Breach and Attack Simulation (BAS) - Thursday
summary
Demo uses Datacom and AttackIQ to run automated WAF rule validation against an Azure W with its default OWASP rule set and reports which rules actually block traffic, integrating with SIEM (Splunk) to pull detections from a Palo Alto firewall. BAS maps actions to MITRE ATT&CK and ships 4,300 pre-built assessments, including exploit chains and APT emulations, and runs continuously but explicitly does not replace hands-on penetration testing or red teaming.
AI-written summary · about
chapters (10)
- 0:00Breach and Attack Simulation intro
- 1:09What is Breach and Attack Simulation
- 2:34Core BAS approaches
- 3:59Threat-centric testing explained
- 5:43BAS vs penetration testing
- 7:49Live AttackIQ Platform demo
- 10:14Control-centric WAF testing
- 12:56Threat-centric testing in practice
- 19:01Advanced APT threat emulation
- 21:10Q&A
related talks
40mAdversary Simulation: Close the Gaps in Your Security Posture
29mAttack Defense Graph Analysis for Supporting SOC and CSIRT Operations
59mBackdoors & Breaches: Live Tabletop Exercise Demo
19mPenetration Testing
30mShall We Play a Game?
01h 08mBackdoors & Breaches: Live Tabletop Exercise Demo
48mMonitoring Application Attack Surface and Integrating Security into DevOps
01h 11m2024 Security BSides // Adam Pennington