9:00AM | Welcome Speech
by Darren Teo, Chief Executive, CSIT
9:10AM | Opening Speech
by Melvyn Ong, Permanent Secretary (Defence Development), MINDEF
9:20AM | Keynote: Evolving Asia Pacific Cyber Threats: Google Threat Intelligence Perspectives
Threat actors are constantly evolving in their targeting, techniques and approaches. Google through the combined forces of its Threat Analysis Group and Mandiant is on the front lines defending users and the Internet from these threats. This talk will cover the major trends and new attacks we see in the region and lessons learnt in building the capability to track and counter.
CTO and Senior Director, Google Threat Intelligence and Co-founder, Google Threat Analysis Group
Shane Huntley is the CTO and Senior Director of Google’s Threat Intelligence organization and Co-founder of Google’s Threat Analysis Group (TAG). For the last 14 years he’s been leading teams to detect, analyze, and disrupt serious and government backed threats against Google and Google’s billions of users.
9:50AM | Keynote: An Evolving Threat Landscape: Key Global Insights from Microsoft
In an increasingly interconnected world, the landscape of cybersecurity threats is evolving at an unprecedented pace. This talk aims to provide a comprehensive overview of the current global threats facing customers and organizations, with a specific focus on recent trends being employed by cyber threat actors. We will delve into how malicious actors are increasingly targeting cloud infrastructures and exploiting trust in our digital identity infrastructure. Further, the session will shed light on the specific threats targeting countries in Asia.
Principal Threat Intelligence Lead, Microsoft Threat Intelligence Center
Matthew Kennedy is a Principal Threat Intelligence Lead at Microsoft’s Threat Intelligence Center (MSTIC), where he leads a global team in discovering, tracking, and disrupting the world's most persistent threats originating from Asian Pacific nations. Matthew is also an Adjunct Associate Professor at Georgetown University’s School of Foreign Service. Prior to joining Microsoft, Matthew's career involved protecting the LinkedIn platform from malicious threats and defending Lockheed Martin from sophisticated threat actors. Matthew has his Master's degree in Information Science from Penn State University.
10:40AM | Rise of the Defenders, Trends, Developments and Latest Thinking in Cybersecurity Defence
An outline of recent Cybersecurity Threat developments and trends in the region (APAC) observed by NTT’s various security groups, functions and teams tasked with monitoring traffic behaviours over NTT’s own IP backbone operations and Threat Intelligence ecosystem of sources. The presentation’s purpose is to share updates and key insights from NTT’s unique perspective on Cybersecurity, drawn primarily from raw netflow data analysis at scale, validated and further enriched through additional means with alliance partners, and international bodies/authorities. ‘What got us here, won’t take us where we need to go’, the world of Cybersecurity has shifted significantly in the last 12 months or so. Making use of latest technologies together with latest thinking, play a significant part maturing security operations, in this presentation we hope to show a little some examples of the why based on what we’re seeing out in the wild, and begin to discuss the how by sharing some of the steps.
Head of Cybersecurity, NTT DATA Singapore
Andrew Namboka is the Head of Cybersecurity, NTT DATA Singapore. In his current role, Andrew is responsible for the execution and strategy for the security solutions portfolio supporting NTT DATA’s clients in assessing, planning, building and operating their environment. Andrew is a well-known security advocate and industry speaker and has more than 25 years of IT industry experience, helping government, telecommunications and commercial companies with their networks. Prior to joining NTT DATA, Andrew worked as Enterprise Security Technologist for Check Point, and prior to that as Chief Security Technologist at Nokia APAC, developing partnerships with clients to build effective solutions for their current and anticipated IT security challenges. Andrew brings a wealth of in-depth technical experience gained in the data-communications and security industry. He started his career in the field as a lead engineer with IBM UK where he was responsible for building secure retail banking infrastructure. In 2000, Andrew joined Nokia UK as a European senior technical consultant before taking on the role of technology manager and subsequently engineering manager for EMEA. He holds an Engineering Honors Degree in mechanical engineering with specialization and post graduate work in robotics and artificial intelligence.
11:10AM | Disrupting the Macro Threat Landscape
The threat landscape continues to evolve with sophisticated threat actors and playbooks – implementing expanded techniques, tactics and procedures (TTPs). Threat actors are leveraging extensive offensive automation, and meanwhile begin to weaponize machine learning to augment their attack chain to penetrate organizations with unprecedented efficiency, stealth and speed. As a result, the mean time to detect (TTD) and respond (TTR) to these threats remains too long. Lengthy open windows of attack cause increased damage via revenue & shareholder loss, as well as brand reputation. This talk will dive into the macro threat landscape, showing examples of root cause issues from underneath that are causing a direct impact on targets above. This includes a growing portfolio of crime services (Crime as a Service) offered on forums, shared infrastructure, and novel tactics observed emerging. Active disruption efforts such as Cybercrime Atlas will be discussed. If we don’t disrupt the root cause, we continue to play the game of whack-a-mole.
