Compass Security
Compass Security is a well renowned company specializing in penetration testing, incident response, digital forensics, and security trainings with offices in Switzerland, Germany, and Canada. Compass Security’s research and community contributions regularly gain public recognition.
Gain Insight: Through penetration testing, social engineering, and technical analysis, we assess systems, applications, and infrastructure. Skilled analysts identify and report not only vulnerabilities but also provide reproducible documentation and propose suitable countermeasures.
Permanent Testing: Let the crowd continuously watch your assets. We help define bug bounty scopes, triage relevant items, track the vulnerability reports, and handle pay-outs.
Practise Emergency: Red Teaming exercises are holistic attack simulations that help benchmark your blue team’s ability to detect, protect and react when facing a real attack.
Relevant Detections Only: We rely on best of breed detection tools to defend your workstations, critical servers, and cloud system. We managed detection and response (MDR) for you. Alerts are on us; we involve you when really necessary.
Backed 24/7/365: Digital forensic and incident response (DFIR) expertise when you need it. Anytime.
Lifelong Learning: The Hacking-Lab Cyber Range is the platform of choice for ethical hacking and security challenges. A perfect fit for competitions (CTFs), hands-on education, and employee training as well as skills assessments. Available both as a service or privately deployed on-site.
Transfer Securely: A secure file transfer solution for bidirectionally exchanging even very large files. Enables 2FA even for non-registered users. Available both as a service or as on-premises appliance installation.
Sessions from previous events
Swiss Cyber Storm 2023
Navigating the Perils: The Precarious Depths of Device Code Phishing in Azure AD
14:35–15:05 · Panorama – Sponsoring
Show description
Multi-factor authentication, even based on WebAuthn, won’t protect you from device code phishing attacks. As such, they pose a significant risk within the Microsoft 365 (M365) ecosystem. This sophisticated form of cyber-attack involves malicious actors attempting to trick users into revealing their access tokens for M365 services such as Office 365, Teams, or SharePoint Online.
Successful adversaries can hijack Azure AD user accounts, compromising emails, documents, and potentially sensitive corporate data. The consequences can be severe, including unauthorised data access, data breaches, identity theft, financial loss, reputational damage, and even regulatory non-compliance.
Swiss Cyber Storm 2022
Human n’ Machine - Leveraging Automated Tool To Enhance Manual Analysis
11:55–12:25 · Panorama – Sponsoring
Show description
In the cybersecurity space we see more and more automation tools that promise to identify and prevent malicious threats. They do a great job at automatising repetitive and boring tasks, but most of the time they fail to give a complete picture of the threat, and some criminals leverage this for their gain. In this talk we will have a look at how we can combine automated analysis tool and manual analysis to have more insight on the actual threat. It will include some techniques used by criminals to bypass automated defence mechanisms and the steps analysts can follow to fully eradicate the threat. Automated analysis tools are not a silver bullet, just one more weapon in the defence arsenal of your company that needs to be yielded by trained soldiers.
Swiss Cyber Storm 2021
Suppliers! Resist Phishing, Implement FIDO2
11:20–11:50 · Scenario 1 (Sponsors)
Swiss Cyber Storm 2019
Malware Attacks on Smartphones
14:45–15:10 · Sponsoring Track
Swiss Cyber Storm 2018
Hidden Inbox Rules in Microsoft Exchange... Or How to Permanently Steal Your Messages
11:50–12:20 · Sponsoring Track