Pre-Summit Meet and Greet
This optional session offers the opportunity to meet and network with your fellow attendees the night before the Summit kicks off. We highly recommend you attend if possible.

Welcome and Introduction by Summit Chair
Erik Van Buggenhout, Certified Instructor & Author, SANS

Keynote Speech
James Lyne, CTO, SANS

The Close Relationship: Exploitation & Penetration Testing
In our role of adversary emulation and flaw demonstration, we have more systems than ever before to attack -- different architectures, operating systems, languages, design patterns and a plethora of wonderful tools. Many of the technology changes in our industry are enhancing security, whilst some are causing regression or exposing new flaws. Exploitation and discovering new flaws are crucial to the tools that much of the offensive industry rely upon, yet many use them without getting to the detail of how they function. In this talk @jameslyne will review some exploitation fundamentals, tools you can use and techniques in a talk packed with live demonstrations (hopefully).

Blame Wars - How to Attribute Responsibility
In November 2018, Austrian security consultancy SEC Consult published a security advisory concerning a vendor of ID solutions using the German national ID card. Authenticating with a real ID card, the researchers had been able to trick a web app into believing they were Johann Wolfgang von Goethe. Technically the bug leading to the vulnerability is easy to describe and reproduce (it is a well-known mishandling of the complex SAML authentication mechanism). Still, a fierce debate between researchers, vendor and circles of German government contractors erupted - not so much about the impact of the vulnerability itself, but more about where to place blame. Since the bug was contained in an accompanying SDK, it could be both the vendor's as well as users' fault. Others blamed SAML itself - and therefore either the standards authors or the German government for picking the standard. In the presentation, I will track the origin of the bug both technically and historically/"politically" to generate some insights into the question who should be to blame for vulnerabilities and security incidents: a sketch for a theory of attribution.
David Fuhr, Head of Research, HiSolutions AG

Automated adversary emulation using Caldera
MITRE ATT&CK is quickly gaining traction and is becoming an important standard to use to assess the overall cyber security posture of an organization. Tools like ATT&CK Navigator and Caldera facilitate corporate adoption and allow for a holistic overview on attack techniques and how the organization is preventing and detecting them. Furthermore, many vendors, technologies and open-source initiatives are aligning with ATT&CK. Some more information on Caldera from the official documentation (https://github.com/mitre/caldera):

"CALDERA is an automated adversary emulation system that performs post-compromise adversarial behaviour within Windows Enterprise networks. It generates plans during operation using a planning system and a pre-configured adversary model based on the Adversarial Tactics, Techniques & Common Knowledge (ATT&CK™) project. These features allow CALDERA to dynamically operate over a set of systems using variable behaviour, which better represents how human adversaries perform operations than systems that follow prescribed sequences of actions."

During this talk, Erik will demonstrate some Caldera strong points and weaknesses and how it can be further improved (e.g. how can we build additional steps to increase our ATT&CK coverage or how can we adapt steps to handle new Windows 10 security features such as ExploitGuard and AMSI).
Erik Van Buggenhout, Certified Instructor & Author, SANS