BSides Tampa 2024
| title | author | length |
|---|---|---|
| Mastering Android Security Research: A Guide for the Modern Security Researcher | Hahna Latonick, Jacob Swinsinski | 48m |
Cites Android at 71.74% market share and 3.3 billion users and ships an ASR playbook (open-sourced on GitHub) that walks through lab setup (Genymotion, Android… | ||
| The No BS SOC Story | Mark Simos | 51m |
Gives a playbook for growing a SOC from one or two people to a global 24x7 operation, backing recommendations with Microsoft CDOC metrics and practices… | ||
| TampaBayDevs | 01m | |
Local developer nonprofit that runs regular networking events and hands-on educational workshops for developers and tech professionals in Tampa Bay. Maintains… | ||
| Thank you, Chris Peacock, for telling us about his Purple Team 101 training session | Chris Peacock | 01m |
Covers a practical cycle for threat-driven purple teaming that moves from gathering cyber threat intelligence to extracting attacker procedures, then to… | ||
| The Fault in Our Metrics: Rethinking How We Measure Detection & Response | Allyn Stott | 42m |
Argues that common metrics mislead and offers concrete replacements: track time spent on false positives (not alert counts) and roll automated time into saved… | ||
| Gaining experience through CTFs | Angela Ramos | 47m |
CTFs map to specific job skills from the NICE framework and can replace “experience” with demonstrable outcomes: students restore SSH and DNS while a red team… | ||
| XZ made EZ | Joey deVilla | 47m |
A supply‑chain backdoor corrupts the xz compression tool used by virtually every POSIX system, installed via a malicious update to liblzma that quietly… | ||
| Ryan Irving Interview | Ryan Irving | 01m |
Explains how to create forensic triage images and why they matter for incident response showing a practical workflow that prioritizes evidence collection… | ||
| Attacks on JSON Web Tokens: A Comprehensive Analysis | Chesleah Kribs | 35m |
Explains concrete JWT failings and exploits: tampering a token when signature checks are disabled (example .NET flag RequireSignedTokens = false), forging… | ||
| Future-proofing Your Career in Cybersecurity | Nicolas Moy | 45m |
Claims a tested SME Authority Framework™ used by hundreds, splitting the path into get skilled, get noticed, get paid. Cites concrete market demand — 3.5… | ||
| Choose Your Own Adventure: Group Interactive IR Scenario | Bryson Bort | 45m |
A live choose-your-own-adventure incident response scenario walks through a Friday ransomware call that escalates from phishing to credential theft to lateral… | ||
| Digital Forensics – The Importance of Forensic Triage Images | Ryan Irving | 46m |
Argues that a targeted forensic triage image plus memory snapshot answers most incidents — “more than nine times out of ten” — and recommends to collect memory… | ||
| Orion's Quest: Modern Pentesting | Kevin Johnson | 51m |
Real pentest stories with concrete results: URL parameter tampering lets an account reviewer ID enumerate and download 9 million records in an hour; a guest… | ||
| Finding Secrets in PDF Files | Kenny Brown, Nikita Mazurov | 40m |
Live demos show concrete attacks and fixes: using Acrobat content analysis to extract underlying text and edit embedded images reveals supposedly redacted… | ||
| Strategic Implementation of the NIST Risk Management Framework (RMF) | Samantha Ramos | 42m |
Step‑by‑step walkthrough of NIST SP 800‑37 applied to a medium‑sized Florida healthcare platform: stakeholder interviews, organization‑wide risk assessment… | ||
| Container Security, Are You Doing It Wrong? | Jeff Weatherford | 47m |
Containers are not virtual machines and are not a security boundary — runtimes using runc (Docker, Podman) had a real-world CVE class (“leaky vessels”), so… | ||
| Understanding CMMC and NIST 800-171 for CUI | Peter Bagley | 48m |
Explains how CMMC maps NIST SP 800-171 into a certifiable ecosystem: 110 controls (about 320 sub-requirements), a level 1 self‑assessment of 17 practices, and… | ||
| Leveling Up your Cybersecurity Career by Hacking Your Mental Programming | Jennifer Roman | 36m |
Laid off after automation eliminates ~80% of a team, narrative turns into concrete job-hunting tactics: use ATS-formatted PDF or DOCX resumes, mirror LinkedIn… | ||
| Winning by deception: tactics, techniques, and procedures of adversarial A.I. | Michael Mallen, Jeremy Rasmussen | 45m |
Four clear adversarial TTPs are defined: poisoning, evasion, extraction, inference with concrete examples — data-poisoned stop signs that change vehicle… | ||
| Closing Ceremony | Aftiam Ramli, Ahmed Almoallu, Ariana Manrique, Elvira Reyes, Tyler Brescia, Chauncey Freeman, Jamey Seman, Christina Shannon, James Bowie, Devon Ford, Peter Bagley, Kate Sousa, AJ Ledwin, Michael Rogers, David Chen, Maria Soyoso-Capuder, Chris Machowski | 55m |
Closing remarks summarize turnout (~1,900 attendees), logistics hiccups (parking) and sponsor retention, then walk through the conference puzzles and community… | ||
| Career Panel Discussion | Kurt Sanger, Ajay Menendez, Leyla Balaskas, Orlando Haynes, Kasandra Perez | 50m |
Actionable hiring tactics: partner with 2–3 staffing firms and tell them transparently what roles you want; recruiters share market salaries, upcoming projects… | ||
| Basic Malware Analysis for Incident Responders | Jared Graff | 33m |
Covers practical static-analysis steps: set up remnux or FLARE VMs, run file to identify architecture, use strings and floss extracts stacked strings to catch… | ||
| Who Let the Dogs Out? When PUPs Become BlackCat's Best Friend | Ryan Rath, Matthew Boyle | 42m |
BlackCat/ALPHV trojanizes legitimate admin tools to gain initial access via malvertising and typo‑squatting, replacing downloads with ZIP/ISO payloads that… | ||
| Navigating the Cyber World: The Impact of AI on Cybersecurity Strategies | Erich Kron | 51m |
Explains that current AI is narrow, not AGI, and excels at anomaly detection (useful for spotting ransomware patterns) but hallucinates answers; demonstrates… | ||
| Navigating the Shadows: A Comprehensive Exploration of Popular and Malicious Tools on the Dark Web | Michaelangelo Zummo | 40m |
Mine of evidence: 324 million underground hits in a year with 88% from messaging platforms, 449k hits for credential stuffers and 144k for OpenBullet 2; a live… | ||
| telling us about his training about setting up a hacking lab! #bsidestampa | InfoSecPat | 01m |
April 5 at USF a hands-on session demonstrates how to assemble a basic cyber security lab from common parts and free tools, showing a working home lab built… | ||
| The New and Improved NIST CSF 2.0 | Michael Brown | 53m |
NIST CSF 2.0 concretely changes structure not just wording: it adds six functions (govern as a foundation), keeps 22 categories, adjusts subcategories to 107… | ||
| Career Track Overview | Peter Bagley | 01m |
Aimed at newcomers to cyber, the session lays out concrete offerings: resume reviews that go top to bottom with specific fixes, professional headshots provided… | ||
| Opening Remarks | 30m | |
Eleven-year community conference with over 1,900 registered attendees and sold‑out $5 training sessions; roughly 300 students and about 100 volunteers support… | ||
| Measures for Securing Privileged Users in M365&Azure Every Organization Should Take | Eric Woodruff | 51m |
84% of org admins lack proper privileged identity controls, so focus on locking down Global administrators in Entra ID: use cloud‑native, non‑mail enabled… | ||
| Britiney Tacket, SecureIdeas at BSides Tampa 2024 | Britiney Tacket | 01m |
Company describes itself as a professionally evil penetration testing firm that hires certified hackers and delivers hands-on engagement rather than automated… | ||
| Mock Interview 1 Q&A - Recruiter Matt Schwope | Matt Schwope | 01h 03m |
Mock interview walks through concrete scenes: a Japan datacenter outage where the team ran five backup restores before finding a good copy and then rolls out a… | ||
| Hook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait | Aaron Strong | 41m |
Claims that 3.4 billion malicious emails are sent per day and a data breach occurs about every 39 seconds, with business email compromise up 1700% and 74% of… | ||
| Ham Radio Village | Pat Conley | 01m |
Hands-on demos of licensed transmitters and amateur frequencies explain that anyone can listen but transmitting requires a credential and training, with plenty… | ||
| Cyber Resilience Starts Within: A Mental Health Perspective | Ben Hartwick | 43m |
Maps mental-health actions onto 18 CIS controls and claims that a security framework can be repurposed for resilience, with concrete steps: inventory your… | ||
| Attack of the Clones! How AI can boost your API Security! | Dr. Sunny Wear | 21m |
Shows concrete results: ChatGPT instance hacking apis GPT generates fuzz payload lists, and given a curl to an httpbin endpoint it pinpoints parameters to fuzz… | ||
| Not Your Mama's Risk Assessment | Seth Earby | 36m |
Argues that traditional, ad hoc risk assessments produce PDF heat maps and Excel checklists that fail to answer real questions, and offers a pragmatic Solve… | ||
| GRC & The Min & Max of Multi-Framework Optimization | Elsa Arcilla | 57m |
Explains a repeatable method that turns NIST artifacts and a simple spreadsheet into an audit-ready control map that collapses duplicate controls across NIST… | ||
| I.AM A Brand | Aftiam Ramli | 36m |
Sales-driven personal branding that uses concrete tactics not platitudes: build I am statements, make intentional discovery calls (example 100 dials a day… | ||
| CISO Track Panel | Christina Shannon, Andrew Cannata, Kyle Redding, Larry Whiteside, Dave Summit, G Mark Hardy, James Bowie, Kathleen Mullin, Brett Colon | 02h 11m |
Nine CISOs debate hard facts not slogans: inventory, IAM and data classification remain undone, causing repeated losses; one team drops 2 million overexposed… | ||
| Evasive Facility Breach: From Ingress to Egress in 15 Minutes or Less | Ralph May, Travis Weathers | 55m |
Claims a prepared team can go from entry to exit inside a facility in a 15-minute ingress window using focused remote recon, onsite surveillance and a chosen… | ||
| Phish & Furious: Unraveling Campaign Builder Vulnerabilities in a Blink-and-Breach World | Raae Wolfram | 32m |
Claims that email campaign platforms let attackers spoof entire domains: in Nov 2023 MailChimp allows signing up with one verified address and sending as any… | ||
| Scoutlier Village | Brandy Jackson | 03m |
Launched last year with the Office of Naval Research, a Cyber Smart Cities curriculum teaches students to move from micro:bit to breakout board to breadboard… | ||
| New Legal & Regulatory Developments Impacting the IT Professional Community | Kurt Sanger | 42m |
Covers concrete legal shifts: the SolarWinds SEC complaint argues public companies face liability for mismatched internal versus public cybersecurity… | ||
| nothing matches | ||