Talks·46 min
Andy Lewis
Walks through the 3CX supply chain compromise and the controls that could have caught the trojanized update.
supply-chainlessons-learnedmalware-analysis+2
Talks LASCON 2023
Austin, TX, USA · October 2023 · 43 talks
Talks from LASCON 2023.
Filters+
1–24 of 43 talks
Talks·52 min
Karen Lu
Presents an enhanced risk formula that folds CVSS factors into ISO 27005-based assessment without double-counting.
riskvulnerabilitiesmanagement+2
Talks·48 min
Anton Aleksandrov
Traces how the Enigma machine's rotors, reflector and plugboard worked, then rebuilds it with serverless functions.
cryptographyreverse-engineeringhistory+2
Talks·45 min
Robert Hurlbut
Explains how threat modeling can fit into agile and DevOps workflows through incremental, story-based and code-driven approaches.
applicationdevopsrisk+3
Talks·50 min
Sean Poris
Shows how Yahoo's bug bounty program secured lasting funding by proving its business value to internal stakeholders.
bug-bountymanagementrisk+2
Talks·51 min
Jason Kent
Shows how counting API endpoint traffic reveals credential stuffing and bot attacks, with analytics to spot them.
applicationthreat-detectionmonitoring+2
Talks·45 min
Theresa Lanowitz
Presents survey findings on edge computing use cases, endpoints, and attack concerns across seven industry verticals.
iotriskdevice+2
Talks·48 min
Dave Ferguson
Shows how static behavior analysis and release diffs can flag malware hidden in software builds before customers receive it.
malware-analysissupply-chainbuild+2
Talks·42 min
Nick Leghorn
Shows how to build a risk-based vulnerability management program that a business can actually sustain.
riskmanagementvulnerabilities+2
Talks·43 min
Chris McGranahan
Explains how pandemic-driven remote work strained security architecture and which controls help modernize it.
architecturenetworkidentity+2
Talks·58 min
Bertold Kolics
Walks Go developers through hardening HTTP APIs with recovery handlers, rate limiting, fuzzing and JSON Schema validation.
appsecwebfuzzing+2
Talks·37 min
Petr Sidopulos
Shows how a security team grew expert-level skills in-house by giving staff protected time to automate routine work.
managementteamlessons-learned+1
Talks·38 min
Baruch Mettler
Shows how scripts and APIs can speed up a breach investigation, from leaked credentials to email, cloud logs and EDR indicators.
incident-responseautomationcloud+2
Talks·59 min
Jim Manico
Surveys XSS and client-side defenses for ReactJS apps, plus API, token and access control risks developers face.
appsecwebvulnerabilities+2
Talks·52 min
Oleg Gryb
Looks back at a decade of API security automation and sets out five pillars for building a lasting program.
applicationautomationvulnerabilities+2
Talks·45 min
Viswanath S Chirravuri
Maps security activities across each DevOps phase and shows how maturity models can measure and guide DevSecOps adoption.
devopsappsecsupply-chain+2
Talks·47 min
Alan Proctor · Josh Sokol
Shows how a small company mapped its controls with the Secure Controls Framework and open-source tools toward ISO 27001 certification.
managementriskopen-source+2
Talks·53 min
Garrett Gross
Explains how unmanaged SaaS sprawl creates security risk and outlines ways to discover and govern shadow IT.
cloudriskmanagement+2
Talks·24 min
Keith Thomas
Shows how OWASP ZAP can move web vulnerability testing earlier into the development and CI/CD pipeline.
appsecowaspweb+3
Talks·35 min
Mike McCabe
Shows how Terraform pipelines can be abused to run code, leak credentials and escalate cloud privileges, plus defenses.
cloudinfrastructureattack+2
Talks·51 min
Marcus Carey
Surveys how AI and large language models can help or harm security, with live chatbot demos built on open tools.
aimachine-learningattack+2
Talks·1 hr 1 min
Abraham Aranguren
Walks through a security and privacy audit of Hong Kong's LeaveHomeSafe contact tracing app and its serious flaws.
mobileandroidprivacy+2