Chief Security Strategist & Global VP Threat Intelligence, FortiGuard Labs
Derek Manky plays a strategic and visionary role in consulting with leading CSOs/CISOs of Fortune 500 companies worldwide across multiple industries, bringing with him over twenty years of cyber security experience. He leads FortiGuard Labs’ Global Threat Intelligence Team. Mr. Manky has established frameworks in the security industry including responsible vulnerability disclosure, which has exercised the responsible handling of over 1000 zero day vulnerabilities. Manky has been with the Cyber Threat Alliance since it was founded in May 2014 and sits on the board. In addition to the Cyber Threat Alliance board, Derek sits on the MITRE Engenuity Center for Threat Informed Defense Advisory Council and the World Economic Forum’s Cybercrime Atlas Executive Committee. He has helped to build collaborative platforms in the cyber security industry for over 15 years. Manky collaborates with global forums and expert groups alongside leading political figures, key policy stakeholders and law enforcement, including the World Economic Forum C4C, NATO NICP, INTERPOL, and FIRST.org. His vision is applied to help shape the future of proactive cyber security, with the ultimate goal to make a positive impact towards the global war on cybercrime.
11:40AM | Panel Q&A
Moderated by Ng Chang Yue, Principal Technical Specialist, CSIT
Principal Technical Specialist, CSIT
Chang Yue has over a decade of experience working in the cybersecurity and vulnerability research domain, for various enterprise and mobile systems. Over the years, he has led teams that performed research spanning a range of digital technologies, to develop solutions that serve Singapore’s cyber defence needs.
Afternoon Sessions (AI in Cybersecurity)
1:30PM | From Bytes to Insights: Unlocking the Power of Automated Malware Reverse Engineering
ACUBE is an automated malware analysis system developed by CSIT that significantly reduces the time taken to analyse malwares. ACUBE streamlines the analysis process by providing a comprehensive platform for preliminary static and dynamic analysis of malware samples. This enables malware analysts to quickly extract valuable insights and expedite threat investigations. We will present our work on building upon the open-source CAPEv2 project to enhance the support for Windows sandbox and integrate novel techniques for detection of rootkits in Linux operating systems. We will also share our thoughts on the use of Machine Learning to identify similarities between malware code functions and open-source libraries to aid manual analysis.
Deputy Director, Malware Research and Analysis, CSIT
Yoke Loon is the Deputy Director for Malware Research and Analysis at the Centre for Strategic Infocomm Technologies (CSIT), a technical agency under the Ministry of Defence that leverages cutting-edge digital technologies to address Singapore's national security needs. He oversees the development of solutions to detect and mitigate malware threats. With 20 years of experience at CSIT, Yoke Loon has held various leadership positions, including Deputy Director for Cyber Defence (Capability), before assuming his current role.
2:00PM | LLM Infrastructure Under Siege: Navigating Firmware and Hardware Security Challenges
The rapid adoption of Large Language Models (LLMs) has introduced new cybersecurity in risks at the firmware and hardware levels, particularly in critical components like GPUs and specialized AI accelerators. These foundational layers, often overlooked, are vulnerable to sophisticated attacks that can compromise model performance and security. Additionally, the opaque nature of LLMs raises significant challenges in ensuring model transparency and integrity, making it difficult to detect tampering or malicious alterations. The complex interaction between hardware vulnerabilities and model behaviour underscores the need for robust security measures tailored to LLM infrastructure. Understanding these risks is crucial for safeguarding AI deployments across industries. This talk will explore emerging threats and strategies for mitigating risks at the hardware and firmware levels, ensuring the resilience of LLM systems.
CTO & Co-founder, Eclypsium, Inc.
Alex is the Chief Technology Officer at Eclypsium, with over 15 years of experience in hardware, firmware, and supply chain security. He had led innovation at companies like Eclypsium, Intel, and McAfee. Alex has also presented in top cyber conferences, like Black Hat, DEF CON, CanSecWest, Recon, etc. In additionally, he founded the first DEF CON Group in Ukraine and co-founded the DCUA CTF team. Alex is also the co-founder of CHIPSEC, an open-source project focused on firmware and hardware security.
2:30PM | The Intersection of Artificial Intelligence and Threat Intelligence
This session explores AI's transformative impact on threat intelligence. Discover how defenders leverage AI to swiftly identify and understand threats, while malicious actors weaponize it for personalized manipulation and automated attacks. Real-world examples from threat research reveal AI's tangible impact on the cyber battlefield and its far-reaching implications for the future of cybersecurity.
Senior Director, Threat Intelligence, Palo Alto Networks Unit 42
Andy Piazza is a Senior Director of Threat Intelligence at Palo Alto Networks Unit 42, where he leads strategic research teams focused on nation state actors, cybercriminal activity, and malware analysis. Prior to Unit 42, Andy was the Global Head of Threat Intelligence at IBM X-Force where he led a team of 50 threat researchers. He is a US Army combat veteran with over 20 years of experience in security operations, threat intelligence, and incident response. Andy is committed to serving the cybersecurity community in a variety of ways, including as the Operations Lead for the Northern Virginia-based cybersecurity conference BSidesNOVA.
3:20PM | AI-Driven Cybersecurity: From Accelerated Computing to Multi-Agent Generative AI
Cybersecurity is evolving into a complex data challenge. One of the most powerful ways to analyze and contextualize this data is through natural language. With the advancement of large language models, we can expand detection and data generation techniques for cybersecurity applications. Organizations are in the early stages of learning how generative AI can be used to strengthen cybersecurity. Find out where generative AI can be applied to security to realize business value — reducing the time to detect cyberthreats, addressing data gaps, and enriching models by creating synthetic training data. In this session, Michael Demoret will provide a technical deep dive of the latest tools NVIDIA is developing, illustrating how LLMs can be seamlessly integrated into high-performance cybersecurity workflows. He will explore current and emerging use cases enabled by LLMs, sharing insights and lessons learned from real-world deployments that are shaping the future of cybersecurity.
Engineering Lead (Morpheus), NVIDIA
Michael Demoret is the lead engineer and architect for NVIDIA Morpheus, an application framework that allows developers to build high-performance pipelines integrated with AI capabilities for the cybersecurity domain. Michael has been with NVIDIA for over seven years and focused on building production-ready inferencing pipelines for large-scale, multi-model AI deployments across multiple sectors. Prior to NVIDIA, Michael spent seven years as a software developer, producing commercial off-the-shelf software for the aerospace industry. His past projects include collision avoidance for the International Space Station and building the first GPU-accelerated ground system at NASA.
3:50PM | Matching the Firepower to the Fight: Practical Prevention Against AI-Powered Threat Adversaries
Check Point has continually advanced the integration of both AI and Generative AI in its threat prevention efforts. The speaker will share application of AI within Check Point's framework and elucidate how the Check Point utilizes AI for comprehensive risk assessments and investigative processes. The presentation will include the strategic use of large language models (LLMs) by Check Point, highlighting their deployment across various scenarios according to specific operational requirements and use cases.
Head of Cyber Evangelist, Check Point
Brian Linder heads Check Point’s Office of the CTO and has appeared multiple times as a cybersecurity expert on media outlets including NBC, CNBC, Fox, ABC, NBC, CBS, and NPR radio, appears regularly on Check Point’s CISOTalk, hosts Check Point’s Weaponizers Underground, and is regular CyberTalks keynote presenter at Check Point's global CPX events. For 30 years, Brian has been an advisor in cybersecurity matters at the C-level to firms big and small in financial, legal and telecommunications, on next generation cybersecurity solutions and strategies for cloud, mobile, and network. Brian holds a B.S. in computer science from Drexel University and an M.S. in Information Science from the Pennsylvania State University.
4:20PM | Panel Q&A
Moderated by Zechy Wong, Deputy Director, AI Office, CSIT
Deputy Director, AI Office, CSIT
Zechy is the Deputy Director for the AI Office at the Centre for Strategic Infocomm Technologies. He leads the organisation’s AI partnership and outreach efforts, working with government and industry partners to advance the development of cutting-edge data and AI solutions for Singapore’s security needs. Zechy holds a PhD in computational linguistics, and his previous experiences as a data scientist and ML engineer have equipped him with a first-hand appreciation for the capabilities and limitations of AI technologies in real-world applications.
Afternoon Sessions (Cloud Security)
1:30PM | Uncovering Cloud Security Claims with Chaos Testing
Many Cloud Service Providers offer built-in security solutions that perform agent less scans, security alerts, and more. However, little is understood about the internal workings of these tools and the veracity of their security claims. By running chaos testing, we can uncover interesting insights into their limits of detection and containment, and highlight gaps that must still be filled by system owners.
Lead Security Engineer, Open Government Products, GovTech
Eugene Lim is building and hacking for good as a Lead Security Engineer at Open Government Products where he solves cybersecurity problems with engineering solutions such as infrastructure as code, chaos testing, and GitOps. In his free time, he loves white hack hacking and his research has been featured at top conferences such as Black Hat, DEF CON, and industry publications like WIRED and The Register.
