Schedule – Oct 24th, 2023

The Human Factor

Download the schedule as a PDF file: Schedule
To see the abstract of a talk click on its title.

Talks with a gray background are talks related to the main topic “The Human Factor”.

Expand All +

  • Arena


  • As more businesses move further towards a cloud environment we often find ourselves in a hybrid world with servers on both sides of the cloud and clients which needs to function in both worlds. This is something that cyber criminals take advantage of and is one of the biggest problems now.

    In this keynote we will discuss for example if macOS more secure than Windows? And what about the roles that clients have in a cloud-based digital world?

    In a cloud-based digital world, clients play a vital role in cybersecurity. By using cloud services, clients entrust their data to third-party providers. As a result, clients must follow best practices and stay vigilant against potential threats. In the macOS attack chain context, clients can be an entry point for attackers if they are not adequately secured

    By understanding the fundamentals of how cyber criminals actually attack us and how our digital transformation can invent security problems will allow us to build better preventive measures. This keynote will also explain the attack chain and the tools used by hackers. We will also talk about adequate security measures, such as multi-factor authentication, encryption, and endpoint protection.

  • Targeting, profiling, and weaponizing psychology against key individuals within organizations has started becoming a go-to methodology employed by cybercriminals and social engineers. It is a low-cost, low-risk and highly successful approach used to infiltrate organizations in the public and private sectors, steal sensitive information, recruit insiders, and help threat actors acquire illicit access to assets and systems.

    We have been observing threat actors performing thorough reconnaissance on targets, building relationships with them online or offline, and actively exploiting or recruiting them. This talk provides insights into the mechanisms and the methodology of today's targeted social engineering attacks and weaponized psychology. It discusses how attackers tailor their approach in order to compromise specific people in key positions. The tricks they use to build trust and elicit information that assist them in strategizing, initiating, or delivering an attack.

    In addition to the modus operandi of these attacks, the presentation will discuss the lessons learned and the defence mechanisms we can employ to detect and deter targeted social engineering attacks. Do individuals that have privileged access to information or systems require a more carefully planned security strategy? What do they need to know? What can we, the professionals in security positions do to ensure the safety of those individuals and our organizations but also where does our responsibility end?

    The presentation will include real-life case studies from current threat intelligence.
    The Human Factor

  • Historically, threat intelligence analysts viewed adversaries as having particular, specific "fingerprints" or operational tendencies in cyber operations. While this perspective worked historically, subsequent evolution in adversary tradecraft and operational security has muddled matters significantly.

    At present, adversaries coalesce around a common set of behaviors or tradecraft: credential phishing or exploitation of unpatched vulnerabilities, credential capture and re-use, and leveraging one of several post-exploitation frameworks, most notably Cobalt Strike. On the one hand, this makes threat intelligence and attribution significantly harder given the great convergence of tradecraft. On the other, defenders have the benefit of operating against a common set of techniques and behaviors to secure networks and evict adversaries.

    In this presentation, we will explore the convergence of cyber operations, its implications for threat analysis and intelligence, and what this means for network defenders in concrete fashion.

  • Based on an in-depth academic study performed across 18 different commercial organisations, this session will explore what it means to be a CISO in practice. This includes the conflicted, often contradictory role CISOs play, stopping people 'having fun' and yet protecting the organisation from potentially catastrophic impacts. CISOs are both precarious and powerful, educator and scaremonger, enforcer and cleric. It will also explore the language that is used in cyber-security practice, how this involves concepts of mysticism, morality, and masculinity, and how these can be problematic.
    The Human Factor

  • Although today passwords are still the first factor used for authentication, since many years the information security market has been informing corporations about the risks associated with their vulnerabilities and those deriving from the use of legacy MFA.

    Join this session to understand the real risks of adopting some of the most common MFA systems used to access your critical systems and how to begin the journey towards secure passwordless and phishing-resistant authentication.
    The Human Factor

  • With the growing complexity of the IT hardware and software stack, with a move from bare-metal to virtual machines & containers, with the prevalent usage of shared central computing resources for Internet-facing services, provisioning of (internal) user services but also the need for serving industrial control systems (OT) in parallel, the design of data center architectures and in particular its networks can become more and more challenging.

    This presentation will introduce the dilemma of creating a highly agile and flexible computer center set-up while still trying to maintain security perimeters within. It is bound to fail.

  • More than 80% of cyber incidents involve a human element, yet security investments continue to paint technology as a panacea.

    Cyber resilience requires a more balanced approach that considers the people that use and deploy technology, and the processes they follow.

    This talk will provide some high-level solutions that cyber leaders like you can use to address the human factor in security; that which technology can’t.
    The Human Factor

  • Our standing dinner allows everybody to mingle, meet friends and talk about the many interesting talks of the day. Naturally, most of the speakers will still be around, so don't rush off after the last talk.
    break-slot

  • Scenario


  • Although researchers have characterized the bug-bounty ecosystem from the point of view of platforms and programs, minimal effort has been made to understand the perspectives of the main workers: bug hunters. To improve bug bounties, it is important to understand hunters’ motivating factors, challenges, and overall benefits. We address this research gap with three studies: identifying key factors through a free listing survey (n=56), rating each factor’s importance with a larger-scale factor-rating survey (n=159), and conducting semi-structured interviews to uncover details (n=24). Of 54 factors that bug hunters listed, we find that rewards and learning opportunities are the most important benefits. Further, we find scope to be the top differentiator between programs. Surprisingly, we find earning reputation to be one of the least important motivators for hunters. Of the challenges we identify, communication problems, such as unresponsiveness and disputes, are the most substantial. We present recommendations to make the bug-bounty ecosystem accommodating to more bug hunters and ultimately increase participation in an underutilized market.

  • How often have you heard about humans being the weakest link? Is there really no way for us to design technologies and processes that are resilient to human error?

    The past two decades have shown that when technologies are designed without considering how they can be misused, they provide a very low barrier of entry for threat actors. Though some have learned the lessons from the past, there are still those that continue to build new technologies with the same mindset as before, that is build fast -> exploit arises -> fix bug. By now, we should already have enough lessons to draw from to get as close to secure-by-design as possible.

    The presenter will be sharing examples on how to approach this so that more organizations get onboard to deliver technologies and processes that are user-friendly while raising the bar for security.
    The Human Factor

  • Cyber risks are particularly dangerous for financial institutions. Successfully fighting them is beyond the resources of a single bank or insurance company. That's why they have decided to collaborate within the industry and with federal agencies such as the National Cyber Security Center, the Swiss National Bank, FINMA and the State Secretariat for International Financial. Together, on April 5, 2022, they established the Swiss FS-CSC association, a public-private partnership that provides information sharing, threat intelligence, crisis management support and prevention activities. For it has become clear to all stakeholders that pooling resources is essential to success.

  • As numerous recent examples have shown, executing unknown binaries carries inherent risks; even those originating from seemingly trustworthy sources can, in fact, contain malicious code. For reverse engineers, determining the presence of such malicious elements within software poses significant challenges. This talk aims to address these challenges by discussing a range of strategies designed to extract potential malicious behavior from complex binaries.

    Initially, our presentation outlines common methods for identifying malicious behavior, such as signature-based checks, string analysis, identification of suspicious API calls and packer detection. However, in recent years, more sophisticated malware has often evaded detection by these traditional strategies. To address this, we introduce various techniques and heuristics for analyzing and navigating more sophisticated binaries.

    Throughout the talk, we examine the advantages and disadvantages of these heuristics, along with their potential applications. By employing these strategies, we tackle various use cases, such as identifying state machines, command and control (C&C) server communication, and string decryption routines in malware. Furthermore, we delve into the detection of API functions in statically-linked executables, detection of obfuscated code, and pinpointing cryptographic algorithms.

  • We have been reading for decades that the world is changing faster and faster. Numerous business literature and academic literature is available on how to improve the business continuity, implement risk management and secure your software development.

    Still businesses are impacted by unforeseen data leaks, misuse of functionality and disrupted business services to their clients.

    The introduction of cloud did not slow this down. We created a complex global system of chaos. Don’t try to get out of this, embrace it, but how?
    The Human Factor

  • Join me as we explore the world of Coordinated Vulnerability Disclosure (CVD). This presentation is tailored to cater to cybersecurity enthusiasts of all skill levels. Together, we will demystify the concepts surrounding CVD and delve into the challenges faced by its participants. Most notably, we will unearth insights into potential solutions to overcome these challenges. Whether you are embarking on your cybersecurity journey or are a seasoned expert, this talk will provide you with the knowledge necessary to navigate the landscape of CVD.

