Best Of The World In Security

12-14 NOV, 2020 | 8 AM - 4 PM EST  |   Global Summit 

SACON

© Copyright 2020 | CISO Platform | SACON

A "No Sponsored" Talk Conference - By The Community, For The Community

“If I hadn't come, it would take another 2 to 3 years to learn and understand these tools”

“Very insightful, will definitely help us create a very effective security architecture”

“The principles .. gives a structure to the thought process”

This conference is put together for the security community by our team. It brings together top minds from the global security industry to engage in great security sessions, workshops and more..

8:30 to 9:00 AM

Registration

9:00 to 11:00 AM

(1 Day Workshop) : Artificial Intelligence & Machine Learning 

Introduction to Machine Learning - demystifying reality from hype and alphabet soup. This will include: 
a. taxonomy of machine learning 
b. model 
c. algorithms 
d. brief introduction to ML mathematics 
e. data 
f. architecture 
g. methodologies, 
h. measurement 
i. deployment   

11:00 to 11:30 AM

Break

11:30 to 1:00 PM

(1 Day Workshop) : Artificial Intelligence & Machine Learning 

Description of the project 
a. problem statement 
b. expected outcome 
c. data description and analysis 
d. challenges 
e. design model 
f. algorithm selecction 
g. technology selection 
h. report design      

CALL FOR SPEAKERS

SACON 4th edition - International Conference on  Security Architecture. Here are some points to keep in mind while submitting the form:

• We are looking for highly technical talks (demonstrations,code-level examples..etc are always welcome)
• The CXO track can have some high level strategic talks which can include Real Case Studies

Submit asap. Submission may close if enough good papers are received

WHO's SPOKEN

WHO COVERED US

WHAT ARE THEY SAYING

REGISTER FOR 2020

Who Should Attend: CISO, CRO, CIO, Information Security Experts,  IT Risk Professionals, Appsec Professionals ....

AGENDA AT A GLANCE

Mobile - We brought together best of the minds in the Security Industry

2019 SACON SPEAKERS

We brought together best of the minds in the Security Industry

We brought together best of the minds in the Security Industry

Don't Forget The Deadline For Submission Is 30th June

Overview of AI & Machine Learning for CISOs and how they're impacting the security landscape

Summary of Top Talks from prominent security conferences like RSAC, BlackHat, Defcon etc.

Overview of Deception Technology, Architecture & Key Components, Deployment Guidelines

Designing Multiple layers of Security Architecture, from Business Architecture to Technical Security Architecture

AI & Machine Learning for CISOs

Top talks from global conferences

Deception

Cybersecurity Reference Architecture Design 

Understanding Business / Management

 & Communicating with the Board

Understanding key management concepts so that you can align your security program with business priorities & Creating a reference board presentation template which you can use for 2018

Managing insider threats using behavioural analytics

Insider Threats

Security Threats Landscape for 2017

Evolution of Security Threats landscape & top 10 threats that were new in 2017

Top 10 Security Predictions for 2018

Based on our research, we'll be presenting top 10 predictions for 2018 for you to consider when making your plans

SOC

Reference architecture and overview of key components of a SOC, e.g.: SIEM, Honeypots, Data Sources, Integrations, Threat Intelligence, EDR, Forensics Tools etc.

IR - Incident Response

Building a framework & processes for managing cybersecurity incidents

Security  Architecture Workshop

Designing Multiple layers of Security Architecture, from Business Architecture to Technical Security Architecture

Cyber Range Drills

Wargame on responding to various types of security incidents at a strategic and operational level

Threat Hunting

Here we'll discuss the Key Components, Tool Set, Learning "Hunter" Skills and a Case Study

Cloud Security

Overview of Amazon’s approach to cybersecurity

AppSec

Creating a scenario of an organization and then use controls from OpenSAMM and BSIMM to choose the right elements of the AppSec program

Security Tech Landscape

Overview of new & emerging security technologies in the market and how the security tech landscape is shaping up

Overview of the IoT technology architecture and modelling threats & controls against different components (e.g.: Gateway)

Forensics

Workshop on how to do a comprehensive forensics examination post an incident, at endpoint & network level

SecDevOps

Leveraging the opportunity provided by DevOps to embed & automate security in the CI/CD processes

Startup Security

Startup Security Stack: Using 80-20 rule to build effective security strategy for a startup

Who Should Attend: CISO, CRO, Information Security Experts,  IT Risk Professionals, Appsec Professionals ....

AGENDA AT A GLANCE

IOT

SOC

Reference architecture and overview of key components of a SOC, e.g.: SIEM, Honeypots, Data Sources, Integrations, Threat Intelligence, EDR, Forensics Tools etc.

IR - Incident Response

Building a framework & processes for managing cybersecurity incidents

Security  Architecture Workshop

Designing Multiple layers of Security Architecture, from Business Architecture to Technical Security Architecture

Cyber Range Drills

Wargame on responding to various types of security incidents at a strategic and operational level

AGENDA AT A GLANCE

Who Should Attend: CISO, CRO, CIO, Information Security Experts,  IT Risk Professionals, Appsec Professionals ....

Threat Hunting

Here we'll discuss the Key Components, Tool Set, Learning "Hunter" Skills and a Case Study

Cloud Security

Overview of Amazon’s approach to cybersecurity

AppSec

Creating a scenario of an organization and then use controls from OpenSAMM and BSIMM to choose the right elements of the AppSec program

Security Tech Landscape

Overview of new & emerging security technologies in the market and how the security tech landscape is shaping up

Forensics

Workshop on how to do a comprehensive forensics examination post an incident, at endpoint & network level

SecDevOps

Leveraging the opportunity provided by DevOps to embed & automate security in the CI/CD processes

Startup Security

Startup Security Stack: Using 80-20 rule to build effective security strategy for a startup

AI & Machine Learning for CISOs

Overview of AI & Machine Learning for CISOs and how they're impacting the security landscape

Top talks from global conferences

Summary of Top Talks from prominent security conferences like RSAC, BlackHat, Defcon etc.

Deception

Overview of Deception Technology, Architecture & Key Components, Deployment Guidelines

Cybersecurity Reference Architecture Design

Designing Multiple layers of Security Architecture, from Business Architecture to Technical Security Architecture

IOT

Overview of the IoT technology architecture and modelling threats & controls against different components (e.g.: Gateway)

Insider Threats

Managing insider threats using behavioural analytics

Security Threats Landscape for 2017

Evolution of Security Threats landscape & top 10 threats that were new in 2017

Top 10 Security Predictions for 2018

Based on our research, we'll be presenting top 10 predictions for 2018 for you to consider when making your plans

Understanding Business / Management

& Communicating with the Board

Understanding key management concepts so that you can align your security program with business priorities & Creating a reference board presentation template which you can use for 2018

Do You Have An Interesting Security Technology To Showcase?

TECHNOLOGY DEMO ZONE

TECHNOLOGY DEMO ZONE

Do You Have An Interesting Security Technology To Showcase?

MEDIA PARTNERS

*Special Discount May Be Available For Pre-Registrants & Past Event Attendees (Email invite only). All Prices exclusive of taxes

IMMUTABLE ARCHITECTURE WORKSHOP

Speaker : Nilanjan De

About Speaker : Currently CTO at FireCompass. He has multiple patents in IT Security and has discovered multiple well known Zero Day vulnerabilities which are listed in CVE. He’s an alumnus of IIT Kharagpur. He’s well-known in the security community and has published several exploits and advisories for the first time in the world

Agenda : 

1. Immutable Infrastructure - Fundamentals, Immutable Servers, Semi-Immutable Servers, Phoenix Servers etc.

2. Advantages & Drawbacks Of Immutable Infrastructure

3. How To Implement ? Immutable Containers

4. Demo. Tools & Technologies

5. Serverless Architecture

1:00 to 2:00 PM

Lunch

2:00 to 4:30 PM

(1 Day Workshop) : Artificial Intelligence & Machine Learning 

-Setup environment, create low level design, coding          

4:30 to 5:00 PM

Break

5:00 to 5:30 PM

(1 Day Workshop) : Artificial Intelligence & Machine Learning

-Run training, test, measure result, create visual presentation of result, any other discussion        

Day 1 : 18th May

Day 2 : 19th May

9:00 to 11:00 AM

(1 Day Workshop) : Exploring Darkweb For Threat Intelligence  

-Introduction - Learn and understand the difference between Clearnet and Darknet. Darknet, Deepweb , Darkweb - what they mean. 
-Operational security before entering the darker side of internet

11:00 to 11:30 AM

Break

11:30 to 1:00 PM

(1 Day Workshop) : Exploring Darkweb For Threat Intelligence 

-Understand Darknet entry points 
-Setting and configuring the Darknet Entry Points (Tor, Zeronet etc) 
-Tor Hidden Services; Using Tor Web Proxies         

1:00 to 2:00 PM

Lunch

2:00 to 4:30 PM

(1 Day Workshop) : Exploring Darkweb For Threat Intelligence              

-Darknet /Deepweb Search Engines              
-Exploring the Darknet – Darknet Economies (Cyber Crime Markets, Drug and Arms Markets, Counterfeit and Fake Currency Markets,Terrorist and Jihadist Presence)
-Utilizing Darknet as definitive source for Threat Intelligence 9. 
-Q&A        

(Note : Agenda may undergo changes under unavoidable circumstances)

10,000+

65+

100+

15+

Attendees

Speakers

CISO/CIO

Trainings

Click Here To See More Testiomonials

MEET OUR PAST SPEAKERS

We brought together best of the minds in the Security Industry

PREVIOUS SACON

Click Here For May 2018

Click Here For May 2017

Click Here For November 2016

Click Here For May 2016

- Manoj Kuruvanthody, Infosys

- Vijay Kumar Reddy, L&T Infotech

- Anil Kumar, DTDC

Click Here For Nov 2017

COMPANIES THAT ATTEND

"No Sponsored Talks"

Call For Speaker

Some of the best minds in the security industry present at our conferences. An ideal profile is found to be trainers, presenters at top security conferences. The quality of your presentation determines success. If your talk is submitted post deadline..we will consider it for the next time

This is a community by the community and for the community, led by community members and not by vendors. There are no sponsored talks and anyone who has a thought to share with the community which the cyber security community will learn from is welcome to share their thoughts through a workshop or a Ted style short talk. The event is free for one to participate. Needless to say the talk needs to be high-quality and no promotions are allowed. No commercial tools only open source

Inspire, Share, Network

40K+ Security Professionals

Establish Your Brand

'Best Of The World' Series

Become A Trusted Expert

By Sharing Your Knowledge

Extend your reach and connect with world's foremost security experts and professionals

'Best Of The World In Security' designates the best minds in security who have exceptional contributions

Become a trusted expert on topics relevant to your industry. Establish you and your company as trusted and respected experts

SOME PAST TALKS

This conference celebrates the foremost security researchers and trainers in the world. This is co-hosted by CISO Platform and SACON with 40,000+ global security professionals. Our vision is to promote collaborative and cooperative learning with the best of the minds in Cyber Security.

