BH2020 #1
View Show IndexSegments
1. Pentesting Results Paint A Biased Picture – Roi Cohen – BH20 #1
Pentesting is littered with politics, bias reporting, and human error. So how do you clean up the trash? A former IDF engineer shares how his stint as a pentester changed the way he thinks about it - and ultimately led to the development of a new technology.
This segment is sponsored by Vicarius.
Visit https://securityweekly.com/vicarius to learn more about them!
Start your free trial today, visit: https://www.vicarius.io/sign/up
Guest
Roi has over 13 years of experience as a pentester, IT admin, and CISO. In his current Role as Vicarius VP Sales, he helps companies to better product their infrastructure against software vulnerabilities.
Host
2. Why Secure Remote Access Is Like The Emperors New Clothes – Charl van der Walt, Wicus Ross – BH20 #1
Our research for Black Hat demonstrates that the Secure Remote Access or so-called 'VPN' technologies typically used by enterprises to facilitate access to their networks for remote employees are poorly understood, improperly configured and don't provide the full level of protection typically expected of them. This isn't because of bugs in the technology, but rather due to a ubiquitous scenario in which the remote worker is connected to Wi-Fi that is is untrusted, insecure or compromised. We demonstrate that in this common use-case 'VPN' technologies do not act as we expect them to and therefore expose several opportunities to an attack with control over the Wi-Fi access point.
To get access to the most recent results from our studies, updates, additional demos and other resources on our research, visit: https://orangecyberdefense.com/global/insecure-remote-access/.
Guests
Wicus Ross is Senior Researcher at Security Research Center for Orange Cyberdefense. He is tasked with investigating industry events and trends, with the single purpose of understanding how these may affect business. Wicus uses his understanding and knowledge to advise customers and threat detection/hunting teams on the appropriate response given the threat or trend.
Charl is a founder of a penetration testing company called SensePost, which was originally based in South Africa but now has global reach since its acquisition by Orange Cyberdefense. He played various roles over his 20 year history with that company, including a stint as CEO in the time preceding the acquisition. In 2020 Charl was appointed to head up the European super-operator’s Security Research division, a role that has him and his team working with diverse datasets and specialists across the group to understand the nature of the security challenges we face and provide insight and guidance on these challenges both internally and externally.
Host
3. Purple Teaming With PlexTrac – Dan DeCloss – BH20 #1
The concept of purple teaming needs to be expanded to incorporate a culture of collaboration across all proactive and reactive activities within enterprise cybersecurity programs.
Learn how PlexTrac can aid in all thing purple teaming and drive to the security posture forward for all.
Key questions to cover: What is purple teaming? Who's on the purple team? How does the purple team relate to the CISO? Where does PlexTrac fit in this process?
This segment is sponsored by PlexTrac.
Visit https://securityweekly.com/plextrac to learn more about them!
To get one month free, visit: https://securityweekly.com/plextrac
Guest
Dan has over 15 years of experience in cybersecurity. Dan started his career in the Department of Defense and then moved on to consulting where he worked for various companies. Prior to PlexTrac, Dan was the Director of Cybersecurity for Scentsy where he and his team built the security program out of its infancy into a best-in-class program. Dan has a master’s degree in Computer Science from the Naval Postgraduate School with an emphasis in Information Security. Additionally, Dan holds the OSCP and CISSP certifications.
Host
4. Protecting Data That Egresses From Cloud Services & SaaS Applications – Jeff Capone – BH20 #1
For a true Zero-Trust environment, it isn’t enough to think about data in cloud services and SaaS applications, we also must protect, control and audit data that egresses form these services onto endpoints.
- How do you protect data that egresses from your cloud services (i.e., Github, Workday, SalesForce, Box, OneDrive)?
- Do you control access to your data after it egresses from your cloud services?
This segment is sponsored by SecureCircle.
Visit https://securityweekly.com/securecircle to learn more about them!
Guest
Jeff Capone, PhD, is CEO, Co-founder of SecureCircle, founded in 2015. An award-winning executive leader with expertise in cyber security, enterprise software development, network and storage solutions, and IoT applications, Jeff has a track record of founding and selling successful software companies. Prior to SecureCircle, Jeff served as CTO at NETGEAR and CEO and Co-Founder of Leaf Networks, which was acquired by NETGEAR. Jeff was an assistant professor at Arizona State University and Director of the Network Engineering and Wireless Telecom Laboratory. Jeff’s distinctions include the National Science Foundation’s CAREER award, numerous IEEE Journal and conference publications. He holds a PhD in Electrical Engineering from Northeastern University.
Host
5. Are You Effectively Addressing API Security? – Michael Borohovski – BH20 #1
All applications use APIs—they’re nothing new to the development world. But are organizations factoring API security into their broader security strategy effectively?
We’ve seen high-profile breaches at well-known companies stemming from their exposure or use of insecure API endpoints. This raises the question of how your software security initiative addresses the controls you need to ensure the APIs you use and produce are secure.
Within this segment, Michael Borohovski will discuss key considerations when designing APIs, along with security controls and security testing that could make or break your software.
This segment is sponsored by Synopsys.
Visit https://securityweekly.com/synopsys to learn more about them!
Guest
Michael “Borski” Borohovski is Director of Software Engineering within the Synopsys Software Integrity Group. He co-founded and was CTO of Tinfoil Security, a SaaS company providing security tooling to DevOps teams, prior to the company’s acquisition by Synopsys in January 2020. With over thirteen years of experience in cybersecurity, Borski has made it his mission to empower developers and protect their work from those seeking to cause mischief. He is also a co-inventor on four patents—with an additional four pending. He holds a BS in Computer Science and Engineering from MIT.
Host
6. Protecting Ethical Hackers – Gary De Mercurio, Justin Wynn – BH20 #1
Arrests in Iowa and a Good Samaritan law for Cyber security. The mistake Iowa has made allowing politicians to pass sweeping reforms on a subject they knew nothing about based on politics and who owned what, versus what was best for the citizens of Iowa.
Guests
Arrests at Iowa and a good Samaritan law for Cyber security the mistake Iowa has made allowing politicians to pass sweeping reforms on a subject they knew nothing about based on politics and who owned what, versus what was best for the citizens of Iowa.
Justin is a Senior Security Consultant who performs all types of offensive penetration testing and specializes in physical security. He credits any success to the lifelong friends he’s made in the industry, who have dramatically accelerated his skills and career, and is eager to help others learn more about security.
Host
7. Satellite Broadband Security – James Pavur – BH20 #1
In my upcoming Blackhat and DEFCON briefings, I will be presenting the result of several experiments looking at real-world security and privacy in satellite broadband communications. We find that it is possible for attackers using cheap home-television equipment to eavesdrop on the internet traffic of people who are thousands of miles away. In the briefing, we show how this effects individuals and organizations ranging from home internet customers, to oil companies, to airlines.
Guest
In his upcoming Blackhat and DEFCON briefings, James will be presenting the result of several experiments looking at real-world security and privacy in satellite broadband communications. They found that it is possible for attackers using cheap home-television equipment to eavesdrop on the internet traffic of people who are thousands of miles away. In the briefing, he shows how this affects individuals and organizations ranging from home internet customers, to oil companies, to airlines.
Host
8. What’s Going On With TikTok? – BH20 #1
What's the latest with TikTok? Will the application be banned? Can you actually ban it? Doug White and Matt Alderman discuss the latest news on TikTok.
Hosts
9. How Did The Twitter Hackers Get Caught? – BH20 #1
The FBI tracked down the Twitter hackers, but how? What mistake did they make? Doug White and Matt Alderman discuss the latest news on the Twitter hack.