Automated Adversary Emulation Using Caldera
Explore automated adversary emulation with MITRE Caldera 2.0, focusing on extending its capabilities, improving reporting, and overcoming security controls for enhanced ATT&CK coverage and adoption.
Catching WMI Lateral Movement in an Enterprise Network
Detecting WMI lateral movement in enterprise networks: overview, challenges, and custom IDS fingerprints for improved security. Practical insights for SOC analysts to enhance threat detection capabilities.
Human Side-Channels and Their Implications for Security and Privacy
Exploring non-physical human identifiers in digital security: forensic linguistics, behavioral signatures, and cultural references. Implications for tracking threat actors and privacy protection.
A Hacker's View to the Upcoming ISO SAE 21434
Explore the ISO/SAE 21434 standard for automotive cybersecurity, focusing on technical mechanisms to protect modern vehicles from hacking and ensure safe driving experiences.
Why Isn't Infosec Working? Did You Turn It Off and Back On Again?
Explore effective infosec strategies with Rob Fuller as he shares insights from his diverse career, debunking myths and focusing on practical solutions for cybersecurity challenges.
IoT RCE, a Study With Disney
Exploring IoT vulnerabilities using Disney Circle and Foscam devices as case studies, highlighting novel attack techniques and discussing the security implications of IoT in home networks.
Outside the Box - Breakouts and Privilege Escalation in Container Environments
Explore real-world container escapes and privilege escalation techniques in popular solutions like Docker and Kubernetes. Learn methodologies for assessing containerized environments and implementing secure configurations.
Crypto Crumple Zones - Protecting Encryption in a Time of Political Uncertainty
Exploring technical solutions for balancing encryption and government access, proposing "crypto crumple zones" to maximize privacy while allowing limited exceptional access in politically uncertain times.
Cryptographically Secure Data Analysis for Social Good
Secure multi-party computation enables analysis of sensitive salary data to calculate pay disparities while maintaining confidentiality, demonstrating potential for social impact in privacy-constrained contexts.
When Malware is Packin' Heat
Exploring packing in malware and benign applications, its impact on anti-virus systems, and the challenges in distinguishing between packed malicious and legitimate software.
Going Nuclear - Programmatic Protections against Extreme Vetting, Social Pressures, and Coercion
Explore programmatic options for protecting sensitive data against forced access, including a "nuclear" option to revoke access and wipe data when under threat.
We Gave You This Internet, Now Play by Our Rules
Exploring how technologists' assumptions impact user security, challenging common beliefs in the security community, and advocating for more inclusive design practices in Internet platforms.
Hacking Sensors
Exploración de vulnerabilidades en sensores de sistemas críticos, demostrando ataques y discutiendo defensas para dispositivos médicos, drones y wearables. Enfoque en la seguridad de sistemas de detección y actuación.
Putting Privacy Notices to the Test
Exploring challenges and improvements in privacy notices and security warnings, discussing cognitive processes, and presenting user studies to enhance effectiveness through iterative design.
What Cybersecurity Can Learn from the Secret Service
Exploring cybersecurity lessons from Secret Service strategies, focusing on interior defense and environmental control to detect and neutralize intruders effectively despite porous network boundaries.
The Paper Ballot Is Not Enough
Exploring cryptographic techniques for inherent election integrity, challenging results with objective evidence, and improving voter registration confidence.
Secrets at Scale - Automated Bootstrapping of Secrets & Identity in the Cloud
Explore Netflix's innovative approach to securely managing secrets and identities for thousands of microservices in a cloud environment, addressing scalability and self-healing challenges.
Moving Account Recovery Beyond Email and the Secret Question
Innovative account recovery protocol beyond traditional methods, offering user choice, privacy, and potential for end-to-end encryption key recovery. Addresses limitations of current practices in online identity management.
Beyond Warm and Fuzzy - Ethics as a Value Prop
Exploring industry ethics as a crucial factor in balancing privacy, security, innovation, and autonomy in the face of emerging sociotechnical challenges in smart technologies and predictive services.
Lessons Learned While Protecting Gmail
Insights into Gmail's defense strategies against various cyber threats, covering spam detection, phishing prevention, malware scanning, network security, and web frontend protection.
The Global Conversation on Encryption
Explores global government proposals affecting encryption, their potential impacts on security and rights, and how various stakeholders are responding. Discusses ways to support strong encryption policies.