Security BSides San Francisco Courses

Sharks in the Water - Open Source Component Risk and Mitigation

Explore open source component risks and mitigation strategies, focusing on supply chain vulnerabilities, recent hacks, and preventive measures through education and automated tooling.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

Managing the Assets of Your Security Career

Strategies for career growth in cybersecurity: improving influence, visibility, and promotion chances through effective stakeholder management and asset tracking techniques.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

How to 10X Your Company's Security - Without a Series D

Discover actionable strategies to dramatically enhance your company's security posture without significant financial investment. Learn from distilled insights and lessons from DevSecOps and modern AppSec experts.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

What's New or Not in 2020 - Are We Making Progress on the Intractable Security Problems

Insightful keynote examining the progress and challenges in Information Security over the past decade, highlighting achievements and persistent issues facing professionals in the field.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

2FA in 2020 and Beyond

Explore the modern 2FA landscape with data-driven analysis, comparing security strength and user experience of various authentication methods like SMS, soft tokens, push, and WebAuthn.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

How to Write Like It's Your Job

Practical advice for security professionals on improving technical writing skills, from starting to finishing, with tools and tips for presenting professional work.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

MOSE - Using Configuration Management for Evil

Explore MOSE, a post-exploitation tool for leveraging configuration management servers to compromise associated agents en masse, simplifying large-scale system takeovers.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk

K-Rail - A Tool to Manage K8s Securely at Speed

Explore offensive and defensive scenarios in Kubernetes security, and learn about k-rail, a tool for mitigating risks and managing configurations securely at scale.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Lessons from DevSecOps Trenches

Panel discussion with security team leads sharing insights on building and scaling security programs, exploring successes, failures, and practical strategies in DevSecOps implementation.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

DevSecOps State of the Union

Comprehensive overview of DevSecOps best practices, tools, and methodologies. Distills insights from industry leaders to help AppSec teams improve security integration, automation, and culture.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Ethical Hacking - DIY Mobile Security Workstation for Cheap

Learn to build a cost-effective mobile security workstation using affordable parts and open-source software. Discover how to create a powerful system capable of running Kali Linux or Parrot OS for ethical hacking and network testing.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Implementing a Kick-Butt Training Program - Blue Team Go

Discover a framework for building a robust cybersecurity training program that empowers analysts with hands-on skills in incident response, forensics, and threat hunting.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Treat the Problems, Not the Symptoms

Explore alternative approaches to Active Directory security, focusing on actionable steps for complex multi-domain environments beyond traditional defensive products.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

Journey to Command Injection - Hacking the Lenovo ix4-300d

Demonstration of chaining vulnerabilities to remotely exploit a Lenovo NAS device, showcasing command injection, XSS, and CSRF techniques for full system compromise.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

Shall We Play a Game?

Develop effective security exercises using MITRE ATT&CK framework. Learn to create, run, and score drills that turn threat intelligence into practiced action for improved incident response.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk