RSAC 2020 Asia Pacific & Japan
2020-07-15..2020-07-17
-- online --
[RSAC 2018 Asia Pacific & Japan, RSAC 2019 Asia Pacific & Japan, RSAC 2020 Asia Pacific & Japan, RSAC 2021, RSAC 2022, RSAC 2023, RSAC 2025 Conference]
| title | author | length |
|---|---|---|
| Detection as Code: Detection Development Using CI/CD | Patrick Bareiss, Jose Hernandez | 30m |
Claims a CI/CD pipeline can turn detection rules into repeatable, testable software: use Sigma or Splunk Security Content YAML, convert and package into Splunk… | ||
| Threat Hunting — Demystified | Ashish Thapar | 31m |
Threat hunting is presented as a repeatable five‑phase program (baseline/objectives, target/data, arsenal, execution, improvise) that shortens the detection… | ||
| Forced Digital Transformation and the Realities to ICS/OT Cybersecurity | Robert Lee | 30m |
COVID forces rapid hyper-connectivity into ICS/OT environments, creating real risk evidenced by Georgia Power’s $8 million predictive‑maintenance savings and a… | ||
| Getting the Security and Flexibility Balance Right in a COVID-19 World | Magda Chelly | 31m |
Corporate remote work drives more COVID‑themed phishing and vishing, employees reuse passwords and send confidential data from personal email, and many hotel… | ||
| How to Tell the Right Cyber-Story to Executives and Board Members | Ian Yip | 28m |
Shows concrete metrics and a repeatable one‑page format: map business risks to tolerance levels, quantify impact (example: NotPetya $300M), convert technical… | ||
| Drone Penetration Testing and Vulnerability Analysis Framework | Vivek Balachandran | 26m |
A Kali-based open-source drone penetration toolkit called DRAT framework implements user and admin modes, a local/server database, automated report generation… | ||
| Through the Eyes of the Adversary: How to Build a Threat Intel Program | Scott Jarkoff, Jason Rivera | 29m |
CrowdStrike’s method turns threat intel into three concrete outputs: ingestable indicators for SIEM/EDR, internet monitoring for leaked credentials and… | ||
| Taking Control of Cyber-Supply Chain Security | Allan Friedman, Beau Woods | 30m |
Demonstrates that a single IP stack (Interpeak’s IPNet) spreads the Urgent/11 flaws into VxWorks and Green Hills-based devices — from MRI machines to Airbus… | ||
| A Simplified and Practical Approach to Pursuing a Zero Trust Architecture | Soumen Bhattacharya, Lynette Qu | 27m |
CARE model promises a practical Zero Trust built around a unified cloud virtual directory, a central policy decision engine, and enforcement proxies placed… | ||
| Two Weeks with a Russian Ransomware Cell | Brook Chelmo | 30m |
Presenter: Brook Chelmo, Senior Strategist, SonicWall
After spending two weeks talking with a Russian ransomware cell, this security guy had to reboot… | ||
| Hacking People’s Mind: When Threat Actors Master Social Engineering | Tal Darsan, Danna Pelleg | 31m |
Claims a post‑COVID spike in RAT and phishing activity with concrete examples: Nanocore infections rise, commercial RATs and legitimate remote‑access tools… | ||
| Recent Trends in Information Operations and Predictions for 2020 | Yihao Lim | 29m |
Claims that state-backed and nonstate actors escalate volume, sophistication and operational security, using deepfakes and lip-synced audio and repurposed… | ||
| Reality Under Attack: Just How Serious Is the Deep Fake Threat? | Alyssa Miller | 30m |
Deepfakes are practical now: consumer tools like Faceswap and cloud services (Deepfakes web) create video and audio fakes, realtime tricks use Avatarify, and a… | ||
| Securing Your M&A Activity with Cybersecurity Due Diligence | Murray Goldschmidt | 30m |
Explains exactly which checks change valuations: verify deal‑room jurisdiction and retention, force strong MFA (prefer hardware tokens over SMS), audit key… | ||
| Authentication and Beyond Using FIDO and Push Notifications | Anand Bahety | 25m |
eBay implements FIDO + Push Notifications to replace passwords on mobile and extend phishing‑resistant keys to web via a push delivery flow, enrolling a device… | ||
| Third-Party Risk Management: Preventing the Next Stuxnet | Rafael Garcia | 31m |
