For decades, the OSI model has been taught as a networking concept, often reduced to a memorization exercise for certification exams. Unfortunately, that approach misses its true value. The OSI model is one of the most foundational frameworks in all of information technology because it teaches professionals how data moves through systems and how dependencies interact to deliver a service. Whether you work in cybersecurity, software development, cloud engineering, systems administration, databases, or networking, every technology problem ultimately involves understanding a flow of information and identifying where that flow is breaking down. This session challenges the traditional view of the OSI model and demonstrates how it becomes a practical troubleshooting and design methodology. Attendees will learn how to use the layers as a framework for hypothesis elimination, root cause analysis, architecture reviews, and cross-team collaboration. Through real-world examples spanning security incidents, application outages, cloud services, authentication issues, database connectivity problems, and network failures, participants will discover why the OSI model remains one of the most valuable skills for modern IT professionals. The goal is simple: stop memorizing the OSI model and start using it to think.

Most security professionals think of an attack surface as a network, a data center, or maybe a factory. What happens when the attack surface is an entire industrial park? Over the past year, I've had the opportunity to help shape the technology strategy for a next-generation industrial campus that's bringing together AI, digital twins, smart infrastructure, advanced manufacturing, energy, industrial networking, and operational technology. It quickly became clear that this wasn't just another Industry 4.0 project—it was the convergence of physical infrastructure and cybersecurity at a scale I hadn't experienced before. This talk walks through the architectural decisions, integration challenges, and security considerations involved in building an intelligent industrial ecosystem. We'll explore how technologies like digital twins, AI, industrial networking, asset tracking, edge computing, and OT systems can be integrated into a single operational platform without creating a security nightmare. This isn't a vendor presentation or a product demo. It's an engineering case study from the trenches about connecting technologies that were never designed to work together and securing them before they become tomorrow's critical infrastructure. Whether you're interested in OT security, AI, infrastructure, networking, or simply where our industry is heading, you'll leave with a different perspective on what "cybersecurity" looks like when the attack surface is measured in acres instead of IP addresses.

Cybersecurity often treats people as the weakest link, but what if we're looking at the problem backwards? Employees rarely intend to create security incidents. They're trying to help a customer, meet a deadline, solve a technical problem, follow instructions, or simply get their job done. Yet reasonable decisions can still produce unreasonable security outcomes. This session explores how organizations can build a healthy security culture that turns human behavior from a source of risk into an additional layer of defense. We'll examine what happens when employees bypass controls to get their jobs done, hesitate to report mistakes, or place too much trust in technology—including exploring examples of people acting on AI recommendations without fully understanding the consequences. The goal isn't to create employees who never make mistakes. It's to create an environment where people feel empowered to pause, question, verify, and report—and where security is viewed not as an obstacle to the business, but as something everyone participates in.

AI agents are increasingly being given the ability to execute commands, access infrastructure, modify code, and interact with real-world systems. But instructions, system prompts, and skills are not security boundaries they influence what an agent **should** do, not what it is actually **allowed** to do. This talk explores harness engineering as a means of enforcing those boundaries through capability control, tool authorization, validation, isolation, approvals, and auditing. We’ll also examine the limitations and new attack surface introduced by harnesses themselves, and why the harness should ultimately control what an AI agent can do.

In today’s landscape, Information Security professionals are battling the "Blinking Box Problem". For a long time, our industry has been focused on buying purpose built tools to address risks within our environment. However, we are now seeing that we have tool/vendor sprawl, bloated costs, and more tools than we know how to manage. Case in point: A blinking box isn't going to solve any of our problems without appropriate governance and strategic implementation of our tools. To successfully approach tool and vendor consolidation, we need to go back to the basics. By leveraging the NIST Cybersecurity Framework (CSF) 2.0, we can realign with our core principles. We’ll do an overview of the NIST CSF Framework, discuss profiling your business, explain the CSF Cores and Tiers, and then do a deep dive into the central Govern (GV) Function and its key categories.

Technical knowledge alone does not make someone ready to defend an organization. Cybersecurity professionals must interpret incomplete information, correlate evidence from multiple systems, make decisions under pressure, and explain why their response is justified. WSU Tech’s Cyber Range provides learners with a broad collection of realistic simulations modeled on real-world threats and security incidents. Working through varied scenarios allows a learner to practice responding to different attack methods while developing the investigative reasoning and technical judgment required in the workplace. This session demonstrates that process using a simulated FIN7 intrusion as a case study. The investigation begins when law enforcement reports finding an organization’s financial information in a threat actor’s possession. Learners must determine what happened, identify the affected systems, establish the scope of the compromise, and recommend an appropriate response. Learners correlate SIEM alerts, firewall traffic, Windows events, and system artifacts to uncover a phishing-enabled compromise, lateral movement, persistence, financial-data staging, and exfiltration. Observable performance criteria evaluates ability to identify the initial compromise, reconstruct the attack, confirm data loss, and propose defensible containment and recovery actions. FIN7 represents one of the many scenarios available in the Cyber Range. Exposure to multiple incidents helps a learner develop transferable capabilities rather than memorize a single investigative process. Structured debriefing then turns missed evidence and incomplete conclusions into targeted opportunities for additional practice. Attendees will leave with a practical understanding of how they and their teams can use WSU Tech’s Cyber Range to develop, refine, and evaluate job-ready cybersecurity competencies through realistic, scenario-based practice.

This talk covers a real unauthenticated account takeover found against a mature enterprise client's .NET Blazor WebAssembly application. We will discuss how hardcoded encryption keys slip into client-side .NET assemblies and how that can compound with other common vulnerabilities into a full arbitrary account takeover from an unauthenticated threat actor. These vulnerabilities were partially discovered by a frontier model (Claude Sonnet 4.5, tested Mar 2026) with refusal behavior bypassed. However, it couldn't put the full exploitation chain together. This talk demonstrates that a much smaller local large language model (LLM) with the right scaffolding achieves full account takeover and, in some cases, appears to surpass the frontier cloud model’s capabilities. This talk also covers how to defend against this class of vulnerabilities, advantages of local LLMs, and the tooling and resources to help you do the same. Note: The finding was reported to the client, remediated, and their information has been redacted and anonymized. The target is described generically and all demonstrations run against a purpose-built replica.