Security BSides San Francisco Courses

Security Learns to Sprint - DevSecOps

A practical talk on helping security teams join fast-moving DevOps through smaller security checks, asynchronous testing, developer enablement, and security champions.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

Securing Coinbase's Edge Payments Infrastructure

Threat-model payment networks and apply application security tools to protect payment flows from fraud, money loss, and personal-data exposure.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Break Crypto like a Pro

Explore how cryptographic implementation mistakes enable attacks, including weak randomness, reused keys, CBC padding oracles, bit flipping, and vulnerable password hashing.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Non-Political Security Learnings from the Mueller Report

Blue-team defense lessons drawn from forensic evidence of the 2016 election hacking campaign.

• YouTube
• 21 minutes
• Self-Paced
• Conference Talk

Detection as Code - The Engineering-Focused Future of Detection and Response

Explore an engineering-first approach to building scalable threat detection programs that cut alert noise and improve security returns.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Tracking Meaningful Security Product Metrics

Learn how security teams can use meaningful metrics to communicate their value across the company.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

What Does it Mean to Build a Proactive Security Culture in an Organization

Explores strategies that build a proactive security culture in an organization, alongside approaches that failed.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Making of the BSides SF Astronaut Badge

Explore the creation of BSidesSF's Astronaut Badge, from technical aspects to logistics, and learn about innovative PCB printing with colorful artwork.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

When is a Vulnerability Not a Vulnerability? Overcoming the Inundation of Noisy Supply Chain Security Alerts

A security talk shows how teams can confidently ignore most noisy software supply chain vulnerability alerts and reshape their security workflows.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

Red Team Tales - 7 Years of Physical Penetration Testing

Stories from seven years of physical security testing show how testers used bypasses and social engineering pretexts to defeat security.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

Rise of the Vermilion - Cross-Platform Cobalt Strike Beacon Targeting Linux and Windows

Examines Vermilion Strike, a cross-platform Cobalt Strike Beacon reimplementation used in real-world attacks against Linux and Windows.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

JavaScript Obfuscation - It’s All About the P-a-c-k-e-r-s

Learn how detecting JavaScript packers can reveal obfuscated files used in phishing, Magecart, supply-chain injection, and malware droppers.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Red Teaming macOS Environments with Hermes the Swift Messenger

Explores Hermes, a Swift implant for red teaming macOS, its Mythic C2 integration, capabilities, and detection with Apple's ESF.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

WireGuard from the Ground Up

Explains WireGuard’s implementation, protocol, and cryptography, comparing its security and performance with IPsec, ngrok, and OpenVPN.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

Hook, Line and Sinker - Pillaging API Webhooks

Demonstrates “Webhook Boomerang” attacks that exploit API webhooks for SSRF and cloud-credential compromise despite metadata-header protections.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk