Cybersecurity & Ransomware Live! Virt Con 2025

Agenda

Day - 01

08:55

T01 - Workshop / HOL: Microsoft Defender XDR

View Info

Hide Info

Level: Intermediate

In this full day of hands-on training, we will go through Microsoft Defender XDR from a Security Analyst perspective.

We will cover the included products in Microsoft Defender XDR, and how to work with them to respond to incidents. Additionally, we will also go through how to perform Threat Hunting with Microsoft Defender XDR.

During this in-depth workshop we will have a mix of lectures and hands-on in the Defender Portal.

You will learn:

About working as an Analyst in Microsoft Defender XDR
About Threat Hunting with Microsoft Defender XDR
About managing Microsoft Defender XDR

09:00

T01 - Workshop / HOL: Microsoft Defender XDR (Afternoon)

09:02

T02 - Workshop: Windows Firewall and IPSec to Protect Against Ransomware

View Info

Hide Info

Level: Intermediate

Every computer, whether in a corporate LAN or a public network, needs to be protected with a firewall. This also applies to all servers! And this means the device itself and not a firewall on the perimeter. Zero Trust means that those protections are in place wherever you might take your computer, and that we can identify the computer and user, not just an address where it says it is. With Windows Firewall you can block pass-the-hash and other lateral movement techniques, and by adding IPsec, you can get all the benefits of 802.1x authenticated networks – only better, more granular, and for free!

Join, Sami Laiho, a world leading security expert, in this full-day workshop and learn how he manages different sized environments and deploys the concept of Client Firewalls.

You will learn:

How to deploy a managed Windows Firewall on clients and servers
How to deploy IPsec in a Windows environment
How to troubleshoot problems with Windows Firewall

09:02

T02 - Workshop: Windows Firewall and IPSec to Protect Against Ransomware (Afternoon)

09:03

T03 - Workshop: Microsoft Entra Identity PowerCamp

View Info

Hide Info

Level: Intermediate

Entra ID is Microsoft’s multi-tenant cloud-based directory and identity management service. For IT Admins, Entra ID provides an affordable, easy to use solution to give employees and business partners single sign-on (SSO) access to thousands of cloud SaaS Applications like Office365, Salesforce.com, Drobox, and Concur. For application developers, Entra ID lets you focus on building your application by making it fast and simple to integrate with a world class identity management solution used by millions of organizations around the world.

Microsoft Entra ID also includes a full suite of identity management capabilities including multi-factor authentication, device registration, self-service group management, privileged account management, role-based access control, application usage monitoring, rich auditing and security monitoring and alerting. These capabilities can help secure cloud-based applications, streamline IT processes, cut costs, and help ensure that corporate compliance goals are met.

This intensive PowerCamp not only prepares you with real world skills but provides an opportunity to interact and learn from an industry expert. Join us for a full day of intensive learning and discussions to fast-track through the maze of technology and get straight to the point this jam-packed day.

You will learn:

A deep dive into identity
How to secure entra ID
Tips & Tricks

09:06

T03 - Workshop: Microsoft Entra Identity PowerCamp (Afternoon)

Day - 02

08:55

W01 - Tales from Incident Response: Unmasking the Threat Actor’s Inner Sanctum

View Info

Hide Info

Level: Advanced

Imagine if You Could Watch Every Step They Take…

Unmasking a threat actors activities is sometime like deciphering an ancient manuscript, but what if you can see every move and control when to strike the pause.

This session is not about log analysis, or following the breadcrumbs left by an elusive adversary. It is about having a full timeline of the threat actors machine and knowing exactly what was done without assumptions or guessing!

You will learn:

The importance of monitoring
How does access brokers operate
The importance of quick response

08:55

W02 - Sysmon 101

View Info

Hide Info

Level: Introductory

Created by Mark Russinovich as part of Microsoft's Free Sysinternals suite of tools, Sysmon is an amazingly customizable and powerful tool in the security professional's arsenal.

