Conference Schedule

A dynamic leader and passionate coach, Stacy is known for his creativity, authenticity, and people first leadership style. He thrives on unlocking potential - both within teams and individuals - and is deeply energized by helping others succeed. A natural storyteller, Stacy believes great stories don’t just inform; they inspire, motivate, and create lasting momentum. Join us as Stacy Betts takes the stage to share insights, stories, and practical strategies that will inspire and empower our community.

Secret! Do you have what it takes to elicit information during a high stakes, pressure sensitive interview? Could you do it in 10 minutes? Could you do it with fake information you memorized for 3 minutes? Come join us and find out!

If your job depends on being found online, realtor, doctor, lawyer, financial advisor, you can't just disappear from the internet. But being findable doesn't mean your home address, phone number, and family details need to be one search away. This talk covers data privacy for people who need a public presence, from securing the DNS and hosting details behind your website to removing your personal information from third-party data brokers.

Rubber Ducky's are pretty well known so you might hope a user won't just plug in a random parking lot flash drive, but do you think they might plug in a random keyboard that looks exactly like the keyboard they already have? Especially if they are told it is a magical keyboard that will make their computer much faster? This talk is all about designing and building a malicious keyboard and then what you can do with it and how you might go about defending from something like this.

Type: Discussion Panel Moderator: Chrissie Collins Panel: Cory Brasel, Shawn Evans, Nikita Belikov As organizations rapidly adopt artificial intelligence, governance has become critical to protecting not only their own information, but also the data entrusted to them by customers and partners. The challenge is balancing the productivity and innovation that AI provides with emerging risks involving data leakage, privacy, security, regulatory requirements, and responsible use. This panel will bring together cybersecurity professionals for a practical discussion of the real-world challenges organizations are encountering as they develop and implement AI governance programs. Panelists will share examples, lessons learned, and approaches for establishing policies, managing risk, educating employees, and maintaining appropriate oversight without unnecessarily restricting innovation. Attendees will leave with practical considerations and recommendations they can apply when evaluating or strengthening AI governance within their own organizations.

Most security professionals think of an attack surface as a network, a data center, or maybe a factory. What happens when the attack surface is an entire industrial park? Over the past year, I've had the opportunity to help shape the technology strategy for a next-generation industrial campus that's bringing together AI, digital twins, smart infrastructure, advanced manufacturing, energy, industrial networking, and operational technology. It quickly became clear that this wasn't just another Industry 4.0 project—it was the convergence of physical infrastructure and cybersecurity at a scale I hadn't experienced before. This talk walks through the architectural decisions, integration challenges, and security considerations involved in building an intelligent industrial ecosystem. We'll explore how technologies like digital twins, AI, industrial networking, asset tracking, edge computing, and OT systems can be integrated into a single operational platform without creating a security nightmare. This isn't a vendor presentation or a product demo. It's an engineering case study from the trenches about connecting technologies that were never designed to work together and securing them before they become tomorrow's critical infrastructure. Whether you're interested in OT security, AI, infrastructure, networking, or simply where our industry is heading, you'll leave with a different perspective on what "cybersecurity" looks like when the attack surface is measured in acres instead of IP addresses.

For decades, the OSI model has been taught as a networking concept, often reduced to a memorization exercise for certification exams. Unfortunately, that approach misses its true value. The OSI Model is one of the foundations of modern computing. Not because it explains networking but because it teaches us how to think. It demonstrates that flow of data as it moves from one computer to another. This flow is key to Trouble shooting. Weather you work in CyberSecurity, Cloud, Infrastructure, Software Development, databases, Identity or networking, every outage, slow down breach and user complaint comes down to how information is flowing and where it is breaking. This session will look at the OSI model through a different lens. Instead of treating it as something to memorize for a test. We'll use it as a practical methodology for trouble shooting. And help the attendee understand the flow of data is key to trouble shooting. Using real-world examples from security incidents, authentication failures, application outages, cloud services, database connectivity problems, and network disruptions, we'll explore how a framework created decades ago remains one of the most effective troubleshooting tools available today. The goal is simple: stop memorizing the OSI model and start using it to think.

