BSides Edmonton 2025
who it's for
security operations engineers, incident responders, cloud security engineers, OT/ICS engineers, security managers, cybersecurity researchers
topics
incident response playbooks and war rooms; lateral movement detection on Windows; cloud incident response and DevSecOps; OT cyber attack simulation techniques; cyber threat intelligence and triage boards; post-quantum crypto pilot deployments; AI-enabled automation for incident response; federated learning privacy and model inversion; resilient branch connectivity with SD-WAN and satellite; supply chain risks and SBOMs; kernel visibility with eBPF; consent-based access control for healthcare
| title | author | length |
|---|---|---|
| Opening Remarks Day 1 | Andrew Meek, Liam Sombberville, Joshua Reynolds | 14m |
This is an agenda and logistics briefing, not technical content: it states the theme Cyber Defender Rising, confirms an all-access pass that covers talks CTFs… | ||
| Everything I Know About Security I Learned... [KEYNOTE] | Michael Spaling | 47m |
An acting CISO at the University of Alberta says the real lessons are practical: uses ChatGPT to draft an intro, keeps a non‑admin primary account, argues down… | ||
| Innovate with Resilience! | Cleo Mushonga | 01h 33m |
Panel shows concrete wins and urgent gaps: a July outage that crippled 8.5 million Windows devices, a Rogers update that knocked out mobile and 911 for 12… | ||
| Cyber Threat Intelligence (Experts recommendations to enhance your security posture) | Alyssa Hartford, Christopher Scutchings, Prashant Prashant, Pedro Kertzman | 43m |
Panelists claim CTI moves teams from reactive noise to focused action: collecting news feeds to brief leaders before questions arrive, building a triage board… | ||
| Navigating Mental Health in Tech Today | Derran Guinan, Joshua Byrne, Michelle Balderson, Rick Byrne, Rita Tippe | 01h 42m |
Panelists share concrete claims and lived outcomes: stepped away from a top security role and began real recovery, persistent incident teams burn out after… | ||
| Defenders Struggle as the Adversary Continues to Break Away | Jason Maynard | 45m |
Claims that most breaches succeed by moving inside the network with lateral movement (about 60–70% of incidents), and that defenders get the biggest wins by… | ||
| What Security Teams Need to Know and Do | Saif Azwar | 44m |
Explains concrete risks and mitigations: shows agentic AI scanning environments and opening change requests, describes live use of automated incident response… | ||
| Cyber... | Hammed Adetayo Adegbola, Sourabh Aggarwal | 22m |
Three Canadian incident responses are described with hard numbers and outcomes: LockBit ransomware forces Indigo to go offline then restore services by March… | ||
| Sweeping Up... | Naor Kalbo | 45m |
AI-driven agentic garbage collector that reads free‑text names, descriptions and tickets to find contextual misconfigurations, claiming to spot… | ||
| A Retrospective on DevSecOps and Cloud IR | Josh Hankins | 35m |
Chronicles a real Chaos DB/Juniper notebook compromise path against Cosmos DB discovered via Wiz, explains containment choices and why key rotation waits were… | ||
| Driven Response to UNC5174 | Alessandra Rizzo | 42m |
Claims UNC5174 combines custom dropper SNOWLIGHT with open-source backdoors like VShell and SLIVER and achieves stealth by fileless Go malware that fetches… | ||
| Schemes, Privacy, and Security | Md Morshedul Islam, Suraj Neupane | 45m |
Describes a practical DCGAN model inversion that reconstructs MRI training images from federated-model weights, measures cosine-similarity (many… | ||
| An OT Cyber attack simulation on a chemical plant | Prashant Prashant, Rajat Kundu | 46m |
A live lab demonstrates a purchasable VM stack (Fortified graphical realism) that simulates a chemical plant, exposes Modbus traffic, and lets an attacker read… | ||
| Where Do I Go From Here? | Robert George | 30m |
Claims a repeatable method: critical reflection model (what / so what / now what) paired with concrete skills — SIEM queries, detection engineering, cloud… | ||
| Opening Remarks Day 2 | 10m | |
Announcements cover logistics and concrete numbers: less than 10% survey response so organizers ask for specific feedback, schedule is on Hacker Tracker and… | ||
