Keynote: Online Child Sexual Abuse Material (CSAM): The Insider Attack You Have Not Seen Coming
summary
Insider misuse of work systems is shown with concrete outcomes: a disgruntled ex-employee runs a peer-to-peer eMule client on a former boss’s machine, causing 1.6 terabytes shared and ~164,000 downloads that briefly make the org the world’s top CSAM distributor; cloud abuse routes content through a federated multi‑cloud, deleted VMs and rotated logs frustrate investigators, and companies paid consultants $500 for limited help. Recommendations include using shared hashes/IOCs (MISP), automated classifiers so staff don’t view images, and never delete — remember 29.3 million reports last year.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 3:51Understanding the problem
- 7:00Classifying the material
- 9:41Scale and prevalence
- 13:20Offender profiles
- 17:55Victim impact and response
- 23:19Case study one
- 31:01Case study two
- 39:59Collaborative solutions
- 52:16Q&A and summary
related talks
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
01h 00mKeynote: How I Met Your Data
48mData-Driven Cyber Indicators of Malicious Insider Threat
41mCollaboration Without Data Loss: Keep IP From Leaking to Competitors
52mLessons Learned from the Summer of Supply Chain Attacks
01h 09mKeynote: An Unauthorized Exchange - From Targeted Espionage to the Global Cyber Pandemic
32mDo This, Not That – Lessons from 7 Headline Grabbing Security Breaches
58mKeynote Address: Mitigating Technology Abuse in Intimate Partner Violence