SECurity FUNdamentals

September 21, 2022

Security Architecture Review for Cloud-based Applications – Where to Start and How to Shift Left?

Application security architecture reviews are used to identify and assess security weaknesses due to architectural flaws in an application. This effort results in specific mitigation or remediation advice meant to strengthen the security posture of the application and reduce risk to the organization. As organizations increase their cloud adoption and innovate at an ever-increasing pace […]

August 18, 2022

De-Escalate the Overly-Permissive Cloud IAMs

The principle of least privilege states that a subject should be given only those privileges needed for it to complete its task. The concept is not new, but our recent research on 18,000 production cloud accounts across AWS and Azure showed that 99% of the cloud identities were overly-permissive. The majority of the identities only […]

August 18, 2022

Azure AD and Microsoft 365 Security Fundamentals

Microsoft invests massively both to provide the tools to protect organizations against cyberattacks, as well as to actively identify and defend against them. Unfortunately, most organizations don’t take full advantage of these tools, and many leave themselves very exposed. This session is an overview of a full day workshop on the same topic. With so […]

June 20, 2022

AI in a Minefield: Learning from Poisoned Data

Data poisoning is one of the main threats on AI systems. When malicious actors have even limited control over the data used for training a model, they can try to fail the training process, prevent it from convergence, skewing the model or install so-called ML backdoors – areas where this model makes incorrect decisions, usually […]

June 20, 2022

Advanced Bot Landscape

Bots are software’s that automate web requests for various tasks without human intervention. Some are beneficial for the Internet but many of them represent a plague for ecommerce websites. Bad bots traffic represents around a quarter of the whole Internet traffic today and is predicted to increase. This traffic includes website content scanning, stolen credit […]

June 20, 2022

Build More Secure Apps by Harnessing the Power of OWASP SKF & ASVS on Kubernetes

Did you know OWASP Application Security Verification Standard (ASVS) can be used as a set of application security requirements? Do you know what the Security Knowledge Framework (SKF) is, and how you can use it to manage your application security requirements and train developers? Are you curious what it takes to deploy a containerized application […]

June 20, 2022

Evasive Manoeuvres: Analysing the Past to Predict the Future of Malware Evasion Techniques

Malware is one of the prevalent security threats. Sandboxes and, more generally, instrumented environments play a crucial role in dynamically analysing malware samples, providing key threat intelligence results and critical information to update detection mechanisms. In this talk, we will analyse the evasive behaviours employed by malware authors to hide the malicious activity of samples […]

June 20, 2022

Trust or Dare: Supply Chain Risks in Aviation

The Civil Aviation sector is transforming itself to the next generation of digital technologies that will thrust it to the next stage of autonomous systems onboard aircrafts, including 5G service in the cabin, preventive maintenance, etc. Now that we are here, it’s time to perform not only the safety of the flight but security of […]

October 20, 2021

Cloudy with a Chance of APT: Novel Microsoft 365 Attacks in the Wild

This past year has proved the point that advanced nation-state backed threat actors are increasingly investing their time and money to develop novel ways to access the cloud. These actors are especially interested in Microsoft 365, where more and more organizations are collaborating and storing some of their most confidential data. Especially for threat groups […]

September 14, 2021

Bot Shops and Info Stealers – Exploring the Dark Web’s Newest Frontier

Carding is one of the earliest forms of cybercrime. Since the 1980s, cybercriminals have developed various fraud tactics to steal and monetize credit card information. To prevent these types of attacks, financial institutions have developed anti-fraud measures to detect and prevent fraudulent transactions. These security precautions include checking various parameters like IP address, operating system, […]

August 23, 2021

Software Composition Analysis 101: Knowing What’s Inside Your Apps

The term Software Composition Analysis (SCA) is relatively new to the security world. However, similar approaches have been used since the early 2000s to indicate security verifications on open-source components. SCA has become an evolution of that. It is the process of identifying and listing all the components and versions present in the code and […]

August 23, 2021

An Anatomy of a DevOps Tool Chain Attack

Businesses are building their digital transformation strategies around in-house development and embracing the DevOps philosophy and associated tooling. However, DevOps tooling is commonly insecure by default, misconfigured and rely on the open-source community to keep things up to date and secure. While cyber security folks are catching up with how to secure the Cloud and […]

June 7, 2021

Broken Brokers in Boxes: Fuzzing Breaks Everything, Even Erlang

Behind the scenes of a trio of recently disclosed vulnerabilities are two innovations. First, putting fuzzing targets in containers makes memory exhaustion much easier to observe. Second, widening our definition of failure makes it possible to locate vulnerabilities even in “safe” environments like Erlang. This presentation begins with a brief review of fuzzing, focusing on […]

May 31, 2021

Adventures in Underland: What Your System Stores on the Disk Without Telling You

Even though you are the only person using a computer, you are not the only one writing to your disk drive! Surprisingly, your disk drive contains a lot of juicy information that can reveal a lot of secrets and history about what you did in the past. There are also places where data can be […]

May 31, 2021

Attacker Techniques: Data Exfiltration

Data exfiltration, or data theft, is a common event that occurs during a breach. This talk will go into detail on specific tools and techniques that attackers have used to exfiltrate data from victim organizations and the ways that we can identify evidence of data access, data staging or data theft. By understanding how attackers […]

September 30, 2020

Drinking Coffee, Unicorns & Demystifying Zero Trust

So exactly what is zero trust? Buzzword, unicorn technology or a framework with meat on the bone? Well, yes on two counts. Zero trust is the realization that everything is on fire. In this talk I will endeavor to strip the idea of a zero trust program back to the bare metal. We will have […]

September 22, 2020

Compliant Yet Vulnerable: Critical Risks of Measuring Instruments in Production Line

In this talk, we are going to review the LAN eXtensions for Instrumentation (LXI), a common protocol among testing and measuring devices. Most legacy wired protocols function on the assumption that they are interconnected in a closed, trusted, secure network. However, once connected to the internet this assumption is no longer true. LXI is one […]

September 15, 2020

PKI Well Revised: Common Mistakes Which Lead to Huge Compromise of Identity

All technologies and systems currently use cryptography and most use certificates at some point. Since their boom, internal PKI systems have not changed a lot nor have the problems that we observe during almost all pentests. It’s time to revise your knowledge about one of the cornerstones of enterprise security and learn a few tricks […]

September 15, 2020

An Introduction to Automotive Security in 2020

As cars continue to become more connected and autonomous, the security of these systems grows in importance. We’re now a decade away from the first public research on automotive security, and since then the challenges of securing these vehicles has increased due to new features. connectivity, and automation. In this talk, we’ll provide an introduction […]

August 11, 2020

The Great Hotel Hack: Adventures in Attacking the Hospitality Industry

Ever wondered if your presence has been exposed to an unknown entity even when you are promised full security and discretion at a hotel? The hospitality industry is a target nowadays for cyber threats. Hotels present many opportunities for hackers and other cybercriminals to target them resulting in data breaches accessing not only credit card […]

June 2, 2020

Active Directory Database Security

How are passwords stored in Microsoft’s Active Directory and how can they be audited? What could an adversary do if they gained access to either a physical or a virtual hard drive of a domain controller? In what ways could one directly modify an Active Directory database file and how can such unauthorized changes be […]

June 2, 2020

Ransomware Attacks: Do’s & Don’ts

Ransomware attacks are prevalent. The actions taken by a company immediately after a ransomware attack can have major implications on their ability to restore operations. This talk will clearly explain which actions should be taken, and which actions might unintentionally cause an organization much more trouble. This talk will go through a series of Do’s […]

August 29, 2019

How to Build an Insecure System out of Perfectly Good Cryptography

Cryptographers focus on provably secure cryptographic primitives. Standards bodies focus on syntax of messages. But there are many system issues that get ignored, leading to interesting security problems. Examples include trust models for PKI, misuse of web cookies, naming issues, and placing unreasonable demands on users. This session provides lessons on and mechanisms for avoiding […]

August 13, 2019

The CIS Critical Controls for Free – Defend all the Things!

The CIS Critical Controls are recognized as a good start in setting up a defensible infrastructure. They are platform / OS agnostic, aren’t driven by vendor agendas, and are very much community and volunteer driven. In this talk, we’ll discuss a typical organization, one that we’d see in many security engagements. We’ll discuss the various […]

August 13, 2019

A Few Things Right: Insights from Live and Simulated Incident Response Failures

While we continue to support the concepts of compliance, defense, governance, and prevention, it’s time to shift our focus beyond those measures with more emphasis on strategic response to incidents. This talk offers real stories of failure and practical, quick-win lessons on how to be prepared to respond quickly, accurately, and confidently when incidents occur. […]

June 17, 2019

OAuth – Everything You Wanted to Know but Not Really!

OAuth is a popular authorization schema used by many iOS and Android apps to delegate user authentication and authorization to a known third-party entity such as Google, Facebook or LinkedIn. This includes apps that enterprises develop or use to connect to G Suite or cloud providers such as BOX and Google Firebase. When users grant […]

May 21, 2019

Serverless Security Top 10 Risks

When adopting serverless technology, we eliminate the need to develop a server to manage our application and by doing so, we also pass some of the security threats to the infrastructure provider. However, serverless functions, even without provisioning or managing servers, still execute code. If this code is written in an insecure manner, it can […]

May 21, 2019

Surviving a Ransomware Attack – Lessons from the Field

Many have succumbed to the various forms on ransom-based malware. Whether it is Cryptolocker, Wannacry, Crysis or the many other forms on ransomware, numerous organizations assume they are not at risk and end up having to respond to a ransomware attack without proper preparation. This presentation will include firsthand case studies and lessons learned during […]

May 21, 2019

It’s Never DNS…. It Was DNS: How Adversaries Are Abusing Network Blind Spots

While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. Attackers have recognized this and have begun increasingly abusing DNS to establish command and control channels, exfiltrate sensitive information and bypass many […]

September 5, 2018

A Peep into the Iron Triangle: IoT Purchasing in a ‘Me First’ Society

With a plethora of IoT devices on the market, and consumer devices being used in the enterprise, it becomes ever trickier to decide on the right strategy for choosing. Product development lives and dies by the phrase ‘Fast, Good, Cheap – Pick Two’. Today, as we push the bleeding edge and strive for instant improvements […]

August 20, 2018

Threat Hunting: From Platitudes to Practical Application

Since its inception, the security industry has been inundated with trendy defense techniques, topics, terms, and products that once implemented will solve all of our security woes. For the last several years one of those terms, threat hunting, has become the darling of defenders and vendors worldwide. But just what is threat hunting? Is it […]

August 20, 2018

PCI for Pen Testers, Now with 100% More Cloud!

The Payment Card Industry Data Security Standard has a bad rap with the security community and for good reason. We’re doing it wrong. Penetration Testers in particular can play a key role in the effectiveness of PCI, but most have never read the Standard and even fewer really understand it. In this talk we’ll cover […]

August 20, 2018

Make Your Own Cloud Security Monitoring Solution

Established methodologies for monitoring cloud-based environments are less than ideal. They come with significant downsides, including the ability for attackers and mischievous users to avoid detection and bypass security controls. I would like to explore how we can use existing technologies like log management systems, SIEMs and the auditing features that cloud platforms already provide […]

May 22, 2018

25 Techniques to Gather Threat Intel and Track Actors

In recent years, we have delivered many talks detailing threat actors, their operations, and their tools. How did we conduct such research and gather such intel? In this talk, we share 25 techniques for gathering threat intel and tracking actors (for example: crimeware (undisclosed) vulnerabilities, C&C misconfig, and underground marketplaces). We explain our use of […]

May 17, 2018

Pragmatic Cloud Security: The Future is Now

Cloud is a new frontier that requires new architectures, higher velocity processes and crisper business-level metrics—none which are really strengths of security programs and practitioners. Given that everything cloud is automated and API-enabled, security teams now have a big opportunity to build and embed security into the cloud technology stack. From continuous guardrails to automated workflows and […]

May 16, 2018

Building Bespoke Threat Intelligence Enrichment Platforms

The aggregation, normalization, enrichment, and contextualization of threat data and intelligence en masse necessitates a robust mix of innovation, automation, and flexibility. The Threat Analyst Workbench should provide mechanisms for extracting data from internal and external sources and building catalogues of intelligence. It should facilitate the analyst to characterize threats, identify outcomes, develop courses of […]

October 23, 2017

Barbarians At The Gate(way): An Examination Of The Attacker’s Tool Box

Attackers are always trying their best to breach your network to steal the secret sauce hidden inside. This session will delve into the attacker’s tool set and focus on the types of attacks that are being leveraged against companies today. I will examine tools, case studies and my own war stories.

October 19, 2017

Breach Happens: Effectively Responding to a Data Breach

Data breaches are the new reality, with the severity and cost of reported breaches escalating constantly. How an organization responds, and how prepared they are in the event of a breach can mean the difference between swift recovery and extended business interruption. This talk will cover: Pre-Breach planning and readiness Incident Response during a breach […]

September 25, 2017

After the Incident: DIY Forensic Collection

Description: When it comes to a post incident self-collection of digital data such as: employee dismissal, data exfiltration, inappropriate behavior/computer usage, or security breach, there is potential for litigation. Whatever the situation, IT personnel should utilize forensic best practices to assure that the information is accurate, admissible, and that the data and original sources are […]

May 9, 2017

Frugal Web Application Testing – Can in-house penetration testing achieve industry standard results while saving you money?

We live in a time where web applications play crucial roles in our society. To deploy a web application into production without properly securing the code and conducting a penetration test to identify the vulnerabilities for remediation, is to welcome an adversary to negatively impact business function, bypass access controls and steal data. While third party companies offer […]

May 9, 2017

Common Attacks Against Active Directory and How to Protect your Organization Against Them

This is not new research, and is really just a demonstration and summary of research done by Sean Metcalf, Rob Fuller, Tim Medin, Tal Be’ery, Benjamin Delpy and others (and they will be credited). It’s all too common that I see people who do not have a good understanding of common attacks against Active Directory […]

May 9, 2017

Top SIEM Use Cases You Should Implement Today

Developing and maintaining an effective SIEM often takes a small army, and can be quite vexatious. In this talk, the audience will be presented with a compilation of the best and most effective SIEM use cases. Gone are the days of noisy, false positive prone alerts – this talk is focused on high accuracy use cases […]

May 9, 2017

Building Your Own Open-source Android Penetration Testing Platform

Android has had a major growth spurt over the last few years and as a result the attack surface is expanding. Many tools for remotely controlling smartphones and obtaining the sensitive information that reside on them have been developed. At the same time, the penetration testing community hasn’t developed an established open source platform for […]

September 1, 2016

Can massive data harvesting drive down the time to breach detection?

With the time to breach detection remaining at 100-200 days and the 100’s of millions of dollars that will be lost to ransomware this year, it is safe to say that modern, relentless attackers have revealed a fundamental flaw in the traditional layered defense model. Any individual layer, when it receives updated security intelligence, does […]

September 1, 2016

Lighting up the Canadian Darknet Financially

Most are familiar with the term Darknet. Many have ventured a few times out of curiosity. For us, Darknet is an untapped source of Threat Intelligence and in some cases amusement. The news you see online about things being sold on the Darknet generally focuses on the United States, Russians, credit cards and drugs. While those are […]

September 1, 2016

The Power of DNS: Gaining Security Insight Through DNS Analytics

DNS is a critical component to all technology running on an enterprise network. Whether it is IT infrastructure, a corporate server, a desktop, a laptop, a POS system, external devices connected to a guest network or even unmanaged devices, such as smart phones or any other connected “thing,” they all use DNS to communicate internally and […]

September 1, 2016

The Security Problems of an Eleven Year Old and How To Solve Them

This presentation explains the problems a child can encounter in the digital world. It covers subjects including siblings gaining control of your devices and online accounts, outside attackers doing those same two things, and your parents restricting what you can access on the internet. Kids face a unique set of problems that have not yet […]

May 2, 2016

IPv6 for the InfoSec Pro on the Go

The first IPv6 RFC was written in December 1995. Slowly and steadily it has been creeping into our lives in the form of “out of the box” configurations, partial protocol implementations, and semi-supported devices. This “on by default” technology is expected to run in parallel with IPv4 in the short term and completely replace it […]

May 2, 2016

Expanding Your Toolkit the DIY Way

A year of phishing and pen testing has resulted in two new tools. One for the creation of phishing emails and another for automating common OSINT and pen testing tasks. Each tool will be available on GitHub, free and open source. This presentation will walk through these tools and how they can help you. However, […]

May 2, 2016

All roads lead to domain admin, a part of a presentation series: From breach to C.D.E. Part I

The focus of this talk is to give an idea of how skilled attacker’s methods are different from the traditional exploits used in order to take control of networks. The idea is to show both old school and new school methods used by attackers and red teams that go from initial breach to domain admin, […]

Subscribe to the Sector Blog
Enter your contact information below to have future blog posts delivered directly to your inbox!