BSides Atlanta 2024

Attendee check-in and registration

Organizers welcome remarks

Keynote address

We will run a NetKOTH CTF with multiple different machines at varying difficulties.

The CTF anyone with an internet connection and a dream can play. Find real information on real targets, earn points, and see how your recon skills stack up.

Schedule:
-Signups: 9-12
-Welcome Session^: 9:30-10
-Practice Round: 12-1
-Contest: 1-3
-Winner's Panel^^ (in Room 400): 4-5

^ The OSINT CTF team will explain the rules of the game, answer questions, and share tips from previous winners!
^^ You are invited to join a panel where the winners of the OSINT CTF will spill their secrets, letting you in on the action behind the scenes of the CTF. Plus, take advantage of the opportunity to ask a question in the live Q&A!

Want a leg up on the competition? Read our recap of a previous OSINT CTF at BSides Atlanta, including interviews with the top teams about their winning strategies: https://www.cgsilvers.com/post/2018/05/08/on-the-road-osint-ctf-at-bsidesatl

Vendor village

Learn how to revolutionize your cybersecurity awareness training with Allie Hunter’s groundbreaking “Hunter Method.” Utilizing relatable stories, employees become captivated while internalizing crucial lessons needed to protect themselves, their families, the organization and its customers.

Come pick locks with the good people at Atlanta Locksport

How can you get the best security testing? If you're regularly consuming security testing services from one or more vendors, there are many things you can do to make sure you are getting the best test results on an ongoing basis. Phil will go over quality management techniques gleaned from decades of working with the most mature pentesting programs in the world.

Let's face it, most of us are too reliant on a specific OS for hacking. This is a far too common pitfall that new and seasoned security professionals find themselves in. The beginning of their learning process hinges on having a "hacking OS" installed, rather than learning a tool at a time. This can lead to a multitude of problems. In this talk, we will review when the use of a "Hacking OS" is appropriate, why our choice could hinder the learning and execution processes, how to easily choose an alternative best to your favorite, and how to make our alternative choice more convenient down the line.

Students, security researchers, journalists, and many other professionals have to interact with Internet sourced data, weird or sketchy websites, and sometimes even known malicious code to learn, conduct investigations, inform the public, and defend everyone. In this talk we will outline some of the concerns (risks) and potential bad outcomes in these activities before offering practical guidance on how to minimize those risks. Our emphasis is on attitudes, foreknowledge, and safer practices, but we may recommend some public tools and capabilities to illustrate points. Background: 10 year infosec career, malware analyst, security instructor, avid reader

Did you know that the human brain is happiest when it gets to do something good for someone else? Are you part of a remote first company? A hybrid company? Or a global enterprise with multiple physical locations? We have an employee community volunteer engagement program focused on educating young children in areas where your coworkers live, anywhere in the world!

Join us to learn step-by-step how to get your coworkers out into their local elementary schools using the free volunteer materials from Savvy Cyber Kids. Your coworkers will thank you!

If you’ve ever hosted a party or any other type of social event, you’re probably familiar with the concept of the guest who wouldn’t leave/begins to overstay their welcome and becomes a great source of annoyance for the host.
Now picture what it would be like to have someone come onto your property uninvited, and then decide to live there indefinitely. The unfortunate truth is…this is something that happens everyday. It’s called “squatting.”

I got laid off a year ago and it went great! Losing a job can happen to anybody and can be very stressful; especially during waves of industry-wide layoffs when so many of our peers are competing for fewer and fewer job offers. This talk presents the steps one should take when faced with job loss in the context of the familiar NIST incident response framework. In this session, we'll discuss how to:
- prepare for job loss
- identify the signs of potential impending job loss
- contain the negative impacts of it
- eradicate job loss (by getting another job)
- recover from your period of unemployment
- learn lessons to be better prepared for job loss in the future

Ludus is an open-source project that helps automate the deployment of labs. This presentation will walk you through how to install Ludus and set up your first lab using Ludus, all in less than 20 minutes.

A talk about the adventures of reverse engineering in the past year, as most talks focus on successes this one focuses on my failures and creates discussion on tactics of reverse engineering and encouraging collaboration in that where one person fails another may succeed but only on the shoulders of those who came before

Trust in our security vendors is fundamental for every security organization in the world. We trust them to provide material value to our programs, to develop new features to address emerging security challenges, and to not cause fleet-wide BSOD outages on Fridays. After a cybersecurity company’s recent global outage, EDR customers understand (now more than ever) the necessity of building operational resilience into their deployments. In this talk, we will discuss the base architecture of EDR agents and how this inherently-privileged sensor presents unique risks to customers. We will dive deep into the principles of operational resilience, weighing security risk against operational risk, and provide guidance on customer-driven controls that tangibly reduce operational risk of privileged agents. We describe the shared-responsibility between an EDR vendor and its customers through a threat model of an agent’s deployment at a company. Rebuilding trust requires transparency from technology and leadership, and operational resilience requires we don’t trust the agent to fail gracefully!

