Security BSides San Francisco Courses

Data Driven Bug Bounty

Use bug bounty metrics and graphs to prioritize vulnerabilities, measure security ROI, and improve remediation across teams.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Building a Predictive Pipeline to Rapidly Detect Phishing Domains

A Python-based supervised learning pipeline uses Certificate Transparency data and domain features to rapidly identify newly issued phishing domains.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

BeyondCorp - Beyond "Fortress" Security

Learn how Google’s BeyondCorp replaces perimeter security with identity- and device-based access policies for work from anywhere.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Assessing the Embedded Devices On Your Network

A hands-on security assessment of networked embedded devices using hardware reconnaissance, UART access, fuzzing, and a VoIP phone case study.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

Elliptic Curve Cryptography for Those Who Are Afraid of Math

A non-mathematical introduction to elliptic curve cryptography, including point addition, key exchange, and the Dual_EC_DRBG backdoor.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

So You’re the First Security Hire - Creating a Security Program and Integrating Security into Your Company’s Culture

A practical guide for a first security hire to build a security program and integrate security into company culture.

• YouTube
• 19 minutes
• Self-Paced
• Conference Talk

Achieving the Web Isolation Nirvana - How Far Along Are We?

Explores browser isolation mechanisms, their effectiveness against attacks involving untrusted code, current challenges, and the future of web isolation.

• YouTube
• 53 minutes
• Self-Paced
• Conference Talk

Detection-as-Code - Why It Works and Where to Start

Explains how detection-as-code brings version control, test-driven development, code reuse, and CI/CD workflows to detection and response teams.

• YouTube
• 21 minutes
• Self-Paced
• Conference Talk

Buying Security - A Client's Guide

A client-focused guide to buying cybersecurity services and getting value from security vendors.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

Attacking and Defending Infrastructure with Terraform - How We Got Admin Across Cloud Environments

Explore how Terraform Cloud environments can be compromised through secret exfiltration and malicious infrastructure deployment, then mitigated.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

Detection as Code - The Engineering-Focused Future of Detection and Response

Explore an engineering-first approach to building scalable threat detection programs that cut alert noise and improve security returns.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Tracking Meaningful Security Product Metrics

Learn how security teams can use meaningful metrics to communicate their value across the company.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

What Does it Mean to Build a Proactive Security Culture in an Organization

Explores strategies that build a proactive security culture in an organization, alongside approaches that failed.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Making of the BSides SF Astronaut Badge

Explore the creation of BSidesSF's Astronaut Badge, from technical aspects to logistics, and learn about innovative PCB printing with colorful artwork.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

When is a Vulnerability Not a Vulnerability? Overcoming the Inundation of Noisy Supply Chain Security Alerts

A security talk shows how teams can confidently ignore most noisy software supply chain vulnerability alerts and reshape their security workflows.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk