_Anton_Gvozdikov_Alamy.jpg?disable=upscale&width=1200&height=630&fit=crop)
July 29, 2024 at 10:06AM
Black Hat USA 2024 offers valuable insights for cybersecurity professionals. Despite the AI trend, vulnerability remediation remains a key focus. Sessions cover Amazon Web Services vulnerabilities, Microsoft’s use of large language models, CI/CD runner security risks, Google Cloud Platform vulnerabilities, and more. Emphasizes the need for proactive security culture and robust vulnerability remediation processes.
Based on the meeting notes, here are the key takeaways for the recommended sessions on vulnerability remediation at Black Hat USA 2024:
1. Yakir Kadkoda, Michael Katchinskiy, Ofek Itach
– Date: Wednesday, Aug. 7, 10:20 a.m.-11 a.m.
– Tracks: Cloud security, enterprise security
– Focus: Methodology for discovering vulnerabilities in Amazon Web Services (AWS) and introduction of a new open source tool for researching internal API calls.
2. Bill Demirkapi
– Date: Wednesday, Aug. 7, 1:30 p.m.-2:10 p.m.
– Tracks: AI, ML & data science, application security: defense
– Focus: Microsoft’s use of large language models (LLMs) for security response workflows and practical applications for vulnerability management using AI.
3. Adnan Khan, John Stawinski
– Date: Wednesday, Aug. 7, 1:30 p.m.-2:10 p.m.
– Tracks: Enterprise security, application security: offense
– Focus: Security risks of self-hosted CI/CD runners and defense against pipeline poisoning and privilege escalation attacks.
4. Liv Matan
– Date: Wednesday, Aug. 7, 1:30 p.m.-2:10 p.m.
– Tracks: Cloud security, application security: offense
– Focus: RCE vulnerability in Google Cloud Platform (GCP) and uncovering hidden APIs used by cloud providers.
5. Eyal Paz, Liad Cohen
– Date: Thursday, Aug. 8, 2:30 p.m.-3 p.m.
– Tracks: Application security: defense, exploit development & vulnerability discovery
– Focus: Risks of transitive dependencies in software projects and strategies for mitigating these vulnerabilities.
6. Qi Wang, Jianjun Chen, Run Guo, Chao Zhang, Haixin Duan
– Date: Thursday, Aug. 8, 2:30 p.m.-3 p.m.
– Tracks: Application security: offense, cloud security
– Focus: Exploiting protocol-level evasion vulnerabilities in WAFs and introduction of WAF Manis testing framework.
7. Ryan Kane, Rushank Shetty
– Date: Thursday, Aug. 8, 3:20 p.m.-4 p.m.
– Tracks: Enterprise security, application security: offense
– Focus: Security of immutable backups and testing processes to ensure data resilience against ransomware attacks.
These sessions provide valuable insights for cybersecurity professionals seeking to enhance vulnerability remediation processes and address evolving attack surfaces.