LIVE demo of an OT system you can build yourself, complete with Programmable Logic Controller (PLC), Human Machine Interface (HMI) and all the hardware and wiring!
- Program a PLC
- Program an HMI
- Attack the industrial process! (Rogue Modbus and Modbus Man-in-the-middle)
- Detect the attacks with Zeek and Snort!
- Lots of blinking lights. mmmm...
If you're interested in getting hands-on experience with OT without breaking the bank, this is for YOU!
Check out the kit project GitHub for a look at what we're bringing!
https://github.com/oniskin/PLC-Trainer-Kit
Inside the Breach: Investigating FIN7 in WSU Tech’s Cyber Range
Matthew Lewis
How would you respond if law enforcement reported finding your organization’s financial information in a threat actor’s possession?
This drop-in Village invites participants to investigate a simulated FIN7 intrusion using WSU Tech’s Cyber Range. Participants can join at any time, work individually or with others, and explore one or more stages of the incident.
The investigation uses SIEM alerts, firewall traffic, Windows events, and system artifacts to reveal phishing-enabled access, network reconnaissance, command-and-control activity, lateral movement, scheduled-task persistence, financial-data staging, and exfiltration.
Participants may focus on identifying the initial compromise, tracing attacker movement, confirming data loss, or developing containment and recovery recommendations. Those who remain longer can continue through the complete incident sequence.
FIN7 represents one of the many realistic simulations available through WSU Tech’s Cyber Range. Participants will leave with practical investigative experience, a clearer understanding of their current capabilities, and specific cybersecurity skills to continue developing.
Everything Is a Flow: Using the OSI Model Beyond Networking
Mitch Roberson
For decades, the OSI model has been taught as a networking concept, often reduced to a memorization exercise for certification exams. Unfortunately, that approach misses its true value.
The OSI model is one of the most foundational frameworks in all of information technology because it teaches professionals how data moves through systems and how dependencies interact to deliver a service. Whether you work in cybersecurity, software development, cloud engineering, systems administration, databases, or networking, every technology problem ultimately involves understanding a flow of information and identifying where that flow is breaking down.
This session challenges the traditional view of the OSI model and demonstrates how it becomes a practical troubleshooting and design methodology. Attendees will learn how to use the layers as a framework for hypothesis elimination, root cause analysis, architecture reviews, and cross-team collaboration.
Through real-world examples spanning security incidents, application outages, cloud services, authentication issues, database connectivity problems, and network failures, participants will discover why the OSI model remains one of the most valuable skills for modern IT professionals.
The goal is simple: stop memorizing the OSI model and start using it to think.
Scaffolding Over Scale: Unauthenticated Account Takeover in Blazor with a Local LLM
Ryan Chaplin
This talk covers a real unauthenticated account takeover found against a mature enterprise client's .NET Blazor WebAssembly application. We will discuss how hardcoded encryption keys slip into client-side .NET assemblies and how that can compound with other common vulnerabilities into a full arbitrary account takeover from an unauthenticated threat actor.
These vulnerabilities were partially discovered by a frontier model (Claude Sonnet 4.5, tested Mar 2026) with refusal behavior bypassed. However, it couldn't put the full exploitation chain together. This talk demonstrates that a much smaller local large language model (LLM) with the right scaffolding achieves full account takeover and, in some cases, appears to surpass the frontier cloud model’s capabilities.
This talk also covers how to defend against this class of vulnerabilities, advantages of local LLMs, and the tooling and resources to help you do the same.
Note: The finding was reported to the client, remediated, and their information has been redacted and anonymized. The target is described generically and all demonstrations run against a purpose-built replica.
Parks and Re-Creation "The Attack Surface Is 17,000 Acres"
Anthony G George
Most security professionals think of an attack surface as a network, a data center, or maybe a factory. What happens when the attack surface is an entire industrial park?
Over the past year, I've had the opportunity to help shape the technology strategy for a next-generation industrial campus that's bringing together AI, digital twins, smart infrastructure, advanced manufacturing, energy, industrial networking, and operational technology. It quickly became clear that this wasn't just another Industry 4.0 project—it was the convergence of physical infrastructure and cybersecurity at a scale I hadn't experienced before.
This talk walks through the architectural decisions, integration challenges, and security considerations involved in building an intelligent industrial ecosystem. We'll explore how technologies like digital twins, AI, industrial networking, asset tracking, edge computing, and OT systems can be integrated into a single operational platform without creating a security nightmare.
This isn't a vendor presentation or a product demo. It's an engineering case study from the trenches about connecting technologies that were never designed to work together and securing them before they become tomorrow's critical infrastructure.
Whether you're interested in OT security, AI, infrastructure, networking, or simply where our industry is heading, you'll leave with a different perspective on what "cybersecurity" looks like when the attack surface is measured in acres instead of IP addresses.
Don't Trust the Agent: Enforcing Security Boundaries in AI Systems
Travis Lowe
AI agents are increasingly being given the ability to execute commands, access infrastructure, modify code, and interact with real-world systems. But instructions, system prompts, and skills are not security boundaries they influence what an agent **should** do, not what it is actually **allowed** to do. This talk explores harness engineering as a means of enforcing those boundaries through capability control, tool authorization, validation, isolation, approvals, and auditing. We’ll also examine the limitations and new attack surface introduced by harnesses themselves, and why the harness should ultimately control what an AI agent can do.
