Security BSides San Francisco Courses

You Might Still Need Patches for Denim

Explore container patch management strategies, including image registry maintenance, continuous deployment, and Google's approach to critical vulnerability patching without downtime.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Concrete Steps to Create a Security Culture

Practical strategies for fostering a strong security culture in organizations, with actionable examples and insights on measuring success in cultural change initiatives.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

Building Identity for an Open Perimeter

Explore Netflix's cloud-first security approach, focusing on identity as the new perimeter through SSO, MFA, and adaptive authentication for a location-independent strategy.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Navigating Passwordless Authentication with FIDO2 & WebAuthn

Explore FIDO2 and WebAuthn standards for passwordless authentication, learn implementation strategies, and discover how to enhance security while improving user experience.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

The IoT Hacker's Toolkit

Explore essential hardware and software tools for IoT security assessment, covering interfaces, analysis techniques, and skill-building for embedded device evaluation.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

No More XSS - Deploying CSP with Nonces and Strict-Dynamic

Learn to implement Content Security Policy with nonces and strict-dynamic to prevent XSS attacks. Discover practical deployment strategies for Pinterest and Instapaper, and understand potential vulnerabilities.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Honeypots 2.0 - A New Twist on Defending Enterprise Networks

Explore dynamic deception at scale using Python's Twisted framework for enhanced network defense, focusing on scalable honeypot technologies and their implementation in enterprise environments.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk

Six Degrees of Infiltration - Using Graph to Understand Your Infrastructure and Optimize Security Decision Making

Explore graph-based solutions for consolidating security intelligence and improving decision-making in complex infrastructures, using tools like Neo4j to enhance visibility and risk assessment.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

The Bucket List - Experiences Operating S3 Honeypots

Insights from operating S3 honeypots: Discover who's hunting for exposed buckets, their methods, and how to protect your AWS assets through monitoring and defensive strategies.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Introduction to Windows Kernel Mode Debugging

Explore Windows kernel debugging essentials, including symbol servers, BSOD analysis, and live debugging. Learn practical approaches to diagnose CPU issues, deadlocks, and blue screens for improved software security.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

An Open Source Malware Classifier and Dataset

Explore open-source malware classification using machine learning, featuring a diverse Windows PE file dataset, pre-trained models, and reproducible code for enhanced static malware detection research.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Crimeware Chaos - Empirical Analysis of HTTP-Based Botnet C&C Panels

Empirical analysis of HTTP-based botnet C&C panels, exploring design, technologies, and characteristics of crimeware control systems used by cybercriminals for managing botnets and other malicious operations.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Pensieve - Finding Malicious Artifacts in Container Environments

Explore techniques for forensic investigation in container environments, focusing on evidence retention and artifact gathering to understand adversarial activities.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk

Fighting Secrets in Source Code with TruffleHog

Discover TruffleHog: a tool for identifying secrets in source code, its applications in DevOps, and new approaches to detecting secrets in package managers like npm and pypi.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Data Driven Bug Bounty

Explore data-driven bug bounty programs: collecting metrics, analyzing vulnerabilities, and leveraging insights to enhance security processes and address weak spots effectively.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk