Breach and Attack Simulation (BAS) - Friday
summary
Shows a working Breach and Attack Simulation pipeline using the AttackIQ platform to run both control‑centric and threat‑centric assessments, validating an Azure WAF baseline rule set and logging to Sentinel. Demos include a WAF health check that reports which test cases are prevented versus merely undetected, and a kill‑chain demo comparing a workstation with Defender/EDR to one without, illustrating which TTPs are blocked, detected, or allowed.
AI-written summary · about
chapters (8)
- 0:00Breach and Attack Simulation intro
- 1:26BAS in security testing
- 2:56Control vs threat assessments
- 4:20BAS vs traditional testing
- 6:07BAS adoption steps
- 8:58Demo: WAF validation
- 11:30Demo: Threat attack chain
- 21:09Next steps & Q&A
related talks
40mAdversary Simulation: Close the Gaps in Your Security Posture
29mAttack Defense Graph Analysis for Supporting SOC and CSIRT Operations
59mBackdoors & Breaches: Live Tabletop Exercise Demo
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
30mShall We Play a Game?
30mFrom Zero to a DevSecOps Hero: Extending Microsoft Sentinel
41mBuilding a Valid Threat Library for Cloud Based Applications
01h 08mBackdoors & Breaches: Live Tabletop Exercise Demo