2:00PM | AI-Powered Defence: Countering Advanced Threats in Today's Dynamic Landscape
Ransomware attacks have seen a significant 18% increase year-over-year, making it evident that AI is no longer confined to theoretical discussions or blocking access to ChatGPT. To combat malicious actors who leverage AI for attacks, the use of AI for defence is crucial. However, the traditional on-premises approach to AI-powered security presents cost and operational challenges due to the extensive data requirements for ML training. But the best AI is powered by the best data. With Zscaler processing over 420 billion transactions daily, our cloud-native security platform can leverage over 500 trillion signals each day. This vast dataset empowers AI to effectively fight AI-driven threats.
As zero-day attacks become increasingly prevalent, prevention of initial compromises and the reduction or elimination of attack surfaces are paramount. Equally important is limiting lateral movement within networks to counter the relentless onslaught of attacks.
In today's dynamic threat landscape, it is crucial to recognize that there are no longer "irresponsible users." AI-driven attacks have become so sophisticated that even seasoned security professionals can fall victim. To proactively protect users, it is imperative to implement security measures long before network traffic reaches on-premises infrastructure. In this session, we will be discussing the proactive protection against advanced attacks, securing your organisation and its users.
Public Sector Chief Technologist, Zscaler
Hansang Bae is the Public Sector Chief Technologist at Zscaler where he supports public sector organisations in their mission to transform and modernise securely. Previously, Bae held technology leadership roles at Netskope and Riverbed Technology and was a Citi (Citigroup) Architecture and Technology Engineering team member. As one of the six global engineering leads, he was responsible for performance engineering, network management (NMS) tools, and capacity planning groups for all of Citi. Bae is a world-renown expert in packet analysis with contributions to Wireshark open-source development.
2:30PM | Layers of Maliciousness
Large crime syndicates are utilizing big tech owned cloud providers as the bottom layer in their cyber crime operations. Malicious CDN providers sit in the middle, enabling them to survive without restriction utilizing varieties of fast fluxing infrastructure that work well for them. These crime groups are performing a variety of serious crimes using these layers of malicious service providers ending with the main big tech companies. In this talk we will go through how we map these crime groups infrastructure through the layers and reveal some of the players involved and the crimes committed affecting Singapore citizens.
Founder & CEO, Silent Push
Ken Bagnall is the Founder and CEO of Silent Push, the leading threat enrichment and hunting platform that allows organisations to have customised feeds relevant to themselves. Ken has an extensive track record of defending companies from cyber attacks. He is the founder of The Email Laundry, which was acquired by FireEye in 2017, where Ken then acted as Vice President of Product Management. Ken has a Cybersecurity Investment company called Phish Security that funds innovation in this sector, and sits on the advisory board of Strike Ready, a security operations platform. Ken was previously on the board of Information Security Ireland, on the executive council of CompTIA UK, and on the executive council of the EU PROTECTIVE threat intelligence project.
3:20PM | Navigating the Cloud-Native Minefield: Tackling Defenders' Pitfalls Amidst Increasingly Sophisticated Attacks
With the increasing complexity of cloud-native technologies, security practitioners face significant challenges. As the dimensionality of cloud-native environments expands rapidly, so does the vast amount of security knowledge required, the number of vulnerabilities, and the potential for mistakes. Simultaneously, attackers are continually enhancing their tactics, adding layers of sophistication to their campaigns targeting cloud-native environments.
In this talk, we will shine a spotlight on both novel vulnerabilities and common pitfalls that could affect any organization globally. We will also explore how attackers are adapting their techniques to exploit cloud-native environments, evade detection, and amplify their impact.
This session will provide an in-depth review of the latest real-life attack vectors, many of which have remained under the radar for extended periods. Attendees will gain insights into high-profile incidents, such as the HeadCrab malware, which leverages common misconfigurations and application behaviors in Redis to conduct highly malicious attacks affecting over 3,000 organizations worldwide and tmpSpectre which is under investigation and still remains hidden in the shadow.
Director of Threat Intelligence, Aqua Nautilus, Aqua Security
Assaf is the Director of Threat Intelligence at Aqua Nautilus, where is responsible of acquiring threat intelligence related to software development life cycle in cloud native environments, supporting the team's data needs, and helping Aqua and the broader industry remain at the forefront of emerging threats and protective methodologies. His research has been featured in leading information security publications and journals worldwide, and he has presented at leading cybersecurity conferences. Notably, Assaf has also contributed to the development of the new MITRE ATT&CK Container Framework.
3:50PM | Panel Q&A
Moderated by Ng Tong Meng, Deputy Director, Cloud Security & Services, CSIT
Deputy Director, Cloud Security & Services, CSIT
Tong Meng works with his team on researching cloud security technologies to develop advanced and timely solutions. Over more than a decade with CSIT, his experience include Windows security, malware analysis and penetration testing in various roles, with a commitment to the advancement of national security.
5:00PM | End of TechCon24