Deployed on Windows hosts, be they servers or workstations, Sysmon captures and logs all sorts of actionable data about potentially nefarious activity taking place on your systems, and goes far beyond what standard Windows Security Log auditing can provide. Want to know when malware is creating files in suspect directories? Want to know when an attacker is establishing certain types of network connections (e.g. RDP/FTP) to exfiltrate data? Want to know when Autorun registry locations are being changed, or when a user accesses the clipboard? Want to see all the DNS queries a user makes? Deploy Sysmon!

In this introductory level session I'll quickly show you what Sysmon audits, how to customize its XML file, and how to quickly deploy it to your systems using another great Sysinternals tool, PSEXEC. We'll also discuss ways to control the data it produces prior to SIEM/SIM ingestion, and how to write PowerShell scripts with event log triggers to act on certain Sysmon events.

You will learn:

About the types of events Sysmon detects and where those events are logged
About how to tune the types of events Sysmon detects, and how to deploy Sysmon on their systems
How to create basic triggers with Scheduled Tasks and PowerShell when certain types of activity is detected by Sysmon

08:55

W03 - Raiders of the Lost Photon: An Introduction to Quantum Cryptography for Security Pro’s

View Info

Hide Info

Level: Intermediate

Join Microsoft MVP and Youtuber, Andy Malone as he introduces you to the world of Quantum Cryptography. With technology literally moving at the speed of light. IT Pro’s and security professionals alike must keep ahead of cybercriminals. So, in this deep dive session join Andy, as he takes you on a journey inside Quantum cryptography. Here we’ll discuss not only the basics, like Qubits but also delve into the technical details of how this revolutionary technology works and more importantly how it can keep you and your data safe.

You will learn:

The basics of Quantum Cryptography
Learn new skills
Enhance current knowledge

08:55

W04 - Disaster Recovery vs. Cyber Recovery

View Info

Hide Info

Level: Introductory to Intermediate

Disaster Recovery professionals know to expect the unexpected. But cybercrime and ransomware have completely changed the DR planning landscape. Because recovery from a cyber event can be very different from recovering from a traditional disaster. What should you do to prepare when there isn’t one guaranteed approach for recovering compromised data?

During our presentation, we’ll walk you through some recovery scenarios. We’ll also complete some tabletop exercises to show you how the right planning and flexibility can give you a better chance to recover from a cyber event

You will learn:

Why business and infrastructure assets may need diverse levels of protection
How 11:11 Systems can help you create a comprehensive cyber recovery readiness program

10:10

Panel Discussion: Data Resilience Redefined: Navigating Protection and Recovery in the Cloud Era

View Info

Hide Info

Level: Everyone

In a world where data is the lifeblood of business, ensuring its protection and rapid recovery is more critical than ever. Join industry leaders as they discuss the evolving landscape of data resilience, best practices for cloud-based protection, and innovative strategies to safeguard your organization's most valuable asset. Discover how to build a robust, agile approach to data continuity in today’s fast-paced digital environment.

11:25

W05 - Fast Focus: 5 Security Best Practices You Should Implement in Microsoft 365 Today!

View Info

Hide Info

Level: Introductory to Intermediate

In today's rapidly evolving digital landscape, securing your organization's data and resources is more crucial than ever. This lightning talk will delve into the top five Microsoft 365 security best practices you should implement today to safeguard your digital environment. We will explore essential strategies such as protecting credentials, safeguarding your content, and securing devices. By the end of this session, you'll be equipped with actionable insights to enhance your organization's security posture, better protecting your environment against emerging threats. Join us to learn how to fortify your Microsoft 365 environment with these important security measures.

You will learn:

Securing user access
Protecting against data exfiltration
Securing end-user devices

11:25

W06 - Fast Focus: Exploring AI's Potential in Resolving Classical Problems in Cyber Risk Management

View Info

Hide Info

Level: Intermediate

This engaging conference session delves into the exciting realm of Artificial Intelligence (AI) and its profound impact on resolving age-old problems in Cyber Risk Management. This session reveals how AI is reshaping our approach to age-old cybersecurity challenges, offering practical insights and real-world examples of its impact. Join us to discover AI's potential for proactive risk identification, compliance assessment, cross walking of regulations, to stay at the forefront of cybersecurity innovation.

You will learn:

Proactive Risk Identification: Discover how AI can predict and prioritize risks before they become threats, giving your organization a strategic advantage.
Streamlined Compliance Assessment: Learn how AI automates compliance checks and simplifies the process of cross-referencing multiple regulations.
Staying Ahead of Cybersecurity Trends: Understand how AI helps organizations adapt to evolving threats and remain at the cutting edge of cybersecurity innovation.

11:25

W07 - Fast Focus: Understanding Cyber Attacks

View Info

Hide Info

Level: Introductory

Cyber criminals are bullies; they pick on the weakest systems first. Many organizations believe they have a zero-trust architecture and high-security, yet fall victim to attacks exploiting misconfigurations, limited control, and poor cyber-hygiene. During this non-stop, lighting fast session we’ll cover best practices preventing poor security configurations from allowing your systems to fall victim to cyberattack.

You will learn:

Best practice recommendations for protecting systems
About common techniques used by cyberattackers for gaining initial network access
Strategies for strengthening network defenses against weak cybersecurity controls and practices

12:55

Keynote: Forward to the Past and Back to the Future – Cybersecurity in 2025 and Beyond

View Info

Hide Info

Level: Everyone

The cybersecurity landscape is shifting fast — are you ready for what’s next?

This keynote delivers a deep, insightful look into the most impactful cybersecurity developments of 2023 and 2024 — the attacks that redefined defenses, the technologies that changed the game, and the unexpected trends that caught even seasoned professionals by surprise.

But it doesn't stop there.

You’ll also get a forward-looking view into what’s coming in 2025and beyond, including:

Emerging threats that could reshape enterprise risk
Strategic missteps to avoid based on recent industry lessons
The evolving role of AI in both offensive and defensive security
Key areas where security teams must adapt or fall behind

Expect real-world examples, data-driven analysis, and practical insights that will help you strengthen your organization’s security posture and stay resilient in an increasingly complex threat environment.

Led by internationally respected security researcher Sami Laiho, this keynote isn’t just about understanding the past — it’s about preparing with confidence for the future.

Walk away with a sharper perspective and a clear roadmap for securing what’s next.

14:10

W09 - A Hacker Just Logged In…

View Info

Hide Info

Level: Intermediate to Advanced

We have never seen this many incidents where the adversary literally just walks in as during the last year!

Many think we are exaggerating when saying that "Hackers don’t HACK in, they LOG IN". But It has never been easier to just log in to a lot of enterprises.

Why and how is this possible at all? What can we do to stop it?

You will learn:

Understanding the attackers ecosystem
Understanding the threat landscape
Prioritizing readiness actions

14:10

W10 - Surviving Ransomware Attacks with Microsoft Defender

View Info

Hide Info

Level: Introductory to Intermediate

Ransomware is the nuclear bomb of malware. Annoying popups and single file deletion problems pale in comparison to the organization-level crippling most ransomware attacks produce. Not to mention the public relation nightmares! Microsoft brings to bear formidable defenses with their Microsoft 365 Defender line of products. Leveraging Microsoft 365 Defender, organizations attacked by ransomware minimize their damage and downtime.

You will learn:

Overview of the Microsoft 365 Defender protection architecture
How to turn ransomware thunder into a squeak
The key settings to turn on; and a few to leave off

14:10

W11 - Defence Against the Dark Arts – Building Rock Solid Entra ID Security Solutions

View Info

Hide Info

Level: Intermediate

It’s the front door, and he who should not be named is knocking. Cyber criminals never rest, and neither should your security stance. In this demo rich session Andy will take you on a journey inside Entra ID and discuss the latest tactics that would be criminals are using to hack into your environment and how Entra and other security features can be used to detect and thwart these attacks. If you’re serious about security, then grab your wand as this is session you’ll not want to miss.

You will learn:

How to defend Entra ID from bad guys
Tips & Trick to protect your infastructure
Provide example of potential attacks

14:15

W12 - Living Off the Cloud: How to Move Faster Than Attackers with CDR

View Info

Hide Info

Living off the cloud attacks are on the rise. Executing rapid, cloud-native techniques to escalate privileges, move laterally between environments, and access critical assets, attackers are targeting the cloud more effectively than ever.

This session will focus on a real-world living off the cloud attack case study, analyzing a step-by-step account of the attack as it unfolded from attackers’ perspective.

We will then switch gears and rewind the attack, explaining how effective detection and response methodologies could — and should — have prevented every step of the attack. Defeating these threats requires powerful centralized visibility and control of all cloud environments and resources. Our key takeaways will therefore be tailored to leveraging the best methodologies and tools to take back the initiative and stop even the most sophisticated cloud attacks.

15:25

W13 - Attacking PowerShell CLIXML Deserialization

View Info

Hide Info

Level: Advanced

Common Language Infrastructure XML (CLIXML) is a widely used PowerShell serialization format. In this presentation, we will learn how to exploit PowerShell deserialization to move laterally and escalate privileges in an enterprise environment. I will perform multiple live demos, including a guest-to-host virtual machine breakout.

I will present several novel deserialization gadgets to achieve everything from out-of-band network requests and credential stealing to remote code execution. This includes golden gadgets that work on vanilla PowerShell installations and gadgets that depend on widely used PowerShell modules.

Finally, we will discuss how we can protect ourselves against these attacks as IT admins and how to avoid these vulnerabilities as developers.

You will learn:

How PowerShell serialization works and how to exploit CLIXML deserialization bugs
How a threat actor could abuse CLIXML attacks to break out from a virtual machine or compromise an admin workstation
The important steps you need to take to mitigate the risk of these attacks

15:25

W14 - Securing the Supply Chain: Lessons Learned from Real Breaches

View Info

Hide Info

Level: Intermediate

The modern supply chain introduces significant cybersecurity risks, as seen in high-profile breaches like SolarWinds. In this session, I’ll explore the complexities of securing the supply chain, including third-party vendor management and software supply chain vulnerabilities. I’ll use real-world case studies to highlight the lessons learned from supply chain breaches, including the consequences of failing to secure third-party access.

We’ll also dive into actionable steps organizations can take to mitigate supply chain risks, such as conducting thorough vendor security assessments, implementing continuous monitoring, and using contractual protections. I’ll provide practical guidance on how to secure both software and hardware supply chains, as well as how to ensure that third-party vendors adhere to your security standards.

Attendees will leave with a clear understanding of supply chain security risks and actionable strategies for protecting their organization from third-party vulnerabilities.

You will learn:

Dive deep into the complexities of securing the modern supply chain, including third-party vendor management and software supply chain risks.
Share lessons from high-profile breaches (e.g., SolarWinds) and how organizations can develop resilient strategies to mitigate supply chain risks.
Provide practical steps for continuous monitoring, vendor security assessments, and contractual protections.

15:25

W15 - Securing Your Endpoint Management Platform

View Info

Hide Info

Level: Introductory to Intermediate

Management Platforms are the keys to the technical kingdom. To secure the enterprise, we must reduce exposure to this critical tool. This session looks at common endpoint security risks and best practices to mitigate them.

You will learn:

The key components to securing your endpoint management platform
The endpoint security tools and technologies that are used today
Why best practices are essential to reducing your footprint

15:25

W16 - Bridging the Gap: How Backup Telemetry is Transforming Threat Detection and Incident Response

View Info

Hide Info

In today's evolving threat landscape, where backup data is both a target and a critical recovery asset, cybersecurity demands a new kind of visibility – one that seamlessly connects IT and security operations. Join Shankar Subramaniam, VP/GM of Security at Druva, as he explores how integrating backup telemetry into Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) platforms is reshaping threat detection and accelerating response times. This session will delve into the future of cyber resilience, spotlighting how data protection tools, when part of the security fabric, provide actionable insights that reduce risk, enhance compliance, and minimize downtime after cyber incidents. Gain practical knowledge on building a unified strategy that uses backup data as both a shield and a sensor.

You will learn:

The Strategic Role of Backup in Security Operations
Understand why traditional backup architectures fall short in today’s threat landscape, and how integrating telemetry into SIEM/XDR platforms offers a unified, threat-aware approach that improves organizational cyber resilience.
Accelerating Threat Detection Through Contextual Insights
Learn how real-time event ingestion and streamlined incident correlation from backup data can significantly reduce mean time to detect (MTTD) and mean time to respond (MTTR), enhancing the effectiveness of your incident response workflows.
Designing for Compliance, Recovery, and Continuity
Explore how leveraging backup data in security workflows not only helps meet audit and regulatory requirements but also enables faster remediation actions – such as snapshot quarantining and restore orchestration – ensuring business continuity with minimal disruption.

Day - 03

08:55

H01 - Oops, I Can Read Your Conditional Access Policies without Being an Admin

View Info

Hide Info

Level: Intermediate to Advanced

This session will look at some of the caveats with AAD Graph API. My research found that if you have a token for these APIs, you have pretty much unhindered access for reading and exporting anything that uses AAD Graph.

Including, reading Conditional Access Policies as an end user.

The session will go through how this is possible, how to do it and demoing the toolkit I created for exporting all of this data as an end user.

You will learn:

AAD Graph APIs can give an actor more read permissions than you thought
How to prevent some of this from happening in your environment
How to hunt for this using KQL

08:55

H02 - Fear the Defaults - Take Control of your Entra ID Configuration

View Info

Hide Info

Level: Intermediate

For many organizations, moving to Microsoft 365 is a given these days. The lure of collaboration, simple(ish) licensing, and built in security checks all the boxes. Unfortunately, just because it is in the cloud, and you have security features, doesn't mean they are enabled or enforced in an effective way.

Do you think the default is good enough? You already got all the security licenses, right?

In this session we will take you through the top security related considerations when it comes to hardening default out of the box Entra ID environments. From applications, to groups, to conditional access, all of which can be used and leverage as a grounds of attack, so know understand the risks, and how to mitigate against them.

At the end of this session, you will be forewarned and forearmed to deal with the fires within your tenant that you did not know were there.

You will learn:

The risk of using the defaults
What you need to get to an acceptable state
About hardening and controlling privileged access

08:55

H03 - Backup/Restore/Recover - That Works in Today's Cybersecurity Landscape

View Info

Hide Info

Level: Intermediate to Advanced

Most backup solutions will cover things like hardware, overwritten files, flooding, fire, etc, etc. For the last 4 years I have been working in CSIRT, and so far, what the customer hoped for, did not work at all.

You will learn:

Understand why existing solutions does not work against cyberattacks
Understand how to build solutions that does protect against cyberattacks
Understand why re-architecture backup and restore solutions prevent or slow down the attacker

10:10

General Session: Digital Sanctuary: Securing Every Organization’s Connected World

View Info

Hide Info

Level: Everyone

Join us for an innovative session that reframes cybersecurity through the lens of digital wellness and collective resilience. This presentation explores how protecting our digital infrastructure goes beyond defensive measures to create spaces where technology serves humanity's highest potential. Through practical examples and interactive discussions, participants will discover how cybersecurity principles can be applied to foster trust, strengthen communities, and build a more secure digital future for all.

Key discussion points include:

Transforming traditional security frameworks into holistic protection strategies
Building cyber-resilient communities through shared responsibility and awareness
Practical tools for implementing "security as care" in organizations
Real-world cases where security measures have enhanced rather than restricted human connection

This session is designed for security professionals, organizational leaders, and anyone interested in the intersection of technology, security, and social impact. Participants will leave with actionable insights for creating digital environments that are both secure and supportive.

