Practical Attack Simulations in Critical National Infrastructure
Explore practical attack simulations in Critical National Infrastructure, focusing on risk reduction, threat modeling, and effective testing strategies for industrial control systems.
Hunting Android Malware - A Novel Runtime Technique for Identifying Malicious Applications
Novel runtime technique for identifying malicious Android apps through instrumentation, addressing frustrations with static analysis and offering practical demonstrations and insights.
Hardware Side Channel Attacks on the Cheapest
Explore side channel attacks on low-cost hardware, covering power analysis, encryption vulnerabilities, and practical demonstrations. Learn acquisition techniques and countermeasures.
Doing This One Crazy Thing Will Change Your AppSec Program Forever
Discover how to revolutionize your AppSec program through effective communication, prioritization, and innovative strategies for securing software development.
Detection Engineering Methodologies
Comprehensive methodology for engineering effective threat detections, covering structure, processes, and technologies for a successful detection program.
A Stratagem on Strategy - Rolling Testing into Product Testing
Explore integrating security testing into product testing strategies, enhancing coverage and aligning security with software requirements for more effective quality assurance in the SDLC.
A Sound Mind in a Vulnerable Body - Practical Hardware Attacks on Deep Learning
Explores hardware vulnerabilities in deep learning systems, demonstrating how fault injection and side-channel attacks can compromise model accuracy and steal proprietary information, highlighting the need for robust ML-level defenses.
A Practical Guide to Fuzz Testing Embedded Software in a CI Pipeline - Dennis Kengo Oka - Ekoparty 2021: Hardware Hacking Space
Practical guide to implementing automated fuzz testing in CI pipelines for embedded software, using Zephyr RTOS as an example. Learn strategies, execution, and vulnerability detection.
The Forgotten Interface- Windows Named Pipes - Gil Cohen - Hack in Paris - 2017
Explores Windows named pipes as potential security vulnerabilities, covering enumeration, scanning, sniffing, fuzzing, and exploitation techniques, with insights on mitigation and defense strategies.
Agnition - The Security Code Review Swiss Army Knife - David Rook - Hack in Paris
Explore Agnitio, a comprehensive tool for secure code review, offering checklists, guidance modules, and automated analysis to enhance software development security practices.
Leveraging the Power of Automated Reasoning - USENIX Enigma Conference - 2017
Explores automated bug detection and security exploit generation using symbolic execution and SMT solvers, showcasing their application in Web security analysis and potential for broader automation.
Legislative Engineering - Design Privacy Laws, Don't Just Draft Them - USENIX Enigma Conference - 2017
Exploring software engineering techniques to improve technology legislation, focusing on component-based architecture and modeling to create more effective and consistent laws.
Interact Differently - Get More from Your Tools Through Exposed APIs
Explore how to leverage exposed APIs and plugin interfaces in software tools to enhance functionality, streamline workflows, and create custom solutions for improved efficiency and effectiveness.
Monitoring Attack Surface and Integrating Security into DevOps Pipelines
Explore strategies for integrating security into DevOps pipelines, focusing on attack surface monitoring, automated testing, and merging static and dynamic results.
Doing Security in 100 Milliseconds - The Speed of Serverless Computing
Explore serverless computing's impact on security, covering key areas like software supply chain and attack detection. Learn practical approaches and see a demo of building and securing a serverless application.
Reversing Web Applications
Explore web application reverse engineering techniques, from information gathering to active testing, to understand behavior, analyze code, and improve security assessments.
Brakeman & Jenkins - The Duo Detects Defects in Ruby on Rails Code
Explore static analysis tools for Ruby on Rails, focusing on Brakeman and Jenkins integration. Learn about security warnings, code updates, and best practices for detecting defects.
An Introduction to ZAP - The OWASP Zed Attack Proxy
Learn to use ZAP, an open-source web application security scanner. Explore features like active scanning, fuzzing, and brute force attacks to enhance your penetration testing skills.
The A's, B's, and Four C's of Testing Cloud-Native Applications
Explore cloud-native app testing with the A's, B's, and Four C's framework, covering threat modeling, API testing, and security management for modern software development.
How to Build an Effective Malware Protection Architecture for File Uploads in Modern Web Apps
Explore a novel approach to automated malware analysis for file uploads in web apps, focusing on scalability, performance, and effective detection of malicious content.
Security Testing - Is Automation Failing Us?
Explore the challenges of security testing automation and its impact on identity, privacy, and overall system protection in modern software development.