WORKSHOPS
KUBERNETES SECURITY: HANDS-ON ATTACK AND DEFENSE
WORKSHOP BY: ALEVSKI HUERTA
Description:
Kubernetes is the de facto operating system of the cloud, and more and more organizations are running their workloads on Kubernetes. While Kubernetes offers many benefits, it also introduces new security risks, such as cluster misconfiguration, leaked credentials, cryptojacking, container escapes, and vulnerable clusters.
This workshop will teach you the fundamentals of Kubernetes security, from protecting your cluster to securing your workloads. You'll learn about RBAC, OPA, security contexts, network policies, and other security features. You'll also learn how to exploit workloads running on a Kubernetes cluster using techniques like container escape, similar to the ones used by real-world threat actors.
This workshop is designed for both beginners and advanced students. By the end of the workshop, you'll have a deep understanding of Kubernetes security and the skills to protect your clusters and workloads
PURPLE TEAMING WITH DETECTION-AS-CODE MODERN SIEM
WORKSHOP BY: KEN WESTIN
Description:
One of the challenges for security teams is writing and deploying detections that generate actionable alerts with rich context while also reducing noisy alerts. This hands-on workshop will teach the fundamentals of Purple Teaming and detection-as-code to help build new detections.
This session will show how to leverage Purple team techniques to develop hypotheses for new detections and strengthen their defenses against future attacks.
I will show how to use open-source offensive security tools to simulate attacks against lab infrastructure and use an investigative approach to learn and build new detections & manage them using detection-as-code principles to eliminate noise and false positives.
​
CYBERSECURITY FOR SaaS STARTUPS FORN NON-SECURITY LEADERS
WORKSHOP BY: AYMAN ELSAWAH
Description:
A definitive guide to creating, establishing, and growing your cybersecurity program at ANY size SaaS startup.
Whether you are small shop or a high growth B2B startup this workshop will teach you how to prioritize your security decisions so as not to impact your growth and business goals.
This course is geared for those ultimately responsible for security at your organization, whether you are the founder, CTO, or VP of Engineering.
Course modules include:
- Cybersecurity 101, Culture, and Terminology
- Compliance Frameworks and what you need to know
- Cybersecurity Baselines
- IT Security Baseline
- Infrastructure Security
- DevSecOps and Shifting Left
- Building Security Culture
- Governance & Risk
- Policies and why they matter
- Board Responsibilities
- Cybersecurity Insurance
- Incident Response & Disaster Recovery Planning
- Hiring and Growing a Security Team
- Org Chart and Why It Matters
- Security Interview Questions and Scorecards
- Hiring your first CISO / Head of Security
Students will receive access to:
- Baseline Playbooks
- Sample Information Security Budgets
- Year One Infosec Roadmaps
- Sample Org Charts
- Additional books and material
A detailed syllabus is available as well.
MAKING EXPLOIT DEVELOPMENT FUN
WORKSHOP BY: MALAV VYAS
Description:
In this talk, we will learn tools and techniques of Exploit Development tradecraft. Starting from the basics of system architecture and OS internals, we would gain relevant background knowledge necessary to develop our first exploit in Linux environment. Once comfortable, we would move to more complicated exploitation techniques such as SEH Exploitation, Buffer Overflow and Return oriented programming exploits in the windows environment. As this is a hands-on-workshop, attendees would be provided a vulnerable application to exploit.