11:25

H04 - NeuroInvasion Penetrating the Core of Artificial Intelligence

View Info

Hide Info

Level: Intermediate to Advanced

This presentation delves into my new research and methodologies for attacking Deep Neural Networks (DNNs) and AI models in black-box environments (without access to internal parameters.). Traditionally, adversarial attacks require access to the model's internals (white-box access), limiting their application in black-box settings. However, this talk introduces **two innovative techniques** to bypass this restriction. Attendees will gain a deep understanding of how these techniques work, from identifying a model’s architecture through **model enumeration** to adapting **white-box attack strategies** for black-box models.

**Model Enumeration** techniques– using prompts, API probing, and output analysis to identify the architecture and behavior of black-box models.
New technique 1- Substitute Model Attacks: How to train and use a substitute model to apply white-box adversarial techniques on black-box systems.
New technique 2- Methods to exploit AI models based on open-source frameworks like GPT by targeting known vulnerabilities

I will also provide practical demonstrations of how **white-box attacks** and other real world vulnerabilities widely deployed AI applications. can be adapted to black-box models once the discussed techniques were utilized, with **a live demo** and mitigations to defend against this attacks.

The presentation demystifies these attacks, making them accessible to security professionals without requiring deep mathematical expertise.

You will learn:

New methods to exploit black-box AI models using model enumeration and substitute models- Substitute Model Attacks, Open-Source Model Exploitation
New Enumeration Techniques: Practical methods to infer black-box model architectures, enabling more effective attacks.
Practical steps for executing white-box attacks such as FGSM on black-box environments.

11:25

H05 - Harnessing the Power of Threat Intelligence with Microsoft Sentinel

View Info

Hide Info

Level: Introductory to Intermediate

In the dynamic landscape of cybersecurity threats, organizations must constantly evolve to stay ahead of adversaries. Microsoft Sentinel, a cloud-native SIEM (Security Information and Event Management) solution, empowers organizations with robust capabilities for ingesting, analyzing, and acting upon threat intelligence data.

This session will delve into best practices for leveraging Microsoft Sentinel Threat Intelligence to fortify your organization's security posture. Participants will learn how to seamlessly integrate threat intelligence feeds into Sentinel, enabling proactive threat detection and response.

Key topics include:

Understanding the different types of threat intelligence
Leveraging threat indicators, such as IOCs (Indicators of Compromise) and TTPs (Tactics, Techniques, and Procedures)
Enriching security alerts with actionable threat intelligence data
Correlating events with threat intelligence to uncover hidden threats
Automating incident response workflows for swift action

Whether you're a security analyst, SOC (Security Operations Center) engineer, or IT professional, this session offers valuable guidance on maximizing Microsoft Sentinel's capabilities. Join us to discover how to stay ahead of threats, enhance your security posture, and protect your organization's assets and data with Microsoft Sentinel.

You will learn:

Integrate threat intelligence feeds into Sentinel
Understanding the different types of threat intelligence
Correlating events with threat intelligence to uncover hidden threats

11:25

H06 - The 5 Key Issues Uncovered During Incident Response, That Would Have Prevented Ransomware

View Info

Hide Info

Level: Intermediate to Advanced

Learn 5 things that could have helped customers to avoid being hit by Ransomware and/or Cyberattacks. Based on 33.000 hours of Incident Response work, I can say that I KNOW what prevent attacks and what doesn't. Join this session to learn what actually make a difference

You will learn:

How to minimize impact
How to prevent breach
From mistakes done by others

14:10

H07 - Protecting Microsoft 365 Data from Cyber Attacks

View Info

Hide Info

Level: Introductory to Intermediate

Your company has made significant investments in Microsoft 365—through licenses, solutions, and dedicated staff. With growing threats to the Microsoft ecosystem, it's crucial that you understand your role in responding to cyber attacks. Every Microsoft 365 professional needs to be aware of the NIST 2.0 framework and the expectations of your role to ensure a swift, effective defense.

In this session, you will deepen your knowledge in these critical areas, empowering you to protect your organization and contribute to a more effective, coordinated response to cyber attacks.

