Securi-Tay is an information Security conference held by the Ethical Hacking Society at Abertay University. After the sell-out success of Securi-Tay 2017, this year’s event will run on Friday 18th of May and Saturday 19th of May. The conference will be held in Abertay University, benefiting from the fantastic transport links to Dundee. As well as transport, Dundee benefits from affordable accommodation in the city centre, as well as a thriving technology community and the reputation for being Scotland’s sunniest city.
The conference is aimed at anyone with an interest in Hacking and Information Security. You don’t need to be a l33t h4x0r to attend and enjoy the event: Securi-Tay promises to provide a fantastic, worthwhile experience for everyone, new to the scene and conference veteran alike. The conference will feature talks from industry professionals and students as well as some workshops. Lunch and an evening buffet will be provided in the bar across the street.
We're happy to announce the schedule for the conference is now available!
You can also find the programme online.
9-00
Welcome!
Meet us in the foyer of Abertay University and sign in!
There's also free stuff!
The first 350 people to arrive will get a free bacon roll! (or veggie alternative)
60 mins
Foyer
10-00
When security incidents happen, you often have to respond in a hurry to gather forensic data from the resources that were involved. You might need to grab a bunch of hard drives and physically visit the data centre to capture data from the systems. And that would mean getting dressed. When infrastructure is in the cloud, you have remote access and APIs for managing all your infrastructure, so you can respond to incidents with automation and do your forensic analysis in your bunny slippers. But is it as good as the capabilities you have in a data centre? Is getting dressed the price you have to pay for high quality forensics and incident response? In this talk Paco will explain the two major domains of cloud events (infrastructure domain and service domain) and describe the security and incident response techniques pioneered by AWS customers like Mozilla, Alfresco, and Netflix. He'll explain how to isolate resources to preserve the integrity of the data; get RAM dumps and disk image snapshots; and identify unauthorised changes to cloud resources using API tools and logs. And all of this while wearing pyjamas.
60 mins
Lecture Theatre 1 (2516)
I'm a security consultant with Amazon Web Services, helping to secure applications and data in the cloud. I've previously done a lot of penetration testing, source code review, and threat modeling. Today I help the biggest enterprises securely move their sensitive data and business critical workloads to the cloud.
11-00
Internal security systems are often cumbersome and difficult to use, leading to your developers not always following best practice. In addition, data egress and unauthorised access are difficult to spot without analysing every endpoint your business uses, including the ones normally outside your sphere of control. In this talk, we outline a new type of heuristics-driven internal security system, designed to be both developer-friendly and easily-extensible.
60 mins
Lecture Theatre 1 (2516)
Jonathan Kingsley is the VP of Engineering at MirrorWeb. When he's not building backend systems, he likes to write film scripts and set swimming pools on fire.
Jamie Hoyle is the VP of User Experience at MirrorWeb. He's a long-suffering Bury FC fan, and accidentally became the CTO at an IoT firm for 9 months.
In this presentation Eamonn highlights the growing transition from real to virtual, from dead to live and the overarching appeal and employability of the multi-faceted security professional.
60 mins
Lecture Theatre 2 (2517)
Eamonn has been prominent in the cyber security spectrum for some years with numerous roles. Working for Police Scotland he has led digital forensic and cyber investigation teams on an international, National and local level.
12-00
Hop over the road to Abertay Student Union for a bite to eat before the afternoon talks.
Oh, lunch is provided as well by the way!
45 mins
Bar One
12-45
"Cloud Native" computing has been a hot topic in the last 18 months with tech. companies joining the CNCF at a rate of knots. At the same time containerization and solutions like Kubernetes have been gaining traction with a wide range of companies as a easy way to run their workloads in the cloud.
With any new trend in computing always comes the question "Can we Pwn it?" . This talk aims to take a look at containerization and cloud computing to see what the answer to that question is.
60 mins
Lecture Theatre 1 (2516)
Rory has worked in the Information and IT Security arena for the last 17 years in a variety of roles, from financial services, to running a small testing company, to working for large companies as a consultant.
