BSides Knoxville 2025

Exploring attack paths across AWS, Azure, GCP and OCI. Learn to dissect misconfigurations through graph-mode visualization, map potential attack paths, and implement practical mitigation using open-source tools. Elevate your defense strategy and fortify cloud environments against evolving threats.

After a decade in consulting roles like software engineer and penetration tester, I joined an open-source company to secure its 300+ repositories across numerous platforms. This session highlights key vulnerabilities and lessons learned, with actionable advice for attendees of all backgrounds.

For years, cybersecurity leaders have been caught in a cycle of compliance—chasing checkboxes, aligning to frameworks, and struggling to keep up with ever-changing regulations. But here’s the real question: Are these standards making us more secure, or just more compliant?

Ready to reign in rogue robots? Let's use our hive mind to sting them where it hurts in the circuits. Fuzz sensors, pwn software, lace AI with venom. Crack firmware hives, jam RF, shred control loops. Join the swarm at BSides Knoxville for an electrifying hack fest that'll make bots scatter!

TBD

Tired of running the same commands over and over? Wish your notes didn't look like a crime scene? Bash scripting can automate the boring, streamline engagements, and save your butt when things go sideways. Come learn how to hack smarter, not harder, because pentesting should be fun, not tedious!

The misuse of open-source red-teaming tools by cybercriminals and nation-states is rising, turning security assets into attack vectors. Tools like Sliver are exploited for advanced threats. Our AI methodology analyzes high-risk tools, enabling organizations to detect/mitigate threats proactively.

Modern disassemblers are awesome, but assemblers today are little better than they were in the nineties. I'm fixing that by writing one that easily ports to new architectures, saving me a ton of work in embedded systems exploitation.

In an era of increasing data breaches, inadequate security isn't just a technical gap, it's a legal ticking time bomb. Learn how seemingly small oversights in access control and data protection can expose businesses to crippling liability, and discover practical steps to minimize your risk.

## Introduction

Businesses of every size are under mounting pressure to protect sensitive data. When an organization's security posture is weak, especially in areas like access control or policy enforcement, the legal consequences can be swift and severe. In this talk, we'll dissect the intersection of cybersecurity and liability, revealing the most common pitfalls that can leave businesses exposed to lawsuits, regulatory fines, and reputational damage.

## Why This Topic Matters

The growing complexity of cybersecurity means that many organizations overlook the legal implications of their security posture. Often, executives view security as a purely technical concern, until an incident happens, and the legal fallout is severe. This session aims to illuminate how specific security failures, especially around access control and privilege management, can directly translate into legal liability.

## What You'll Learn

1. Legal Frameworks & Regulations

Overview of relevant U.S. and international laws, from data protection regulations (GDPR, HIPAA) to newer legislation targeting corporate accountability (such as the SEC's cybersecurity rules).

2. Common Failure Points

How poorly enforced access policies, insider threats, and deficient incident response protocols create liability.

3. Case Studies & Lessons Learned

Real-world examples showcasing the severe financial, operational, and reputational consequences for companies that failed to protect sensitive data.

4. Risk Mitigation Tactics

Best practices for building robust access controls, continuous monitoring, and governance frameworks that stand up in court and regulatory investigations.

## Who Should Attend?

This talk is geared toward anyone responsible for or interested in cybersecurity risk management, security engineers, IT managers, CISOs, compliance officers, and legal professionals. By integrating both the technical and legal viewpoints, attendees will gain a holistic understanding of the steps required to protect not just their data, but their entire organization from crippling liability.