BSides Bristol 2024
Welcome, and important messages from the BSides team.
May sure you visit this year's sponsors and show them some appreciation. The event would not happen without them!
Fraudsters, scammers, tricksters, charlatans, con artists, swindlers - call them what you will, but they all have one thing in common - they have mastered the art of manipulation, and the power of persuasion!
In this opening keynote, Sarah will explore some of the common tactics, and techniques used by these actors, why they work, and how we can collectively reduce the probability of becoming a victim.
Make sure you stick around, as Sarah is also doing a book signing of her best selling book 'Understand the Cyber Attacker Mindset' throughout the morning.
Discover the latest advancements in Software Bill of Materials (SBOMs), their critical relevance driven by the US executive order, and dive into key SBOM formats like SPDX and CycloneDX. Explore the current landscape of SBOM tooling and understand how to enhance software security and compliance.
Ever wanted to try scambaiting? Now's the time to learn how to. What are the tools you'll need? Where do you get scammer emails from? How do you call scammers on the phone? What about the ethical side? All that and examples of scammer calls and "trophies" will be in this talk.
Come and chill out in our wellbeing village and learn some techniques designed to help with stress and burnout. Want to try some mindful doodling? How about some breathing exercises for tension release? Maybe some gentle yoga? Drop in and see if you can grab one of our limited edition BSides Bristol stress balls too.
Industrial Control Systems (ICS) run many aspects of critical infrastructure and manufacturing. In this practical led workshop, you'll learn what ICS is, how to identify ICS devices and a number of ways to attack them, with practical labs using real-word devices. No past experience required!
Interested in seeing how industrial control systems work and how secure they are? The ICS Village run by the University of Bristol's Cyber Security Group includes live demos and hands-on exercises of various attacks against ICS devices using our mobile demonstration units.
Fascinated with physical security? Want to learn how to pick locks in a safe environment? The lock picking village welcomes all, regardless of skill level and experience. Learn the basics, or even trying your hand at some of the advanced techniques.
Hear about one of the South West Regional Cyber Crime Unit's many success stories, from the initial crime report through to action against the perpetrators. It will also include some takeaways for organisations to help protect themselves from cyber crime.
In an era where cyber threats are rapidly evolving, the traditional security defence measures are no longer sufficient. This is where cyber threat hunting steps in—an approach that actively seek out cyber threats or malicious activities within the organisations network before they are able to cause harm.
Automating detection and response with Tines
From the discussions of complex systems with millions of lines of code, to the core plot of a malware backdoor bringing down the park’s fences, Jurassic Park is a window into the challenges of a technology driven world and the many dangers posed by an avaricious and hasty adoption of high-tech solutions.
How to get the most out of networking events such as BSides Bristol!
Discover how Explainable AI revolutionizes cybersecurity, enhancing clarity, precision, and trust. Learn to tackle complex threats with XAI—less false alarms, more innovative, proactive defence.
This Lego cyber security workshop is called ‘Investing in Infrastructure’ and builds on the hugely popular Decisions and Disruptions workshop. Lego 1.5 as it's informally known, adds new cyber threats, defences and scenarios to challenge your thinking about cyber security. The workshop is aimed at everyone, but particularly those who are interested in risk, leadership and decision making (or Lego!). No prior technical knowledge required!
Discover how storytelling can captivate developers and enhance cybersecurity awareness. Through five true stories, learn the impact of storytelling on understanding application security and its essential lessons.
It is not a widely known fact that squid used to have shells. Ancient cephalopods in the Jurassic Period, the common ancestor of modern octopus and squid, were creatures like today's nautilus. They relied on a large external shell for defence. Squids evolved intelligence and agility and so must we.
It takes an average of 212 days to detect a security flaw. Demystify security flaws by seeing them as defects whose root cause needs to be identified. Using automation tools and QRQC, a Lean Methodology tool, you will see how to track vulnerabilities, correct them and avoid their reappearance.
This talk will explore the growing field of human risk management and quantification, diving into the next step in an organizations risk journey - quantifying people. We will talk about where the market is, how people are adopting it, and what organizations can gain from human risk management.
Can we rely on existing ways of recruiting and retaining talent if we want to build the workforce for the future? Cyber is known as a space for neurodivergent thinkers but how can we create inclusive workplaces to embrace creativity and innovation for the next generation with neurodiversity in mind.
Are you measuring what truly matters? This session provides a recipe. Identifying and prioritizing actionable KPIs to improve cloud security operation and communicate security value to the leadership.
Discover the hidden world of ransomware: its impacts, prevention strategies, and cutting-edge defences. Join me to navigate through the complexities and emerge equipped to safeguard against evolving cyber threats.
In a world where we're all exposed to all kinds of cyber threats, defining cyber security responsibilities feels almost impossible. And what's the easiest way to define the impossible? Make it possible by teaching EVERYONE about their important role in staying secure online.
Data is the lifeblood of the digital age, and its creation is proliferating at an unprecedented scale. In 2024, over 300 million terabytes of data will be generated daily, a figure that will only grow as the internet continues to permeate every aspect of our society. This data encapsulates the full spectrum of human experience, from humorous cat memes to devastating cyberattacks. Making sense of these vast streams of information, traveling at lightning speed through cables and airwaves, is a Herculean task, yet a crucial one if we are to mitigate the potential risks lurking within.
Threat intelligence analysts are inundated with data, and agentic AI systems can be invaluable tools for rapidly analyzing vast unstructured datasets, filtering out noise, and accelerating insights. But how can these agentic systems assist, and what role should
they play in the threat intelligence ecosystem? This discussion will explore the current landscape of agentic systems, the principles of their design, and the strengths and weaknesses of deploying these agents with minimal supervision in the real world.
You've seen the numbers thrown around. '80% of incidents affect small businesses', '£72k average salary in cyber security', and so on. Many of us have a hunch these are wrong, or made up on the spot. Calling them out requires research and understanding stats, so this talk provides the tools needed.
Stick around to the end and see if you've won big on the raffle!
Welcome, and important messages from the BSides team.
May sure you visit this year's sponsors and show them some appreciation. The event would not happen without them!
Flying is safe. However, aeroplanes are increasingly connected and consume data from multiple sources. We've been carrying out independent research in to aviation cyber security for several years and have found some interesting vulnerabilities along the way.
The EU referendum on the 23rd of June 2016 marked a seismic moment in my professional and personal life. It had forced me to reevaluate - who I was, my values and what the next chapter holds. Fast forward to 2024. The power of community has allowed me to not only grow but thrive! This is my story.
Prepare yourselves for cyber-battle, and pick up your threat intelligence weapons! Join this session to learn about the evolution of threat intelligence and how to elevate threat intelligence to strengthen your defences and navigate the cyber battlefield.
Remember WordPress? It powers over 43% of websites (~810M sites). We will show you how to make money with WordPress vulnerabilities, an ideal entry point into the challenging world of bug bounty hunting. Suitable for all experience levels with challenges, walkthrus, and guidance to help you succeed.
Interested in seeing how industrial control systems work and how secure they are? The ICS Village run by the University of Bristol's Cyber Security Group includes live demos and hands-on exercises of various attacks against ICS devices using our mobile demonstration units.
Where creativity, combat and engineering, come together to create an unforgettable experience!
Fascinated with physical security? Want to learn how to pick locks in a safe environment? The lock picking village welcomes all, regardless of skill level and experience. Learn the basics, or even trying your hand at some of the advanced techniques.
Inventing good detections is hard, using them with your SIEM (Security information and event management system) is even harder. That's where Large Language Models (LLMs) come in. This talk will describe how to use your existing runbooks, and experience, to improve your threat detection coverage
What is neurodiversity, and what does it have to do with cyber security? From personal journeys to how companies can better support neurodiverse staff, this talk will decode neurodiversity and highlight the need for inclusion and equity in this field.
Discover how cutting-edge health tech can revolutionize patient care without compromising security! Join our talk to explore innovative strategies for managing cyber risks in health tech, ensuring patient data protection while enhancing recovery outcomes with AI and wearable technology.