'Best Of The World In Security'

Terry Cutler

MEET OUR FIRST 40+ SPEAKERS

We brought together best of the minds in the Security Industry

Myrna Soto

Chief Strategy Officer, Forcepoint
CISO Platform 100 Influencer

Magda Chelly

Head Cyber Consulting, Marsh Asia
Founder WoSEC Singapore

Gregory Touhill

CISSP, CISM, President, Appgate Federal
First CISO, USA Government

Sanjay Nagaraj

CoFounder, Chief Technology Officer, 
Traceable.ai

Dan Lohrmann

CSO, Security Mentor
Author, Blogger, Influencer

Ed Adams

President,
Security Innovation

Rewanth Cool

Security Consultant, Payatu
ML, DevSecOps

Abhay Bhargav

DevSecOps
We45

Javier Vazquez Vidal

Security Lead
Noelscher Consulting GmbH

Lars Hilse

Political Advisor To Governments
Cyber Security, Defence

Hrushikesh Kakade

OSCP Honoured
Payatu Trainer

Renata Budko

Head Of Product, Traceable
Cloud, Security, Mobile Infrastructure

Inon Shkedy

OWASP Trainer & Contributor
Traceable AI

William Martin

CISSP, Security Researcher
Defcon 26 Speaker

Murray Goldschmidt

Cyber Capability Education and Training | Cyber CX

Jonathan Pollet

Founder
Red Tiger Security

Amit Modi

Manager
Industry Expert

Satish S

Security Manager,
Security Innovation

Meetali Sharma

Head Risk, Compliance, Infosec
SDG Corporation

Harshit Agrawal

Security Researcher
RF & IoT Security

Chinthakindi Vishwanath

CEH | Cyber Security Trainer

Ashu Sharma

Malware Analyst,
Mindtree

Akhil Reni

CTO
WeSecureApp

Peter Stephenson

Author, Researcher, Trainer
Cyber Security, Digital Forensic

Asmita

IoT Security Cnsultant
Payatu

Himanshu Mehta

Senior Security Researcher
Digital14 | Xen1thLabs | speaker RSAC USA

Vinod Babu B

Cyber Security Architect
Cyber Crime, Dark Web

Prakash Ashok

AppSec Engineer
WeSecureApp

Krishna Nuthakki

Cyber Security Analyst
WeSecureApp

Ravi Ayappa

Principal Consultant Cybersecurity & Risk Advisory

Roshna Khalid

Cybersecurity Trainer
CEH

Jitendra Chauhan

Head Of Research
FireCompass

Apoorv Saxena

Red Team Researcher
FireCompass

Avishag Daniely

Senior Director
Guardicore

Zainab Al.Sheheimi

CEO & Consultant trainer
Etteqa for Cybersecurity Services LLC

Katy Westlun

Cybersecurity Specialist
IT Awareness, Red Team

Mirza Asrar Baig

Founder
CTM360

Rohitanshu Singh

Security Innovation, Security Engineering Manager

Sashank Dara

Consultant
Co Founder and CTO at Seconize

Founder, Cyology Labs
IFSEC Global Influencer 2020
CISO Platform 100 Influencer

Agenda Overview

Keynote : Why Zero Trust Yields Maximum Security (Gregory Touhill)

Keynote : The Human Element (Myrna Soto)

Keynote : Cybersecurity Horror Stories (Terry Cutler)

Keynote : Cyber Security Awareness & Preparedness (Dan Lohmann)

TED Talk : Rethinking Application Security For Cloud-Native Era (Sanjay Nagaraj)

TED Talk : Zero Trust In Application Security (Renata Budko)

Workshop : RFID Security in Corporates (Rohitanshu)

Workshop : Web hacking using Cyber range (Satish S)

Workshop : Managing Next Generation Threats to Cyber Security (track: Next Generation Challenges) (Peter Stephenson)

Workshop : Unlocking Secrets of Android Application Hacking (Rewanth Cool, Hrushikesh Kakade)

Workshop : Hardware Security on Vehicles (Javier Vazquez Vidal)

Workshop : Practical Reverse Engineering with Radare2 (Sanoop Thomas & Samandeep Singh)

Workshop : Telecom Security (Harshit Agarwal, Himanshu Mehta)

Workshop : Network scanning, sniffing, VAPT (Mithun Verma)

Workshop : A stroll through the kill-chain (William Martin)

Workshop : API security for developers and pentesters (Inon Shkedy)

Workshop : Scenario based cyber training (Murray Goldschmidt, David Halfpenny, Kirk Nicholls)

Workshop : How to Perform Penetration Testing on Industrial Control Systems and Operational Technology Safely (Jonathan Pollet)

Here's a few sessions to give you an idea about what amazing is going to be covered. There are more sessions..we will keep updating

Unlocking Secrets Of Android Application Hacking

Introduction : This course aims to focus on providing the necessary hands-on experience to developers, pentesters, and security consultants to assess their Android Pentesting skills by hacking an advanced customized android application.For this purpose, we exclusively developed an open-source Damn Vulnerable Banking Application, a clone close to real-world banking applications. By the end of this workshop, the participants will be able to assess android application security from both an offensive and defensive point of view

Featured Trainings

Agenda :

Linux Internals
Boot Process
Filesystems
Processes
Android Internals
Android Architecture
Security Architecture
Application Internals
Application Structure
Application Components
Environment Setup
Android Debugging
Android Debug Bridge
Static Analysis
Application reversing
Analysing SMALI codes
Challenge 1 - Basic Smali Challenge
Dynamic Analysis
Intro to Frida
Challenge 1 - Basic Frida Challenge

Attendee Requirement : 
Laptop with 60+ GB free hard disk space 8+ GB RAM
Windows 8.1+ OR Ubuntu 16.x + (64 bit Operating System)
Intel / AMD Hardware Virtualization enabled Operating System
Administrative access on your laptop
rooted android device/emulator installed

Hrushikesh Kakade
Payatu, Trainer, OSCP Honoured
Multiple CVEs

A Stroll Through The Kill Chain 

Introduction : This is a deep dive talk on penetration testing, and provides a first-person view of an attacker traversing through an environment. In a purple team styled seminar, we will take a deep dive on each of the steps in kill chains used to compromise environments. While viewing the first-person attacker perspective, we will also show what forensic data is being created and what protections could be placed to identify & terminate the attack. This talk is for any who are new to penetration testing, or those who have never seen one being conducted first hand 

Agenda :

