Schedule

Infrastructure whose failure scenarios result in catastrophic cascading failures that can lead to loss of life, extensive environmental impacts, and loss of organisational or government reputation.

In this session, we will examine the five-year journey an Australian major hazard facility embarked upon that resulted in the safe adoption of automated ways of working. You will see how a risk and business centric approach, underpinned by SABSA and functional safety engineering standards (IEC 61508/61511), increased process maturity, uplifted capability, removed people from harm’s way, reduced operational risk by a factor of 10, and modernised work management.

We will discuss use cases C-suite and plant managers care about (hint: it’s not configuration management), COTS vs. inhouse development, pre-requisite logical services required to ensure human and computer instantiated workflows remain distinguishable, the “physics” of maintenance debt and its impact on organisational change management, as well as the challenges associated with event-driven automation and extending orchestration to the physical world.

All concepts discussed will be related to a vendor neutral “just in time network administration” capability we build throughout the presentation culminating in its implementation through a live demo.

During my CISO career I have witnessed how security teams operating without proper data context make decisions based on assumptions rather than data and evidence. They deploy controls that do not match actual risk scenarios, prioritize threats that are not present in their environments, and end up missing actual gaps they should be addressing.

The presentation examines how context transforms the effectiveness of your security program. Through case studies from other companies as well as my own teams, I will demonstrate how data driven approaches make threat modelling, incident response, risk assessments and other
security functions more efficient and impactful.

Key takeaways will include strategies for building context-driven security functions, establishing engagement channels that help your teams focus on what matters, and creating processes grounded in data rather than the industry hype.

As organisations adopt new ways of working and face an increasingly uncertain threat landscape, security architects are under increasing pressure to deliver interoperable, reusable, and business-aligned cybersecurity artefacts. This presentation will include practical artefacts and examples that demonstrate how this approach has enabled the organization to respond rapidly to:

• New business priorities—such as integrating Distributed Energy Resources (DER)
• Adopting a new product-centric and agile delivery model for digital transformation
• Aligning digital products with best practices and regulatory frameworks, including ISA/IEC 62443 and the Australian Energy Cybersecurity Framework (AESCSF v2.0)
• Synchronising security artefacts with other enterprise architecture domains: Business, Information, Application, and Technology.

Attendees will be encouraged to consider SABSA as a holistic, risk-informed approach that serves as a strategic enabler for cybersecurity in complex and evolving environments.

The Strategic Value Risk Model (SVRM) was developed to enable organisation to manage ever changing risk environment and maintain an optimized risk posture, thereby enabling value optimization.  The SVRM focusses organizations on what really matters, as opposed to chasing down every emerging threat and uncovered vulnerabilities.  It also enables definition and management of effective risk governance metrics, thereby enabling board of directors and senior leaders drive value chain alignment.

This session is for those who feel that creating meaning from words is both a powerful and dangerous undertaking. These brave persons want to better would language for their work. It is also for anyone who enjoys a cheeky bit of wordplay.

Attendees will be exposed to principles and tools to help form robust attributes and demonstrate their utility for ESA. By the end of the session you will be drafting Attributes with the decisiveness of James Murray heading the Oxford Scriptorium.

The research shows how credentials for internal portals, cloud dashboards, developer platforms, and communication tools are exposed through this process. The goal is to help security teams understand what gets leaked, how it’s organized for resale or sharing, and how organizations can monitor public channels for signs of risk.

Infostealer malware is built to collect and dump anything useful from a device. This includes saved browser credentials, autofill data, session cookies, API tokens, wallet addresses, and app-specific passwords. Once collected, these logs are uploaded to Telegram bots, marketplaces, or leak sites.

The research walks through how these logs are typically structured and what credentials they contain. Examples include login details for GitHub, Slack, AWS, Gmail, Notion, Discord, Office 365, database dashboards, and internal dev tools. Logs often include SSH private keys, JWT tokens, and webhook URLs. In many cases, cookies allow attackers to access services without even needing passwords.

By analyzing some incidents using OSINT methods, the research maps the lifecycle of credential stealers. It covers the path from infection, to log exposure, to potential misuse. The examples are based on public stealer log collections and show how much sensitive access data ends up in the open. + Working and defense from common infostealers like Raccoon, Redline, and LummaC2.