In a rapidly evolving digital landscape, QR codes have become indispensable tools for contactless convenience, particularly in the post-COVID era. However, alongside their rise in popularity lurks the shadow of qishing,QR code phishing‚posing significant cybersecurity risks.
This talk dissects the disillusionment of junior testers expecting a corporate world CTF. We discuss training hackers vs testers, the culture of discussing tests, and unspoken expectations in corporate. While it's self-therapy for the anxious junior tester, it offers insights for providing training.
Operational Technology (OT) underpins the critical infrastructures on which we rely everyday. Devices and systems such as programmable logic controllers, SCADA platforms and distributed control systems are central to delivering water and power to our homes, driving manufacturing environments and safe, continued operation of transportation systems. As attacks against OT systems grow, what are the typical security issues that plague such environments? What are the anti-patterns that repeatedly occur across OT systems compromising their security and leaving attackers with easy forays into the very heart of critical infrastructures. This talk will reflect on experiences of nearly 30 years and the deadly sins from which many OT environments suffer. What can we do to avoid these traps? In fact, quite a lot!
I would love to take the opportunity to speak about PlugX malware. In this presentation I would give a run down of it's history, it's threat actors, victims, some cases where PlugX was utilized and how organizations can protect themselves against it.
Discover 9001 insane ways to break out of a container! from bypassing eBPF validation to privilege escalation, this talk is covers a variety of different attack vectors aimed at breaking free from the container.
The term CTI brings joy and dread to the community. Some think it's all about the technical detail, while others think it's a high level abstract analysis narrative about APTs; both are convinced they're right, and they are...in part! I propose it's a process and approach that needs teamwork!
IPv6 makes up nearly 50% of internet traffic, it can automatically configure itself on a network and all modern devices have IPv6 enabled by default. About time we took notice? This talk will give a crash course into what IPv6 is, why it is an attackers dream and why we need to secure it now.
Explore the ever-evolving landscape of mobile app testing, from fundamentals to advanced techniques. Witness real-world examples of vulnerabilities that led to an account takeover and other live demos. Unlock the secrets of mobile app testing and take your skills to the next level!
Following on from the presentation "So you wanna be a baiter", Wayne steps through demonstrations of live calls to scammers and show the tactics used in real time.
Rethink authentication with a secure, user-friendly password-less solution. Leveraging 3 technologies, it provides a frictionless experience without sacrificing security. Designed to address pain points of traditional password systems, this system enhances security while delivering a seamless UX
A diverse skillset makes for effective teams, and this is also the case when it comes to Cyber. This talk shows how technical and non-technical people work together to tackle cyber crime across the globe, and why having people from all walks of life can help you succeed.
Space is vital to today’s world, sustaining critical services such as the energy grid, transportation and finance. This talk explores its vulnerability to cyber attacks, especially in the ground segment where space assets like satellites are monitored and operated, drawing upon my PhD research.
Ever wondered how secure your smart home is? With IoT devices like voice assistants becoming integral to our lives, safeguarding privacy is crucial. But how aware are users of the security risks? Join me as we explore the privacy concerns of voice assistants and why awareness matters.
Want to learn about the history of BSides and find out what's involved in organising the event at Bristol? This is the talk for you! Maybe you are just interested in finding out more from 2 of our directors, or you are interesting in volunteering or sponsoring us in 2025.. come along and prepare to be dazzled! (honestly...).
Humans are seen as the weakest link, thus phishing is a common attack vector. We will explore the effect of the prevalence of phishing campaigns, the confusion & mistrust they can cause. The results of an awareness competition will be used to understand varying attitudes toward phishing campaigns.
CORS misconfigurations are one of the most widely misunderstood topics in the web app testing space, largely due to common misconceptions about them. This talk will arm aspiring web app testers with the knowledge to identify and exploit CORS issues end-to-end and key mitigating controls to consider.
Come along to this session and understand more about what it takes to submit your own CfP (call for paper) application to speak at an event like BSides.
Stick around to the end and see if you've won big on the raffle!