Claims that Stuxnet reached industrial PLCs via a contractor using a USB and changed centrifuge speeds to destroy more than a 1,000 machines on Siemens S7-4000… | ||
| Build Privacy into Your Products and Gain User Trust | Sara Gerber | 28m |
Argues that embedding privacy into products reduces liability and boosts trust by doing concrete work: create a cross‑functional trust team, inventory every… | ||
| Can Policing Prevent Cybercrime? | Craig Jones | 27m |
INTERPOL coordinates 194 member countries to collect and analyze cyber threat data, use Project Gateway to ingest private-sector feeds, and operate a cyber… | ||
| Cyberespionage: Targeted Attacks Abusing Third-Party Cloud Services | Jaromir Horejsi | 28m |
Multiple APTs reuse legitimate cloud services as infrastructure: Patchwork drops encrypted configs on Feed43, GitHub, WordPress (one xml.xml pattern appears in… | ||
| Privilege Escalation and Whitelisting Bypass with Proxy DLLs | Jake Williams | 29m |
Explains a hands‑on method that builds proxy DLLs which export the same functions and forward calls to a renamed legitimate copy, letting attackers persist and… | ||
| PKI Well Revised: Common Mistakes Which Lead to Huge Compromise of Identity | Mike Jankowski-Lorek | 30m |
Live demo shows that a misconfigured CA template with requesting a server template with clientAuthentication and arbitrary SAN lets a low-privilege user… | ||
| Breaking Bad (Passwords) | Hamed Merati, Willem Mouton | 31m |
Sense of Security analyzes three years of Active Directory dumps, cracking hashes on a consumer PC with four GPUs in 2–5 hours and finding ~60–73% of passwords… | ||
| The Rise of Digital Empathy | Ann Johnson | 18m |
Presenter: Ann Johnson, Corporate Vice President Cybersecurity Solutions Group, Microsoft
When billions of people formed the largest remote workforce in… | ||
| You See Honey, I See Beehive: Developing Honey Networks | Joseph Muniz | 30m |
Claims an end-to-end deception system that cuts breach-detection time from weeks or months down to hours by combining Phantom networks (fake subnets fed to a… | ||
| Inside the Mind of a Hacker: How a Light Bulb Almost Stopped Christmas | Joseph Carson | 30m |
A red team replicates a real breach chain: using software-defined radio and a Raspberry Pi to impersonate a smart light bulb on the guest Wi‑Fi, the team… | ||
| Explore Adventures in the Underland: Forensic Techniques against Hackers | Paula Januszkiewicz | 32m |
Claims that live memory dumps yield recoverable evidence including in-memory evtx logs and that a custom reverse shell can be traced to system through Prefetch… | ||
| Security Basics: Burn It All and Start Over | John Strand | 28m |
Argues that common controls fail and lists concrete fixes: replace blacklist web filtering with blocking uncategorized sites, enforce 16-character passphrases… | ||
| The Four Horsemen of DevSecOps | Nachu Subramanian | 33m |
OCBC Bank’s DevSecOps recipe centers on four concrete defenses: Security Architecture Design review, SAST/DAST/IAST and Nexus Firewall plus Coverity/Black… | ||
| Countering Persistent Threat Actors in APAC and Globally | Steven D'sa, Vincent Wong | 30m |
Mandiant reports attackers reattempt access ~1 in 3 times globally (about 9 in 10 in APJ historically) and demonstrate concrete return methods: web shells, RDP… | ||
| Social Cybersecurity: Social Influence and Design in End-User Cybersecurity | Sauvik Das | 23m |
Analyzes 1.5 million Facebook users’ networks to measure adoption of three tools: login notifications, login approvals (Facebook 2FA), and trusted contacts… | ||
| 20/20 Security Vision: Managing Digital Risk in the Era of IoT | Arthur Fontaine | 31m |
Predicts three times as many devices as people by 2025 and adds 150,000 devices per minute as a concrete growth metric; quantifies IoT-caused DDoS owner costs… | ||
| Hack Your Cybersecurity Career: Your Role in the Ecosystem | Caroline Wong | 23m |
Cobalt.io presents data from State of Pentesting 2020 analyzing ~1,200 web pentests (2,500+ run on the platform historically) and shows machines (when… | ||
| Implementing Critical Cybersecurity Controls in a DevOps Environment | Steven Sim | 28m |