Lunch time!

AI is affecting every career associated with data. You need to be asking the right questions about AI in security solutions as a security operator, and security leaders should be asking what can it feasibly do to improve their security program. Everyone in the security organization must ask how it's going to change their role and responsibilities as the business implements AI and how it will change the security program's mission.

Cyber practitioners will gain insight into cyber insurance preparedness and basics when it comes to coverage and claims, as well as some perks that may come along with their policies that aren't always utilized.

Ever wonder what it's like to outsmart the smartest? Join me, as we dive deep into the art of "Hacking the Human: Zero Trust & Breaches." We’ll explore the vulnerabilities that hackers love to exploit—human trust. Social engineering isn't just a buzzword; it's the most effective tool in a hacker's arsenal, and I'll show you exactly how it's done.

In this session, we'll break down real-world examples of how I and others have bypassed some of the most secure systems by targeting the weakest link: people. I’ll also share how zero trust can be a game-changer in securing organizations, ensuring that no one—even the most trusted employees—gets a free pass.

This isn't your typical cybersecurity talk. Expect stories, live demonstrations, and a no-nonsense approach to understanding and defending against the threats lurking in organizations. If you think your firewall is enough, think again. Let’s dig into the human factor and turn the weakest link into the strongest defense.

Discover the innovative approach to simplifying security operations with SOCFortress CoPilot, a platform designed to provide a unified view of your security landscape. This session will explore how CoPilot enhances the usability and accessibility of open-source security tools by integrating with key systems like Wazuh for endpoint and cloud workload protection, and Velociraptor for advanced forensic analysis. Learn how to automate and deploy these integrations seamlessly, optimizing your security operations for efficiency and effectiveness. Join us to see how you can fortify your security posture with this powerful trio.

Whether it’s proof of concept attacks, dev-environment data exposure, or full-blown leaked customer credentials, one thing is clear – SaaS applications continue to be a growing threat vector for vendors and customers alike. SaaS customers are often playing catch up to the latest attacks for a given application, chasing down ghost tenants and struggling to maintain security best practices across the enterprise. In this talk, we discuss our successes and failures implementing an enterprise-scale SaaS configuration management program. We cover topics such as overcoming technical limitations of vendor APIs, educating app owners to be security champions of their tools, building a robust monitoring platform to identify posture drift for our apps, stack ranking your crown jewel apps to prioritize work, identifying key metrics that security leadership cares about, as well as the woes of non-burdensome ticketing for app owners to manage their security risk alongside their other expected job functions. We share a multi-year roadmap that takes us from near-zero protection or visibility to operationalized KTLO with quantitative value at each step. Securing SaaS apps from risky configurations such as ghost admins, SSO-bypass and weak MFA is a mountainous task when you may have anywhere from dozens to thousands of apps across your company. It takes a village!

Assumptions burn defenders every day. Perhaps the most pernicious one is that systems and their controls will always work as designed. Best practices in security may be good guidelines, but unfortunately also suffer from these same blind spots. For example, best practice recommends the use of LAPS for local administrator account passwords of domain-joined computers, yet misconfiguration of active directory can turn it from a protective control into a vulnerability. But what if there was a way to challenge these assumptions up front? The best way to dismantle these types of assumptions is to experience how deeply flawed they are. There is no better way to gain first hand experience into this perspective than immersion in the offensive security space. In this talk we'll explore how to immerse yourself in the offensive security world to obtain this knowledge without needing to change careers or obtain additional certifications. By being more informed about offensive security, defenders are better able to recognize relevant intel, understand existing threats, and more readily discover attacker behavior. Join me as I discuss how there's more to defending than just defense, and how you can find and engage with the amazing resources that are out there waiting to be explored.

Dive into a transformative journey celebrating the unique strengths and untapped potential of neurodivergent individuals in the realm of information security. Explore the concept of neurodiversity as a catalyst for innovation, redefining differences in brain function as valuable assets. Delve into the world of ADHD, autism, and other neurodivergent conditions, unveiling the extraordinary superpowers they bring to the table.

This presentation provides more than just information; it is a call to action. It aims to empower neurodivergent individuals to confidently pursue careers in information security and equip leaders with the tools to foster a thriving, inclusive workforce. Let’s bridge the gap, embrace the full spectrum of minds, and secure our future one innovative solution at a time.

Between Python version mismatches, virtual environments, and containers, getting even popular software to work on every operating system and setup is more cumbersome than it should be. Hackers should be fighting vulnerabilities, not their own tooling.

With numerous threats and vulnerabilities emerging constantly, prioritizing security efforts can be overwhelming. This presentation introduces a practical method for leveraging MITRE ATT&CK and MITRE D3FEND to enhance threat modeling and refine your security roadmap. Attendees will gain insights into how these frameworks can help identify and prioritize the most impactful threats, leading to more effective and strategic security measures. This approach ensures that resources are allocated efficiently, and defenses are focused where they will make the greatest difference, moving beyond reactive responses to a more data-driven and strategic security posture.

Effective communication is vital in managing cyber incidents to ensure timely and appropriate responses. Taking insights from the misinterpreted telegram in the film “The Three Amigos,” this presentation explores the negative impacts of miscommunication during cyber crises. The film provides a unique framework to illustrate how misunderstandings can lead to confusion, ineffective responses, resource misallocation, increased risk, loss of credibility, and financial and emotional costs in the context of incident response.

This presentation will:
Analyze the misinterpreted telegram scenario in “The Three Amigos” and its parallels to real-life cyber incident communication failures.
Discuss the key elements of effective cyber incident communication, including clarity, timeliness, audience awareness, simplicity, consistency, and common language.
Highlight the critical need for precise and clear communication to avoid the pitfalls demonstrated in the film.
Introduce practical strategies for ensuring effective communication during cyber incidents, with a focus on preparation, training, and continuous improvement.

Attendees will gain a deeper understanding of the importance of accurate communication in cyber incident response and learn actionable steps to improve their organization’s readiness and response capabilities. This engaging and informative session is ideal for executives, communication professionals, and incident response teams seeking to enhance their communication strategies during cyber crises.
By using the entertaining, yet instructive, example of “The Three Amigos,” this presentation offers a memorable and impactful way to emphasize the necessity of clear and effective communication in cyber incident response.

Are you prepared to respond to a ransomware attack? Ransomware has emerged as one of the most pressing cybersecurity threats, affecting businesses and organizations worldwide. The consequences can be devastating, crippled operations, financial losses, reputational damage, and even potential legal repercussions. Security teams may lack firsthand experience in handling these incidents. This talk will provide a comprehensive look at how ransomware attacks unfold, what to expect during an incident, and how to effectively prepare, investigate, and respond. We'll explore a real-life case study to make these insights relevant. By the end of this deep dive, the audience will not only understand how a ransomware attack works but will also be equipped with the knowledge needed to prepare for, respond to, and mitigate its impact on their organization.

This lecture will provide aspiring cybersecurity professionals with practical guidance on entering the field.
He'll cover:

• Essential skills and knowledge areas
• Educational pathways and certifications
• Building hands-on experience
• Networking and job search strategies
• Common entry-level roles and career trajectories

Whether you're a student, career changer, or IT professional looking to specialize, this session will not only equip you with actionable steps to launch your cybersecurity career, but also inform you of market trend data, entertain you with relatable anecdotal stories, and inspire you to pursue a career within the Cybsecurity Industry.

As organizations transition to public cloud environments, they increasingly rely on third-party security and monitoring vendors to ensure the protection of these environments. These vendors offer diverse solutions, including CSPM, CNAPP, observability tools, and services such as MSSP and MDR. Most of these services are delivered via Software as a Service (SaaS), necessitating continuous access to customers' cloud environments for effective oversight.

While third-party risk assessments typically focus on the security of the vendors' systems, any breach within a vendor's cloud infrastructure can directly affect customer security. Since 98% of organizations have at least one third-party vendor that has experienced a data breach, there is a growing need for enhanced visibility into vendor activities inside customers’ cloud infrastructure. This includes monitoring their actions, the resources they access, and whether they possess excessive privileges.

In this presentation, we will analyze how third-party vendors gain access to customer cloud environments, explore methods for developing an automated system to monitor their activities and discuss how to establish alerts for deviations from expected behavior. Additionally, we will examine strategies to ensure vendor permissions consistently align with their actual activities to minimize unnecessary access over time.

Throughout the day at BSides Atlanta, bright-eyed contestants will be vying for the crown in the OSINT CTF (Open Source Intelligence Capture the Flag). Only the most creative, persistent recon artists will collect enough flags to rise to the top of the leaderboard. You are invited to join a panel where the winners of the OSINT CTF will spill their secrets, letting you in on the action behind the scenes of the CTF. Plus, take advantage of the opportunity to ask a question in the live Q&A!

Everyone has a Cyber Threat Intelligence Program. Therefore we need to have a Cyber Threat Intelligence Program. The boss says "Go build it".So what do you do now? Based on a couple of decades of experience and observation of programs, I walk through what happens when you try to start a Cyber Threat Intelligence Program, how to do it wrong, and by contrast, how to do it right?

Organizers closing remarks and giveaways