These days he spends most of his work time on application, cloud and container security. He’s an active member of the UK InfoSec community and has been presenting at security and general IT conferences for the last 8 years.
When he’s not working he can generally be found out and about enjoying the scenery in the Highlands of Scotland, when the midgies aren’t biting!
2016 saw a substantial rise in ransomware attacks and in some cases the return of some favourites with Cryptowall, CTB-LOCKER and TeslaCrypt being some of the most popular. The volume of attacks was in fact pretty steady for a good part of the year, with regular campaigns coming out on a weekly basis. It was interesting to see the variety in mechanisms used for the ransomware which not only included self-contained binaries but went all the way to the use of scripts. As part of the research I conduct last year, I wanted to understand why such a drive and lure for ransomware outside of the victims will pay as well as have some way of properly testing "anti-ransomware" solutions with an unknown variant. So to do that, I went ahead and built my own ransomware and drew some conclusions on why it became so popular.
The intent of this talk is to demonstrate why ransomware has become a tool of choice for attackers beyond the notion of victims will pay. By analysing and investigating existing ransomware and delivery methods, I outlined a framework to easily build my own version of a ransomware.
60 mins
Lecture Theatre 2 (2517)
As a global security advocate and threat researcher, Thomas spends his time advising companies on managing their data protection activities against malicious parties not just external threats but also compliance instigated. Thomas' 25+ years background in IT includes varying roles from incident responder to security architect at fortune 500 company, vendors and consulting organizations. Thomas is also an active participant in the InfoSec community not only as a member but also as director of Security BSides London, and ISSA UK chapter board member.
13-45
Assessing binary applications (i.e. anything with an EXE, DLL, JAR, etc.) can be a challenging space to get started in due to the large number of languages, platforms, network protocols, and other supporting technologies. This talk will cover a range of common security vulnerabilities that I find in my day-to-day work, how I generally find them, how you can exploit them, and what remediation you can suggest to clients.
60 mins
Lecture Theatre 1 (2516)
Graham has been working as a penetration tester for the last 5 years, and currently heads up the binary application assessment service at Cisco Advanced Services. His main areas of focus are Windows applications and drivers, cryptography, and hardware.
Spear phishing is on the rise, and the more our lives are displayed online, the more information a hacker has to target us. This talk will describe our journey for a spear phishing attack, detailing how to pick and research vulnerable targets via social media, and then how to construct emails based on the information discovered. Finally, we will demonstrate a typical spear phishing attack and the access a hacker could expect to obtain following a successful campaign.
We will use real-life case studies from social engineering engagements, supported with statistics from the attacks and the resulting real-world consequences.
After this talk attendees will understand:
60 mins
Lecture Theatre 2 (2517)
Alex Archondakis is a self-taught ethical hacker, with a background in programming and a particular interest in human psychology and social engineering. Alex specialises in web application and external infrastructure testing and recently co-presented a two-day workshop at ISACA CSX Europe on Red versus Blue teaming.
14-45
Take five! ... or fifteen.
15 mins
Wherever you want!
15-00
Mobile Wifi devices routinely emit probe-req packets giving details of the BSSIDs they have been associated with in the past - the Pineapple device exploits this very feature. Some devices now emit spoofed MAC addresses as part of their tracking preventing. But what if there existed a scalable WiFi scanning monitoring network? Would this enable devices even with obfuscated MACs to be tracked. This presentation describes work-in-progress to built cheap (disposable!) Wifi tracking devices and the infrastructure to support the capture,data-mining, analysis and visualisation of probe-req packet information with a view to understanding the potential threat to privacy it represents.
60 mins
Lecture Theatre 1 (2516)
Senior Lecturer, Abertay University.
A talk in 2 parts.
In Part 1 I'll use the OSI 7 Layer Model as a talking point about the diversity of areas of work/research/areas of concern across the infosec spectrum.
In Part 2, Rockstars vs Plumbers; I'll talk about the work that enterprise security people do across layers, how this relates to "rockstar" researchers, and security versus compliance.
The aim of the talk is help bridge the gap between various infosec "tribes" and educate attendees on the breadth of topics and how they relate to one another. e.g. for those working at the application layer the issues at other areas of the stack; and why "plumber" work/doing the basics is still important work, how compliance activities can aide security; and why research work is important and helps day-to-day enterprise security admins.
60 mins
Lecture Theatre 2 (2517)
Over 15 years enterprise IT/infosec experience, currently working in a freelance/interim capacity, coming from sys admin/network engineer background. Worked for a with a mix of orgs: media, public sector/NFP, engineering, FMCG, SaaS/online, finance. PgDip in Software and Systems Security, CISSP.
16-00
Due to the increasing number of recommendations for people to use VPN’s for privacy reasons, more app developers are creating VPN apps and publishing them on the Apple App Store and Google Play Store. In this ’gold rush’, apps are being developed quickly and, in turn, not being developed with security fully in mind. This talk outlines some of the research undertaken as part of my final year dissertation into the security and privacy of VPN apps on Apple's iOS platform, gives an insight into the general state of security on an ecosystem that is generally known to be secure and discusses methods to build secure VPN clients.
60 mins
Lecture Theatre 1 (2516)
I'm a fourth year student at Abertay University, studying BSc (Hons) Ethical Hacking. My interests include offensive & defensive security and privacy.
Threat Hunting refers to proactively and iteratively searching through networks or datasets to detect and respond to advanced threats that evade traditional rule- or signature-based security solutions. But what does that really mean? And what real impact does it have on the security team?
Threat hunting looks at a mountain of security data already being produced daily by the traditional monitoring solutions such as netflow data, firewall events and logs. Now include end point data and the events to review explode exponentially. The claim, from various vendors, is that the additional data provides greater visibility but for whom. Traditional incident detection doesn't necessarily take into consideration the endpoint events. Building a threat hunting activity scoped to start with end point data can significantly change the game.
This talk is a journey of how to dive into threat hunting and will cover the principals of threat hunting as a foundation while examining the challenges of working with large datasets that can be generated by end point data and analyse some of the tools claiming to ease this burden including machine learning.
60 mins
Lecture Theatre 2 (2517)
As a global security advocate and threat researcher, Thomas spends his time advising companies on managing their data protection activities against malicious parties not just external threats but also compliance instigated. Thomas' 25+ years background in IT includes varying roles from incident responder to security architect at fortune 500 company, vendors and consulting organizations. Thomas is also an active participant in the InfoSec community not only as a member but also as director of Security BSides London, and ISSA UK chapter board member.
17-00
Take five! ... or fifteen.
15 mins
Wherever you want!
17-15
This talk will discuss how we can leverage current/emerging techniques in infosec to advance our capabilities to hack shit/do research/write more secure code. Basically a "here is the awesome stuff we have now and massively underuse". Kinda broken into 3 bits - advanced exploitation techniques/RE techniques (SAT/SMT solvers, program synthesis), stuff we have now that makes writing secure code possibly easier (langsec, rust, mitigations), and stuff testers can leverage to get the job done better (data driven test cycles, collaborative testing, etc). The objective of this talk is to point out stuff people can go try out / use / look into for advancing the field a bit
60 mins
Lecture Theatre 1 (2516)
Darren is a member of LizardHQ, a community of security researchers and activists, and infosec research think tank.
rum.supply18-15
Just a couple of words before the...
15 mins
Lecture Theatre 1 (2516)
18-30
Sponsored by LizardHQ, join us in the union for a few(?) drinks and lots of awesome chat!
???
Abertay Student Union
11-00
Good Morning!
Meet us in Bar One for a breakfast buffet a chill atmosphere.
Pancakes, refreshments, and more!
75 mins
Abertay Student Union
12-15
DNS is great. DNS TXT records are greater. A quick run through of how I manage my VPN tokens using DNS and some bash hackery.