Claims that DevOps must embed security by design and assume breach, with measurable actions: use MITRE ATT&CK for threat modeling, COBIT/NIST CSF for… | ||
| Continuous Security by Design | Rob Richardson | 21m |
Argument: Kubernetes does scheduling, not runtime isolation, so secure the image. Walkthrough shows adding Anchore (free, microservices) into the build… | ||
| Don’t Worry, Be API: Addressing AppSec’s Newest Challenge | Erez Yalon | 30m |
Checkmarx-led research defines an OWASP API Security Top 10 and claims access control is the biggest API risk, splitting it into BOLA (broken object-level… | ||
| Building Safety, Security and Resilience through Chaos | Aaron Rinehart, Jerome Walter | 28m |
Chaos engineering is applied to security by deliberately injecting failures and measuring what actually breaks. A Lambda-based framework called ChaoSlingr runs… | ||
| Small Cells and Smaller Devices: Using 5G to Solve IoT Device Security | Senthil Ramakrishnan | 31m |
Claims that 5G reduces IoT device risk by shifting security from distant clouds to local edges, using <20 ms latency and distributed cores to run… | ||
| Intelligence Sharing for Critical Infrastructure Resiliency | John Lee | 32m |
OT/IT convergence drives real-world failures: examples include a 2014 German steel mill outage, a 2012 wiper that wiped 30,000 workstations, Ukraine grid… | ||
| When World News Matters to You: Operationalizing Geopolitical Intelligence | Mei Nelson | 26m |
Claims that geopolitics changes what to hunt and when, backed by concrete methods: linguistic forensics on WannaCry ransom notes linking text quirks to… | ||
| Hackers Going to Hack | Chloe Messdaghi | 30m |
Gamification claims to close skills gaps by using CTFs and bug bounties, hackathons and simulated training to produce measurable gains: 96% of organizations… | ||
| 3rd-Party Cyber-Risk Mitigation by Using ISO Standards | Willy Fabritius | 29m |
Claims that adopting ISO 27001 and ISO 22301 produces measurable reductions in third‑party cyber risk by forcing documented supplier agreements, regular… | ||
| A New Fuzzing Method Driven by Payload’s Integrity Focus on Logic Bugs | Li Wenjie, Hao Zhao | 20m |
Presenters:
Li Wenjie, Mobile Security Researcher, Ant Financial
Hao Zhao, Chief Mobile Security Architect, Ant Financial
The logic vulnerability has the… | ||
| Beyond Penetration Testing: Developing a Defensive Cyber-Workforce | Keyaan Williams | 28m |
Argues that defensive capacity, not glamourous penetration testing alone, stops breaches: cites the SingHealth breach with 1.5 million records and 160,000… | ||
| The Accountability Game: Streamlining Data Privacy across APAC and the Globe | Jason Lau, Robinson Roe | 28m |
Claims enterprise-wide certification using ISO 27701 on top of an existing ISO 27001 baseline (ISO 27001 took about eight to nine months), plus PCI Level 1… | ||
| Protecting Businesses from Breaches: Simple Lessons Still Unlearned | Christine Smoley | 27m |
Most large breaches here trace to simple failures: a leaked NSA exploit hitting unpatched SMBv1 (WannaCry shuts 80 NHS orgs, cancels 20,000 appointments), a… | ||
| The Wolves Among Us… A Tale of APT’s Thievery | Stefano Maccaglia | 31m |
Diplomatic network suffers multi-gigabyte exfiltration traced to an APT; incident investigation over two weeks reconstructs two simultaneous attackers, five… | ||
| DevSecOps with IoT - Is it a myth? | Neel Mitra | 31m |
Claim: DevSecOps for IoT is achievable end-to-end. The demo shows a GitHub + npm workflow that creates a CloudFormation stack, provisions Greengrass Core… | ||
| The New CISO: What Got You Here, Won’t Get You There | Stan Lowe | 28m |
Claims that the CISO role must shift from technologist to business enabler, with concrete steps: set recurring business leader meetings to learn one vertical… | ||
| Get the Freaking Basics Right! | Daniel Kroiss, Robert Lamprecht | 29m |
Security fails come from missed fundamentals: known vulnerabilities left unpatched, flat networks, and rampant privileged accounts. Claim: focusing on three… | ||
| Security Outgunned: Measuring Software Defined Attack Surface | Richard Seiersen | 23m |
A quick method applies basic predictive analytics (Approximate Bayesian Computation) to POC results from two vulnerability scanners: one reports 30 critical… | ||
| It Hurt Itself in Confusion: No Distribute Scanners and Stealthy Malware | Mathieu Gaucheler, Liv Rowley | 26m |
No‑distribute scanners let criminals test malware stealth by scanning against dozens of AV engines without feedback to vendors; Scan4You ran eight years with… | ||
| Your Application is Mostly Written by Strangers | Edwin Kwan | 25m |
Most applications are built from other people’s code: measured examples show 98% OSS by component count and file size (one app had 268 open‑source components… | ||
| Building Cybersecurity as a Shared Service | Erwin Eimers | 28m |
Sumitomo shifts from a regional hosting model to a three-tier cybersecurity shared service that keeps operational control at each group company while… | ||
| Cloud Safeguarding: View from Cloud Providers | Myles Hosford, Mark Johnston, Abbas Kudrati, Britta Glade | 01h 09m |
Cloud providers say customers gain concrete payoffs: reduced toil from provider-managed patching, built‑in resilience and global DDoS and region failover, and… | ||
| The AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes | Pieter Danhieux | 30m |
Claims that current practices release 2 million exploitable bugs/year and that enterprise ratios are roughly 1 AppSec per 200 developers drive a practical… | ||
| Effective Software Supply Chain Monitoring | Michael Angelo | 26m |
Describes a DIY monitoring pipeline that identifies installed components by hashing and metadata, matches them to CVEs via a local relational database, and… | ||
| Reality Check: Cybersecurity’s Story | Rohit Ghai | 27m |
Cybersecurity shifts from perimeter defense to protecting data and trust everywhere as work becomes an activity not a place, and attackers pivot to remote… | ||
| Privacy: Fundamentally Right? Standards: Fundamental Requirement | John Britton, Laura Lindsay | 30m |
ISO/IEC 27701 extends 27001 into a Privacy Information Management System that maps specific controls to GDPR, Hong Kong PDPO, Australia, Singapore and South… | ||
| Jigsaw Puzzle Attack: A New Attack Method for Platform APP | Weiting Chen, Yao Yao | 17m |
Presenters:
Weiting Chen, Senior Strategy Researcher, Ant Financial
Yao Yao, Security Engineer, Ant Financial
This is a new attack idea for mobile apps… | ||
| The Hugh Thompson Show | George Takei | 26m |
Anecdotes tie tech to human behavior: a tense meeting about BGP Border Gateway Protocol ends when a speaker sees the largest spider, closes video but forgets… | ||
| How Protocol Gateways May Introduce More Problems than They Solve | Philippe Lin | 29m |
Trend Micro researchers analyze 5 commercial protocol gateways (three real‑time, two data‑station) using a modified boofuzz fuzzer and find pervasive issues… | ||
| Does Artificial Intelligence Need a General Counsel? | Alan Brill, Paul Jackson | 25m |
Argues that AI projects routinely miss legal and social risks and that early involvement of legal, compliance and risk teams prevents failures; shows concrete… | ||
| The DevSecOps Journey at Prudential Asia | Mohan Yelnadu | 35m |
Prudential runs four concrete DevSecOps tracks: SAST with IDE plugins and CI integration, DAST in CD pipelines against preprod apps, SCA with artifact repo and… | ||
| Creating a Culture That Thrives with Disruption | Charlene Li | 29m |
Outlines three concrete beliefs—openness, agency, bias for action—and shows how each maps to repeatable practices: publishing internal data to build… | ||
| Walk-Through of Business Email Compromise: Human Factors or Human Failures? | Espen Otterstad, Kai Roer | 28m |
Company email gets phished, credentials stolen, and within 24 hours criminals register a fake domain registration and scan inboxes for old invoices; they set… | ||
| Getting Engagement in the Midst of Chaos | Erich Kron, Javvad Malik | 30m |
Remote work drives a near-vertical rise in COVID-themed phishing with phishing kits on the dark web and exposed RDP ports spiking (Kaspersky and Shodan data)… | ||
| nothing matches | ||