  • Our standing dinner allows everybody to mingle, meet friends and talk about the many interesting talks of the day. Naturally, most of the speakers will still be around, so don't rush off after the last talk.
    break-slot

  • Sponsoring - Panorama


  • We have become accustomed to the fact that our own infrastructure is under constant attack. That's why we are constantly working on technical and organizational measures to protect ourselves and be prepared for these threats. But what if it happens to one of our partners, service providers, or suppliers? What do we do when we find out?

    In this presentation, you will get a brief insight into two supply chain attacks that put several Swiss companies at risk. The focus will be on the actions taken by these companies and the lessons learned from dealing with this risk to be better prepared next time! As an attendee, you will be able to use these lessons to prepare your own organization for similar supply chain attacks.

  • Strong authentication has long been considered a topic without need for innovation. Recently the spotlight is on strong authentication again as new treats have emerged, NIST raised the requirements for government agencies and FIDO took leadership for security and standardization. In this speech, we will have a look at the challenges of strong authentication as point-in-time action and focus on emerging solutions such as continuous authentication or continuous adaptive trust (CAT).

  • Cybersecurity is no longer an IT/office issue but is becoming increasingly prevalent in the service and production sectors. In the past, classic awareness measures were usually dumped on all those "affected" with a watering can.

    However, in times of increasing cyber threats combined with tight budgets and production step optimizations, it is necessary to focus on relevance. Cybersecurity is now omnipresent, but not equally pronounced everywhere. Phishing, for example, is more prevalent in everyday office life than in a production plant with technical equipment. Nevertheless, there is also a need for awareness measures there, but adapted to the respective working environment.

    Jörg Jungblut, SBB AG, and Markus Günther, TEMET AG, show their way to a decentralized controlled awareness, which consists of more than just sending phishing e-mails.
    The Human Factor

  • The InfoGuard Penetration Testing Team has explored the topic of user enumeration on public platforms in more detail. We show the many ways in which this attack target can be achieved, the extent to which artificial intelligence helps an attacker to do this, and the unexpected effects this seemingly inconspicuous vulnerability can have.

  • Multi-factor authentication, even based on WebAuthn, won't protect you from device code phishing attacks. As such, they pose a significant risk within the Microsoft 365 (M365) ecosystem. This sophisticated form of cyber-attack involves malicious actors attempting to trick users into revealing their access tokens for M365 services such as Office 365, Teams, or SharePoint Online.

    Successful adversaries can hijack Azure AD user accounts, compromising emails, documents, and potentially sensitive corporate data. The consequences can be severe, including unauthorized data access, data breaches, identity theft, financial loss, reputational damage, and even regulatory non-compliance.

    To mitigate these risks, it is critical to implement strong conditional access policies, regular security awareness training, and vigilant monitoring of suspicious activity within the M365 environment.

    Felix will walk you through the nifty details of the attack, demonstrate a piece of custom Compass middleware that simplifies the execution of device code phishing exercises, and discuss the limits of common mitigations.

  • In recent years, ransomware has been, and still is, one of the main cyber threats for organizations of all sizes across the world by causing availability disruption and producing elevated financial costs.

    Ransomware groups are structured as modern organizations with departments, specific roles assigned to every operator, and a clear chain of command. The attacks are performed actively by humans and are indeed named human-operated ransomware attacks.

    In cyber security, we often talk about humans as the weakest link for organizations because, without doing enough awareness activities, all the money spent on technologies and processes has a low impact on the overall security posture. However, we rarely discuss the human factor behind threat actors and how we can leverage it to better protect ICT infrastructures.

    The talk will discuss one of the major ransomware gangs, Black Basta, and how the techniques adopted by the threat actors behind the group can be detected and prevented by also exploiting the weakest link of every organization, including criminal ones... the human factor.
    The Human Factor

  • Immerse yourself in the fascinating real-life examples of actual security incidences and how the actions that companies are taking along those incidents are predicted by the top trends of industry analysts! Learn more about the shift in the market and how organizations and cybersecurity professionals can gain valuable insights from these market shifts. Don't miss this opportunity to enhance your own security service by us pro-actively “leaking” our experience!

  • Our standing dinner allows everybody to mingle, meet friends and talk about the many interesting talks of the day. Naturally, most of the speakers will still be around, so don't rush off after the last talk.
    break-slot