A Decade After Stuxnet’s Printer Vulnerability – Peleg Hadar, Tomer Bar – BH20 #3
We will describe the Print Spooler vulnerabilities that are found in Windows OS, and will explain how it’s related to Stuxnet. We will also release several tools. The name of Peleg and Tomer's talk is entitled "A Decade After Stuxnet's Printer Vuln: Printing is Still the Stairway to Heaven", and is scheduled for August 6th at 11am PT during Black Hat 2020!
Peleg Hadaris a Security Researcher, in the InfoSec field for more than 7 years, interested in Vulnerability Research.
Tomer Bar is a hands-on security researcher with 20 years of unique experience in cyber security. He leads the SafeBreach Labs as the VP of Security Research. In the past, he ran research groups for the Israeli government and then led the endpoint malware research for Palo Alto Networks. His main interests are Windows vulnerability research, reverse engineering, and APT research. His recent discoveries are the PrintDemon vulnerabilities in the Windows Spooler mechanism which were a candidate in the best privilege escalation Pwnie awards. He presented his research at Black Hat 2020, Defcon 2020, 2021, 2022, SecTor, Recon, HackCon, Security Fest and Confidence conferences.
Planning Security Strategy Without The Black Hat Expo? – Ian McShane – BH20 #3
This year we’ve seen organizations accelerate their so-called digital transformation almost overnight. Now we’re getting to the point where security leaders and business owners need to stop and take stock of what happened, what’s a temporary band aid, and figure out how to build their strategy without the luxury of getting yelled at by vendor booths in Mandalay Bay.
This segment is sponsored by CrowdStrike. Visit https://securityweekly.com/crowdstrike for a totally free trial!
CrowdStrike at Black Hat USA 2020 https://www.crowdstrike.blog/join-crowdstrike-at-black-hat-2020/
With almost twenty years in information security including practitioner, product manager, and a shift as the lead Gartner analyst for endpoint security and EDR, CrowdStrike’s VP of Product Marketing Ian McShane has seen a lot of crazy things in his time.
Defining the Dynamic Application Security Testing Market – Ferruh Mavituna – BH20 #3
Dynamic application security testing (DAST) for web applications has come a long way, establishing a niche market with a variety of offerings. In this segment Ferruh will discuss the big differences in DAST solutions available and help you understand which one is a pure DAST that you could rely on the most in this day and age.
This segment is sponsored by Netsparker.
Visit https://securityweekly.com/netsparker to get a trial of the best dynamic application scanning solution on the market!
Ferruh Mavituna is the founder and strategic advisor of Invicti Security, a world leader in web application security solutions. His professional obsessions lie in web application security research, automated vulnerability detection, and exploitation features. He has authored several web security research papers and tools, and delivers animated appearances at cybersecurity conferences and on podcasts. Exuberant at the possibilities open to organizations by the deployment of automation, Ferruh is keen to demonstrate what can be achieved in combination with Invicti’s award-winning products, Invicti and Acunetix.
Effectively Protecting Your Users Against Ransomware & Zero-Day Exploits – Danny Jenkins – BH20 #3
ThreatLocker CEO, Danny Jenkins explains why his new approach of blocking everything that is not trusted and only allowing those applications that are approved, is a cleaner and more comprehensive approach to ensuring malware does not end up on your networks.
During this segment, Danny explains how he’s changing the entire approach and paradigm to cybersecurity.
This segment is sponsored by ThreatLocker.
To effectively protect your users from ransomware and zero-day exploits, visit https://www.securityweekly.com/threatlocker
Danny Jenkins, CEO & Co-Founder of ThreatLocker, a cybersecurity firm providing Zero Trust endpoint security, is a leading cybersecurity expert with over two decades of experience building and securing corporate networks, including roles on red and blue teams. He is dedicated to educating industry professionals about the latest cyber threats and frequently speaks on the topics of ransomware and Zero Trust.
What’s Next In Work From Home Security? – Stephen Boyer – BH20 #3
Security professionals need to be thinking of the next evolution of the approach from working from home, specifically focusing on the security of the home network for both employees and third party contractors. Stephen Boyer discusses how to rate the risk of these new attack vectors using data BitSight already has...
To request a security snapshot report, visit: https://securityweekly.com/bitsight
Stephen co-founded BitSight in 2011 and serves as the Chief Technology Officer. Prior to founding BitSight, Stephen was President and Co-Founder of Saperix, a company that was acquired by FireMon in 2011. While at the MIT Lincoln Laboratory, Stephen was a member of the Cyber Systems and Technology Group where he led R&D programs solving large-scale national cybersecurity problems. Before MIT, he worked at Caldera Systems, an early Linux startup. Stephen holds a Bachelor degree in Computer Science from Brigham Young University and Master of Science in Engineering and Management from the Massachusetts Institute of Technology.
The Paramedic’s Guide to Surviving Cybersecurity – Rich Mogull – BH20 #3
The security world is fraught with cases of mental health issues, burnout, substance abuse, and even suicide. We live in a world of threats and responses that trigger the deepest parts of our psyche; with the barriers between "online" and the physical world constantly crumbling. While some deal in theory, many of us deal with real incidents, challenges, and dangers every day and are constantly looking for techniques to respond better while staying saner.
Rich will share the lessons he learned in decades of emergency response and show how to apply them to your security career and daily practice to improve your effectiveness and mental resiliency.
With twenty years of experience in information security, physical security, and risk management, Rich is one of the foremost experts on cloud security, having driven development of the Cloud Security Alliance’s V4 Guidance and the associated CCSK training curriculum.
Developer Security Champions – Sandy Carielli – BH20 #3
Firms that want to secure applications are challenged by understaffed security teams and lack of security awareness on the part of developers. Developer security champions are developers who act as a security point of contact in their team, but programs to create and support them require investment and planning.
Sandy advises security and risk professionals on application and product security, with a particular emphasis on the collaboration among security and risk, product management, application development, operations, and business teams. Her research covers topics such as proactive security design, protecting modern and emerging application architectures, protection of applications in production environments, and embedding security throughout the product lifecycle.
Third-Party Risk Management (TPRM) – Alla Valente – BH20 #3
A firm’s network of third-party relationships can be a source of strength and an Achille’s heel, depending on the maturity of their risk management process. Companies have limited or no control over how third-parties secure their technology infrastructure, their applications, and their data, yet they're on the hook for breaches, cybersecurity incidents, and regulatory fines incurred.
Alla is a principal analyst at Forrester. Her research interests include governance, risk, and compliance (GRC), third-party risk management (TPRM), and contract lifecycle management (CLM), and Alla’s current research focuses on enterprise risk management (ERM), AI risk, and risk management frameworks. Alla helps Forrester’s security & risk clients establish strategy, adopt best practices, and select technology. Alla’s work has enjoyed wide exposure in the media, including in The Wall Street Journal, CNBC, and she speaks frequently at risk and executive conferences.
The Intersection of Security & Privacy Operations – Gabe Gumbs – BH20 #3
Are security operations teams prepared to respond to privacy threats? Although you can achieve security without privacy, namely keeping information safeguarded from those that should not have access, you can not keep data private without security. How can we address this challenge?
This segment is sponsored by Spirion.
Visit https://securityweekly.com/spirionbh to learn more about them!
As Spirion’s Chief Innovation Officer, Gabriel imagines and create technology that pushes data security technology forward in an increasingly complex digital world. Responsible for seeing where data security is going next and ensuring that organizations of all sizes are able to get there. With a 18+ year tenure in CyberSecurity, he has spent most of that time as a security practitioner, aligning security innovations with business objectives for Fortune 100 organizations, today Gabe is responsible for spearheading innovation across the organization through thought and product leadership.