You will learn:

Evidence of attack
Scope & Containment
Recovery & Remediation

14:10

H08 - Security is Not Meant To Be a Matter of Convenience

View Info

Hide Info

Level: Introductory to Intermediate

This session tackles the often-overlooked challenge of aligning management, leadership, and HR with the non-negotiable demands of modern cybersecurity. We explore effective strategies for presenting compelling arguments that transcend the common misconceptions of security as a hindrance to convenience. By delving into real-world examples, attendees will learn how to foster a culture that values security as a foundational principle, including how to engage non-technical stakeholders in meaningful discussions about risk management, compliance, and the potential impacts of security breaches on the organization’s bottom line. Emphasizing communication, education, and strategic negotiation, this session equips participants with the tools needed to turn skepticism into support, paving the way for the successful implementation of advanced security measures. Join us to transform the security conversation within your organization, ensuring that your digital defenses are not just tolerated, but actively championed by all levels of leadership.

You will learn:

Equips participants with the tools needed to turn skepticism into support
How to transform the security conversation within your organization.
Understand what's involved in bridging the gap between organization and security.

14:10

H09 - Code Secure Without Becoming a Hacker

View Info

Hide Info

Level: Intermediate

The Security World is great at training pentesters by the dozens. This success has hidden the fact that the same approach does not work for training Software Engineers. This will cover how security emerges from engineering and how Security Assurance can optimally interact with developers without hindering developer velocity.

You will learn:

How software engineers can thrive in a world of shovel left security training.
How to re-align principals to let development champion security.
How software engineers can dominate security.

15:25

H10 - Keep the Front Door Shut - How Cybercriminals are Abusing Entra ID to Gain a Foothold

View Info

Hide Info

Level: Intermediate to Advanced

Entra ID has become a main point of entry in a lot of incidents around the world.

This session will cover common tactics used by threat actors and how you can start building your Entra ID as safe as possible.

You will learn:

How default settings are allowing threat actors to enumerate large parts of your Entra ID tenant
What to do, if anything to stop it.
Cool demos, and how you can try it out yourself

15:25

H11 - USBreached and USBroken

View Info

Hide Info

Level: Introductory

Delve into the world of physical computer security by revisiting the good old fashioned USB port, and all the threats to your computer and network that can originate from USB devices. From USBKillers, Juicejackers (malevolent charging ports), and Rubber Duckies, we'll cover the whole gamut of threats posed from by USB drives, cables, charging ports, and Human Input Devices, and how to protect yourself from them. We might even fry a laptop or two for fun during the session!

You will learn:

How attackers use Rubber Duckies and other HID devices to compromise systems and exfiltrate data
How Juice Jackers distribute malware to devices, and how USBKillers can destroy hardware.
How to mitigate common USB attack vectors, by using USB port locks, disabling USB ports in BIOS or in the OS, and other protective techniques.

15:25

H12 - M365 Defender - Custom Detections Everything You Need to Know

View Info

Hide Info

Level: Intermediate to Advanced

As cyber threats evolve in complexity and sophistication, organizations must fortify their defense mechanisms to safeguard their digital assets. Microsoft 365 Defender offers a comprehensive suite of tools designed to detect, investigate, and respond to modern cyber threats across multiple platforms.

This session will dive into the realm of custom detections within M365 Defender, providing attendees with a thorough understanding of how to tailor their defense strategies to their unique organizational needs. Participants will gain insights into leveraging custom detections effectively.

You will learn:

Custom Detections
Relevant Use-cases
Kusto Examples

Speakers

Andrew Silva

HPE

Shankar Subramaniam

Druva

Lauren Place

Justin Nordeste

Jim Jones

Vanessa Toves

Druva

Ben Stegink

Intelligink

Jan Ketil Skanke

CloudWay

Chen Shiri

Accenture Security

Stefan Schörling

Onevinn AB

Padraic O'Reilly

CyberSaint

John O'Neill, Sr.

AWS Solutions

Mikael Nystrom

mikael.nystrom@truesec.se

Marcos Nogueira

Sounoga Technologies

Andy Milford

RDPSoft

Andy Malone

andymalone.org

Sami Laiho

Adminize.com

Steve LaBeau

Principal Technology Solutions

Dave Kawula

dkawula@triconelite.com

Viktor Hedberg

Truesec

Alton Crossley

Émile Cabot

TriCon Elite Consulting

Mattias Borg

Alexander Andersson

Trusec

Hasain Alshakarti

Truesec

About Event

Why Attend?

Agenda

Day - 01

T01 - Workshop / HOL: Microsoft Defender XDR

Mattias Borg

Stefan Schörling

T01 - Workshop / HOL: Microsoft Defender XDR (Afternoon)

Mattias Borg

Stefan Schörling

T02 - Workshop: Windows Firewall and IPSec to Protect Against Ransomware

Sami Laiho

T02 - Workshop: Windows Firewall and IPSec to Protect Against Ransomware (Afternoon)

Sami Laiho

T03 - Workshop: Microsoft Entra Identity PowerCamp

Andy Malone

T03 - Workshop: Microsoft Entra Identity PowerCamp (Afternoon)

Andy Malone

Day - 02

W01 - Tales from Incident Response: Unmasking the Threat Actor’s Inner Sanctum

Hasain Alshakarti

W02 - Sysmon 101

Andy Milford

W03 - Raiders of the Lost Photon: An Introduction to Quantum Cryptography for Security Pro’s

Andy Malone

W04 - Disaster Recovery vs. Cyber Recovery

Jim Jones

Justin Nordeste

Panel Discussion: Data Resilience Redefined: Navigating Protection and Recovery in the Cloud Era

Dave Kawula

Sami Laiho

Mikael Nystrom

John O'Neill, Sr.

Shankar Subramaniam

Andrew Silva

W05 - Fast Focus: 5 Security Best Practices You Should Implement in Microsoft 365 Today!

Ben Stegink

W06 - Fast Focus: Exploring AI's Potential in Resolving Classical Problems in Cyber Risk Management

Padraic O'Reilly

W07 - Fast Focus: Understanding Cyber Attacks

John O'Neill, Sr.

Keynote: Forward to the Past and Back to the Future – Cybersecurity in 2025 and Beyond

Sami Laiho

W09 - A Hacker Just Logged In…

Hasain Alshakarti

W10 - Surviving Ransomware Attacks with Microsoft Defender

Dave Kawula

John O'Neill, Sr.

W11 - Defence Against the Dark Arts – Building Rock Solid Entra ID Security Solutions

Andy Malone

W12 - Living Off the Cloud: How to Move Faster Than Attackers with CDR

Lauren Place

W13 - Attacking PowerShell CLIXML Deserialization

Alexander Andersson

W14 - Securing the Supply Chain: Lessons Learned from Real Breaches

John O'Neill, Sr.

W15 - Securing Your Endpoint Management Platform

Émile Cabot

W16 - Bridging the Gap: How Backup Telemetry is Transforming Threat Detection and Incident Response

Shankar Subramaniam

Day - 03

H01 - Oops, I Can Read Your Conditional Access Policies without Being an Admin

Viktor Hedberg

H02 - Fear the Defaults - Take Control of your Entra ID Configuration

Jan Ketil Skanke

H03 - Backup/Restore/Recover - That Works in Today's Cybersecurity Landscape

Mikael Nystrom

General Session: Digital Sanctuary: Securing Every Organization’s Connected World

John O'Neill, Sr.

H04 - NeuroInvasion Penetrating the Core of Artificial Intelligence

Chen Shiri

H05 - Harnessing the Power of Threat Intelligence with Microsoft Sentinel

Marcos Nogueira

H06 - The 5 Key Issues Uncovered During Incident Response, That Would Have Prevented Ransomware

Mikael Nystrom

H07 - Protecting Microsoft 365 Data from Cyber Attacks

Vanessa Toves

H08 - Security is Not Meant To Be a Matter of Convenience

Émile Cabot

Steve LaBeau