> Penetration Testing Types & Methodologies
> Preparing For A Test
> External Network Attacks & Killchains
> Endpoint Compromise, Evasion, and Enumeration
> Internal Network Attacks & Killchains
> Environment Hardening & Detection Tuning

Attendee Requirement : 

Attendees should have a basic understanding of networking, logging & monitoring, active directory, and endpoint security. No special equipment will be required 

How To Perform Penetration Testing On Industrial Control Systems And Operational Technology Safely 

Introduction : Industrial control systems (ICS), including supervisory control and data acquisition (SCADA) are found in many national critical infrastructure industries such as oil and natural gas, electric utilities, transportation, petrochemical and refining, water and wastewater, pharmaceutical, and manufacturing. Due to the high availability nature of these systems, any security testing must ensure that these systems are not affected operationally. Traditional IT Penetration Testing techniques are too harsh and potentially damaging to these sensitive systems. This educational presentation will first provide an overview of how ICS systems work, their vulnerabilities, and threats to these systems. The second part of this short training course will dive into proven methodologies and tools that our team has used to safely perform penetration testing on these systems. Lastly, this talk will conclude with best practices to secure and defend ICS and OT systems from cyber incidents  

Agenda :

ICS Systems Overview
> ICS Inputs, Outputs, and Sensor Networks
> Controllers, Embedded Systems and Protocols
> SCADA and ICS Protocols
Penetrating ICS Systems Safely
> Recent Threats to ICS-SCADA Systems
> ICS System Testing Methodology
> Penetration Testing ICS Systems - OSINT and Internet Layer
> Penetration Testing ICS Systems - Corporate Layer
> Penetration Testing ICS Systems - OT DMZ and HMI Layers (3 and 2)
> Penetration Testing ICS Systems - ICS Protocols and Controllers Layer
ICS Defense-in-Depth and Risk Management Strategy
> SCADA DMZ Design and Network Segmentation
> SCADA Remote Access Design Considerations
> Deployment of IDS/IPS - Including Custom Signatures
> Security Event Monitoring and Logging for SCADA
> Overview of Security Frameworks that impact SCADA (NIST 800-53, NIST 800-82, ISA S99, CFATS, NERC CIP)

Attendee Requirement : 

C-level Management
Risk and Internal Audit Teams
Industry Analysts
IT Directors and Senior Management
IT Staff
Penetration Testers
SOC Analysts
Plant Management and OT Supervisors
Plant Engineers and System Integrators

API Security For Developers And Pentesters  

Introduction : This session will cover the API Security field from two different perspectives. The first part will be dedicated to the OWASP Top 10 for APIs and how developers who use modern technologies, such as cloud, CI/CD and SPA should think about API security. The second part will show you how the new concepts can help you as a Pentester or a bug bounty hunter to find more critical vulnerabilities in a more efficient way   

Agenda :

Most of the modern applications that have been developed in the last years deeply rely on APIs, including web, mobile and IOT apps. APIs are different from traditional web servers in many ways.
OWASP has acknowledged this shift in threats and has announced the OWASP API Security Project. The project addresses modern API threats and provides mitigation techniques.
Come learn from the leader of the project about the OWASP Top 10 For APIs and how they are different from traditional top 10 lists and see examples for complex API exploits

-Understand the underlying implementation of the application from the API traffic
-Detect potential vulnerable points in APIs
-Advanced exploitation techniques for: BOLA(IDOR), Mass Assignment, BFLA, Excessive Data Exposure and more.
-Examples for complex API exploits, which involve many steps
-Perform a successful and effective pen test in modern applications

Attendee Requirement : 

Anyone can attend

Scenario Based Cyber Training  

Introduction : A hands on workshop showcasing examples of simulation and experiential Learning to develop a cyber skilled workforce. This workshop will make a research-based case for using scenario based simulations and other experiential learning techniques to improve the cyber capabilities in your organisation. In a showcase of practical exercises you'll participate in cyber escape rooms, cyber ranges, incident response and crisis simulations. Reset your expectations for what cyber security training can and should be for everyone in your organization: the front desk, the call center, technical roles, management, the board of directors and everyone in between. Everyone has a role to play in cyber security, so let them roleplay.   

Agenda :

-Workshop Introduction
-Simulations and experiential learning, what it means and why it works
-Cyber Security Escape Room (active participation required)
-Introduction to cyber ranges for training
-A cyber range sampler (active participation required)
-Introduction to crisis simulations
-IR/Crisis Simulation (active participation required)
-Debrief + Q&A

Attendee Requirement : 

Anyone can attend

Managing Next Generation Threats to Cyber Security  

Introduction : The emergence of next generation technology into the cyber security space has added complications and challenges on several levels.  When we talk about next generation technologies we should mean those associated directly with artificial intelligence (AI) and associated components such as machine learning (ML).  Unfortunately, many organizations opt to hype current generation products as next gen. In this workshop we will begin by exploring what we need to know about AI and its components. We will dispense with the marketing hype and get down to the facts.  Then we will look in detail at a few available tools that truly are next gen - and what makes them next gen - followed by a discussion of where the adversary is going with AI, ML and other next gen technologies. We will wrap up with research from my upcoming book which discusses the collision between the law and cyber science. In this section we also will address some governance issues that you need to know.

Agenda :

-Introduction - sorting out the next gen hype from the next gen facts and a few definitions
-Picking your tools - are they really next gen and how do you know - do you need next gen tools and why or why not - some examples with short demos
-Is the adversary using next gen technologies, how do we know and what should we do? Some demos
-The law and cyber science - are we ready to prosecute the next generation of adversary - what are we doing now and what's wrong with it - do we need a whole new set of laws? - How does this affect our governance?

