@bsidesjoburg@infosec.exchange

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 23, 2026

We welcome OffSec as a Silver Sponsor for BSides Joburg 2026! OffSec is the global proving ground for operational cyber capability, where cyber operators and teams at every stage of their journey come to develop and demonstrate the skills needed to out-think real-world adversaries. Born from our own penetration testers, Kali Linux, and the OSCP exam, we combine deep, realistic content with performance-based labs, exams, and ranges to forge critical thinkers who can solve unscripted problems under pressure. Our approach reveals real-world readiness, builds confidence in how people will perform when it matters, and accelerates impact without lowering the bar. For individuals and enterprises who want more than paper qualifications, OffSec provides a trusted, evolving standard for cyber capability—and our mantra is simple: Try Harder. More about them: https://www.offsec.com

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 22, 2026

Travis More will be presenting "The Device Doesn't Take No for an Answer" at BSides Joburg 2026. The vendor app says "online" while the firewall drops every byte of outbound traffic. The voice prompt says "router connection unsuccessful" while the device hammers an IP it never resolved. Embedded devices lie to their owners, and most owners can't see it. This talk is the result of putting six embedded devices through the same enforcement lab, a mix of bottom-of-market kit and units from more recognisable vendors, and measuring the gap between what they say and what they do. You walk out with a nine-phase test you can run on your own kit, a four-axis scorecard that survives a procurement meeting, and a way to tell the difference between failing safe and failing by lying.

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 22, 2026

Roelof Temmingh will be presenting the Keynote at BSides Joburg with a talk titled "Goedkoop koop is duur koop" - the price of cheap thinking. Thinking is expensive: time and effort, the one budget you can't refill. So we buy discounts like heuristics, tidy stories, curated feeds, and now agents that decide for us. Every discount is rational. Every discount is also an attack surface, and for twenty years an industry has been optimizing against it: a kill chain running recon, exploit, and payload against human cognition, at machine speed, one operator per user. This talk maps that attack: who runs it, how, and why — then asks the harder question: what actually defends against it, and where those defenses could break.

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 20, 2026

Jared Naude will be presenting "The Black Box Problem: Detection Engineering in the Age of AI Agents" at BSides Joburg 2026. Aircraft accident investigations depend on a detailed evidence trail that allows investigators to reconstruct a sequence of events, understand contributing factors, and recommend changes that prevent similar failures. Detection engineering serves a comparable purpose in cybersecurity by creating a digital trail of breadcrumbs through logs, telemetry, identity activity, and system events. As AI agents become increasingly integrated into enterprise environments, organisations face emerging identity, data, and supply chain risks that may be difficult to observe or explain. This talk examines how detection engineering can provide the visibility needed to investigate these new threats and considers why the cybersecurity industry continues to struggle to share lessons from incidents in a structured and meaningful way.

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 20, 2026

Christoff Jacobs will be presenting "Shedding Light on Mobile Trust: Rethinking SSL Pinning" at BSides Joburg 2026. SSL pinning is not dead - it just needs a redesign. Mobile applications have traditionally relied on static SSL pinning to defend against man-in-the-middle attacks. However, static pins introduce operational challenges, including certificate rotations, application updates, and recovery from compromised trust anchors. This talk explores an alternative approach: a protocol-driven model that enables the secure exchange and validation of SSL pins between a mobile application and backend services. By moving beyond hardcoded trust relationships, organisations can improve resilience, reduce deployment friction, and maintain strong transport security without sacrificing agility. We will examine the threat landscape, design considerations, trust-establishment mechanisms, and practical implementation patterns for securely distributing and validating pins at runtime. Attendees will leave with a fresh perspective on mobile trust models and a roadmap for building more adaptable, future-ready SSL pinning solutions.

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 19, 2026

We welcome Lumanta as our Bag Sponsor for BSides Joburg 2026! At Lumanta, we help organisations navigate digital transformation with clarity, purpose, and innovation. Inspired by the quiet strength of the manta ray, our approach is simple: Explore. Innovate. Transform. Authentically.

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 18, 2026

Ivan Burke will be presenting "Using CSC to build future cyber workforce" at BSides Joburg 2026. The cyber security skills gap is a global problem, but it is acutely felt in South Africa, where access to structured, affordable, and locally relevant training remains limited. This talk draws on first-hand experience designing and building Capture the Flag (CTF) challenges for the SANReN Cyber Security Challenge (CSC) to explore how individuals and small groups can become the spark that ignites a local security community. From identifying the gap to building beginner-friendly challenges, running competitions, and watching participants grow into contributors. The SANReN CSC was created with the sole purpose of building up local cyber security skills but we would like to extend that goal by supporting local communities to start up their own initiatives and hacking communities.

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 17, 2026

Christo Goosen will be presenting "Turning Roadkill into braAI-VibeSDLC" at BSides Joburg 2026. Anyone got a light? When the CEO or product people send you a zip or github project do we burn or braai? Corporate and enterprise level AI enabled development is another beast in of itself. This talk reflects 3-6 months of rolling out claude code enterprise to 200+ engineers securely, turning agentic roadkill into a product with AI-SDLC and how you can shine the light in the generative darkness. Often the discussions start with a solution seeking a problem. Ample opportunity to search for problems that kill the project. Who is this for? Why? How much will it cost? Saving $3000 a year on SAAS licence can often translate into $30000 engineering time and fines way above that when you vibe-exfiltrate your company's data.

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 17, 2026

Keith Makan will be presenting "Lighting the Way in the Dark: Binary-Only Race Detection in Go with Zorya-Volos" at BSides Joburg 2026. "How do I find race conditions in a Go binary without being a wizard? Do any tools actually cater to real-world, off-the-shelf binaries?" When source code is unavailable, Go’s runtime acts as a dark, impenetrable black box where traditional scanners fail. Given the prevalence of Go in critical cloud infrastructure and high-stakes cryptocurrency environments, these "invisible" vulnerabilities represent a significant and under-addressed security risk. To address this, Keith will present Zorya-Volos, a specialized framework that lights the way into the obscured depths of Go runtime internals and concurrent behavior, bridging the gap between theoretical research and practical, in-depth security assessment. Get your BSides Ticket: https://www.quicket.co.za/events/354828-bsides-joburg-2026/ Schedule: https://pretalx.com/bsides-joburg-2026/schedule/

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 12, 2026

Dietmar Marggraff will present "A journey through Cybersecurity Regulation in practice" at BSides Joburg 2026. Join us on a journey through the OT cybersecurity of a fictitious chemical plant in Germany where everything seems under control - until the regulators arrive. The IT team has done its best, the engineers trust their safety systems, and everyone is fairly confident that “nothing serious can happen here.” But as new regulatory demands start landing on the desk, the plant is forced to confront an uncomfortable question: is the plant actually secure, or merely hoping for the best? In this session, we follow a chemical plant as it navigates real European and German cybersecurity regulations, including KAS-51, TRBS 1115-1, and the EU Cyber Resilience Act. Along the way we explore OT risk assessments, safety instrumented systems, hazardous incident reporting and a lot more! Finally, we bring the lessons home to South Africa. As our own regulatory environment continues to develop, what should we copy, what should we avoid, and what should we design differently from the start? Attendees will leave with a practical, story-driven view of how cybersecurity regulation moves from policy documents into control rooms, engineering workshops, audit reports, and national resilience. Get your BSides Ticket: https://www.quicket.co.za/events/354828-bsides-joburg-2026/ Schedule: https://pretalx.com/bsides-joburg-2026/schedule/

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 10, 2026

Stephen Munro & Logan Kroeger will be presenting "Gimme! Gimme! Your Creds After Midnight: Weaponising Veeam Credential Extraction" at BSides Joburg 2026. Backup solutions deal with incredibly sensitive data, and for ransomware to be truly effective, backups are a primary target. One of the common backup technologies we encounter during red team engagements is Veeam and it often stores highly privileged credentials needed to perform backup jobs across the environment. Domain Admin, vSphere administrator, ESXi root: all sitting in a database, encrypted with DPAPI, waiting for someone to ask nicely. In this talk, we walk through how we went from manually extracting credentials from Veeam Backup & Replication and Veeam ONE databases to building and releasing VeeamDumper, a .NET tool and Beacon Object File (BOF) that automates the entire process. We'll cover the credential storage mechanisms and encryption differences between VBR and Veeam ONE (including the undocumented Veeam ONE entropy value we had to figure out ourselves), the DPAPI decryption chain, and how extracted credentials map to infrastructure targets for lateral movement. Get your BSides Ticket: https://www.quicket.co.za/events/354828-bsides-joburg-2026/ Schedule: https://pretalx.com/bsides-joburg-2026/schedule/

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 08, 2026

We welcome Orange Cyberdefense as a Gold Sponsor for BSides Joburg 2026! For over 25 years, Orange Cyberdefense has been proud to reflect the incredible work and knowledge our team of ethical hackers do. Which is why, in “The Age of AI” we know that people are more important than ever. We believe that security teams can be equipped with tools that enhance their workflow without the scepticism or buzzwords that typically accompany the technology. That is exactly the approach that we bring to our solutions. More about them: https://www.orangecyberdefense.com/za/

0

BSides Joburg @bsidesjoburg@infosec.exchange · Jul 03, 2026

We welcome Absa Group Limited as a Platinum Sponsor for BSides Joburg! Absa is a leading pan-African bank, inspired by the people they serve and determined to be a globally respected organisation of which Africa can be proud. As a financial institution, they empower and enable - from investing in employees to uplifting communities and enabling their clients' ambitions.

0

BSides Joburg

Posts

Remote instance

Media