BSides Knoxville 2025

Exploring attack paths across AWS, Azure, GCP and OCI. Learn to dissect misconfigurations through graph-mode visualization, map potential attack paths, and implement practical mitigation using open-source tools. Elevate your defense strategy and fortify cloud environments against evolving threats.

How can security teams stay ahead of 24/7 cyber threats? This talk explores AI-driven SOAR tools that combine intelligent decision-making with automation. Learn how AI enables dynamic workflows, automates after-hours responses, and empowers SOCs to reduce alert fatigue and improve response times.

After a decade in consulting roles like software engineer and penetration tester, I joined an open-source company to secure its 300+ repositories across numerous platforms. This session highlights key vulnerabilities and lessons learned, with actionable advice for attendees of all backgrounds.

Your Active Directory environment is a vast dungeon filled with hidden traps, cursed artifacts, and deceptive illusion spells. This talk uncovers lesser-known attack paths that let adversaries bypass defenses and plunder your domain's treasures. Will you be the DM - or the next victim of a TPK?

For years, cybersecurity leaders have been caught in a cycle of compliance—chasing checkboxes, aligning to frameworks, and struggling to keep up with ever-changing regulations. But here’s the real question: Are these standards making us more secure, or just more compliant?

"The Digital Certificate is like your Driver's License" This short talk goes into some common misconfigurations of Digital Certificates found in the wild. Quick Examples: Exposed Mail Servers, HTTP redirects, and faulty firewalls.

Ready to reign in rogue robots? Let's use our hive mind to sting them where it hurts in the circuits. Fuzz sensors, pwn software, lace AI with venom. Crack firmware hives, jam RF, shred control loops. Join the swarm at BSides Knoxville for an electrifying hack fest that'll make bots scatter!

TBD

Tired of running the same commands over and over? Wish your notes didn't look like a crime scene? Bash scripting can automate the boring, streamline engagements, and save your butt when things go sideways. Come learn how to hack smarter, not harder, because pentesting should be fun, not tedious!

Watch a deepfake built live on stage—and understand what you're really up against. This practical, technical session reveals the nuts-and-bolts of deepfake creation, uncovers security implications, and arms you with actionable strategies for detection and defense.

The misuse of open-source red-teaming tools by cybercriminals and nation-states is rising, turning security assets into attack vectors. Tools like Sliver are exploited for advanced threats. Our AI methodology analyzes high-risk tools, enabling organizations to detect/mitigate threats proactively.

Are the kids alright? Get a look behind the curtain at what attacks are seen in local K12 schools and how schools can defend with limited staffing and limited budgets. We'll look at insider attacks, recon, enumeration, password spray, MFA sweep, and a demo of bypassing MFA with stolen cookies.

Modern disassemblers are awesome, but assemblers today are little better than they were in the nineties. I'm fixing that by writing one that easily ports to new architectures, saving me a ton of work in embedded systems exploitation.

The cyber talent shortage is a lie. Orgs can't hire and retain enough cyber talent because they're wasting it. Engineers are burning out because they're doing the wrong kinds of work. In this talk, we show security leaders and engineers how to think differently and fix this problem forever.

In an era of increasing data breaches, inadequate security isn't just a technical gap, it's a legal ticking time bomb. Learn how seemingly small oversights in access control and data protection can expose businesses to crippling liability, and discover practical steps to minimize your risk.

## Introduction

Businesses of every size are under mounting pressure to protect sensitive data. When an organization's security posture is weak, especially in areas like access control or policy enforcement, the legal consequences can be swift and severe. In this talk, we'll dissect the intersection of cybersecurity and liability, revealing the most common pitfalls that can leave businesses exposed to lawsuits, regulatory fines, and reputational damage.

## Why This Topic Matters

The growing complexity of cybersecurity means that many organizations overlook the legal implications of their security posture. Often, executives view security as a purely technical concern, until an incident happens, and the legal fallout is severe. This session aims to illuminate how specific security failures, especially around access control and privilege management, can directly translate into legal liability.

## What You'll Learn

1. Legal Frameworks & Regulations

Overview of relevant U.S. and international laws, from data protection regulations (GDPR, HIPAA) to newer legislation targeting corporate accountability (such as the SEC's cybersecurity rules).

2. Common Failure Points

How poorly enforced access policies, insider threats, and deficient incident response protocols create liability.

3. Case Studies & Lessons Learned

Real-world examples showcasing the severe financial, operational, and reputational consequences for companies that failed to protect sensitive data.

4. Risk Mitigation Tactics

Best practices for building robust access controls, continuous monitoring, and governance frameworks that stand up in court and regulatory investigations.

## Who Should Attend?

This talk is geared toward anyone responsible for or interested in cybersecurity risk management, security engineers, IT managers, CISOs, compliance officers, and legal professionals. By integrating both the technical and legal viewpoints, attendees will gain a holistic understanding of the steps required to protect not just their data, but their entire organization from crippling liability.

Phishing attacks remain one of the most successful tactics used to get into an organization. In this presentation, we'll dive into the art and science of building an engaging, effective phishing program. The presentation will include real-world examples and stories from running and internal program.