Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat USA
July 31 - August 5, 2021
Las Vegas, NV, USA
SecTor
November 4 - October 30, 2021
Toronto, ON, Canada
Black Hat Europe
November 8-11, 2021
Virtual Event
11/20/2018
09:00 AM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Black Hat Europe: Stock Up On New Security Tools and Training

If you work in cybersecurity it's important to stay abreast of the latest tools and techniques, and there's no better place to do that than Black Hat Europe in London next month.

As the year winds down around us, now is a good time to be planning ahead for a fruitful new year. If you work in cybersecurity that means keeping abreast of the latest tools and techniques, and there’s no better place to do that than Black Hat Europe in London next month.

For example, MongoDB’s Keeping Secrets: Emerging Practice in Database Encryption Briefing promises an hour dedicated to reviewing the latest advances and breaks in database encryption techniques, including searchable encryption, multi-party authorization, and attribute based access. Expect a deep dive into database encryption threat models and the realities of production ops, including emerging methods around data in-use and blind administrator models.

If you want something of an inside look at how Black Hat’s network works, check out the Decisions and Revisions - The Ever Evolving Face of the Black Hat NOC Briefing from RSA and Red Sky Solutions. It’s your chance to get up close and personal with the Black Hat NOC, as you’ll learn how (and why) equipment and services are deployed on the Black Hat network. You’ll also get insight into the changes made when deploying and securing a network in the U.S., Europe, and Asia, alongside lots of interesting stories and stats! It’s a full debrief of the activity seen this year, what has changed since past shows, and what that means for the industry as whole.

When it comes to threat modeling there can be a gap between academic knowledge and the real world, so it’s important to study real-world examples if you want to keep sharp.  In Toreon’s two-day Advanced Whiteboard Hacking Aka Hands-On Threat Modeling you’ll get some practical threat modeling scenarios based on real projects,  robust training experience, and the templates to incorporate threat modeling best practices in their daily work.

Make time for Not So Secure’s Web Hacking - Black Belt Edition Training if you want to spend two days learning the latest web hacking techniques. You’ll practice some neat, new and ridiculous hacks which affected real products, some of which were bagged in bug bounty programs. The vulnerabilities selected for the class typically either go undetected by modern scanners or rely on overlooked exploits, so it’s a great place to learn something new!

You’ll find a slew of new tools to check out at the Black Hat Europe Arsenal, including Astra: Automated Security Testing For REST APIs.  Built to help developers and security engineers detect and patch vulnerabilities in the initial phase of the development cycle, Astra can automatically detect and test login & logout (Authentication API), which makes it easy for anyone to integrate this into CICD pipeline. Astra can also take API collection as an input, making it a great tool for testing APIs in standalone mode.

You might also enjoy an Arsenal demo of SCAVENGER: A Post-Exploitation Scanning/Mapping Tool, which can help you by mapping systems and finding "interesting" and most frequently used files, folders and services. Once credentials are gained, it can scan remote systems (Linux, Windows and OSX) via services like SMB and SSH to scrape that system looking for "interesting" things and then cache the result. This gives you the ability to find the "interesting" and most frequently files used on that system -- password files being accessed by an administrator, for example, or heavily-used credit card database files. Don’t miss it!

Black Hat Europe returns to The Excel in London December 3-6, 2018. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
lahome
50%
50%
lahome,
User Rank: Apprentice
11/21/2018 | 8:47:06 PM
GOOD ARTICLE
New security tools and traiding are very necessary.
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-33035
PUBLISHED: 2021-09-23
Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the all...
CVE-2021-34767
PUBLISHED: 2021-09-23
A vulnerability in IPv6 traffic processing of Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, adjacent attacker to cause a Layer 2 (L2) loop in a configured VLAN, resulting in a denial of service (DoS) condition for that V...
CVE-2021-34768
PUBLISHED: 2021-09-23
Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected dev...
CVE-2021-34769
PUBLISHED: 2021-09-23
Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected dev...
CVE-2021-34770
PUBLISHED: 2021-09-23
A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, remote attacker to execute arbitrary code with administrative privileges or cause a deni...