{"id":91,"date":"2026-05-23T17:23:10","date_gmt":"2026-05-23T15:23:10","guid":{"rendered":"https:\/\/it-defense.hostpress.me\/it-defense-2027\/?page_id=91"},"modified":"2026-08-19T11:58:00","modified_gmt":"2026-08-19T09:58:00","slug":"presentations","status":"publish","type":"page","link":"https:\/\/it-defense.de\/it-defense-2027\/en\/program\/presentations\/","title":{"rendered":"Presentations"},"content":{"rendered":"\n

Presentations \u2013 IT-DEFENSE 2027<\/h2>\n\n\n\n

<\/p>\n\n\n\n


C2 Evolution From the Past to Tomorrow \u2013 Xavier Mertens<\/a><\/strong><\/strong><\/p>\n\n\n\n

Since malware has evolved with time, it has to communicate with a server to work smoothly. Most of it always used the good old \u201cclient – server\u201d model. That\u2019s the basics of a botnet where we have \u201cbots\u201d waiting for commands from their master. From a malware developer\u2019s perspective, the implementation of this communication channel has always been a key element because it must happen below the radar. I\u2019ll provide a recap of the C2 protocols from the past to today and tomorrow and show you common tactics used by attackers to interact with the infected computers.

This talk will be held in English.<\/em>
 <\/p>\n\n\n\n

The Next Era of Cyber Defense: Clarity, Control and Response at Scale – Paula Januszkiewicz<\/a><\/strong><\/strong><\/p>\n\n\n\n

In this keynote, cybersecurity is reframed as a challenge of clarity and control rather than tooling. Despite significant investments, organizations continue to experience breaches that go unnoticed until it is too late.<\/p>\n\n\n\n

Attackers exploit gaps in understanding rather than gaps in technology. Signals exist, often in abundance, yet they are not translated into actionable insight at scale. This creates environments where detection is present, but response is ineffective. Paula presents a strategic approach to achieving clarity across identity, endpoints and cloud environments, along with methods for transforming that clarity into coordinated response.<\/p>\n\n\n\n

The session offers a new perspective on how organizations can see, understand and act on attacks as they happen. Attendees can expect practical insights, real-world lessons learned and incident examples drawn directly from Paula’s field experience.

This talk will be held in English.<\/em>
 <\/p>\n\n\n\n

Trust No Token: Hunting Identity-Based Attacks Beyond the IdP \u2013 Nestori Syynimaa<\/a><\/strong><\/strong><\/p>\n\n\n\n

Identity has become the primary security perimeter. Modern attackers no longer need to exploit vulnerabilities or bypass network defenses. Instead, they steal authentication tokens and operate as legitimate users. Whether obtained through adversary-in-the-middle (AiTM) phishing kits, infostealer malware or compromised endpoints, bearer tokens provide direct access to cloud services without requiring the attacker to authenticate again.<\/p>\n\n\n\n

Most organizations focus their detection efforts on identity providers (IdPs), treating them as the central control point for identity security. However, token theft fundamentally changes the game. Once a token has been issued, attackers can bypass many IdP-centric detections and interact directly with service providers, where critical activities such as data access, lateral movement and exfiltration occur.<\/p>\n\n\n\n

This presentation examines the modern token-based authentication ecosystem from both offensive and defensive perspectives. We will dissect how authentication tokens are issued, used, abused, and replayed across cloud environments. We will explore the limitations of traditional indicators such as IP addresses and HTTP headers and demonstrate how emerging techniques such as JA4 TLS fingerprinting can provide more resilient methods for identifying both human and non-human identities. Attendees will learn why visibility from either the IdP or the service provider alone is insufficient, and how correlating telemetry across both sides of the trust boundary enables detection of advanced token replay attacks that would otherwise remain invisible. Through real-world attack scenarios, detection strategies and practical guidance, this session provides a deep dive into the technologies and signals required to defend the modern identity perimeter.<\/p>\n\n\n\n

This talk will be held in English.<\/em>
 <\/p>\n\n\n\n

Fighting the Dark Triad: Navigating Toxic Leadership in Cybersecurity – Matthew Webster<\/a><\/strong><\/p>\n\n\n\n

Cybersecurity professionals often focus on technical growth, governance and risk maturity – but what happens when the greatest threat isn’t a vulnerability in code, but in character?

In this deeply personal and practical session, I share my encounter with individuals who exhibited traits of the Dark Triad – narcissism, Machiavellianism and psychopathy – and how those encounters derailed not just security efforts, but entire teams. These personalities are rarely talked about in our field, but they can cause immense harm to cybersecurity programs, organizations and people alike.

You’ll learn how to recognize common behaviors, patterns and tactics used by Dark Triad personalities, especially those in positions of influence. More importantly, you’ll walk away with strategies to detect, manage and protect yourself and your teams from psychological and organizational harm.

This talk blends behavioral science, leadership resilience and cyber governance for professionals operating at the intersection of risk, trust and people.

Key takeaways:<\/p>\n\n\n\n