Kentucky Office of Homeland Security

      

Detection Engineering at UPS      

In this presentation, we Will share how UPS security operations center (SOC) operations are engineered, and how we orient our efforts to defend against recent threats      

     

UK's Road to DMARC Enforcement ...and Securing all the Email Things      

A roadmap discussion on how the University of Kentucky successfully reached a DMARC enforcement policy of p=reject and other changes to drastically reduce the attack surface of the enterprise's Exchange environment. This session will discuss challenges and milestones for the teams involved. And provide recommendations on tools, products, and configurations that can be leveraged to better secure complex mail environments that leverage M365's Exchange Online or hybrid Exchange services.      

     

Beyond Passwords: Strengthening Identity Security in M365      

As identity-based attacks continue to rise, securing user access has become the foundation of modern cybersecurity. In this session, we will explore how Microsoft 365’s identity protection features—such as Azure AD Identity Protection, Privileged Identity Management (PIM), Temporary Access Pass (TAP), and Conditional Access—can help organizations mitigate risks and enforce strong security policies.      

     

Is Big Brother Really Watching?      

Are your devices betraying you? In this session, we will be taking a look at mobile, IoT, and automobile infotainment system forensics. We are all aware of the plethora of data that is stored in that little box each of us carries around with us. Our mobile phones are basically a digital recording of our lives. What you may not be aware of is the amount of and types of data that can be recovered other devices you use on a daily basis. What does your automobile know about you? What about the simplest of IoT devices? In this session we will investigate details we can glean from your devices, which means these are all things that your devices are collecting about you.      

     

Building a Cybersecurity Culture.      

This presentation focuses on the importance of cultivating a cybersecurity culture that goes beyond compliance and integrates security practices into the organization’s values and everyday behavior. We explore how leadership commitment, continuous education, and fostering open communication can build a culture of security. Employees should feel empowered to follow secure practices, report suspicious activities, and view cybersecurity as an essential part of their role.      

     

The Forgotten Networks: OT Cybersecurity Across Industries      

Operational Technology (OT) cybersecurity is no longer just a concern for power plants and water utilities. From building access controls and IP cameras to HVAC systems and point-of-sale devices, overlooked OT components are becoming prime cyberattack targets across industries. This session will explore real-world cyber incidents, best practices for securing OT environments, and the importance of frameworks like the Purdue Model. Attendees will gain insights into mitigating emerging threats and practical security strategies for diverse sectors, including manufacturing, healthcare, and retail.      

     

Ghostmarket09 - The United States v. Jesse Kipf      

In this joint presentation, we will present a case study on the successful investigation that brought cybercriminal Jesse Kipf, aka Ghostmarket09, to justice. The FBI opened and investigation after they identified Kipf attempting to sell access to state death registration systems. The talk will discuss how collaboration supported the FBI's investigation and assisted federal prosecutors. In October 2023, Kipf was indicted on charges of computer fraud, identity theft, and bank fraud. In August 2024, Kipf was sentenced to 81 months for computer fraud and identity theft for breaching death registration systems in multiple states. The speaker will share insights from this collaboration, discussing how cybersecurity vendors, law enforcement, and prosecutors can work together to identify, investigate and prosecute threat actors. They will highlight challenges of building a case and critical evidence needed for conviction.      

     

Securing Healthcare’s Future: The Role of Cyber Resilience in Patient Safety      

Healthcare provider CISO perspective on the evolution of cyber-crime, lessons learned from recent public incidents, emerging threat vectors and suggested focus areas for cyber defense teams in the next 6-12 months      

     

Getting Started with Risk Assessment for Blue Teams      

Risk assessment is a crucial component of any blue team's defense strategy. This session covers the fundamentals, including how to identify assets, evaluate threats, and prioritize risks. Participants will learn practical steps to assess vulnerabilities, measure their potential impact, and implement security controls to enhance their organization's defenses. This session is ideal for individuals who are new to risk assessment or are looking to improve their current approach.      

     

Red Team Tool Demo      

See red team tools in action. Flipping Zeros, Kali's Linux, Social Engineering Toolkits, Bad USBs and more that can't be named by specific brand.      

     

CISA’s No - Cost Tools, Available to YOU!      

CISA has developed several cybersecurity tools which are available to anyone to use. This session will specifically focus on three tools, Logging Made Easy, Malcolm, and SCUBA Gear. CISA's Logging Made Easy (LME) is a no cost, open source platform that centralizes log collection, enhances threat detection, and enables real-time alerting, helping small to medium-sized organizations secure their infrastructure. Malcolm is a powerful network traffic analysis tool suite designed with the goals of being easy to use, a streamlined deployment, and provides powerful traffic analysis. ScubaGear is an assessment tool that verifies that a Microsoft 365 (M365) tenant’s configuration conforms to the policies described in the Secure Cloud Business Applications (SCuBA) Secure Configuration Baseline documents/