Barbarians At The Gate(way): An Examination Of The Attacker’s Tool Box

Attackers are always trying their best to breach your network to steal the secret sauce hidden inside. This session will delve into the attacker’s tool set and focus on the types of attacks that are being leveraged against companies today. I will examine tools, case studies and my own war stories.

Read more

Breach Happens: Effectively Responding to a Data Breach

Data breaches are the new reality, with the severity and cost of reported breaches escalating constantly. How an organization responds, and how prepared they are in the event of a breach can mean the difference between swift recovery and extended business interruption. This talk will cover: Pre-Breach planning and readiness Incident Response during a breach […]

Read more

After the Incident: DIY Forensic Collection

Description: When it comes to a post incident self-collection of digital data such as: employee dismissal, data exfiltration, inappropriate behavior/computer usage, or security breach, there is potential for litigation. Whatever the situation, IT personnel should utilize forensic best practices to assure that the information is accurate, admissible, and that the data and original sources are […]

Read more

Frugal Web Application Testing – Can in-house penetration testing achieve industry standard results while saving you money?

We live in a time where web applications play crucial roles in our society. To deploy a web application into production without properly securing the code and conducting a penetration test to identify the vulnerabilities for remediation, is to welcome an adversary to negatively impact business function, bypass access controls and steal data. While third party companies offer […]

Read more

Common Attacks Against Active Directory and How to Protect your Organization Against Them

This is not new research, and is really just a demonstration and summary of research done by Sean Metcalf, Rob Fuller, Tim Medin, Tal Be’ery, Benjamin Delpy and others (and they will be credited). It’s all too common that I see people who do not have a good understanding of common attacks against Active Directory […]

Read more

Top SIEM Use Cases You Should Implement Today

Developing and maintaining an effective SIEM often takes a small army, and can be quite vexatious. In this talk, the audience will be presented with a compilation of the best and most effective SIEM use cases. Gone are the days of noisy, false positive prone alerts – this talk is focused on high accuracy use cases […]

Read more

Building Your Own Open-source Android Penetration Testing Platform

Android has had a major growth spurt over the last few years and as a result the attack surface is expanding. Many tools for remotely controlling smartphones and obtaining the sensitive information that reside on them have been developed. At the same time, the penetration testing community hasn’t developed an established open source platform for […]

Read more

Can massive data harvesting drive down the time to breach detection?

With the time to breach detection remaining at 100-200 days and the 100’s of millions of dollars that will be lost to ransomware this year, it is safe to say that modern, relentless attackers have revealed a fundamental flaw in the traditional layered defense model. Any individual layer, when it receives updated security intelligence, does […]

Read more

Lighting up the Canadian Darknet Financially

Most are familiar with the term Darknet. Many have ventured a few times out of curiosity. For us, Darknet is an untapped source of Threat Intelligence and in some cases amusement. The news you see online about things being sold on the Darknet generally focuses on the United States, Russians, credit cards and drugs. While those are […]

Read more

The Power of DNS: Gaining Security Insight Through DNS Analytics

DNS is a critical component to all technology running on an enterprise network. Whether it is IT infrastructure, a corporate server, a desktop, a laptop, a POS system, external devices connected to a guest network or even unmanaged devices, such as smart phones or any other connected “thing,” they all use DNS to communicate internally and […]

Read more

The Security Problems of an Eleven Year Old and How To Solve Them

This presentation explains the problems a child can encounter in the digital world. It covers subjects including siblings gaining control of your devices and online accounts, outside attackers doing those same two things, and your parents restricting what you can access on the internet. Kids face a unique set of problems that have not yet […]

Read more

IPv6 for the InfoSec Pro on the Go

The first IPv6 RFC was written in December 1995. Slowly and steadily it has been creeping into our lives in the form of “out of the box” configurations, partial protocol implementations, and semi-supported devices. This “on by default” technology is expected to run in parallel with IPv4 in the short term and completely replace it […]