15 mins
Abertay Student Union
Greasing wheels, chasing 9s, polishing LAMPs, and doing devops at Sky Betting and Gaming
12-30
A talk around disaster recovery testing, chaos engineering, etc. and how we do this at Sky Betting and Gaming
30 mins
Abertay Student Union
Dad, husband, computer-man. Greasing wheels, chasing 9s, polishing LAMPs, and doing devops at Sky Betting and Gaming
13-00
Profiling the attacker
It was once said "Intrusion analysis is as much about TCPdump as astronomy is about telescopes. Understnading who is attacking a network and why is just as important as analysing the packets on the line.
This slot will focus on a technical offender profiling framework that can be used to build a knowledge base on malicious actors. This talk will take a deep dive into the following areas:
30 mins
Abertay Student Union
I am a computer security consultant that has worked in a variety of security roles, from SOC work to sec dev ops. I have a BSc in Computer Security as well as certifications in other areas, including Prince2. I have also written for several websites in the past and began speaking at security conferences in 2017.
13-30
There is a distinct communication gap between the software engineering and cybersecurity communities when it comes to addressing reoccurring security problems, known as vulnerabilities. Many vulnerabilities are caused by software errors that are created by software developers. Insecure software development practices are common due to a variety of factors, which include inefficiencies within existing knowledge transfer mechanisms based on vulnerability databases (VDBs), software developers perceiving security as an afterthought, and lack of consideration of security as part of the software development lifecycle (SDLC). The resulting communication gap also prevents developers and security experts from successfully sharing essential security knowledge. The cybersecurity community makes their expert knowledge available in forms including vulnerability databases such as CAPEC and CWE, and pattern catalogues such as Security Patterns, Attack Patterns, and Software Fault Patterns. However, these sources are not effective at providing software developers with an understanding of how malicious hackers can exploit vulnerabilities in the software systems they create. As developers are familiar with pattern-based approaches, this paper proposes the use of Vulnerability Anti-Patterns (VAP) to transfer usable vulnerability knowledge to developers, bridging the communication gap between security experts and software developers. The primary contribution of this paper is twofold: (1) it proposes a new pattern template – Vulnerability Anti-Pattern – that uses anti-patterns rather than patterns to capture and communicate knowledge of existing vulnerabilities, and (2) it proposes a catalogue of Vulnerability Anti-Patterns (VAP) based on the most commonly occurring vulnerabilities that software developers can use to learn how malicious hackers can exploit errors in software.
30 mins
Abertay Student Union
I am a PhD student at the University of Abertay, Division of Cybersecurity. Being a Software Engineer with expertise in cybersecurity, I have design a novel pattern-based approach to capture and communicate poor security practices to software developers.
14-00
Ethical Social Engineering: Soft Skills for Workplace Success
Many technically-oriented degree programmes do an excellent job of providing students with a thorough grasp of technical and engineering skills and material, but fall short of providing the soft skills necessary to successfully deploy these in a professional or workplace environment. Yet these are the skills that will help the student not only advance swiftly in their field, but become a sought-after member of a project team. This talk will give a brief overview of the three essential soft skills that will help the student transitioning into the workplace be viewed as an individual rather than a resource, and ensure clients, customers and colleagues are treated as people rather than clueless bumblers, meme bros, or competitors:
i. Courtesy and respect - listening, valuing, retaining integrity.
ii. Active listening and self awareness - considering before judging, paying attention and demonstrating, reflecting back, relevant questions, summarisation
iii. Professionalism - responsibility, teamwork, “yes and” and “yes but”
It concludes with some thoughts on how these techniques can be pulled together in a way that reflects and enhances the best ‘you’ and the role of experience and continual development throughout the security professional’s career.
30 mins
Abertay Student Union
Security consultant at ECS Security. Abertay BSc Digital Forensics graduate 2017. Over a decade's worth experience in content production, game design, scriptwriting, digital media, software development, and writing compact biographies.
14-30
We're looking for more lightning talks on the day! Reach out to a member of staff for more details.
??? mins
Abertay Student Union
Tickets are available through Eventbrite. Standard tickets are £25, student tickets £20.
Buy Tickets!