Truesec at Stockholm Tech Show 2023

Elin Richarz och Mats Hultgren

Senior Advisor Crisis Management and Continuity Planning respektive Director of Operations – Incident Response – Murphy Solutions och Truesec

There is a great misunderstanding within most organisations claiming IT disturbances to be an IT issue, pointing out the IT-department as responsible to plan for and handle disruptions in the IT environment. But frankly – in the IT-department perspective – there is no great issue related to non-functioning IT-solutions. The real consequence is owned by the business departments – and the panic which is generated causes the biggest issue for the IT department to handle. Let us erase the misunderstanding and talk business continuity in a practical perspective – making IT a business common problem.

• Room E4
• Level 200 – Intermediate
• IT Decision Makers

David Lilja och Hasain Alshakarti

SOC Level 3 Analyst respective Principal Cyber Security Advisor – Truesec.

How are the Threat Actors gaining ground and persistence in an environment today? How sophisticated are they?

Real world cyberattacks will be uncovered and explain in detail.

• Room M1
• Level 300 – Advanced
• IT influencers and implementers

Mikael Nyström och Viktor Hedberg

Principal Technical Architect respektive Senior Consultant – Truesec.

We work in the Cyber Security Incident Response Team, also known as CSIRT. We salvage / rescue / recover customers every day, doing this means that we have seen things that no one should see, We have done things that you cannot even imagine was possible to do. In this session we will summarize what went wrong and what could have prevented it from becoming an incident. This is a session not to miss…

• Room M1
• Level 300 – Advanced
• IT influencers and implementers

Mats Hultgren, Sandra Barouta Elvin, Elin Richarz, Kristoffer Haleen

Director of Operations Incident Response Team, Nationell säkerhetschef, Senior Rådgivare Krisledning respektive Cyber Practice Leader – Truesec, Microsoft, Murphy Solutions, Howden Insurance Brokers.

Sverige har länge varit ett av föregångsländerna inom digitalisering och i samband med pandemin ökade tempot ytterligare! Digitala lösningar är inte bara stommen för många verksamheter, utan även någonting som fler och fler erbjuder som tjänst. Trots att IT ofta är ett hjärta i verksamheten finns det ofta ett gap mellan funktion och säkerhet.

Frågan vår panel kommer att diskutera är dock hur redo våra organisationer är för de utmaningar som följer med den skyndsamma digitaliseringen?
Har våra organisationer ett systematiskt arbetssätt och förutsättningarna som krävs för att en allvarlig incident inte ska få katastrofala följder – från IT-avdelningen hela vägen upp till styrelserummet?

Kom och lyssna till Sandra Elvin, Kristoffer Haleen, Elin Richarz och Mats Hultgren när de vänder och vrider på dessa frågeställningar.
Med djupa insikter från skarpa incidenter kommer de med problematisering och rekommendationer kring hur en organisation behöver förhålla sig till den nya digitala världens både möjligheter och utmaningar!

• Room M8
• Level 100 – Foundation

Carolina Angelis

Säkerhetsrådgivare – Truesec Human Threat Intelligence

Sverige har skakats av flera misstänkta spionfall under den senaste tiden. Ett stort antal avslöjanden har även gjorts i övriga Europa och fler lär följa. Varför ser vi denna ökning av så kallade personbaserade inhämtningen, det vill säga att man rekryterar någon på insidan? Det försämrade säkerhetspolitiska läget i vårt närområde är ett skäl, men finns det fler? Carolinas föreläsning kommer att förklara hur själva rekryteringen går till, vilken roll sociala medier spelar samt vilka drivkrafter och personligheter som är vanligt förekommande hos den som blir spion.

• M8
• Stockholm Tech Show
  

Viktor Hedberg och Mikael Nyström

Senior Consultant respektive Principal Technical Architect – Truesec

How do you make sure your hybrid Infrastructure is up to date, secure and keep tracks of security posture?

This session will look at how we can leverage the cloud to secure on-prem, in more ways than one!

Covering topics on Azure Arc, Azure AD, Conditional Access on servers(!) and more…

• Room M1
  
• Level 300 – Advanced
  
• IT influencers and implementers
  

Mikael Nyström och Viktor Hedberg

Principal Technical Architect och Senior Consultant – Truesec

Let’s face it, if you are the admin, you have all they keys the bad guys wants. In this session you will learn how to protect your credentials, so that only YOU can use them. You will learn how to protect the control plane (AD/AAD) and use delegated permissions for everyone using a tiered access model, it is time to step up.

• Room M1
• Level 300 – Advanced
• IT influencers and implementers
  

Shabazz Darr and Viktor Hedberg

Senior Infrastructure Consultant and Senior Consultant – Netcompany, UK and Truesec

In this session we will give an overview of the Microsoft SC-400 Information Protection certification exam. We will use content from our co-authored book to give you insights which will help you prepare and pass this exam. As a bonus we will also do a book giveaway where you can win a signed copy of our book!

• Room M3
• Level 200 – Intermediate
• IT influencers and implementers

Johan Lindfors

CINO – Truesec

There are tons of resources available for someone who wants to become better at writing secure code, and lots of them are free. OWASP naturally comes to mind, and there are several active projects which should be recognized as bag of tricks in the discipline of secure development. And there are others as well! In this session we will give you some of our personal recommendations that will help both individuals, teams and organizations.

• Room M3
• Level 100 – Foundation
• Developers

Hasain Alshakarti och Carlo Alberto Scola

Principal Cyber Security Advisor respective Penetration Tester and Cyber Security Consultant – Truesec

Modern IT environments offer passwordless authentication to improve security and improve user experience. Certificate and key-based authentication does not only makes the user’s life easier, it also gives the offensive side an excellent opportunity to obtain versatile credentials and be more stealthy.

This technical session will provide detailed demos and discussions about the different attacks using certificate- and key-based authentication in a Windows environment ranging from certificate services misconfigurations and abuse to Windows Hello for Business keys and sessions.

• Room M1
• Level 300 – Advanced
• IT influencers and implementers

Alexander Andersson och Rasmus Grönlund

Principal Digital Forensic Investigators – Truesec

With more than 10.000 hours, leading over 300 forensic investigations — Alexander and Rasmus will take you through all the phases, challenges, and the most important learnings when responding to a cyber attack against a complex enterprise environment.

The session will cover the entire lifecycle of an incident, from start to end, and consider the challenges we as incident responders see again and again in our cases:

– How do you scale forensic data collection and analysis to handle thousands of servers?
– How do you remotely access an environment that is breached, malfunctioning, that at the same time needs to be contained?
– What are the techniques today’s threat actors use, and what traces do they leave?
– How do you contain the situtation and minimize the risk for further damage?
– What steps are needed to eradicate the threat and close any ways back into the environment?
– What options do you have when everything fails, can ever paying the ransom be an option?

The session will cover the forensic aspects of incident response on a high level, but will also feature technical deep dives on advanced attack techniques, threat actor modus, and how Truesec recently reversed and cracked a ransomware to get the customer’s files back without paying the threat actors.

• Room M1
• Level 300 – Advanced
• IT influencers and implementers