Andrew MacPherson

Andrew MacPherson ( @AndrewMohawk ) has been around the information security space and specifically dealing with OSInt and data graphing for more than a decade, from bypassing physical security to looking at new ways to represent data more intelligently. Previously working as the first employee at Paterva, the company that brought you Maltego, he gave valuable insights into future directions, features and solutions that could be achieved with the tool. He also was responsible for building many of the various servers that are used to integrate with it. He has also presented many novel talks at many different security conferences including Blackhat, Defcon, Hack in the Box and BSides to name a few. Outside of that he has a keen knowledge of cat memes, makes a mean cup of tea and has an avid interest in hardware

From Breach to Bust: A Short Story of Graphing and Grey Data

The OSInt and Recon community have come alive in the last few years with a myriad of different tools, scripts as well as other resources for gathering and attributing information. Typically these involve single steps; from things like taking an email address to a social profile or looking up websites related to a domain. Single order tools are awesome, but using them in conjunction with various graphing methods and other tools allows you to visualise the data far beyond one order for even more awesomeness. In this section we will discuss the various methods of layout and visualisation as well as look at an example of footprinting an organisation - such as a three letter agency ;) The talk will then focus on the "OS" part of OSINT. It will go into whether breaches, forum dumps and compromised databases should be part of an investigator’s arsenal. These sources of information are usually in the grey area of obtainability and accessibility. We will discuss the level of availability of these datasets as well as practical methods to interrogate such enormous data stores. This data offers a lot more information than can be seen at first glance, its not all about which email addresses and domains were seen in Ashley Madison! Finally the talk will conclude with a demonstration showing that linking public open source data can give us valuable leads into breached data to allow us insight not commonly seen before. Think finding the private social media profiles of an individual who works at an agency. Or even how we can quickly use infrastructure based information (such as IPs/Netblocks) to not only see what people who work somewhere are interested in but also where they might have been in breached data that we would not have previously known about!

Stefano Zanero

Politecnico di Milano

Stefano Zanero is an associate professor at Politecnico di Milano. His research focuses on malware analysis, cyberphysical security, and cybersecurity in general. He has an extensive speaking and teaching experience in Italy and abroad. He co-authored over 90 scientific papers and books. He is a Senior Member of the IEEE, the IEEE Computer Society (for which he is a member of the Board of Governors), and a lifetime senior member of the ACM. Stefano is also a co-founder and chairman of Secure Network, a leading information security consulting firm based in Milan and in London, and a co-founder of BankSealer, a startup in the FinTech sector that addresses fraud detection through machine learning techniques

Securing Cyber-physical Systems: Moving Beyond Fear

Cyber-physical systems are attracting a lot of attention: attacks on connected cars received a lot of media exposure, as did attacks on industrial control systems, medical devices, and more generally on IoT devices. A lot of this interest is driven by vulnerability research (often in the form of "stunt hacking"). While useful and frankly engaging and attractive, this research does not really help answer the fundamental question of how to embed security analysis in design. In this talk, we will use automotive security as a case study to try to outline a risk-based design methodology that can be used to deal with our hyper-connected future.