For organizations looking to embrace Artificial Intelligence while maintaining strong governance and risk controls, this presentation provides a practical roadmap for developing an AI Risk Management Program aligned to the NIST AI Risk Management Framework (AI RMF). Attendees will learn how to establish an enterprise-wide approach to identifying, assessing, mitigating, and monitoring AI-related risks while enabling innovation and business value. The session outlines the key components of an effective AI governance structure, including risk management processes, roles and responsibilities, policy development, regulatory and compliance considerations, security controls, data governance requirements, and ongoing monitoring practices.

With a massive attack surface that generates billions in dollars of revenue for manufacturers, often times the data collected by these devices is more valuable then the physical product itself. A look into what data is observable through targeted network traffic analysis and the protocols and endpoints they communicate through. After seeing the recent investigation made by independent journalists and security researchers, revealing numerous security and spying concerns from LG TVs, it prompted my own further research into additional devices manufactured by Roku and Samsung. This talk will go over the 3 step process used to collect and analyze network traffic that exposed excessive data leakage, including tokens, and eventually finding an exploitable CVE that allowed for unauthenticated control of the TV. Learn how to check your own Smart TV’s for potential privacy and security concerns and also more importantly what you can do to try and protect some of your digital privacy from the onslaught of advertisers and attackers.

Cybersecurity often treats people as the weakest link, but what if we're looking at the problem backwards? Employees rarely intend to create security incidents. They're trying to help a customer, meet a deadline, solve a technical problem, follow instructions, or simply get their job done. Yet reasonable decisions can still produce unreasonable security outcomes. This session explores how organizations can build a healthy security culture that turns human behavior from a source of risk into an additional layer of defense. We'll examine what happens when employees bypass controls to get their jobs done, hesitate to report mistakes, or place too much trust in technology—including exploring examples of people acting on AI recommendations without fully understanding the consequences. The goal isn't to create employees who never make mistakes. It's to create an environment where people feel empowered to pause, question, verify, and report—and where security is viewed not as an obstacle to the business, but as something everyone participates in.

As one of the hot topics currently in the news both nationally and locally, this discussion aims to educate attendees on the basics of Flock or ALPRs in general, ways in which some of this tech can be used, legal cases in the past and currently ongoing that are challenging these technologies, and then how to engage your community on this matter, regardless of which side of the argument you may land on, at a Local, State, and Federal Level

AI agents are increasingly being given the ability to execute commands, access infrastructure, modify code, and interact with real-world systems. But instructions, system prompts, and skills are not security boundaries they influence what an agent **should** do, not what it is actually **allowed** to do. This talk explores harness engineering as a means of enforcing those boundaries through capability control, tool authorization, validation, isolation, approvals, and auditing. We’ll also examine the limitations and new attack surface introduced by harnesses themselves, and why the harness should ultimately control what an AI agent can do.

A Cybersecurity Solutions Architect and CISSP with nearly 30 years in IT shares the unfiltered version of a career in security: which education paths actually pay off, how to survive being thrown in over your head, why rejection is a signal worth listening to, and how experience gets built before it gets credentialed. The session ends with a candid look at AI's role in the field today, where it helps, where it doesn't, and how to use it without letting it think for you. Built for students and early-career professionals who want the real story, not the recruiting pitch.

Technology environments don't sit still. Applications are upgraded. Configurations change. Access is modified. Infrastructure is replaced. Integrations are added. And when something breaks, an emergency change can go from idea to production pretty darned fast. Meanwhile, organizations continue to invest in increasingly sophisticated security technology to detect, prevent, and respond to threats. But here's the problem: technology doesn't manage change. Effective Change Management does. A strong change process makes risk assessment part of the conversation before the change happens. It establishes an approval chain that makes it clear who reviewed the change and accepted the risk. And it creates an audit trail that can answer the questions everyone starts asking when something goes wrong: What changed? Why? Who approved it? When did it happen? And what happened next? This session takes a practical look at Change Management as part of an organization's cybersecurity posture. We'll explore how effective risk assessment, appropriate authorization, and an auditable record of change can give security teams something their tools can't provide on their own: context. Because having a great security stack doesn't mean much if you don't have a handle on the changes happening in the environment it's protecting.

In this presentation, we'll go over scenarios in which reclusive staff could've helped out if we had been more friendly and open with them. Additionally, we'll talk about IT management and how to build an inviting culture, so that problems find you!

Cybercriminals don’t always need to defeat the best security—they just need to find an easier target. Don’t Be the Low Hanging Fruit challenges IT leaders to take a hard look at the assumptions behind their security strategy. We’ll examine how attackers are getting around MFA, exploiting legitimate credentials, targeting privileged access and vendors, attacking backups, and using AI to make social engineering more convincing than ever. Using real-world breaches and lessons from nearly 30 years of working with computers and the Internet, we’ll ask the questions that matter: If an attacker already had a valid credential, what would stop them? Would you know they were there? And is your organization harder to attack than the one next door?

In today’s landscape, Information Security professionals are battling the "Blinking Box Problem". For a long time, our industry has been focused on buying purpose built tools to address risks within our environment. However, we are now seeing that we have tool/vendor sprawl, bloated costs, and more tools than we know how to manage. Case in point: A blinking box isn't going to solve any of our problems without appropriate governance and strategic implementation of our tools. To successfully approach tool and vendor consolidation, we need to go back to the basics. By leveraging the NIST Cybersecurity Framework (CSF) 2.0, we can realign with our core principles. We’ll do an overview of the NIST CSF Framework, discuss profiling your business, explain the CSF Cores and Tiers, and then do a deep dive into the central Govern (GV) Function and its key categories.

A joint talk on the process of bringing the Conagotchi badge to life, from concept to completion.

Most vulnerability programs do exactly what they were built to do. They scan everything, ticket the 9.8s and report a shrinking critical count to the board. Attackers still walk in through the CVSS 6.2 on the public VPN. This talk explains why severity scores were never meant to measure risk, and how free signals like CISA KEV and EPSS can cut the list down to what attackers actually use. It also covers how reachability, compensating controls and asset value decide what really matters in your environment, and what CISA's new BOD 26-04 means now that CVSS is out of the federal decision model. Attendees leave with a practical way to move from "fix 150,000" to "fix the 40 that will breach you," plus one question to ask their team on Monday. Takeaways: - Why CVSS measures severity, not risk - How to use KEV and EPSS together to prioritize - How compensating controls change exposure, and what BOD 26-04 means for that - A simple maturity path from scanning to exposure management

Technical knowledge alone does not make someone ready to defend an organization. Cybersecurity professionals must interpret incomplete information, correlate evidence from multiple systems, make decisions under pressure, and explain why their response is justified. WSU Tech’s Cyber Range provides learners with a broad collection of realistic simulations modeled on real-world threats and security incidents. Working through varied scenarios allows a learner to practice responding to different attack methods while developing the investigative reasoning and technical judgment required in the workplace. This session demonstrates that process using a simulated FIN7 intrusion as a case study. The investigation begins when law enforcement reports finding an organization’s financial information in a threat actor’s possession. Learners must determine what happened, identify the affected systems, establish the scope of the compromise, and recommend an appropriate response. Learners correlate SIEM alerts, firewall traffic, Windows events, and system artifacts to uncover a phishing-enabled compromise, lateral movement, persistence, financial-data staging, and exfiltration. Observable performance criteria evaluates ability to identify the initial compromise, reconstruct the attack, confirm data loss, and propose defensible containment and recovery actions. FIN7 represents one of the many scenarios available in the Cyber Range. Exposure to multiple incidents helps a learner develop transferable capabilities rather than memorize a single investigative process. Structured debriefing then turns missed evidence and incomplete conclusions into targeted opportunities for additional practice. Attendees will leave with a practical understanding of how they and their teams can use WSU Tech’s Cyber Range to develop, refine, and evaluate job-ready cybersecurity competencies through realistic, scenario-based practice.

OT (Operational Technology) security is frequently handed to an IT security team with little to no training in how or why it's different. Come learn: - What is OT? - Why can't I just use IT security tools? - What is the right way to secure them?

Internal vulnerability, external vulnerability, XDR (endpoint vulnerability) and SIEM alerts. Which is best or do I need all of them? This presentation will identify issues experienced by an experienced cybersecurity consultant providing security monitoring for his customers. Monitoring is not difficult to implement; interpreting the data, assessing risk and remediation is the difficult part. Participants in the session will discover the pain points experienced by the consultant, how the pain points were overcome and the results of the effort

This presentation explores the parallel between one of the most important shifts in the history of art and the shift of cyber security due to Artificial Intelligence (AI). Prior to the invention of photography, the value artists produced was largely dependent on the ability to create realistic references of people, places, and events; being relied on to preserve memories and details. The creation of cameras displaced the artist's landscape, making preserved instances faster, cheaper, and more accessible. This displaced the value photo-realistic artists initially provided and drove artistic value to focus on creativity, originality, and interpretation. This change gave rise to entirely new branches of art such as Impressionism, Surrealism, Dadaism, and Pop Art; each depended less on accuracy and more unique perspectives for success. In current presence, AI is generating a similar moment for tech workers by automating many tasks that once primarily relied on a worker's technical skill. As programming becomes increasingly accessible through the use of generative technologies, the value in IT professionals may no longer rely on the ability to code effectively or have a depth of technical knowledge, but those who can get creative, frame problems in a new perspective, and orchestrate technology in a novel manner. Just as artists were not eliminated by photography but fundamentally changed what society valued in art, AI is unlikely to eliminate roles in cybersecurity. AI will redefine what makes the roles exceptional, showcasing the shaping of the future belongs to not only those who can execute, but to those who can create and innovate differently.

This talk covers a real unauthenticated account takeover found against a mature enterprise client's .NET Blazor WebAssembly application. We will discuss how hardcoded encryption keys slip into client-side .NET assemblies and how that can compound with other common vulnerabilities into a full arbitrary account takeover from an unauthenticated threat actor. These vulnerabilities were partially discovered by a frontier model (Claude Sonnet 4.5, tested Mar 2026) with refusal behavior bypassed. However, it couldn't put the full exploitation chain together. This talk demonstrates that a much smaller local large language model (LLM) with the right scaffolding achieves full account takeover and, in some cases, appears to surpass the frontier cloud model’s capabilities. This talk also covers how to defend against this class of vulnerabilities, advantages of local LLMs, and the tooling and resources to help you do the same. Note: The finding was reported to the client, remediated, and their information has been redacted and anonymized. The target is described generically and all demonstrations run against a purpose-built replica.

In this talk about AI, I’m going to discuss my journey from the beginnings of using it once I found it useful to where I am today, and the key things that I discovered along the way. I’ll cover the following: - Getting started: understanding the "dials and knobs" that affect the expected output. - Running it locally first: to learn how AI technology works and will bite you. - Shadow AI: AI is everywhere and knowing where it is, is important. - Prompting that makes you think: simple techniques to improve your prompting for better output. - Agents and harnesses: getting more complex work done with more advanced configuration. - Experience as the multiplier: why AI should be pushed upstream. - When not to use AI: AI is not a hammer and not everything is a nail. Audience members will take away not to be afraid of AI, and that taking the time to learn the dials and knobs, will make anyone with interest and curiosity a better user of the technology.

Firmware extraction is a critical first step in hardware security assessments, and eMMC storage is one of the most commonly encountered targets across "higher-end" embedded AI and IoT devices. This talk covers two practical approaches to extracting firmware from eMMC chips: in-circuit lead tapping and full chip-off removal. We walk through identifying eMMC pinouts, soldering to exposed test points, and interfacing with affordable readers for in-circuit extraction, then cover hot air desoldering, BGA reballing, and reading bare chips via socket adapters for chip-off. For each method, we discuss tooling, trade-offs, failure modes, and when to choose one approach over the other based on board layout, risk tolerance, and common obstacles like epoxy potting and locked partitions.

Most small businesses don't have an IT department, they have one overworked person wearing five hats, or nobody at all. This talk is a practical playbook for small business owners and the accidental IT people tasked with keeping things running: documentation, backups and disaster recovery, automation, compliance basics, and, just as important, knowing when it's time to call in outside help.

Soft skills are starting to be recognized as being as valuable as the technical skills - but where is the training for those! While employers are offering more to support the development of soft skills, they can still be difficult to master - let alone understand. Join us as we take a dive into how to recognize your soft skills and how to obtain the ones that you enjoy from others.