1. Introduction and Context

• Why stealer logs are a practical threat to modern businesses
• Who gets infected and how that leads to third-party exposure
• Overview of log distribution on Telegram, forums, and marketplaces

2. What Gets Leaked

• Email credentials and 2FA backup codes stored in browsers
• Cookies for authenticated sessions on platforms like Slack, GitHub, Notion, and AWS
• OAuth tokens and refresh tokens for Google, Microsoft, and custom apps
• SSH private keys, API tokens, and .env files from local folders
• Passwords stored for database tools like phpMyAdmin, MongoDB dashboards, and Redis GUIs
• Admin panel logins saved in browser autofill

3. How These Credentials Are Collected

• Behavior of common stealers like Raccoon, RedLine, and Lumma
• How logs are organized: domain tags, browser metadata, IP and system info
• How tokens and cookies are exfiltrated directly from browser memory
• Screenshot files and grabber modules that capture opened panels or inboxes

4. Public Distribution and Market Behavior

• Telegram bots offering credential search by domain or keyword
• Leaked dumps uploaded to paste sites, temporary file hosts, or clearnet panels
• Marketplaces selling access to logs filtered by country, platform, or business domain
• Bulk stealer data shared freely in forums for credit farming or reputation

5. Patterns in Exposure

• Domains most commonly seen in leaked logs: SaaS tools, cloud dashboards, CMS panels
• Frequent exposure of productivity tools: Office 365, Google Workspace, Notion, Trello
• Developer-focused credentials: GitHub tokens, SSH keys, CI/CD credentials
• Trends by region or sector: fintech and startups often show up in public logs due to widespread SaaS usage

6. What Could Be Done With These Credentials

• Accessing internal Slack or Discord channels without triggering 2FA
• Reusing GitHub credentials to access private repos or commit history
• Connecting to remote servers using stolen SSH keys
• Using API tokens to interact with third-party services and leak data
• Logging into email accounts and resetting passwords to other platforms
• Silent access to cloud dashboards through cookies, bypassing login completely

7. Detection and Monitoring

• OSINT-driven ways to monitor for leaked credentials tied to your domain
• Tracking mentions of company names, emails, or internal tool domains in stealer bots
• Watching for unauthorized access attempts originating from leaked IPs or cookie sessions
• Collaborating with threat intel and DFIR teams to correlate exposure

8. Preventive Measures and Awareness

• Reducing password reuse across internal and personal systems
• Auditing session expiry and token validity in cloud applications
• Encouraging staff to avoid storing work credentials in browser managers
• Monitoring employee credential exposure through domain-based threat feeds
• Educating teams on the risk of downloading free software or tools from unreliable sources

Expected Outcomes:

• A full understanding of how credential stealers operate and what they capture
• Visibility into how credentials are exposed publicly and what attackers look for
• Clear examples of credentials and tokens leaked in real logs
• Techniques to detect if your organization appears in these public spaces
• Practical recommendations for reducing exposure to stealer-based threats

Who Should Attend:

• SOC teams and detection engineers
• Threat intelligence analysts
• Incident responders and DFIR teams
• Cloud security and SaaS administrators
• Red teamers and defenders looking to simulate this attack path

Key Takeaways:

• Credential stealers expose far more than just passwords
• Logs containing cookies, tokens, and keys can grant direct access to business services
• Publicly leaked logs are searchable and actively used by attackers
• Monitoring these sources can provide early warning of possible compromise
• Preventing credential theft starts outside the perimeter, often on unmanaged devices

Presenting from dual perspectives – that of a cub reporter hungry for clarity and a regional information ambassador advocating for purpose-driven stewardship – we explore how SABSA’s conceptual and contextual layers can be revitalised through ontological thinking. Together, we propose a shift in focus from static taxonomies to flexible ontologies, enabling organisations to navigate ambiguity, reinforce relevance, and transform data into embedded knowledge.

Key topics include:

• Data Cleansing as Stewardship: Neglecting this foundational step is like letting an under-11s football team run riot in your newly renovated house.
• Metadata’s Dual Edge: A potential gateway to insight – or a quiet amplifier of bias?
• OWL as Enabler or Encumbrance: Can the Web Ontological Language evolve from overhead to guardian?

We argue that embracing ontology allows SABSA to support intuitive, gut-driven decision-making with structured insight – particularly in organisations where data is the dominant, if not sole, asset. We outline a practical ontological model for SABSA’s conceptual and contextual layers, demonstrating how it can better reflect the real-world complexity that businesses face.

By the end of the session, attendees will be invited to reconsider the relevance of ontologies for modern security architectures – and perhaps reimagine what SABSA could become when data is understood not just as resource, but as relationship.”

Biometric authentication is being sold as progress. But beneath the promise lies a problem of permanence, precision, and power – who controls the data, who accesses it, and what happens when it’s wrong.

This presentation will examine:

• Why biometric data is inherently high risk, and why most storage and transmission models don’t treat it that way
• Real-world failures of biometric systems, from government IDs to commercial smartphones
• How biometric spoofing and false positives are exploited, even in mature deployments
• What effective biometric implementation actually looks like

Key takeaways:

• Biometric data is immutable – we cannot treat it like passwords
• Spoofing is practical, repeatable, and underreported
• Consent and transparency in biometric systems are mostly performative
• Most implementations trade off accuracy, auditability, or user rights – sometimes all three
• There are ways to deploy biometrics safely, but they’re expensive, complex, and rarely done properly

We started by profiling threat actors based on what they wanted, what they could do, and who they typically went after. Then we mapped their favourite tactics and techniques using MITRE ATT&CK as our guide. The interesting part came when we linked these attack patterns directly to existing security controls – suddenly we could see exactly where we had important gaps and where we were over-investing.

Weaknesses in recovery procedures, gaps in system dependencies and unclear operational resilience targets were revealed.

We could finally show leadership how specific threats connected to business risk and prove that our security investments were hitting the right targets. SABSA helped to remind us how we needed to create traceability throughout.

The accuracy, completeness and timely accessibility of the information required to determine the optimum way forward is more important than ever.

The session draws in from philosophy to  illustrate how ancient wisdom can be applied to cyber security and risk management. Will illustrate how Socratic method, an interactive technique for establishing knowledge, allows us to test assumptions through honest dialogue, think differently and ultimately guide us towards better understanding the implications of decisions that needs to be made. The audience will experience how to draw strength from contrarian thought, and utilise it as a tool for both establishing ignorance and knowledge.

Next, we’ll delve into techniques for writing and using effective security patterns, highlighting best practices and common pitfalls to avoid.

Participants will have the opportunity to understand how security patterns can be adopted in practice.

We’ll then examine how security patterns can enhance overall security and why they offer a more practical approach compared to relying solely on security standards.

Participants will learn the core steps for writing security patterns as part of the SABSA framework.

We’ll provide practical examples of a security pattern for AWS and how this is being applied in businesses to provide design assurance.

This session reframes traditional tabletop exercises, highlighting how process targeted digital twin environments, cyber ranges, and business aligned simulation models can enhance not just technical preparedness but real decision making, incident response coordination, and organisational insight. From the boardroom to the supply chain, attendees will gain insights in to how the use of real-world simulations can inform and evolve with the business to reflect enterprise priorities, regulatory obligations, and operational risks.

Designed for seasoned professionals, this session avoids prescriptive training models and focuses on reusable, strategic patterns for building human-centric resilience programs. Emphasis will be placed on architectural governance, lifecycle integration, and aligning with standards such as NIST SP 800-160, ISO 42010, and the Australian Government Protective Security Policy Framework (PSPF).

This presentation tackles the gap in privacy implementation and asks: what if Privacy by Design was truly architected by design?

We explore how the SABSA framework offers a business-driven, attribute-based approach to embed privacy across the data lifecycle – including classification, sensitivity labelling, usage, sharing, and secure disposal. Without architectural grounding, organisations risk data exposure, inconsistent handling, and loss of trust.

The discussion also covers the paradoxes of AI and data privacy – where growing demands for data analytics clash with strict privacy obligations. SABSA helps balance these tensions by linking privacy requirements to business risk, producing measurable, enforceable outcomes.

Attendees will learn to translate privacy requirements into architectural layers, implement dynamic sensitivity and lifecycle-aware controls, and create a unified privacy-by-design framework bridging legal, technical, and business perspectives.

Key takeaways:

• The need for architectural ownership of privacy beyond legal mandates
• Using SABSA attributes to model and govern privacy effectively
• Designing controls adaptive to data sensitivity and lifecycle
• Aligning privacy goals across legal, technical, and business domains

Quite often left unattended these legacy systems or components may simply continue to work and that return on investment continues to pay off. Perhaps no longer with vendor support, scarce availability of parts (new or used), limited recovery methods or upgrade paths, lost expertise, or loaded with vulnerabilities with ever increasing risk (there it is again) as the environments and systems around them evolve and change. It’s a choice, and life isn’t always so simple.

There is another side to that coin. Those systems that today are considered the current norm, sometimes labelled ‘next gen’ or ‘cutting edge’. But where will they be in years or decades to come? Will they continue to work in isolation, can they be sweated as simply as those that came before? What of that lurking demon known as planned obsolescence?

When a button is pushed, or a key is turned the user expects something to happen. What happens when nothing now happens, all that presents is darkness, a blank screen, no sign of life, no change in state…this is the Fear of the Dark.

Pivoting from prior themes of a CISOs viewpoint through cinematic classics in previous COSAC presentations, your presenter delves into the societal problem that is largely being ignored in terms of longevity, resilience and risk.

This session will look at the unappreciated challenges faced by industry and society as time passes, where tech debt begins to transform into tech liability and sunken costs. At best impacting productivity, usefulness or choices, or at worst grinding operations to a halt and generating more and more waste with a material societal impact and significant financial cost.

The aim is to have a discussion with the audience on these ever-mounting issues in the short and long term, and how cyber security professionals and practitioners may manage these kinds of challenges in their own organisations, and within our broader personal lives.

In other words, can we find a way to reduce and navigate these lurking risks? Or will we keep “walking a dark road at night…a constant fear that something’s always near…fear of the dark….fear of the dark…”

As a former junior professional chess player turned SABSA enthusiast, I invite the audience to unpack the multifaceted aspects of architecting world class (chess) talent. Inspired by the Polgar sisters’ educational experiment which famously suggests geniuses can be made, this unique session explores how SABSA can model and sustain human potential.

The unique value proposition stands in the journey to understand how to measure intangible assets such as talent!!

Finally, is talent innate, or just a bunch of meticulously engineered factors? Join me as we dissect it, learn to measure it, manage risks around it and maintain it. Drawing on a decade of experience in competitive chess, I reveal successes, failures, lessons learnt and efforts to prepare for junior world championships and meticulous planning.

Getting it right the first time, while not impossible, requires more than just implementing a framework or methodology. Learn how to grow beyond just being a lean organisation, to one that is both Lean & Mean – making every resource/investment count and to move from being reactive to proactive in posture.

Those wishing to give a talk at the rump session must submit a short abstract, no more than one page long, according to one of the following procedures:

• Electronic submission: Send email to the rump session chair David Lynas at [email protected]
• Hardcopy submission at conference: Hand the submission to David Lynas at the conference before noon on Wednesday 25th February.

Submissions should include a requested amount of time for the presentation. An anticipated absolute maximum of four minutes will be allocated for each presentation.

Many practitioners come out of self-study or training armed with new skills, but struggle with applying them in complex situations and under tight time frames. Not to mention, there may be a limited number of practitioners in their organization (or region for that matter) to learn from. The primary goals for this session are to build relationships with other practitioners, to learn from each other on different ways to apply techniques to solve problems, and setup situations where we can creatively apply and adapt our skills. This is not a session where you will sit and listen to a presenter telling you how to do something.

Past attendees of the Design-Off have marked this as one of the highlights of the conference and we hope you will leave feeling the same way. Each year we feature a unique customer and problem set, so if you have attended in a previous year, be assured that this year will present a new and different challenge. This year we have several tweaks planned based on feedback from past attendees that we think will further enhance the experience!

Teams are made of people with different skill sets and skill levels, and team members will be actively engaging each other and trying to find the best way to meet the challenges. This is not a competition in using a specific formal methodology or framework (although they will definitely come in handy), but is meant to be an exercise in applying these techniques in a ways that most effectively meet the client’s needs.  Each year’s winners proved their mettle through several challenges, demonstrating skills in listening to clients, applying risk management, demonstrating business value, and effectively communicating with the client. There can be only one winning team, however all participants will learn from the experience. Where else can you see how different groups of high level security practitioners apply their skills to address the same problem? That said, you will want to win this! The winning team members not only get bragging rights, but will be announced on the SABSA LinkedIn group, and each member will receive a personal acknowledgment on LinkedIn congratulating them on their achievement! Other spot prizes will be awarded by the moderators in addition to this to recognize outstanding efforts of participants.

A few of the hardest problems SABSA architects face are working alone, and getting started where there are challenges.   These design workshops not only build teams from people who may have never worked together before, they challenge the groups to quickly overcome challenges to deliver actionable architecture quickly.  It can be done; this activity proves it.

AI, quantum computing, machine learning, security staffing, privacy, compliance, incident handling, ransomware, … the list goes on and on.  Forum delegates are always learning, willing to listen to and learn from others who’ve encountered things they might not have, definitely not shy about sharing opinions, strategies and techniques, and committed to our strange and but very necessary profession.

With moderating by a not-quite-extinct security dinosaur, you and your peers will experience a half-day immersion in the COSAC APAC way.  Moderator questions or comments on associated issues and related publications can produce very different reactions from the crowd. Participants cast their own light on raised topics based on constraints, objectives, tools, techniques, hidden land mines and final outcomes. We all learn from each other.

Come join us and help solve the current and maybe future information security problems of the world.

We’ll use the datasets to augment a standard Generative AI Large Language Model (LLM) and attendees will learn how to prepare the system prompts necessary to drive its operation. To conclude the workshop, attendees will prepare their augmentation dataset, select their preferred LLM, and use their AI Fast Track Agent to prepare a fast track deliverable for a project.

Attendees are encouraged to work in groups and participate hands on in each practical lab throughout the course of the workshop.