| The Storm and the Compass [KEYNOTE] | Joshua Reynolds | 01h 04m |
Claims that LLMs replace analysts give way to specifics: a reproducible open‑weight model on laptop parses npm worm scripts, Langraph builds a Langraph agent… | ||
| An Introduction to Cybersecurity in Space | Samin Zaman | 44m |
Claims that there are more satellites in the last three years than in the three decades prior and demonstrations using hack RF1 and lime SDR plus GNU Radio… | ||
| Resilient Branch Connectivity with SD-WAN and Satellite | Thomas Dang | 43m |
Fortinet Secure SD-WAN deploys across 20 sites with dark fiber, MPLS, cable, ADSL and satellite fallbacks, proving Starlink Mini pulls ~200 Mbps in the field… | ||
| Defending Operational Frontlines with Industry Experts with... | Jason Maynard, Austin Scott, Doug Leece | 40m |
Claims: solar inverters with covert 4G chips were remotely shut down in December 2024; Colonial Pipeline stops move 45% of eastern US fuel and recovers in… | ||
| The Business of Cybersecurity | Burt Kim | 41m |
A concrete case drives the talk: a company with 20 endpoints (mostly Windows) enforces a 2-day patch policy and struggles to coordinate monthly Patch Tuesday… | ||
| Who Wants to Be a Cyber Millionaire? | Donald Ashdown, Michael Spaling | 34m |
A fast-paced cyber trivia session runs on the WooClap platform with a 20 second timer per multiple-choice question and points awarded by response speed, 40… | ||
| More Than Backups and Hope | Derran Guinan, Rick Byrne | 41m |
Survey-backed framework claims 74% in horizons 1–2, so most orgs still have dusty DR plans while facing ransomware, extortion, and exfiltration. Concrete tools… | ||
| Enhancing Lateral movement and Data Access Identification on Windows Systems | Kostya Ilioukevitch, Phalgun Kulkarni | 36m |
LMDA provides two Velociraptor artifacts that aggregate and normalize Shellbags LNK Jumplists UAL event logs and RMM traces into a single timeline, tagging LM… | ||
| a journey... | Sergey Volkovich | 43m |
Shows a concrete pipeline: passive fingerprints (HTTP user‑agent, TTL 64, DHCP vendor class option 60, DNS names) feed weekly CSV lookups of MAC prefixes… | ||
| Public-private partnership unveils the full scale of a sophisticated Linux threat | Pedro Kertzman | 30m |
Public‑private forensics tie seized physical servers to a long‑running Linux botnet called Ebury revealing compromised ~400k Linux hosts over 15 years, four… | ||
| From Recon to Reporting | Jay Panchal | 38m |
Claims an AI pipeline that automates reconnaissance, vulnerability analysis, exploitation and report drafting and shows a demo against a vulnerable web app… | ||
| From Zero to Success | Jia Hu | 29m |
Claims a real bug in Cisco's EDR and shows a working bypass: an obfuscated PowerShell reverse shell hosted via a simple HTTP server, fetched with… | ||
| Lateral Movement in the Age of Hybrid Cloud | Ian Lin, Chance Pearson | 48m |
Concrete attack paths, working tools, and specific misconfigs decide what to watch: live demos of device code fishing and evil gen X phishing that steal… | ||
| Ensuring Data Security in the AI Revolution | Ikhtear Bhuyan | 40m |
Claims concrete defenses: IBM Guardian products perform discovery across Db2 Big Data NoSQL and vector DBs, apply encryption and activity monitoring, and add… | ||
| Securing the Invisible | Rameez Ali | 42m |
Shadow AI already causes measurable harms: data exfiltration that can trigger GDPR fines up to 4% of global revenue, rapid adoption (ChatGPT hits 1 million… | ||
| Consent Based Access Control and Healthcare Data | Brechin Piper | 43m |
Claims a workable model called Consent Based Access Control (CBAC) that puts patients in charge of healthcare records by linking existing provincial IDs to… | ||
| Security Lessons for Early Adopters | Pooja Shah | 44m |
Practical checklist: map threats with threat modeling, run red‑team stress testing, and enforce runtime safeguards like access limits, memory isolation, kill… | ||
| From Subscription to Backdoor Intruder | Simon Maxwell-Stewart | 45m |
Research finds that Azure B2B guests with billing permissions in their home tenant can create and own subscriptions in external resource tenants without… | ||
| nothing matches | ||