Read more

Expanding Your Toolkit the DIY Way

A year of phishing and pen testing has resulted in two new tools. One for the creation of phishing emails and another for automating common OSINT and pen testing tasks. Each tool will be available on GitHub, free and open source. This presentation will walk through these tools and how they can help you. However, […]

Read more

All roads lead to domain admin, a part of a presentation series: From breach to C.D.E. Part I

The focus of this talk is to give an idea of how skilled attacker’s methods are different from the traditional exploits used in order to take control of networks. The idea is to show both old school and new school methods used by attackers and red teams that go from initial breach to domain admin, […]

Read more

Preventing Home Automation Security Disasters

Increasingly, our lives are becoming entangled with gadgets that require more than simple installation, they require WiFi and an IP address. As we move from upholstered caves to house-shaped machines that automagically know when to turn lights on or off, raise or lower the temperature, unlock the front door upon our approach – we might […]

Read more

Run Faster, Continuously Harden – Embracing DevOps to Secure All The Things

Infrastructure and application deployments are easy, but as security professionals we have to be conscious of the security concerns. Enter DevOps: pro-actively secure, reduce the attack surface, and automate changes at scale. Through a security focussed lens, we look at how embracing DevOps can reduce information security leakages for application and infrastructure deployments. In this […]

Read more

The Internet of Bad Things and Securing the Software Defined Data Center

This last minute session has no available abstract.

Read more

Agile Incident Management – Bringing the “Win” Back to Data and Privacy Breach Responses

Presently, managers and technical staff rely on a traditional reactive incident response process that starts when a security breach is identified – it allows the attacker to “seize the initiative”. DigitalDefence will present the Agile Incident Management (AIM) methodology, which stresses proactive planning in combination with a rapid and effective response to an attack. Using Canadian-specific […]

Read more

Building an Effective Vulnerability & Remediation Management Program

Vulnerability scanning is like flossing, some do it regularly, some only when they have an issue or having their annual checkup, and some not at all. The challenge is that like bacteria the bad guys don’t sit back and wait for you to get around to it, and like teeth your IT systems are never […]

Read more

Security for non-Unicorns

Security is becoming quite the thing nowadays, everyone wants to have some. The mantra that things should be built with security in mind and can’t be plastered on later is a very important one, whether you are established or if you’re based in Silicon Valley and are about to write “the new hotness”. However, what […]

Read more

Ground Zero Financial Services: Targeted Attacks from the Darknet

This will be an advanced level discussion covering attacks sourced from the Darknet that target the global financial services industry. We will detail what the Darknet is, how it operates, why it’s so elusive and why it’s a breeding ground for malicious activity. More specifically, we will focus on new and emerging threats stemming from […]

Read more

Peeling The Layers Of Vawtrak

Vawtrak, also called NeverQuest, is a banking malware that targets banks and other financial institutions all over the world. It is a sophisticated malware that challenges the likes of Zeus and other malevolent trojans. Vawtrak has been seen to bypass 2FA, captured video and screenshots, and also form part of a big botnet infrastructure. Vawtrak is a […]

Read more

Covering my IaaS: Security and Extending the Datacenter

It might still be “early days”, but cloud based infrastructure-as-a-service (IaaS) offerings are maturing fast and becoming financially compelling.  If you haven’t started to look at these services, you’ll need to sooner than later.  Of course, extending your datacenter outside of your datacenter has just a couple of security implications (that was sarcasm). This talk […]

Read more

Pulling back the covers on credit card fraud: A detailed look at financial fraudware.

Credit card theft has dominated the information security headlines recently and for good reason. This talk will demonstrate (with both Chip & PIN and magnetic stripe credit cards) how malware is able to steal the most critical details. It will also delve into the underground economy and explore how the stolen data is stolen, used […]

Read more

So, you want to be a pentester?

This presentation is designed to provide practical career advice to aspiring penetration testers, or those who want more insight into what the actual day to day life of a penetration tester is like. This presentation examines social, psychological, and physical issues surrounding a career in one of information security’s most popular fields. October 21, 2014 […]

Read more

Stupid is as Stupid Does – The Good, The Bad and The Idiots

How Hackers get caught Everyone sees the daily stories about hackers stealing personal data and credit cards but the media moves on to the newest breach the next week. What happens to these cases and the criminals behind them? This presentation will cover Law Enforcement (the good), criminals and their motives (the bad) and the […]

Read more

The Things You See (and Application Scanners Won’t)

Application scanners are a very common tool often used by security professionals to identify vulnerabilities and weaknesses in (mostly) web applications. However, due to the “developer factor”, applications often include weakness and vulnerabilities that are simply not “detectable” by scanners, and relying on these results often means ignoring significant security risks that are still presented […]

Read more

Identity in the Age of the Cloud

Organizations have traditionally enforced access to various services, applications, resources by establishing a person’s identity. Identity Management encompasses a number of processes such as authentication, authorization, provisioning, deprovisioning throughout a person’s life-cycle in the context of the organization. As employees bring their own devices and applications move beyond the firewall to the cloud, how should […]

Read more

What’s Behind “Big Data” and “Behavioral Analytics”

“Big Data” and “Behavioral Analytics” are the latest hot terms in threat detection, but what do they mean and how do they work when applied to security? This presentation will uncover the math behind behavioral analytics explaining the principles and mathematics that make accurate threat detection based on anomalous behavior possible.  It will explain why […]

Read more

How they get in and how they get caught

This talk will take you through the basics of how to pick, rake, bump, impression and bypass a lock, but be careful, you’re leaving a lot of evidence behind. Using datagram’s work at lockpickingforensics.com as a jumping off point we’ll explore how a picker gets in, and how, with careful observation and some practice, we […]

Read more

Vulnerability analysis of 2013 SCADA issues

This session is result of a yearlong study of the most recent SCADA vulnerabilities and includes root cause analysis, attack vector scrutiny, consequence of successful attack and remediation study. Attendees will get an insight into the factors that resulted in the nature and magnitude of the harmful outcomes in order to identify what actions need […]

Read more

Watching the watchers: hacking wireless IP security cameras

Low cost commodity IP surveillance cameras are becoming increasingly popular among households and small businesses. As of April 2013 Shodan (www.shodanhq.com) shows close to 100000 cameras active all over the world. Despite the fact that there are many models by different vendors, most of them are actually based on the identical hardware and firmware setup. […]

Read more

CRYPTOGEDDON – Sector 2013 Edition: Online Cyber Security War Game

A CSEC cybersecurity analyst has gone rogue. He has taken a large cache of top secret files that include the names and identities of several secret agents working in foreign countries. This rogue analyst has stowed these files on the internet in an encrypted format and he is now threatening to share the location of […]

Read more

Appsec Tl;dr

Have you ever wondered what it takes to get one of those “Elusive” bug bounties that people are always snapping up? In this presentation, Gillis Jones will walk you through the fundamentals of the web, and on to the art of hacking the planet. Complete with examples, secrets that the professionals try and keep quiet, […]

Read more

Threat Modeling 101

Threat modeling allows developers and security professionals to collaborate and catch vulns before they ship – and potentially before the code is even written. In this hands-on workshop, Leigh will teach the basics of threat modeling using a game called Elevation of Privilege.

Read more

Frayed Edges; Monitoring a perimeter that no longer exists

The foundations of traditional network security are crumbling in the public cloud. Old assumptions will leave your cloud deployments vulnerable and exposed. In this talk, we’ll examine the existing models of network security and how you can transition to new cloud-friendly models that take advantage of dynamic cloud environments. With the stage set, we’ll dive […]

Read more
Subscribe to the Sector Blog
Enter your contact information below to have future blog posts delivered directly to your inbox!
Fields marked with an * are required