Security BSides San Francisco Courses

Fuzzing Malware for Fun & Profit

Explore coverage-guided fuzzing to find vulnerabilities in malware, potentially stopping DDoS attacks and controlling botnets. Learn about netAFL tool and see real-world exploitation demos.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

HTTP Security Headers - A Technology History Through Scar Tissue

Explore HTTP security headers, their evolution, and best practices. Learn to leverage browser-built security controls, with a focus on implementing effective content-security-policy for enhanced web application protection.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Collect All the Data - Protect All the Things

Explore blue team strategies for comprehensive data collection, analysis, and correlation using open-source tools and machine learning to enhance continuous monitoring capabilities.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

BADPDF - Stealing Windows Credentials via PDF Files

Discover how PDF files can be weaponized to automatically leak Windows NTLM hashes, potentially compromising user credentials without interaction.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk

Strangeways, Here We Come

Explore cloud migration for startups: benefits, risks, and security best practices. Learn about AWS, cloud architecture, and strategies for a successful transition from on-premises to cloud-based solutions.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

The Memory of a Meltdown

Explore Spectre and Meltdown vulnerabilities through hands-on demonstrations, understanding their impact on memory access and learning how to exploit them using proof-of-concept techniques.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

What We Can Learn from Google's Fight with Phishing

Insights from Google's research on phishing attacks, including prevalence, impact, and effective mitigation strategies. Explores prevention methods and provides customized recommendations for different user environments.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Lessons Learned Implementing Meaningful Access Controls to Customer Data

Insights on implementing robust access controls for customer data, reducing internal access by 70% through improved tooling, processes, and automation at Intercom.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

Keep it Like a Secret - When Android Apps Contain Private Keys

Análisis de seguridad en apps Android: descubrimiento de miles de claves privadas expuestas, técnicas de craqueo de contraseñas y potenciales riesgos asociados.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Blue Team Fundamentals

Explore effective strategies to counter common cyber attacks, including credential stuffing, phishing, and RCE attempts, with practical takeaways to enhance your organization's security posture.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Using Ancient Math to Speed Up Security Assessments of Windows Executables

Discover how to accelerate Windows executable security assessments using Euclidean Distance and Bayes Theorem, enabling rapid triage and efficient risk reduction in regulated environments.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Caught My WebApp Cheating on Me

Exploring techniques to detect and prevent client-side injections and tampering in web applications, ensuring integrity and security of code executed in the browser.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Listen to Your Engine - Unearthing Security Signals from the Modern Linux Kernel

Exploring Linux kernel security signals through system call analysis, focusing on detecting privilege escalation, resource abuse, and side-channel attacks in cloud-native environments.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Logging, Monitoring, and Alerting in AWS - The TL;DR

Comprehensive guide to AWS security services for effective monitoring, alerting, and incident response. Learn critical configurations to immediately enhance your infrastructure's protection.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Practical Steps for Reducing Exposure and Detecting Compromise

Strategies for securing DNS services, protecting against common attacks, and monitoring traffic for compromise. Covers both authoritative and recursive perspectives to enhance overall network security.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk