FIRSTCON22

61 talks · 2020–2022 · indexed by Breach Arc Archive. Links open each talk on YouTube.

• 0-day In-the-Wild Exploitation in 2022...so far. 2022
• Traffic Light Protocol 2022: Updates for An Improved Sharing Experience 2022
• CERT-UA: Research and Technical Analysis of Large-Scale Cyber Attacks in Ukraine in 2021 2021
• How I Handled One of the Biggest Banking Fraud Incidents of 2020 2020
• A Diamond is an Analysts Best Friend Introducing the Diamond Model for Influence Operations Analysis
• Attack Flow - Beyond Atomic Behaviors
• Being A Better Defender By Channeling Your Worst Adversary:
• Beyond Incident Reporting - An Analysis of Structured Representations for Incident Response
• Bridging Together Independent Islands - STIX Custom Objects and Matching Mechanisms to Correlate...
• Build Automated Malware Lab with CERT.pl Open-Source Software
• Community Management and Tool Orchestration the Open-Source Way via Cerebrate
• Creating an Information Security/Information Assurance Program - Lessons Learned
• CSAF - the Magic Potion for Vulnerability Handling in Industrial Environments
• CSIRT and SOC Modernization Practices
• Cyber Ireland - Addressing Cyber Crime Through Industry-Academia-Government Collaboration
• Cybersecurity Maturity in the Pacific Islands - Integrating CERT Services in a Regional Framework
• Decoding the Diversity Discussion
• DNS as Added Security Against Ransomware Attacks
• Don't Blame the User! Stop the Phish Before it is Even Sent
• EDR Internals From a Defenders Perspective
• Endorsing the New Rules
• Enhancing Operations Through the Tracking of Interactive Linux-based Intrusion Campaigns
• FIRST SIG Updates
• Follow the Dynamite: Commemorating TeamTNT's Cloud Attacks
• Formulating An Intelligence-Driven Threat Hunting Methodology
• Global IR in a Fragmented World
• Going with the (work)flow? Incident Response for Vicious Workflows
• How to Secure Your Software Supply Chain and Speed-Up DFIR with Hashlookup
• How to Talk to a Board so the Board Will Talk Back
• Improving Sector Based Incident Response
• Incident Response Investigations in the Age of the Cloud
• Internet Spelunking: IPv6 Scanning and Device Fingerprinting
• It's Just a Jump To The Left (of Boom)
• Keynote: Cybersecurity's Image Problem and What We Can All Do About It
• Keynote: Online Child Sexual Abuse Material (CSAM): The Insider Attack You Have Not Seen Coming
• Keynote: What Do We Owe One Another In Cybersecurity?
• Knowledge Management - Nourishing and Enhancing Your Communication and Intelligence
• Living with Ransomware - The New Normal in Cyber Security
• More Than a CSIRT: Lessons Learned from Supporting a National Response to COVID-19
• Never Walk Alone: Inspirations From a Growing OWASP Project
• No More Ransomware in Critical Infrastructure!
• Open Source Doesn't Care About You, But You Should Care About It
• Operation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
• Prioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization
• Ransomware Incident Response - The Real-World Story of a Ransomware Attack
• Ransomware Stages of Grief
• Ransomware, Risk, & Recovery: Protecting and Creating Resilience for Hybrid Active Directory
• Reversing Golang Binaries with Ghidra
• Rise of the Vermilion: Cross-platform Cobalt Strike Beacon Targeting Linux and Windows
• Sightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild
• Speed is key: Leveraging the Cloud for Forensic Artifact Collection & Processing
• The Blue Side of Documentation
• The SolarWinds Supply Chain Compromise
• There is No TTP
• Threats versus Capabilities Building Better Detect and Respond Capabilities
• Timing is Everything: Generic Trigger Events for Malware Memory Dumping
• VEXed by Vulnerabilities That Don't Affect Your Product? Try This!
• Watching Webpages in Action with Lookyloo
• Who Do You Think You Are?
• Who Shares Wins
• Your Phone is Not Your Phone: A Dive Into SMS PVA Fraud