Attendee Requirement : 

Mid-level or higher security specialist, technology attorneys, cyber law enforcement

How to Build Effective SoC   

Introduction : This session will help individuals to get the indepth details on SoC and how they can build the SoC which can be Business Enabler in their organizations. This session will also give them the information on How can they evaluate some of the main components before they finalize them and consider them into the SoC Environment

Agenda :

-What is SoC - including three pillars of SoC
-What is Expected Out of SoC
-Technologies Involved
-SIEM Evaluation Criteria
-How to Increase SoC Maturity
-How to Define the Use Case
-How to Build the Use Case
-How to Build the SoC Processes
-How SoC can be a Business Enabler
-MSSP Vs. On Premise SoC
-Key Consideration to run it Effectively
-How to Perform Incident Management
-How to Automate Incient Management
-Challenges of SIEM
-Evolution & Role of SOAR in Incident Management
-Advantages of SOAR
-Key Elements to Look For in SOAR
-SOAR Evaluation Criteria

Attendee Requirement : 

Anyone can attend

Telecom Security   

Introduction : This workshop aims to give an intermediate-level understanding of the potential risk associated with cellular mobile communication networks and the security issues in the radio access network. In particular, we begin with a brief history of Telecom, fundamentals of mobile network, radio signals, the security architecture of GSM/UMTS/LTE, cellular network attack detection methods, and security vulnerabilities with possible practical examples with case studies

Agenda :

Radio Signals Fundamental Concepts
Mobile Network and Antennas
Mobile Internal Architecture (Telecom Perspective)
Introduction to mobile networks and protocols (2G/3G/4G)
Authentication, Privacy, and Encryption Algorithms
Signaling Channels
IMSI Catching and Detection
SIM Architecture and AT Commands
Attack surface on user equipment and core network
BTS setup 2G, 3G, and 4G for specific need with Software-Defined Radio
Case Studies

Attendee Requirement : 

Anyone with an interest in the topic and who wants to understand the basics of Telecom Security. If available an RTL-SDR or an SDR device.

Himanshu Mehta   
Xen1thLabs, Senior Security Researcher 

Hacking IoT With EXPLIoT Framework   

Introduction : This workshop is for Pentesters, security researchers or someone looking to get into IoT security but is reluctant due to the wide range of technologies involved and plethora of different tools. While it does require a considerable amount of knowledge in the domain, it is not as difficult as you may think. In this workshop we will introduce you to some of the important concepts and EXPLIoT framework  in a very simple way that can be used for the various IoT attack vectors. The primary focus of this workshop is to introduce the attendees to the open source IoT Security Testing and Exploitation Framework - EXPLIoT and enable them to use as well as extend it by writing plugins for new IoT based exploits and analysis test cases. It’s a flexible and extendable framework that would help the security community in writing quick IoT test cases and exploits. The objectives of the framework are:
1. Easy to use
2. Extendable
3. Support for hardware, radio and IoT protocol analysis
EXPLIoT currently supports the following protocols which can be utilized for writing new plugins/exploits:
1. Radio – BLE , Zigbee
2. Network – MQTT, CoAP, DICOM, MODBUS, MDNS, NMAP, TCP, UDP
3. Hardware – CAN, SPI, I2C, UART, JTAG
This talk would give attendees a first-hand view of the functionality, how to use it and how to write plugins to extend the framework

Agenda :

- IoT Attack Surface
- EXPLIoT Framework
-- Architecture
-- Executing plugins
-- Extending the framework by writing your own plugins
- MQTT
-- Protocol
-- Security issues
-- Hands-on with plugins
-- Write a custom Plugin
- Plugin Demos
-- BLE plugins Demo
-- Zigbee Demo
-- I2C Plugins Demo

Attendee Requirement : 
#Prerequisites
- Knowledge of generic security testing (web, mobile or infra)
- Knowledge of Python
- Knowledge of Linux
- Laptop with Linux OS and EXPLIoT installed ($ sudo pip3 install expliot) and install eclipse mosquitto for hands-on
*Any change in attendee requirement (software installations) woulde be updated 3-4 days before the training.

Asmita 
Payatu, IoT Security Consultant

RFID Security In Corporates   

Introduction : This workshop will talk about various security aspects about RFID’s system implementation in corporates and how an unauthorised user could leverage it to their  profit. This workshop is geared towards beginners who would want to understand RFID systems and its security aspects with no prior or limited knowledge about it. This session covers all the fundamentals to start with RFID systems and explore the stream from a Security standpoint

Agenda :

Introduction
  Hardware Requirements
  Quick Overview of Arduino
  Installing Arduino IDE
  RFID LAB Setup
  What is RFID
Working Principle
  RFID Transceiver
  RFID Transponder
  Operating frequency range
Exploring various Frequencies
  Low Frequency RFID
  High Frequency RFID
Security Analysis
  Reversing EM4100 Protocol
  Mifare Classic 1k Dissection
  Cloning RFID Tags

Attendee Requirement : 

This session will be more demo driven, which does not have any specific hardware requirements, any device capable of audio/video is fine. The instructor will be demonstrating all the practicals in their own lab with life demo feed for audience.

Rohitanshu Singh
Security Innovation, Security Engineering Manager

Web Hacking Using Cyber Range    

Introduction : Bring out the hacker in you by trying out Security Innovation’s Hacking CyberRange – specially designed web applications with real world vulnerabilities. A parallel class session will also teach novices about how to uncover simple vulnerabilities and evolve into uncovering more complex vulnerabilities. You can simply sit and learn or get straight to hacking our application or follow along and do both. Live scores of participants will be displayed.

Agenda :
Introduction to CyberRange
Introduction OWASP top 10
Cross-Site Scripting Attacks
Cross-Site Request Forgery
SQL Injection Attacks, error based, time based and data exfiltration using SQL Injection
Insecure File Upload Attacks
Privilege Escalation

Attendee Requirement : Laptop and Laptop Charger. Any web browser, Proxy tool such as OWASP Zap (https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) or Burp Proxy Free (https://portswigger.net/burp/communitydownload).

Satish S 
Security Innovation, Security Engineering Manager

Hardware Security On Vehicles   

Introduction : We are all aware of the current risks when developing a connected product, especially with vehicles since much is at stake both from an information and safety perspective. In this workshop, we will learn how to build Security requirements, architect, design, test and  produce Safety and Security critical components using a methodology that works in harmony both with Engineering and Security

Agenda :

Introduction to Product Security
Understanding the threats
Security requirements
Scope
Hardware
Software and Data
Working with engineering teams
Security Architecture
Hardware
Communication lines/buses and their data
Software
System design
Hardware
Working with requirements
Testing
Testing the hardware security
Testing the software/data security
Production
Security risks in production
Questions

Attendee Requirement : 
Basic understanding of the development cycle of an electronic device.
Basic understanding of Data Protection laws and ISO26262
Basic understanding of Hardware and Software development would be desirable but not required

Javier Vazquez Vidal   
Product Security expert

Web Application Penetration Testing   

Introduction : Introduction of Ethical Hacking, Life cycle of Hacking, Introduction of Penetration testing, Steps in Penetration Testing, Foot printing Module, Scanning Module, Live Demos on Finding Vulnerabilities a) Bypass Authentication b) Sql Injection c) Cross site Scripting d) File upload Vulnerability (Web Server Hacking) Countermeasures of Securing Web applications

Agenda :
-vulnerabilities of web application and how to report the issues to concern department.
-vulnerabilities:
-Bypass Authentication
-SQL injection
-Cross site scripting
-File upload Vulnerabilities

Attendee Requirement : 
Anyone can attend

Vishwanath Chinthakindi  
IBM, Cyber security consultant

A Tutorial On Advanced Malware Analysis    

Introduction : Very often people call everything that corrupts their system a virus without being aware
about what it actually means or accomplishes. This tutorial systematically gives an introduction to the different varieties of samples that come under the wide umbrella known as
malware, their distinguishing features, prerequisites for malware analysis and an overview of
the malware analysis process.

Agenda :

1. Why perform Malware Analysis?
2. How does antivirus software work?
3. How to do basic Malware Analysis?
4. What are Static Malware Analysis tools available?
5. What are Dynamic Malware Analysis tools available?
6. What Next?
Learners will be taught to use existing tools and techniques and also some recent researches
will be discussed in the tutorial

Attendee Requirement : 
Researcher, Student, Academician or people from corporate, who have the knowledge of Operating
system (WINDOWS) and basic understanding of Assembly codes & C programming language.

Dr. Ashu Sharma 
Mindtree Ltd, Technical Specialists: Malware Researcher

Dark Web Vulnerabilities & Cryptocurrencies In Cyber Crime 
   

Introduction : Darknet is a mysterious place that can be accessed through the internet and this is turned out to be a notorious pavilion of crimes spread across the world. The onion router relays of TOR network with dynamic entry and exit nodes had built strong and complex security walls for the dark web. The dark web is no more just bothering of Law Enforcement Agencies but for everyone

Agenda :
Overview on Internet, Deep, Dark Web.
Dark Technology Strengths and Weaknesses.
Tactics Techniques and Procedures on Darknet.
Top 10 Crimes, Threat Vectors & Actors on Darknet.
Impact and Legal Implications of Darknet.
Darknet stores & sites listing.
Darknet finances.
Darknet links to the physical world.
How to identify and trace the darknet websites.
Way forward to protect from darknets.
* Includes conceptual explanation and tool demos.

Attendee Requirement : 
i7 Laptop with 8 gb ram or above

B. Vinod Babu 
Ryna Technologies Pvt Ltd, Director

DevSecOps    

Introduction : Managing comprehensive security for continuous delivery of applications across organizations continues to remain a serious bottleneck in the DevOps movement. The methodology involved in implementing effective security practices within delivery pipelines can be challenging. This talk is designed to give a practical introduction of implementing Security across Continuous Delivery Pipelines by leveraging the plethora of cloud offerings and is backed by a ton of hands-on labs, original research and real-world implementations of DevSecOps that work.

Agenda :

-DevOps and the role of Security:
-Agile and DevOps Intro
-DevOps without Security - Issues
-A move towards DevSecOps and Secure SDLC
-Pre-Commit and Commit-Time Security:
-SAST and SAST Automation Strategies for --DevSecOps
-SCA and Automation Strategies for DevSecOps
-Commit and Test-time Security
-DAST and Automated Dynamic Scanning
-Additional DevSecOps Practices
-Agile Threat Modeling for DevSecOps
-Container Security and Automation

Attendee Requirement : Laptop with latest browser is good enough

Monitoring Secrets Everywhere - Application & Cloud Security 
   

Introduction : Over the last few years, we have seen how organizations were being compromised by small mistakes made by their employees like leaving secrets on public code repositories, inside container images, AMIs or even AWS user-data. In this talk Akhil and Prakash will walk you through some of the well known breaches, process failures, solutions, and one automation to rule them all.

Agenda :
-Know about a few breaches
Get to know about few breaches that happened with major enterprise companies in the past due to secrets being leaked publicly.
-Scoping your organization
Get to know how to scope your organization across people, technology, and processes as a first step before actually starting the scans to find secrets.
-Scanning for secrets across your organization
Learn about open-source tools used to perform scanning across GIT repos, Container images, AMIs & other related stuff.
-Case study
Get to know how we scaled this kind of automation to find over 10,000+ secrets across the whole organization and bought it down below 500 in just a couple of weeks.
-Automation
Learn automating the scanning using various bash & python scripts, connect with your favorite orchestration tools such as Jenkins or learn to write some pre-commit hooks to avoid committing secrets.

