66e5fba
Format: application/pdf
Last Update: April 14th, 2025
Size: 1.19 Mb
- IT US CZTLP:CLEAR
Validating Vulnerability Analysis with Statistical Analysis of Metadata (In Person & Virtual)
Alexander Bushkin (Red Hat, IT), Chess Hazlett (Red Hat, US), Keith Grant (Red Hat, US), Marian Rehak (Red Hat, CZ)
Vulnerabilities are each unique, but the industry uses metadata to reflect similarities in cause, consequences, and impact. This talk examines whether it's possible to use that metadata to understand the vulnerability landscape as a whole, and also to validate the work of security analysts.
Alexander Bushkin is a Product Security Engineer at Red Hat with a background in cyber threat intelligence, malware analysis, and security architecture. He contributes to security analyses for RHEL and RHEL-related products as well as other internal security projects.
- AUTLP:CLEAR
Vulnerability Data Analysis with Google Spreadsheets and Apps Script for Fun and Profit
Andrew PollockAndrew Pollock (Google Open Source Security Team, AU)
Andrew will share tips and tricks on how to use Google Sheets, Apps Script and the various JSON APIs available from the CVE List, the NVD and OSV.dev to slice and dice vulnerability metadata, based on his experiences in Spreadsheet Engineering
Andrew Pollock has most recently been a Senior Software Engineer on Google’s Open Source Security Team (GOSST), working on OSV.dev. He is passionate about consistent high quality, machine readable vulnerability metadata for detecting and remediating vulnerabilities in open sourcesoftware. He is based in Brisbane, Australia.
- PTTLP:CLEAR
Vulnerability Response of Last Resort: Dealing with Un(der)maintained Packages in the Open Source Ecosystem
Diogo SousaDiogo Sousa (Canonical, PT)
The open-source software ecosystem continues to steadily expand, with millions of packages across repositories. However, this growth is not matched by a corresponding increase in maintainers, leading to challenges in package sustainability and opening the door to potential issues in vulnerability management. To help address these issues, open-source distributions can act as a "Vulnerability Responder of Last Resort" for under-maintained packages, providing community guidance and helping to process reports. Also discussed is the particular impact of vulnerability reports on packages facing these challenges.
Diogo Sousa is an Engineering Manager at Canonical, working in support of the Ubuntu Security team’s mission of providing Canonical users with the most secure and reliable open source experience possible. His day-to-day focus is on Ubuntu Pro’s Expanded Security Maintenance offering, prioritizing workloads and coordinating fixes across main and universe packages for all Ubuntu LTS releases.
Outside professional endeavors, but still within arm's reach, he co-leads the OWASP Lisboa chapter, delivers talks at cybersecurity events, participates in alumni events with current students, mentors people undergoing career upskilling, and writes some content here and there.
In his (truly) free time, you can find him cooking (still can't do baking), expanding his movie collection, teaching math, and playing board games.
- US IETLP:CLEAR
Vulnerability Root Cause Mapping with CWE: Challenges, Solutions, and Insights from Grounded LLM-based Analysis
Alec Summers
Chris MaddenAlec Summers (The MITRE Corporation, US), Chris Madden (Yahoo Product Security Team, IE)
Root cause mapping is the identification of the underlying cause(s) of a vulnerability. This is best done by correlating CVE Records and/or bug or vulnerability tickets with CWE entries. Accurate root cause mapping is valuable because it directly illuminates where investments, policy, and practices can address the root causes responsible for vulnerabilities so that they can be eliminated. This enables trend analysis where a valuable feedback loop into SDLC or architecture design planning can help remove of whole classes of vulnerabilities in organizations’ products. However, widespread adoption of root cause mapping has been elusive due to several challenges including CWE usability, completeness, the diversity of terminology interpretation, and organizational resource constraints, to name a few.
This presentation touches on the value of root cause mapping and recognizes recent adoption in the CNA community, before exploring what is being done to address existing challenges and develop practical solutions. Additionally, we evaluate the performance of a grounded large language model (LLM) tool against the CWE Top 25 Most Dangerous Software Weaknesses dataset. The comparative analysis sheds light on the viability of advancements in LLM capabilities in helping to scale decentralized root cause mapping throughout the vulnerability management ecosystem, offering actionable insights for practitioners and researchers alike.
Alec Summers is a principal cybersecurity engineer at the MITRE Corporation with diverse and extensive experience in software assurance and vulnerability management, as well as cyber operations, assessments, and supply chain risk management. He is MITRE’s CVE and CWE Project Leader, managing teams that support vulnerability and weakness research & analysis, content production, program coordination, infrastructure and services development, and community engagement across a global stakeholder community comprising industry, government, and academia. He also serves as the moderator for the CVE Board.
Chris Madden is a software engineer and system architect building secure trustworthy software at scale for embedded and cloud for 30+ years. He likes to understand things deeply - and uses data analysis and dumb questions to build that understanding. He’s not big on titles, hierarchy or status quo. He does his best work while asleep or on a mountain bike. He works at Yahoo Product Security team. Yahoo delivers value to customers through software; Chris exists to help developers deliver high quality software efficiently and securely. His primary focus is Risk-based prioritization at scale across the DevSecOps pipeline. He led an effort with some industry thought leaders to publish a Risk-based prioritization guide:https://riskbasedprioritization.github.io/. He is now applying LLMs to reduce toil and improve CVE enrichment and capturing his learnings in a guide:https://cybersecai.github.io/https://www.linkedin.com/in/chrisamadden/
- USTLP:CLEAR
Vulnrichment: Year One (In-Person & Virtual)
Art Manion
Lindsey CerkovnikArt Manion (ANALYGENCE Labs, US), Lindsey Cerkovnik (CISA, US)
Vulnrichment is CISA's effort to fill in the gaps on vulnerability data—namely, gauging impact and risk of vulnerabilities as they are published by CVE. Our approach on tackling the daily dozens to hundreds of vulnerabilities on behalf of the federal government embraces radical transparency, and this talk by Lindsey and Art will go over the requirements for Vulnrichment, the realized and expected outcomes, and the federal government's use of an open forum like GitHub Issues to deal with errors, omissions, and discrepancies.
Art Manion spends a lot of time working on various aspects of cybersecurity vulnerabilities including coordinated disclosure, measurement, response prioritization, and public policy. Art has led and contributed to vulnerability-related efforts the Forum of Incident Response and Security Teams (FIRST), the CVE Program, ISO/IEC JTC 1/SC 27, and the (US) National Telecommunications and Information Administration (NTIA). Art is the is the Deputy Director of ANALYGENCE Labs where he works closely with the (US) Cybersecurity and Infrastructure Security Agency (CISA). Art previously managed vulnerability analysis at the CERT Coordination Center (CERT/CC).
Lindsey Cerkovnik is the Chief of CISA’s Vulnerability Response & Coordination (VRC) Branch. Her team is responsible for CISA’s Coordinated Vulnerability Disclosure (CVD) process, the Known Exploited Vulnerabilities (KEV) catalog, and CISA’s Stakeholder Specific Vulnerability Categorization (SSVC) process. Lindsey and her team help to maintain, support, and advance the global vulnerability ecosystem by funding and overseeing the CVE and CVE Numbering Authority (CNA) programs, leading the production and dissemination of machine-readable vulnerability enrichment information, and engaging in valuable technical collaboration with the vulnerability research community.
- USTLP:CLEAR
We All Want Validation (in our SecOps Detections)
John StonerJohn Stoner (Google Cloud, US)
John Stoner is a Global Principal Security Strategist at Google Cloud and leverages his experience to improve users' capabilities in Security Operations, Threat Hunting, Incident Response, Detection Engineering and Threat Intelligence. He blogs on threat hunting and security operations and has built multiple APT threat emulations for blue team capture the flag events. John has presented and led workshops at various industry symposia including FIRST (CTI, Tech Colloquium), BSides (SF, Las Vegas), SANS Summits (DFIR, Threat Hunting, Cloud and SIEM), WiCyS, Way West Hacking Fest, AISA and DefCon Packet Hacking Village. He also enjoys listening to what his former teammates referred to as "80s sad-timey music."
Adversary emulation and simulation isn't just for threat hunting. These capabilities can be extended to detection engineering to provide security operations teams the ability to craft detection logic that can move from indicators of compromise to adversary tactics and techniques.But how do we ensure detections are valid next year or even next month? After all, environments aren't static. To make this more challenging, many organizations have test environments that don't reflect their production environments, so testing may need to take place in production.To make meaningful progress in the field of detection engineering, testing and validation needs to occur due to evolving security controls, infrastructure and adversaries. This presentation will focus on highlighting the challenges security operations teams face and ideas how these obstacles can be overcome.To highlight these efforts, we are leveraging the open source Atomic Red Team library of tests to build an infrastructure to generate events that facilitate the testing and validation of detections. The presentation will discuss bridging the gap from building initial rules to the practical application of continual testing and validation, and will include ideas how this kind of testing can be performed in a production environment without causing disruptions to the current security operation team's cadence and reporting.Attendees will come away with:-A greater understanding of why testing of detections on an on-going basis is crucial-Potential pitfalls when setting up an on-going testing process-Solutions to simplify this process that can be used in your organization
- JETLP:CLEAR
What Can Cybersecurity Incident Responders Learn from Real-World Crises?
Matt PalmerMatt Palmer (Jersey Cyber Security Centre, JE)
As Director of Jersey Cyber Security Centre (JCSC), Matt leads national cyber defence for the island of Jersey, overseeing the direction of the CSIRT in order to promote and improve cyber resilience across critical national infrastructure, businesses, communities, and citizens. A former Chief Information Security Officer for fortune 500 companies and some of the world's leading financial institutions, Matt became the first Director of JCSC in 2021. He is a FIRST liaison member. Matt is also the co-founder of the Channel Islands Information Security Forum and a Commissioner of Jersey's Financial Regulator, the JFSC.
From bombings to floods and fires, real-world emergencies often demand rapid, effective responses under pressure. These scenarios present lessons that can significantly benefit the cybersecurity incident response community. Matt Palmer will explore how a series of life-and-death crises inspired the Jersey Cyber Security Centre (JCSC) to align its approach with emergency management principles and practices from civil defence and emergency services. By examining parallels between physical and cyber incidents, he will share actionable steps that security teams can take to adopt these best practices, build collaboration, and improve outcomes.
- US DETLP:CLEAR
What's New in CSAF v2.1: Key Updates Explained
Justin Murphy
Thomas SchmidtJustin Murphy (DHS/CISA, US), Thomas Schmidt (BSI, DE)
Justin Murphy is a Vulnerability Analyst with the Cybersecurity and Infrastructure Security Agency (CISA). He helps to coordinate the remediation, mitigation, and public disclosure of newly identified cybersecurity vulnerabilities in products and services with affected vendor(s), ranging from industrial control systems (ICS), operational technology (OT), medical devices, and traditional information technology (IT) vulnerabilities. Justin is involved with many other vulnerability management related efforts, including CISA's Software Bill of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) work, and he serves as a co-chair for the OASIS Common Security Advisory Framework (CSAF) and OpenEoX Technical Committees. Justin is also the co-founder of the Global Community of Practice on Coordinated Vulnerability Disclosure (Global CVD-COP). Justin is a former high school mathematics teacher turned cybersecurity professional and has a M.Sc. in Computer Science from Tennessee Technological University, and a B.Sc. degree in Statistics from the University of Tennessee (Knoxville).
Thomas Schmidt works in the 'Industrial Automation and Control Systems' section of the German Federal Office for Information Security (BSI). His focus is the automation of advisories at both sides: vendors/CERTs and asset owners. Schmidt has been a leader in the OASIS Open CSAF technical committee, and key in bridging this work with the CISA SBOM work. Prior to this, Schmidt was BSI's lead analyst for TRITION/TRISIS/HatMan and developed, together with partners, a rule set for Recognizing Anomalies in Protocols of Safety Networks: Schneider Electric's TriStation (RAPSN SETS). To increase security of ICS and the broader ecosystem, BSI responsibilities cover many areas including establishing trust and good relations with vendors and asset owners. Mr. Schmidt completed his masters in IT-Security at Ruhr-University Bochum (Germany) which included a period of research at the SCADA Security Laboratory of Queensland University of Technology (Brisbane, Australia).
The Common Security Advisory Framework (CSAF), an international, open standard for producing, distributing, and discovering machine-readable security advisories has been making strides in enhancing transparency and efficiency for vulnerability management processes.This talk will explore the key changes introduced in CSAF v2.1 compared to CSAF v2.0, highlighting the enhanced capabilities and flexibility of the new version. Through concrete examples, the presentation will demonstrate what can now be achieved with CSAF v2.1 that was either not possible or more challenging with CSAF v2.0. Specific focus will be given to new features, support for other updated standards like CVSS and TLP, shifting of perspectives (score to metrics, cwe to cwes, etc.), and incorporating support for the Exploit Prediction Scoring System (EPSS) and Stakeholder Specific Vulnerability Categorization (SSVC) frameworks. The session will also address migration strategies, tooling needs and updates, easy conversion, and offer practical scenarios for moving CSAF v2.0 content to v2.1, ensuring organizations can smoothly adopt the updated standard while maximizing its benefits. As the number of vulnerabilities identified rapidly increase, possibly at an exponential rate, this talk is essential for those looking to stay ahead in vulnerability management and make the most of CSAF v2.1's new features.
- CATLP:CLEAR
Where Do We Aim? A Look at the State of Vulnerable Software Identification and Its Future (Virtual)
Andrew Suter (BlackBerry Ltd, CA)
How can application, package and library producers help their consumers to stay safe? CPE and PURL are the major contenders for mapping vulnerabilities to impacted software. But which is best? The answer may actually be to use both. Each have strengths and weaknesses, and both have opportunities where they may be able to improve.
Additionally we’ll explore the responsibility of software producers to provide the metadata needed for informed decision making and how organizations like Mitre and NIST can help push us towards a more informed future.
Andrew Suter is the Senior Manager of BlackBerry PSIRT. He has spent the past 10 years reviewing 3rd party vulnerability metadata to efficiently triage and prioritize actions for product engineering teams. Member of OWASP, FIRST PSIRT and CVSS SIGs.
- FITLP:CLEAR
Why is Finnish Healthcare Doing So Well Against Ransomware?
Perttu HalonenPerttu Halonen (National Cyber Security Centre Finland, FI)
Mr Perttu Halonen, senior specialist, the National Cyber Security Centre Finland (NCSC-FI). Perttu has worked as healthcare cyber security liaison at the NCSC-FI since 2017, and facilitates the operation of Finnish social services and healthcare information sharing and analysis centre SOTE-ISAC.
Healthcare cyber security is a major topic, especially because of proliferation of ransomware, and cyber criminals deliberately targeting such attacks against healthcare delivery organisations. Meanwhile, Finnish healthcare providers are doing surprisingly well in terms of ransomware incidents: none reported since the year 2017. It's not clear why is it so. Ransomware incidents have become commonplace in Finnish society, and the good situation in healthcare stands out even inside Finland. In this presentation we study which kind of cyber security challenges do Finnish healthcare providers face, how is cyber security managed in the Finnish healthcare system, and how does the Finnish way compare to approaches in some other European countries. The presentation provides useful insights for policymakers, national level CSIRTs and cyber security managers.
