Serverless computing is a kind of cloud computing execution model that enables enterprises to use the computational power of a cloud service provider (CSP). It allows enterprises to focus on building apps and core products, rather than using manpower to maintain and secure server infrastructure. However, serverless technologies are not immune to risks and threats.

This presentation aims to shed light on the security considerations in serverless environments and help adopters in keeping their serverless deployments as secure as possible. It focuses on services offered by AWS, which has the widest range of offerings available in the serverless services market.

The benefits of migrating to and using cloud-based technologies also come with the risk of exposing organizations' infrastructure to the whole internet. To discover how exposed these cloud deployments are, Joey and his teammates conducted an indepth survey of various cloud services and technologies, and identified a large number of exposed and badly configured cloud services, and in some cases, actively compromised cloud infrastructure.

This presentation will explore the various issues that they discovered, as well as the risks introduced to the organization. Furthermore, the presentation will touch on basic guidelines and best practices on how to secure your own cloud deployments.

During WW2, the U.S. used a flawed cryptographic device that relied on electro-mechanical relays in its operation. Eventually, researchers discovered they were able to detect electromagnetic spikes and eventually recover the plain text via radio. Decades later, Wim van Eck published an analysis on computer monitors, which describes a way to eavesdrop on CRT displays, in similar fashion with flawed U.S device. Such research elevated alertness on research regarding side channel, and caused consternation in the community as such attacks required sophisticated equipment only available to organizations with a huge budget to expend.

In recent years, such topic has developed into a field of its own, and dubbed TEMPEST by NSA. In Black Hat USA 2020, researchers have revealed a method to eavesdrop on conversations via vibration patterns in a hanging light bulb, which only requires a line of sight to obtain. In this session, the researchers will discuss the journey of USBee, a malware variant that uses electromagnetic emissions from an ordinary USB cable to exfiltrate data.

During WW2, the U.S. used a flawed cryptographic device that relied on electro-mechanical relays in its operation. Eventually, researchers discovered they were able to detect electromagnetic spikes and eventually recover the plain text via radio. Decades later, Wim van Eck published an analysis on computer monitors, which describes a way to eavesdrop on CRT displays, in similar fashion with flawed U.S device. Such research elevated alertness on research regarding side channel, and caused consternation in the community as such attacks required sophisticated equipment only available to organizations with a huge budget to expend.

In recent years, such topic has developed into a field of its own, and dubbed TEMPEST by NSA. In Black Hat USA 2020, researchers have revealed a method to eavesdrop on conversations via vibration patterns in a hanging light bulb, which only requires a line of sight to obtain. In this session, the researchers will discuss the journey of USBee, a malware variant that uses electromagnetic emissions from an ordinary USB cable to exfiltrate data.

Asking the right business question is easily the most important phase of any data science project. Despite this, many data science teams focus on the wrong business questions. Teams often select projects that are either not feasible or tackle problems that don't drive sufficient business value.

Isaac will talk about a methodology for selecting the right business question, therefore ensuring that data science projects deliver real, risk controlled business value.

While AI and ML can support businesses, critical infrastructures, and industries as well as help solve some of society's biggest challenges, these technologies can also enable a wide range of digital, physical, and political threats to surface.

This presentation will discuss research, a joint effort among Europol, Trend Micro, and the United Nations Interregional Crime and Justice Research Institute (UNICRI), that shows the present state of the malicious uses and abuses of AI and ML technologies, and the plausible future scenarios in which cybercriminals might abuse these technologies for ill gain.

There has been an ongoing evolution of the malware and security landscapes. In the last few years, we have seen the widespread adoption of machine learning (ML) into cybersecurity solutions. In response to this, we have seen changes in the methods adopted by malware authors to evade security solutions. It is a game of cat and mouse between the attackers and defenders, and unfortunately there are real-world consequences when cybercriminals succeed.

In this presentation, Jon will look at this ongoing evolution of security and malware. He will describe why ML is a key technology in understanding the interaction between malware and how security solutions can help maximize the benefits of ML-based security

This presentation aims to give an overview about how Kubernetes - an orchestration tool for scalable container deployment and management - works and to provide the best practices users can follow to secure their cluster when deploying and maintaining a cluster on their own or via managed services on Cloud Service Providers such as Google, AWS and Azure.

This session will be covering everything from the Master Node, starting with the Kube API server, also including the etcd, Role Based Access Control and Network Policies, and then the Worker Nodes, covering the kubelet, how to enable audit logs and how to protect your pods. CIS Benchmarks for Kubernetes and the default security configurations will also be discussed.