Attendee Requirement : 
Participants will need to have a little bit of experience with version control, cloud & container envs, orchestration and a bit of Bash or python scripting

Akhil Reni 
CTO, WeSecureApp

Prakash Ashok 
Cyber security professional , WeSecureApp

Krishna Nuthakki 
Sr. Cyber Security analyst , WeSecureApp

Shifting From Pentest To Continuous Automated Red Teaming (CART) 
   

Introduction : Shifting from Pentest to Continuous Automated Red Teaming (CART) will talk about Build on Foundation - Strategic Red Teaming Foundation of Red Teaming Red Teaming Maturity Model and Self Assessment Building Red Teaming Organization State of Internet Security & Cyber Kill Chain Later will be Hands On - Tactics, Tools, and Procedures Reconnaissance & OSINT Infrastructure Web Applications Deep and Dark Web Other Advanced OSINT Techniques Multi Stage Attacks Attacking Cloud Attacking Containers Phishing Simulation Credential Stuffing Other Advance Attack Techniques

Agenda :
Day 1: Build on Foundation - Strategic Red Teaming
Foundation of Red Teaming
Red Teaming Maturity Model and Self Assessment
Building Red Teaming Organization
State of Internet Security & Cyber Kill Chain

Day 2: Hands On - Tactics, Tools, and Procedures
Reconnaissance & OSINT
Infrastructure
Web Applications
Deep and Dark Web
Other Advanced OSINT Techniques
Multi Stage Attacks
Attacking Cloud
Attacking Containers
Phishing Simulation
Credential Stuffing
Other Advance Attack Techniques

Attendee Requirement : Click Here

Jitendra Chauhan 
Principal Architect, Firecompass

Apoorv Raj Saxena 
Red team researcher , Firecompass

Running Secure Businesses In the Cloud 
   

Introduction : Running Secure Businesses in the Cloud” would give a detailed insight to  Business managers, IT Security  professionals and IT Managers in the industry on how the People, Process and Technology aspects of the implementation of Cloud Security would be a force multiplier to run a secure business . The session would cover in detail, an overview of Cloud Security, guidance to IT and Business Managers on how to align Cloud Security controls to the Business using by implementing the 14 Security Domains per the ISO Standard . The Security features and components of Microsoft Azure and Amazon Web services (AWS) have also been discussed to illustrate implementation of security controls.

Agenda :
1. Cloud Security Overview
a. Cloud Types
b. Demand drivers for the Cloud
c. Challenges
d. Consumer & Vendor Responsibility
e. Top Threats
f. Data Security
g. Virtualization Security
2. Aligning Cloud Security to the Business (ISO 27002:2013 & ISO 27017:2015)
a. Information Security Organization and Management
b. Human Resources Security
c. Asset Management
d. Access Control
e. Cryptography
f. Physical and Environmental Security
g. Operations Security
h. Communications Security
i. Systems Acquisition Development and Maintenance
j. Third Party Security
k. Incident Response Management
l. Information Security Aspects of BCM
m. Compliance
3. Microsoft Azure Overview
a. Security Features
b. Security Components
4. AWS Overview
a. Security Features
b. Security Components

Attendee Requirement : None

Dr Ravi Ayappa 
Principal Consultant (Cyber Security & Risk Advisory Services)

Cloud Security: Limitations Of Cloud Security Groups And Flow Log  
   

Introduction : Cloud Security Groups are the firewalls of the cloud. They are built-in and provide basic access control functionality as part of the shared responsibility model. However, Cloud Security Groups do not provide the same protection or functionality that enterprises have come to expect with on-premises deployments. In this talk we will discuss the top cloud risks in 2020, why perimeters are a concept of the past and how in the world of no perimitiers do Cloud Security groups, the "Cloud FIrewalls", fit it. We will practically explore Cloud Security Group limitations across different cloud setups from a single vNet to multi-cloud

Agenda :
Top Cloud Security Risks in 2020
Segmentation, Compliance and Visibility - Cloud Security Groups (Azure, AWS, GCP)
Familiarizing with Azure Terminology:
NSGs and ASGs
Flow Logs
VNets
Limitations of Azure Security Groups within a single vNet
Limitations of Azure Security Groups across multiple vNets and Regions
Limitations of Security Groups in Multi-Cloud

Attendee Requirement : Laptop, Internet Connection. Azure Free Account

Avishag Daniely 
Senior Director, Guardicore

Ethical Hacking 

Introduction : The Internet is home to seemingly infinite amounts of confidential and personal information. As a result of this mass storage of information, the system needs to be constantly updated and enforced to prevent hackers from retrieving such valuable and sensitive data. This increasing number of cyber-attacks has led to an increasing importance of Ethical Hacking. So Ethical hackers' job is to scan vulnerabilities and to find potential threats on a computer or networks. An ethical hacker finds the weakness or loopholes in a computer, web applications or network and reports them to the organization. It requires a thorough knowledge of Networks, web servers, computer viruses, SQL (Structured Query Language), cryptography, penetration testing, Attacks etc. In this session, you will learn all about ethical hacking. You will understand the what ethical hacking, Cyber- attacks, Tools and some hands-on demos. This session will also guide you with the various ethical hacking certifications available today.

Agenda :
Ethical hacking and its Importance
• Types of hackers and Need for ethical hackers
• Ethical hacking steps and Tools
• Installing Kali Linux , basic commands demo
• Phishing demo, SQL demo, firewall
• Metasploit attack
• Skills of an ethical hacker
• Certified ethical hacker v10(CEH)
• Why CEH certification
• Other ethical Hacking certifications and Ethical Hacking Career

Attendee Requirement : None

Roshna Khalid T 
Cyber Security Trainer, CEH

Cyber Security Governance 

Introduction : Most organizations have good enterprise-level security policies that define their approach to maintaining, improving, and securing their information and information systems. However, once the policies are signed by senior leadership and distributed throughout the organization, significant cybersecurity governance challenges remain. In this workshop I will explain the transforming organizational security to strengthen defenses and integrate cybersecurity with the overall approach toward security governance, risk management and compliance.

Agenda :
What is Cybersecurity Governance?
Cybersecurity Governance Principles
Cybersecurity Transformation
Establishing Cybersecurity Governance

Attendee Requirement : Background in cyber security management

Zainab Al. Sheheimi 
CEO & Consultant trainer, Etteqa Cybersecurity Services

Reengineering Cybersecurity: A New Approach To Save A Losing Cyber War

Introduction : The challenges of enterprise security are only growing every day; moreover, they continue to outpace the defenders. The risks are high, but so are the stakes motivating the acceleration of digital transformation on the 4th industrial revolution journey. Enterprise security is a significant factor in the success and a board-level agenda item. We continue to spend more on Security, and yet our losses are exponentially increasing and the risks are high. Though there are enough security technologies deployed inside the network in the current approach to managing cyber risks, it seems the external aspect is getting much lower attention than the required. .Complementary to this ideology, here are a few interconnected concepts to enhance cybersecurity and win this losing war.

Agenda :
Redefining Cybersecurity
Defining roles of IT, Information, and Cybersecurity.
A comparison of the physical world's security and the virtual world.
Offensive Defense
Complementing the defensive layered approach of security with Offenses outside of the network perimeter.
Threat Intelligence
Importance beyond Indicators of Compromise. A closer look at Indicators of Exposure, Warning & Attack
Why TTP's are more important than IOC's
Takedown ++
Identifying and mitigating all possible data attributes that are part of an attack apart from the typical takedowns.
Leveraging AI and Automation
Comprehensive DRP Stack
A proposed all-inclusive technology stack to cater to all areas in cyberspace.
Playbooks
Whilst end-users may look to adopt playbooks within their internal environments via SOAR/SEIM, the same can be applied in Cyberspace.

Attendee Requirement : None required, just access to the internet with a notebook and pen

Mirza Asrar Baig
Founder & CEO, CTM360

Featured Keynote

Why Zero Trust Yields Maximum Security

Abstract : In this provocative and sometimes irreverent presentation, retired Brigadier General Greg Touhill, the United States government's first federal Chief Information Security Officer, will discuss why the legacy perimeter defense model has been overwhelmed and made obsolete by the advent of modern mobility and cloud computing. He'll demonstrate how to make the business case that the shift to the Zero Trust security strategy is now essential for businesses to survive and thrive in today's highly contested global digital economy.

Cybersecurity Horror Stories

Abstract : Join white-hat hacker Terry Cutler, Founder & CEO of Cyology Labs, to share your stories of the incredible cybersecurity gaffs you’ve seen – and how they could have been avoided. We’re not naming names in this session, but bring along your favourite (true) story of the disaster that should have been averted.

Why Zero Trust Yields Maximum Security

Abstract : In this provocative and sometimes irreverent presentation, retired Brigadier General Greg Touhill, the United States government's first federal Chief Information Security Officer, will discuss why the legacy perimeter defense model has been overwhelmed and made obsolete by the advent of modern mobility and cloud computing. He'll demonstrate how to make the business case that the shift to the Zero Trust security strategy is now essential for businesses to survive and thrive in today's highly contested global digital economy.

Risks Of Cyber Terrorism

Abstract : Natanz was probably the first noteworthy cyber-physical attack, in which the barrier between cyber and physical instruments (network connected infrastructure) was breached. The attack on TV5MONDE, in which their 11 satellite feeds were cut and their social media channels taken over, was pretty much along the line of what I published in an article called “ISIS Cyber Terrorism Analysis”, which outlined this attack vector.What these attacks had in common, also with the attack on the German Chancellery a few months later, was that they were all based on social engineering, meaning that the exploit was delivered by email or otherwise introduced by human elements inside the target. This, combined with the factors outlined before, presents a grave threat to organizations. My keynote will focus on explaining this combination of threats, along with other possibilities in cybercrime which are increased by the anonymizing characteristics of the dark web and bitcoin.

Zero Trust in Application Security 

Abstract : The concept of zero-trust, previously mostly used in network design, is rapidly becoming the foundation of the application and data architecture. In this talk, we will look into threats vectors that can become reality if the zero-trust in application and API security is not prioritized

Rethinking application security for cloud-native era

Abstract : Cloud native applications are API driven and are based on distributed microservices. APIs are the gateway to your business and expose a lot of the business logic to the outside world. Legacy solutions to understand your applications security posture are not applicable to these modern continuously changing environments

Hijacking A Pizza Delivery Robot (Using SQL injection)

Abstract : Welcome to the lighter side of the software security world! We’ll explain complex topics like injection flaws, configuration errors, and parameter tampering with real-world analogies, like breaking into your house through your shed, or sneaking into a Coldplay concert using a reflective yellow vest, a walkie talkie toy, and bravado. If you’ve ever struggled to remember exactly how these issues work or struggled to explain them to someone outside of the security field, this presentation will help (and probably make you laugh). This talk is ideal for anyone who wants to understand core Application Security concepts so they can apply risk mitigation strategies with better context.

Cyber Risk And How To Link Business And Technology

Abstract : Organizations across Asia are exposed to cyber-attacks, as the region is not prepared for cyber incidents. This is primarily due to the absence of a rigorous regulatory environment for the industry, a low level of investment in cybersecurity, and a lack of awareness. In this era of fast digital transformation, companies across industries, more than ever find themselves at the cross roads of increased usage of emerging technology and thus emerging cyber risks—making them attractive targets for cyber criminals. Understanding cyber risks and the possible mitigation and transfer strategies becomes then a critical aspect to consider and to discuss. It is crucial for firms to understand how their technology adoption is expanding their surface of attack, and for risk managers to identify vulnerable exploitable entry points by cyber criminals. The presentation will bring both perspectives and simplifies the link between business and technology.

Cybersecurity Awareness and Preparedness

Abstract : Learn about global data challenges that the public and private sector face as they tackle remote work, the different aspects of data breaches, and how growing threats and vulnerabilities are bringing managed and protected services to the forefront of our cybersecurity conversations. What makes for effective training? What topics are the most important? What stories and examples are best? How can organizations change the cyber culture for the better?