Throughout his career, Joe Grand has taken on projects where “doing it live” was a necessary evil. Whether hacking cryptocurrency wallets worth millions of dollars or testing prototypes on the streets of San Francisco, the expectation of success in front of others was ever present. Inspired by the title of Rush’s tenth studio album, Grace Under Pressure, Joe will talk about the hacks that brought him the most amount of pressure and the often unexpected results that followed.

In this talk, Macca and James take a chainsaw to the OSI model and ask a simple question: what happens when the protocol itself is the bypass? Starting from the gloriously unhinged world of custom binary protocols and cursed encapsulation stacks, the team demonstrates live how trivially modern security controls can be defeated when defenders are pattern-matching on protocols they expect to see. Equal parts education and crimes against networking, this talk will leave you questioning every assumption your security stack is quietly making about what ‘normal’ traffic looks like.

Warning: may contain interpretive dance.

This hands-on workshop begins with a detailed introduction to the Open Fibre Data Standard (OFDS), Google Earth, and KML for visualising internet infrastructure and facility data.

After the intro, attendees will work through a guided lab to create their own map.

Please bring a laptop that you can use to install or run QGIS and access Google Earth.

Security Architecture is a strategic and high-impact position. It demands broad and deep technical skill sets across IT and security. Despite this demand, no clear definition exists for the role. Subsequently, no clear pathway exists to becoming a security architect, leading to fragmented expectations, skills, and responsibilities across the industry.

This needed to change. In 2025, we surveyed 332 practicing security architects globally across industries and regions to understand their career pathways, their formal and informal training, and their daily responsibilities — to answer the question: What is a Security Architect? The results reveal consistent and troubling patterns.

This talk walks through the research and findings, covering overall themes by region, industry, and other segments to help diagnose the problems facing the sector. We then establish a blueprint for security architecture roles and careers so that security architecture will remain effective and sustainable into the future.

For aspiring architects, we highlight what skills and experience are the best pathway to landing that position. For practicing architects, we raise the most common challenges faced by your peers and provide a standardised and clear position description for your role. For managers and leaders, we outline how security architecture must be structured to deliver genuine value for your organisation, as well as give you the tools to identify and reduce the sources of friction that lead to retention and hiring challenges.

Whether you’re aspiring, practicing, or hiring, this talk will provide the benchmarks and blueprint the industry has been missing!

In this presentation Bruce builds on where it all started with Blue Teaming yo ICS and presents Purple Teaming yo ICS. Bruce will outline the case for why Critical Infrastructure operators need to do purple teaming to ensure they are defensibly managing cyber security risks for their Operational Technology (OT).

This presentation will start with a primer on purple teaming and walk through how critical asset operators should develop purple team assessments for their OT systems. It will discuss methods to gather relevant Cyber Threat Intelligence to inform assessments. Critically for asset operators, Bruce will discuss why purple teaming needs to happen in a representative test lab environment initially to give both teams confidence in their assessments. The presentation will cover useful tools and techniques to support asset operators plan and execute their purple team assessment, and finally Bruce will discuss how he built his home lab to support this presentation.

Session outline:

• Why Purple Teaming?
• What is Purple Teaming?
• Where to find Cyber Threat Intelligence to support your Purple Team scenario?
• What are some relevant Purple Teaming Scenarios for different OT Systems?
• Why you should do this in a representative lab environment?
• Purple Teaming Tools to help you run an OT Purple Team

Threat-Informed GRC reframes governance, risk, and compliance around the real behaviours of adversaries. This talk shows how treating threat actors as stakeholders can turn GRC into a practical prioritisation engine: helping teams cut through noise, focus technical effort where it matters, and make stronger cases for security investment. Attendees will learn how to partner with GRC teams to connect adversary tactics to governance decisions, board conversations, and day-to-day security work.

This workshop runs twice — 13:00 and 15:15. Choose the session that suits your schedule.

Step into a facilitated tabletop exercise (TTX) run as a mini CTF challenge. Work through a realistic cyber crisis scenario, make the calls that matter, and see how your decisions stack up against other players in the room.

Designed for executives, board members, and technical practitioners alike, this 90-minute interactive session puts you at the decision table — not just watching from the sidelines. Your choices are scored as you progress, adding a competitive edge to the learning experience.

Please bring your own laptop to participate in the challenge.

EV chargers are becoming a common part of home and business networks, but they often don’t get much security attention. This talk covers the discovery of a vulnerability leading to remote code execution in a smart EV charger. It also looks at how built-in IoTHotspot functionality can turn a compromised charger into a pivot point into internal networks. The session will walk through the research process, vulnerability discovery, exploitation, and the broader risks of increasingly connected charging infrastructure.

As digital media shifted from owned objects to licensed services, libraries were replaced by platforms, preservation by authentication, and custody by policy. At the same time, platform enshitification and AI have hollowed out search, archives, public knowledge, and scholarly access.

Rather than treating modern piracy as a moral failure, this talk reframes it as an emergent response to institutional and information collapse - a form of fault-tolerant infrastructure that arose because official and legal systems abandoned stewardship.

The goal is not to romanticise or endorse piracy, but to use it as a diagnostic: a signal of where our knowledge systems have failed, and what properties any legitimate successor must restore.

We are trained to recognise social engineering as something attackers do to us. Reciprocity, trust, relevance, urgency: we can name every lever. Then we walk back to our desk and try to change human behaviour with a policy document.

This talk is about the reframe. Every principle attackers use to break in is available to defenders to build culture. Used ethically, deliberately, and out in the open, that is not manipulation. That is the job.

This talk dissects the anatomy of a modern Windows EDR sensor, examines its main components, and explores methods (including one or two possibly unpublished techniques) that continue to remain effective. We’ll wrap up with pointers on performing EDR security research and building an environment to help you discover new evasion techniques for your next red team engagement.

This workshop runs twice — 13:00 and 15:15. Choose the session that suits your schedule.

Step into a facilitated tabletop exercise (TTX) run as a mini CTF challenge. Work through a realistic cyber crisis scenario, make the calls that matter, and see how your decisions stack up against other players in the room.

Designed for executives, board members, and technical practitioners alike, this 90-minute interactive session puts you at the decision table — not just watching from the sidelines. Your choices are scored as you progress, adding a competitive edge to the learning experience.

Please bring your own laptop to participate in the challenge.

SS7 signalling firewalls are the primary defence carriers deploy against phone tracking, SMS interception, and subscriber data theft. These firewalls inspect MAP (Mobile Application Part) messages encoded in ASN.1 BER (Basic Encoding Rules) and apply policy based on the decoded contents — blocking suspicious location queries, filtering unauthorised subscriber lookups, and enforcing GSMA FS.11 category rules.

The problem: BER was designed for encoding flexibility. The same data can be encoded multiple valid ways. When the firewall’s BER decoder and the target network element’s decoder disagree about how to parse a PDU, the firewall fails to extract security-critical fields — and if it fails open, the attacker’s query passes through uninspected.

This talk presents a taxonomy of every publicly known SS7/MAP firewall bypass technique, unified under a single root cause: decoder divergence caused by legal-but-rarely-used BER encoding constructs. We cover seven techniques spanning 2018-2024: global opcode substitution, double MAP component injection, extended application context manipulation, long TCAP transaction IDs, missing SCCP subsystem numbers, extended tag encoding (the 9F 00 technique disclosed by Enea in July 2025), and a previously undocumented technique (flag65711) discovered through source code analysis of a production SS7 library.

For each technique, we show the exact bytes on the wire, explain which BER construct creates the decoder divergence, demonstrate the bypass in a live Osmocom testbed with Wireshark captures, and provide detection signatures.

We then identify BER constructs that have not yet been exploited — indefinite-length encoding, constructed primitive types, multi-octet tag forms beyond two bytes, and nested encoding ambiguities — providing a research roadmap for both offensive researchers and firewall vendors.

The talk concludes with six defensive rules for building signalling firewalls that survive BER ambiguity, anchored by the most important: fail closed on decode failure.