Security BSides San Francisco Courses

Exposed Secrets - How Public Git Repositories and Docker Images Expose Millions of Secrets Like API Keys and Security Certificates Every Year

Learn how API keys and security certificates become exposed through public Git repositories, Docker images, and packages.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

The Power of Guardrails - How to Slash Your Risk of XSS in Half

Learn how secure code defaults and development guardrails can reduce recurring vulnerabilities, including cross-site scripting risk.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Ooga Booga - Avoiding Reinvention of the Wheel - Useful Security Tools and Lessons to Know

Learn Marie Kondo-style techniques for selecting useful security tools and avoiding reinvention of common solutions on under-resourced security teams.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Practical Threat Hunting With Machine Learning

Practical threat hunting with machine learning models, illustrated through case studies of high-value threat detections.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

An Unlikely Friendship - Why Security Engineers and Product Managers Should Be Working Together

Learn how security engineers can partner with product managers to prioritize security features, advance a security-focused roadmap, and reach security-conscious customers.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

Read the Fantastic Manual - Writing Security Docs People Will Actually Read

Learn to identify documentation needs, create security docs iteratively, and measure whether people actually use and understand them.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Go With The -Work-flow

Examines how cloud workflow management platforms expose misconfigurations, credentials, sensitive data, insecure code, and containerized malware.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk

Embracing Risk Responsibly - Moving Beyond Inflexible SLAs and Exception Hell by Treating Security Vulnerabilities and Risk Like Actual Debt

A security risk-management approach that treats vulnerabilities as debt, replacing inflexible SLAs and permanent exceptions with responsible risk acceptance.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Biohacker - The Invisible Threat

Explores how implanted people and contactless technologies can become attack vectors against physical and digital security.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

Redefining Threat Modeling - Security Team Goes on Vacation

Explores how to scale threat modeling programs without creating a security-team bottleneck as companies grow.

• YouTube
• 48 minutes
• Self-Paced
• Conference Talk

CTF Writeup - Log 'em All

Walk through solving a difficult hacking and reverse-engineering challenge built around a classic bug in Pokémon Red.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Offensive Javascript Techniques for Red Teamers

Explores JavaScript payloads that use a browser to reconnoiter and reach internal network assets before a malware implant.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

A Look at Jython-Enhanced Reverse Engineering with Ghidra

Use Jython and Ghidra’s scripting API to streamline static analysis of obfuscated malware.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Leveraging Osquery for DFIR at Scale

Explore how osquery can help incident responders investigate attack breadcrumbs and accelerate digital forensics and incident response at scale.

• YouTube
• 20 minutes
• Self-Paced
• Conference Talk

How to Write Like It's Your Job

Practical advice for security writers on starting and finishing exploit reports, choosing tools, and checking work for professional presentation.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk