HACKER SUMMER CAMP 2024 GUIDES — Part Ten: The Diana Initiative 2024
Welcome to the DCG 201 Guides for Hacker Summer Camp 2024! This is part of a series where we are going to cover all the various hacker conventions and shenanigans both In-Person & Digital! This year in 2024 we have completely lost our minds and thus we will have a total of 18 guides spanning 3 months of Hacker Insanity!
As more blog posts are uploaded, you will be able to jump through the guide via these links:
HACKER SUMMER CAMP 2024 — Part One: Surviving Las Vegas & Virtually Anywhere 2024
HACKER SUMMER CAMP 2024 — Part Two: Capture The Flags & Hackathons
HACKER SUMMER CAMP 2024 — Part Three: Design Automation Conference #61
HACKER SUMMER CAMP 2024 — Part Four: ToorCamp 2024
HACKER SUMMER CAMP 2024 — Part Five: LeHack 20th
HACKER SUMMER CAMP 2024 — Part Six: HOPE XV
HACKER SUMMER CAMP 2024 — Part Seven: SummerCon 2024
HACKER SUMMER CAMP 2024 — Part Eight: DOUBLEDOWN24 by RingZer0
HACKER SUMMER CAMP 2024 — Part Nine: TRICON & REcon 2024
HACKER SUMMER CAMP 2024 — Part Ten: The Diana Initiative 2024
HACKER SUMMER CAMP 2024 — Part Eleven: Wikimania Katowice
HACKER SUMMER CAMP 2024 — Part Twelve: SquadCon 2024
HACKER SUMMER CAMP 2024 — Part Thirteen: BSides Las Vegas 2024
HACKER SUMMER CAMP 2024 — Part Fourteen: Black Hat USA 2024
HACKER SUMMER CAMP 2024 — Part Fifteen: DEFCON 32
HACKER SUMMER CAMP 2024 — Part Sixteen: USENIX Security Trifecta 2024
HACKER SUMMER CAMP 2024 — Part Seventeen: HackCon 2024
HACKER SUMMER CAMP 2024 — Part Eighteen: SIGS, EVENTS & PARTIES
The Diana Initiative 2024
Date & Time: Monday, August 5th 8:00am PST — 9:00pm PST
Location: Westin Las Vegas Hotel & Spa (160 E Flamingo Road,
Las Vegas, NV 89109)
Website: https://www.dianainitiative.org/
Tickets: https://www.eventbrite.com/e/the-diana-initiative-2024-tickets-773825511937
Virtual Platform(s): N/A
Schedule: https://www.dianainitiative.org/event/2024-schedule/
Live Streams:
YouTube: N/A
Discord: N/A
Virtual Chat: N/A
Affordability: The minimum ticket is $149 for a normal badge, $204.80 “1337” level that includes an Electronic Badge (you can add on an Electronic Badge to any ticket at $40). Students with proof at $49 and Veterans, Press and Kids under 18 can get in for free. This does not include Eventbrite fees and taxes.
Code Of Conduct: https://www.dianainitiative.org/about/policies/
The Diana Initiative was born out of a need to create a supportive environment for underrepresented groups in cybersecurity. Founded in 2015, it has grown to become a pivotal event, fostering a diverse and inclusive cybersecurity community. The 2024 edition promises to be even more impactful, with a range of activities designed to inspire and educate.
Back for the 8th year, The Diana Initiative is hosting a one-day diversity-driven conference committed to helping all underrepresented genders, sexuality, races and cultures in Information Security. The Diana Initiative features multiple speaker tracks, fully expanded villages with hands-on workshops, and women-led cybersecurity trainings.
This year our theme is “Lift While You Climb.”
Originally known as TiaraCon, this matured and harden version of the original concept has evolved so much over time that it has emerged from DEF CON’s shadow and has grown into it’s own thing. As a group that is made up and led by various minorities on the fringes of society (New Jersey standard approved), we completely understand the need and creation of a space to discuss issues in a demographic of technology-minded people. If you identify as a woman, an ally or want to learn amazing technology skills while getting a broader social impact picture, this convention is for you!
VENUE OSINT RECON
Westin Las Vegas Hotel & Spa (160 E Flamingo Road,
Las Vegas, NV 89109)
Hotel check in is 4:00 PM (PST) / Check out is 12:00 PM (PST). Hotel cannot guarantee early check-in without room guarantee and payment for the night prior. Late check-out request must be approved by front office on the day of departure. Hotel will store attendees’ baggage at no cost, based on availability.
Guest must cancel room reservation 72 hours prior to confirmed arrival date to avoid a non-refundable cancellation fee equal to one night’s room and tax.
A mandatory Destination Fee will apply to all guest rooms. This fee is $35.00 (plus 13.38% tax) per room, per day. .
Group attendees can renew with a special 20% discount at Hibiscus Spa. Relax and rejuvenate in our spa including soothing treatment rooms, and comfortable locker room. Choose from many spa treatments and services to help you look your best and feel rested. To confirm appointment attendees may call 702–836–5945.
Parking Your Hacked AF EV
There is parking available to hotel and non hotel guests.
On-Site Parking: Daily: $17
Valet, Daily: $23
There are Electric Car Charging Station
CONVENTION MAPS
FIRST FLOOR
SECOND FLOOR
COVID-19 Information
The Diana Initiative plans to be in person in Las Vegas. The ongoing COVID-19 pandemic brings extra considerations to our planning.
We, and our attendees, must adhere to the current US and Nevada rules at the time of the event. These are constantly in flux and we will have to be flexible. Our rules may go above and beyond the legal minimums set in place by the Country and State and County we are hosting the event in.
Masks
We are requiring everyone to wear a mask.
- The mask needs to be [FFP2], KF-94, KN-95, N-95s, or comparable. Cloth masks with filters (such as PM2.5) are acceptable.
- Mask should be a solid, multi-layer piece of material.
- Mask should not have slits, punctures, or be loosely woven / has slits (such as tulle, crochet, lace, etc).
- Mask should not have exhalation valves.
- A properly worn mask completely covers the nose and mouth.
- May contain filter pockets or sleeves.
- Items that do not count as masks; Cloth masks without filters, Scarves, ski masks, balaclavas, bandannas, shirt or sweater collars pulled up over the mouth and nose.
Air-Cycling
We will be testing the Carbon Dioxide levels (CO2 ppm) in the event space before and during the event. We plan to place air filtration units in spaces with weaker air cycling to keep the risk levels lower.
COVID FAQ
Do you require a mask?
Yes as stated in our [COVID policies] we require masking for everyone.
Do you require a COVID vaccination?
No. This year we do not require a vaccine but we do require masks as stated in our [COVID policies].
What should I do if I test positive?
First, please do not come to the event space. If you test positive at the event or in the days after for covid — please let us know at covid@dianainitiative.org along with what track(s) or village(s) you were at to the best of your memory. We will not share your name but we will warn/update everyone using social media to test themselves if they were in those locations. We will keep a public list of the number of cases (and dates of positivity if available) for the year. We hope you understand that we do not want anyone currently testing positive in the event space.
What should I do if I feel unwell?
First, please do not come to the event space. Next, take a covid test. If you are in the Westin let us know your room number and we’ll drop it off at your door. We will try and have extra covid tests on hand. We are providing tests to all volunteers and speakers, and will try to also supply them to any attendees who feel unwell.
Capture The Flag Competition 2024 Summary
This year we are offering two different CTFs which will run during our one day event, August 5, 2024 from 9am to 5pm.
Please view the Part Two: Capture The Flags & Hackathons (COMING SOON) section for more detailed information.
Adversary Village (ALSO AT DEFCON 32)
Choose-your-own-Adversary-Adventure Tabletop Game
Adversary Village area | August 5, 2024 [Monday] | 09:00 to 17:00
Adversary Adventure is a Choose-Your-Own-Adventure model interactive game, where everyone can participate and choose various tasks. The participants can choose to play as an attacker who performs adversarial activities against a target, as a defender who deals with a potential breach, as a CISO who is managing a ransomware attack, or even as management executives going through a table-top exercise, watching your progress by making choice until the game reaches its conclusion.
Hands-On & Guided Breach Simulation Exercises
Adversary Village area | August 5, 2024 [Monday] | 09:00 to 17:00
This area will feature guided breach simulation exercises for participants to engage with. There will be two activities, “Breach-the-Hospital” and “Breach-the-Office,” based on two LEGO sets. A simulated cyber range will be available for each scenario, providing an exact replica of an enterprise production environment. We will provide a detailed walkthrough of the attack scenarios, including Tools-Techniques-and-Procedures (TTPs) commands and how-to guides, demonstrating how to attack and breach the hospital’s infrastructure or the office environment. This exercise will give participants a clear understanding of how adversaries infiltrate corporate environments
Join the Adversary Village Discord Server
In addition to the on-site Adversary Village, join the official Adversary Village Discord server to connect with the amazing community of adversary simulation experts and offensive security researchers of Adversary Village!
Career Village
9:00am–5:00pm with a lunch break 12:00pm–1:00pm
Ready to level up your career in cybersecurity? Look no further than the Diana Initiative’s Career Village — a comprehensive platform designed to provide tailored guidance and actionable insights from the trailblazing women and non-binary leaders shaping the future of this dynamic industry.
- We will take walk-ups or sign-ups throughout the day for whatever career assistance you need, no RSVP needed!
What to Expect:
- Mock Interviews: Practice makes perfect! Hone your interviewing skills in a supportive environment. Receive constructive feedback from seasoned professionals to refine your approach.
- Resume Reviews: Get expert eyes on your resume to ensure it showcases your unique strengths and aligns with industry best practices.
- Lightning Talks: Fuel your ambition with rapid-fire presentations on topics like salary negotiation, navigating career transitions, and building your personal brand.
Why Attend:
- Representation Matters: Access invaluable advice and mentorship from women and non-binary engineers who comprehend the challenges and opportunities unique to you.
- Community Building: Forge connections with peers and expand your professional network in a welcoming, inclusive environment.
- Empowerment: Walk away equipped with the tools and confidence needed to navigate your cybersecurity journey successfully.
Who Should Attend:
Whether you’re a student exploring your options, a recent graduate seeking your first role, or an experienced professional looking for new challenges, the Diana Initiative Career Village is designed to meet you where you are and help you reach your full potential.
Join us at the Diana Initiative and discover how the Career Village can empower you to thrive in the world of cybersecurity!
Professional Headshots!
Capture your professional essence with a stunning headshot! We are thrilled to announce Erin Gilliatt, an amazingly talented photographer, will be on-site at this year’s Career Village, ready to help you put your best face forward. Whether you’re updating your LinkedIn profile, enhancing your personal brand, or simply in need of a fresh, polished look, take advantage of this fantastic opportunity. Step into the spotlight, and let us help you shine! Details will be posted soon!!
Additional Career Village Resources
Job Board
https://www.dianainitiative.org/event-2024/career-village-2024/job-board-2024
LIGHTNING TALKS (20 mins)
9:30 AM — Get Your Home Lab on your Resume (Kat Fitzgerald)
10:15 AM — How Job Advancement is like Poker (Rhonda Lemke)
11:00 AM — Navigating Change (Nicole Becher)
1:00 PM — The Rollercoaster Ride of a Security Engineer (Patricia Temples)
1:45 PM — Climbing to the Tippy Top of Security Engineer (Lea Snyder)
2:30 PM — Ethical AI (Shan Ren)
3:15 PM — Career Mistakes (Emily Guy)
4:00 PM — Critical Skills Beyond Technology (Manju Mude)
ICS VILLAGE (ALSO AT DEFCON 32)
9:00am–5:00pm with a lunch break 12:00pm–1:00pm
The effort to provide educational opportunities to future IT / OT administrators, security professionals, and engineers to fill the nation’s cybersecurity workforce is what ICS Village was built to help with.
High profile industrial control system (ICS) security issues have grabbed headlines and sparked change throughout the global supply chain. The ICS Village allows defenders of any experience level to understand the unique failure modes of these systems and how to better prepare and respond to the changing threat landscape.
Interactive simulated ICS environments, such as Hack the Plan(e)t and Howdy Neighbor, provide safe yet realistic environments to preserve safe, secure, and reliable operations. The ICS Village brings a compelling experience for all experience levels and types, with IT and industrial equipment. Our interactive learning approach invites you to get hands on with the equipment to build your skills.
We bring you real components such as programmable logic controllers (PLC), human-machine interfaces (HMI), remote telemetry units (RTU), and actuators to simulate a realistic environment by using commonly used components throughout different industrial sectors. You will be able to connect your machine to the different industrial components and networks and try to assess these ICS devices with common security scanners to sniff the industrial traffic, and more!
Lockpick Village
9:00am–5:00pm with a lunch break 12:00pm–1:00pm
Lockpick Extreme is back again with us hosting our lock picking village!
Come in between and learn how to pick, as well as browse some items available for purchase!
Maker Village
9:00am–5:00pm with a lunch break 12:00pm–1:00pm
- Learn to solder
- “Stitch & Bi**H” hangout area
- Sticker exchange table
ABOUT WORKSHOP REGISTRATION
Welcome to The Diana Initiative Workshops!
Join us for a day filled with exciting learning opportunities and networking at The Westin Las Vegas Hotel & Spa. Our workshops cover a range of topics from cybersecurity to career development. Whether you’re a seasoned professional or just starting out, there’s something for everyone.
Don’t miss this chance to enhance your skills, connect with like-minded individuals, and have a great time. See you there!
Tickets to the specific workshops listed in the agenda below are Add-Ons to the General Admission.
Please ensure you purchase a ticket to The Diana Initiative conference.
An Introduction into DotNet Malware Analysis
Time (Pacific): 0800–1200
Location: Acacia A
Cost Per Person: $0 (FREE)
To attend you must purchase a [TDI Ticket] AND [A Workshop “General Admission” ticket AND the add-on for this workshop]
Max Kersten is a malware analyst, blogger, and speaker who aims to make malware analysis more approachable. In 2019, Max graduated cum laude with a bachelor’s in IT & Cyber Security, during which Max also worked as an Android malware analyst. Currently, Max works as a malware analyst at Trellix, where he analyses APT malware and creates open-source tooling to aid such research. Over the past few years, Max spoke at international conferences, such as Black Hat (USA, EU, MEA, Asia), DEFCON, Botconf, and other conferences. Additionally, he gave guest lectures and workshops for several universities and private entities.
Prerequisites:
- A laptop (x86_64 based) capable of smoothly running one x86_64 Windows 10 VM
- Visual Studio Community Edition (2019 or later) on the VM
- The DotNet Framework runtime for version 3.5 and later (default, version 4 is installed) on the VM
- dnSpyEx, de4dot, DotDumper, and other tools can be downloaded during the workshop as these are insignificant in size.
- Understand VB.NET/C#, and preferably be (somewhat) comfortable writing it. It is possible to join the workshop without the ability to write code, but you will notice this in the later stages of the workshop.
DotNet based malware originally started out as a novelty, but has shown it is here to stay. With DotNet malware being used by APT actors and script kiddies, and anything in-between, it is safe to say that one will encounter it sooner rather than later. This four-hour workshop primarily focuses on the analyst mindset and fundamental knowledge, including topics such as loaders, unpacking, obfuscation, DotNet internals, and (un)managed hooks. In short, one will learn how to analyse DotNet malware, and write automatic unpackers. As such, this class is perfect for aspiring and beginning analysts, while also providing background information and additional techniques for intermediate analysts.
The workshop’s materials will partially consist of actual malware samples, the precautions for which will be explained in-detail during the workshop, ensuring the safety and integrity of the systems of the attendees.
Introduction to Reverse Engineering Workshop for Women
Time (Pacific): 1300–1700
Location: Acacia A
Cost per person: $0 (FREE)
To attend you must purchase a [TDI Ticket] AND [A Workshop “General Admission” ticket AND the add-on for this workshop]
- Basic Computer Skills: Basic operating system and programming concepts. Focus of the training will be Windows 32-bit binaries written in C. Some knowledge of scripting languages may be helpful for additional script reverse engineering exercises.
- Programming: Basic programming knowledge of a compiled language (such as C) or a scripting language (e.g. JavaScript, Python, etc.)
- Hardware: A laptop capable of at least one Virtual Machine (VM) such as VirtualBox (link to minimum requirements here) where you can install a list of tools
- Software: VirtualBox, Ghidra, and your favourite code or text editor installed in your laptop (setup instructions to be provided prior to class)
- Curiosity!: Reverse engineering is all about asking questions and being curious about how things work
In this workshop, we’ll be reverse engineering a real-world malware binary from start to finish using the open-source Ghidra decompiler. Alternatively, for folks who want a gentler introduction to reverse engineering, we’ll also have some script-based malware available to analyze. This session will be very hands-on and will provide some practical tips for identifying malicious code and understanding how it works.
This workshop is ideal for beginners who are completely new to reverse engineering and are eager to learn how to analyze and understand malware in a supportive and collaborative environment.
Why Women Only?
Because a girl-to-girl conversation is so much more fruitful than a full classroom with only one or two women hiding in the corners. I’ve done so many things in my life where I was the only girl among X other participants, and I promise I’ve been hiding in the corners more than once.
For the gents it might not be that obvious, but it is not easy for young females who haven’t yet found their place in life to walk into a class room, a university lecture, an office or a conference room full of men. Who, generally speaking, very often very well seem to know their place.
I’ve had girls in my classes before, hiding and holding back although I am so certain they would have been capable to be so much better than what their final results showed. So yeah this will be women only, for every female should feel welcomed and encouraged to do her best and get the most out of it.
BlackHoodie’s Mission
BlackHoodie is a series of technical trainings aiming to attract more women to the field of cyber security
Our events are women-only, except if individual organizers state otherwise
Whether introduction level or advanced, classes are always challenging
All of our events are free to attend
We do not exert any preference in education level, occupation or corporate affiliation of attendees
BlackHoodie is dedicated to serve the community, we aim to integrate, not separate
BlackHoodie is independent, and cannot be leveraged to promote anything but its own mission
We seek quality over quantity, in number of classes and attendees
We also support/encourage attendees to start giving technical trainings thereby providing a platform to build their confidence.
Finding the Needle: An Introduction to Detection Engineering
Time (Pacific): 1300–1700
Location: Acacia B
Cost per person: $0 (FREE)
To attend you must purchase a [TDI Ticket] AND [A Workshop “General Admission” ticket AND the add-on for this workshop]
Prerequisites:
Attendees should bring their own laptop, with 16GB+ RAM, and 50GB of available hard drive space.
Attendees should be comfortable with either Python 3 or Golang, including core language syntax and the execution environment of their preferred language.
Presenter(s):
Kathy Zhu
Having worked in the security industry for 8+ years, Kathy is currently a Security Engineering Tech Lead in the detection space at Google. Her interest and experience is in detection engineering and software development. Outside of work, she also enjoys running, the outdoors, and reading.
Troy Defty
Following over a decade in the UK and Australian InfoSec industries, including an 8 and a half year stint in red teaming, Troy jumped the proverbial fence from red to blue, and is currently a Security Engineering Manager at Google. His interest and experience is in detection engineering, red teaming, threat modeling, hardware, and assessing ICS environments. Other interests include music, electronics, the outdoors, travel, rugby, CTF, and making piano-related noise.
Abstract:
As defenders, we are always outnumbered, but we are by no means outmaneuvered. Attackers may hide in the haystack of haystacks, but with scalable detection logic, efficient coding practices, a thorough investigation methodology, and a reasonable corpus of computing, we can still determine which haystack to look within, and subsequently find the needle.
This is often made possible by a detection pipeline. And knowing how detection pipelines work, and the role each component plays, can help us write more efficient, more accurate detections to make life hard for the attacker. By reducing the attacker’s window of opportunity, whilst making the subsequent investigation easier for the would-be analyst, we can maintain a strong defensive position, forcing the attacker to burn significantly more resources in an attempt to make progress.
This workshop will run attendees through implementing a simple detection pipeline in code, and some basic detection rules, to understand how to:
- Ingest and normalize arbitrary log data, and make such data available for downstream detection rules
- Implement detection logic, to isolate potentially malicious behaviour
- Enrich log data with more context, aiding investigation
- Draw relationships from individual log entries, to reduce investigative noise.
Fine-Tune Your Career With Improv
Time (Pacific): 0800–1200
Location: Acacia B
Prerequisites: None
Cost per person: $0 (FREE)
To attend you must purchase a [TDI Ticket] AND [A Workshop “General Admission” ticket AND the add-on for this workshop]
Presenter(s):
Leslie Martinich
Leslie Martinich, a computer scientist who began her journey writing compilers, operating systems, and advanced communication software, led her team to deliver ground-breaking technology allowing developers to create parallel and distributed programs through Remote Procedure Calls (RPC).
In the middle of her career, she made a pivotal realization: project failures weren’t due to technical hurdles, but rather rooted in managerial and leadership challenges. Determined to rectify this deficiency, she built leadership programs which she presented across 6 continents (sorry, Antarctica!), focused on innovation and preparing effective leaders. Her enthusiasm lies in instilling engaged leadership skills that resonate with the aspirations of today’s young tech professionals and entrepreneurs.
Leslie is more than just a leader in tech; she’s a catalyst for change. From sparking innovation to nurturing teamwork, Leslie’s mission is to empower organizations to go beyond delivering products. Her guiding principle? Engaged leaders inspire teams, reduce turnover, and drive towards excellence in quality. Join her on a journey that’s not just about quick fixes but about inspiring and helping leaders to become the influential change-makers of tomorrow.
Christina Aldan
Christina Aldan is a brand strategy consultant, keynote speaker, trainer, and mentor. She offers businesses brand consulting and creative content for everyday media. With over 18 years of experience in the digital realm, Christina is highly regarded for her approach to business, partnering with clients to find unique strategies that ensure their goals are met. Christina builds connections through her keynote addresses, training workshops, and technological education. She uses these tools to help individuals and businesses cultivate value in everyday media. Christina has delivered talks on all 7 continents, presenting training workshops for the Microsoft MVP community, international corporations, and conferences worldwide. Christina uses her charisma and expertise to inspire others by mentoring women in business like herself. She also has sat on state and local boards supporting women in tech, entrepreneurship, mental health, and children with learning disabilities.
She is the recipient of the Las Vegas Women in Tech Community Service Award, the Distinguished Woman of the Year Award in STEM. Learn more at: Luckygirliegirl.com.
Abstract:
Human behavior can be fine-tuned to get the best results in your career path. Understanding how our emotions and nervous system affect our behavior makes us more effective in negotiations and communications. Train your brain to respond to get the best possible outcomes in work situations.
Practice actionable communication strategies throughout this workshop with improv, role playing in actual scenarios from the software development industry, and creative discussions.
Outcomes:
• Participants will be able to communicate with their teams to achieve successful outcomes.
• Participants will be able to negotiate with colleagues and customers to lead to winning outcomes.
- Participants will be able to communicate with executives.
GIRLS NIGHT OUT
These are outside-convention activities direclty associated with the Diana Initiative that is mirrored from the Part Eighteen: SIGS, EVENTS & PARTIES section of our guides.
Dinner for the Neurodivergent TDI Folks
Date: Sunday, August 4
Time: 7:00–9:00pm PDT
Location: Westin Las Vegas Hotel & Spa (160 E Flamingo Road,
Las Vegas, NV 89109)
We are requesting everyone try to bring at least one resource that they found useful to share with other attendees — whether it helped you at work, at home, or navigating conferences as a neurodivergent person.
This is a full dinner with non alcoholic drinks and meal (salad, entree, sides, desert) at the Westin Las Vegas Hotel and Spa, 160 EAST FLAMINGO ROAD, LAS VEGAS, NEVADA, USA, 89109, on the second floor, Casuarina.
Served with Freshly Brewed Regular Coffee, Hot and Iced Tea
- Grilled Vegetable Antipasto including: Zucchini, Portobello Mushrooms, Artichokes, Peppers and Olives
- Romaine, Herbed Croutons, Shaved Pecorino Romano Cheese and Pink Peppercorn Dressing
- Caprese Salad with Mozzarella Cheese and Heirloom Tomatoes, with a Balsamic reduction
- Rotini Pasta Salad, Sun Dried Tomatoes, Genoa Salami, Pepperoncini
- Flat Iron Steak, Caper and Roasted Tomato Sauce
- Chicken Marsala, Wild Mushrooms
- Pan Roasted Cod with Cannellini Bean Stew
- Rigatoni with Spicy Bolognese
- Creamy Polenta and Parmesan Cheese
- Roasted Fennel and Broccoli Rabe
- Warm Focaccia with Assorted Toppings
- Tiramisu, Cannoli, Napoleon
DI Social 2024
From 8pm-10pm [2000–2200] we’re hosting a social!
Note: there will be no food just some snacks and we are prohibited from having outside food and drinks in the room so please eat dinner before coming!
There will be:
- Karaoke
- Knitting / Crochet
- Coloring books
- Come and Chill!
Hosted Bar
- Select Liquors
- Premium Liquors
- Select Wines
- Craft Beer
- Domestic Beer
- Imported Beer
- Juice, Soda and Bottled Water
Crudité
- Seasonal Selection of Fresh Sliced Vegetables including:
- Cherry Tomatoes, Baby Carrots, Brocolini, Cauliflower, Celery and
- Marinated Olives, Sweet Peppers
- Assorted Dipping Sauces to include: Hummus & Romesco Sauce
Women, Gender Non-Conforming & Non-Binary Meetup with The Diana Initiative
Saturday, August 10th
Time: 19:00–21:00
Location: Room Block 305–306 @ Las Vegas Convention Center (300 Convention Center Dr, Las Vegas, NV 89109)
The Diana Initiative is hosting a meetup where we’d love to get all the gender non conforming, non-binary and women attendees together to hang out and make friends! DEF CON is better with friends.
DCG 201 TALK HIGHLIGHTS FOR DIANA INITIATIVE 2024 (PST)
This is the section where we have comb through the entire list of talks on both days and list our highlights for the talks that stand out to us. Note that this does not invalidate any talks we didn’t list, in fact, we highly recommend you take a look at the full convention schedule beforehand and make up your own talk hilight lists. These are just the talks that for us had something stand out, either by being informative, unique or bizarre. (Sometimes, all three!)
Keynote: Navigating the AI Frontier: Myths, Realities, and the Path to Effective Governance
8:00 AM PST
Track 1 (Palo Verde A)
Join Dr. Brandie Nonnecke in navigating the intricate landscape of artificial intelligence, from its basic forms — such as narrow AI focused on specific tasks — to the transformative potential of generative AI. This keynote provides a comprehensive understanding of AI, cutting through the hype to reveal its actual potential and limitations, and preparing attendees for the nuanced reality of an AI-integrated future.
In the spirit of “lift as you climb,” Dr. Nonnecke will emphasize empowering everyone in the AI journey, ensuring inclusivity and shared growth as we advance in this field. She will delve into the latest developments in AI, highlighting how these innovations are reshaping industries and everyday life. Special attention will be given to the cybersecurity aspects of AI, discussing the ethical and societal implications of these changes and the potential threats posed by AI technologies.
Dr. Nonnecke will explore legal mechanisms and other strategies to harness the benefits of AI while mitigating its risks. This keynote is a must-attend for anyone keen to grasp the multifaceted nature of AI and its profound implications on our world, with a focus on empowering communities and ensuring a secure digital future.
Brandie Nonnecke
Director, CITRIS Policy Lab & Assoc. Research Prof., Goldman School of Public Policy, UC Berkeley
Brandie Nonnecke, PhD is Founding Director of the CITRIS Policy Lab, headquartered at UC Berkeley. She is an Associate Research Professor at the Goldman School of Public Policy (GSPP) where she directs the Tech Policy Initiative, a collaboration between CITRIS and GSPP to strengthen tech policy education, research, and impact. Brandie is the Director of Our Better Web, a program that supports empirical research, policy analysis, training, and engagement to address the rise of online harms. She serves as co-director at the Berkeley Center for Law and Technology at Berkeley Law and the UC Berkeley AI Policy Hub. Brandie is the host of TecHype, a groundbreaking video and audio series that debunks misunderstandings around emerging technologies and explores effective technical and policy strategies to harness emerging technologies for good. Her research has been featured in Science, Wired, NPR, BBC News, MIT Technology Review, Buzzfeed News, among others. Her research articles, op-eds, and presentations are available at nonnecke.com.
Asleep at the Wheel: An Analysis of a Municipal Surveillance Technology in Seattle
9:30 AM PST
Track 2 (Palo Verde B)
More and more cities are instituting their own Surveillance Ordinances. Seattle was one of the first USA cities to have such an Ordinance, so let’s see what can be gleaned by examining one of these municipal surveillance technologies in more detail: a service that provides real-time travel time calculations using a system of WiFi/Bluetooth MAC address sniffers deployed across the city. I’ll bring you up to speed on this surveillance technology, the variety of issues that have been identified with it (both technical and non-technical), and its current status in Seattle. I’ll also discuss some aspects about privacy of mobile devices specific to challenges with MAC addresses (i.e. randomization, etc). Lastly, I will give you pointers on how to get started reviewing surveillance technologies your local municipality has deployed, so that you too can put your technical/security skills to use to help your neighbors and community.
Cynthia Spiess
independent security researcher & privacy advocate
I’m an independent security researcher & privacy advocate. Over the last nearly 6 years, I’ve reviewed and given public comment on all of Seattle’s official surveillance technologies. I’ve worked closely with the Seattle Community Surveillance Working Group. I’ve also organized with various local non-profits and grassroots groups participating in the Seattle Surveillance Ordinance process and on state-level legislation spanning: civil liberties, data privacy, digital IDs, automated decision systems, right to repair, and other bills.
Dancing to the DMA Tunes
10:30 AM PST
Track 1 (Palo Verde A)
The Digital Markets Act(DMA) passed in early 2024 aims at regulating the digital markets of the European Union. Unfortunately, this introduces risk in the AppSec field, including mobile applications. The tweaks made to comply with the DMA could shake up the tiny edge that mobile apps had over web apps — the secure controlled environment. Especially for Apple and its notorious “crystal prison” called iOS. This talk will shed light over DMA’s effect on the security posture of the mobile landscape, with iOS as an example.
Vineeta Sangaraju
Senior Research Engineer at Synopsys
Vineeta is a seasoned security researcher. She focuses on crafting innovative solutions that enhance application security. Her research further influences static analysis solutions across the server-side, mobile and client-side domains. Armed with a master’s degree in Computer Science from Indiana University, she has over 7 years of experience in the field. She also enjoys sharing her knowledge at application security conferences as a presenter. Vineeta’s ideal day involves laying in the grass on a sunny day reading a fantasy or sci-fi book.
CTI Saves the World: Using Threat Profiles to Defend Against Geopolitically Motivated Adversaries
11:00 AM PST
Track 2 (Palo Verde B)
Curious how to use cyber threat intelligence (CTI) to build a threat profile and defend against geopolitically motivated threat actors? Attend this talk to learn how.
CTI can be used to inform, educate, and help security personnel make decisions. Security professionals can use CTI and threat profiling to focus security operations efforts to accurately identify and defend against specific threats. This talk will cover the different types of CTI, the intelligence lifecycle, how to conduct CTI threat profiling, and how to build a threat profile unique to your organization. Geopolitical events and so many other factors come into play when building a threat profile. In this interactive session, you will practice operationalizing basic CTI concepts to identify threats for organizations of varying industry vertical, size, and geography. You will build a threat profile, then reframe your threat profile after receiving new information about the changing geopolitical threat landscape.
With an enhanced understanding of the adversary and threat profiles, you can empower and lift up your security team to leverage CTI and better defend against the adversary. Attendees should walk away from this talk with an enhanced ability to build a unique threat profile and defend against adversaries in a geopolitically complex threat landscape.
Clarissa Bury
Strategic Advisory Consultant
Clarissa Bury is a Consultant at CrowdStrike, where she provides strategic guidance to help clients respond to cyber attacks. Prior to her role at CrowdStrike, she was a Security Engineer where she worked primarily on building secure architecture and policy. Beyond her professional endeavors, she enjoys exploring local coffee shops and tinkering with RFID tools.
Nivu Jejurikar
Senior Consultant at Mandiant
Nivu Jejurikar is a Senior Consultant at Mandiant, part of Google Cloud. In her role, Nivu advises companies of various sizes and industry verticals on cybersecurity topics. Nivu has previously worked at CrowdStrike and Deloitte Cyber. In her spare time, she enjoys reading fiction books and spending time outdoors.
Sponsored Session: Deploying TLS Post-quantum Hybrid Key Exchange at Scale
1:00 PM PST
Track 1 (Palo Verde A)
The development of quantum computers is poised to unlock efficient computation of certain classes of problems, which may represent useful advancement of technology, but is also known to eventually be able to break many current encryption schemes. One such area of encryption known to be affected is Diffie-Hellman key exchange, used for shared secret establishment in Transport Layer Security (TLS). In response, the cryptography community has been developing post-quantum key exchange mechanisms, which are resistant to decryption by both classical and quantum computers, along with TLS hybrid key exchange, which allows greenfield post-quantum mechanisms to be used alongside an established classical algorithm. This talk will present Meta’s experience implementing and deploying post-quantum TLS hybrid key exchange with the Kyber key exchange mechanism for internal traffic at scale, along with challenges encountered, involving post-quantum library code as well as the network impact of large Kyber public key shares on the wire.
This talk is sponsored by Meta.
Jolene Tan
Software Engineer at Meta
Jolene Tan is a software engineer at Meta, where her focus is on implementing TLS encryption and enforcement for internal traffic, ensuring the security and privacy of data transmitted within the company. She recently co-authored an article on post-quantum cryptography for the Engineering at Meta blog and contributed code changes to liboqs, an open-source library for quantum-safe cryptographic algorithms. Prior to her current role, Jolene worked on Tectonic, Meta’s distributed file system. Jolene holds a Bachelor of Computing in Computer Science from the National University of Singapore.
GEN-Z Critique on SOC 2
2:00 PM PST
Track 1 (Palo Verde A)
Over the past few months, I had the opportunity to witness Series C security startup, Semgrep, navigate its SOC 2 certification. I was also interested in the general understanding of SOC 2 with engineers, so I went and interviewed 50 of them to hear their viewpoints! I uncovered surprising insights into SOC 2, GRC, and security policies. In this talk, I’ll share the essential steps for obtaining SOC 2 certification at a tech startup, providing quick and straightforward strategies for success. Drawing from Semgrep’s experience, I’ll highlight the crucial steps for a smooth certification process. From a modern viewpoint, I’ll call out the parts of SOC 2 that surprised me the most and I’ll delve into the areas that I saw drive real value for our company. We’ll have a bit of fun, critiquing SOC 2 with a Gen-Z lens. Lastly, I’ll touch on things that SOC 2 doesn’t demand but should be part of any modern security program. The key things that I hope you take away from my talk are what to expect when you start to pursue SOC 2 certification, traps to watch out for, and ways to make it as painless as possible.
Charissa Kim
Technical Program Manager (Security TPM)
Charissa Kim is a Security TPM at Semgrep. She has spoken on various panels and presented at conferences such as the National Cryptologic Foundation (NCF), National Institute of Standards and Technology (NIST), National Initiative for Cybersecurity Education (NICE), and many others. Charissa also founded Cyber Youth Tech (CyTech), a non-profit organization devoted to empowering the next generation of STEM and cybersecurity professionals.
Furthermore, Charissa directed and produced K-12 Cyber Talk, a cybersecurity webcast sponsored by the National Security Agency, providing a welcoming environment for K-12 students to learn and explore cybersecurity along with its diverse career options and opportunities. She is also the first female All-American from the National CyberPatriot and Northrup Grumman Nationals competition.
Going Beyond [False] Privacy Promises: Quantifying Privacy Risks in Mobile Apps
2:00 PM PST
Track 2 (Palo Verde B)
Privacy policies have gotten much better in recent years, but they fail to describe risky privacy related app behaviors. How can we measure and expose observed privacy risks in mobile apps? Can we derive a quantitative risk score based on how mobile apps actually behave? This session shares experiences on the challenges of developing a proposed method for quantitatively scoring privacy risk in mobile apps.
Lisa LeVasseur
Founder/Executive Dir/Research Dir Internet Safety Labs
Lisa LeVasseur is the founder, Executive Director and Research Director of Internet Safety Labs, a nonprofit software product safety watchdog, starting in 2019. Her technical industry contributions and deep knowledge of consumer software products and connected technologies span more than three decades. She has dedicated the past five years to developing a vision for software product safety — where all connected, software-driven technology is safe for people.
Disinform your Surroundings: AI and disinformation campaigns
3:00 PM PST
Track 1 (Palo Verde A)
Humanity has some serious issues defining what is real and what is fake. We base our reality upon our proven evidence of the world — our observables. What if what we observe is so convincing that it causes entire movements of falsity? In this talk, we explore the use of AI technologies in disinformation campaigns around the world. We’ll cover some past campaigns and their long-term effects, the technology behind them, and some actions you as a non-AI lifeform can take to prevent rampant overuse in human rhetoric.
Killr Bunn3
Tess is an enthusiast in all things strange and unusual. With a background in blue team operations, threat hunting, writing, and messing with things she shouldn’t, Tess enjoys deep-diving into ongoing threats, circumventing red tape, and believes that every problem is cyclical. Tess lives on a small homestead surrounded by Maine forest with her family, numerous animals, and software-defined radios.
Is your Security “Kenough”?
3:00 PM PST
Track 2 (Palo Verde B)
Struggling with false positive alerts? Your security might not be Kenough! Join us for a Barbie-themed talk as we break down trending threats, from initial access to payload installation and persistence. We’ll discuss behavioral detection opportunities for each threat, equipping you with processes to detect malicious activity effectively. Gain insights into potential prevention measures and learn how to test your detection logic using open source tools. Come on Barbie, let’s go detect threats!
Rachel Schwalk
Rachel is a Senior Detection Engineer at Red Canary, where she spends her time hunting for evil across customer environments and developing new methods of detection.
Mackenzie Foss
Detection Engineer who is passionate about demystifying cybersecurity and advocating for Women In STEM through representation.
Zero Trust to Full Empowerment: Advancing Diversity and Inclusion in Cybersecurity
4:00 PM PST
Track 2 (Palo Verde B)
The ‘zero trust’ model in cybersecurity teaches professionals to question everything, a mindset critical for protecting digital assets but potentially isolating in diverse workplace environments. This talk explores the dichotomy between the clear, skepticism-based playbooks used in cybersecurity and the necessary absence of such frameworks for embracing diversity of thought. It discusses how without explicit tools and processes to guide interactions in diverse settings, professionals trained to be skeptical by default to support zero trust may struggle to thrive. The presentation offers insights into creating a balanced approach that fosters security without compromising inclusivity.
Rachael Skillman
Rachael Skillman, VP of Services at Arbitr Security, has dedicated her career to placing people at the heart of technological and cybersecurity innovation. With a rich background in product and project management, cybersecurity, and software development, she’s propelled organizations to thrive amidst tech evolution. Rachael believes the core power of technology and cybersecurity is shaped by its people and purpose and empowering those elements is the key to foster meaningful change.
Finding Your Route: Beginner’s Guide to Homelabs
5:00 PM PST
Track 2 (Palo Verde B)
Whether you want to start a career in security or are curious about another role within security, it can feel daunting (or exciting) when comparing your current skill level to that role’s job descriptions. Now, imagine having most or all the skills of that role…do you think you sat through tutorials or read books to get there? Probably not.
Practicing hands-on activities in your homelab while learning a new skill is one of the best strategies to understand concepts at a deeper level — and it’s more fun! Homelabing encourages you to seek out challenges, solve problems that interest you, and document any follow up questions, which can lead to more routes to explore. It’s a continuous learning process that also has the added benefit of showing your future employer that even though you may not have professional experience, you do have a demonstrated interest and knowledge you gained from project-based learning. My hope is for you to consider building your own homelab and start/continue learning and improving your skills and chances at getting your next role.
Erica Ching
From aspiring middle school math teacher to Security Analyst (and a few roles in between), Erica used project-based learning to bridge the gap of experience and education to get her first role in infosec. In her experience, starting a homelab while she studied the foundations of security was more effective than studying to pass a test (only to forget things a week later). At her first and current infosec role, Erica performs risk and security assessments for her organization’s departments, vendors, and enterprise systems/applications. She’s been in this role for more than 2 years and wants to help other people who come from non-traditional backgrounds get into cyber too.
