Seven specialised hands-on training sessions

This training provides participants with an in-depth introduction to operational technology (OT) through a series of offensive security exercises. They will gain hands-on experience with SCADA and PLC systems, exploring the industrial protocols and interfaces commonly used in these environments. Focusing on equipment used in the power industry, students will have the opportunity to work directly with real-life OT equipment involving mains voltage. Through hands-on exercises, they will observe scenarios such as AC voltage manipulation and the bypassing of electrical safety mechanisms, gaining insight into cyber-physical vulnerabilities. After this training, participants will have a deeper understanding of applied OT security, the impacts of cyber-physical attacks on critical infrastructure, and the importance of securing these systems. Such essential knowledge is also transferable to other domains of critical infrastructure and industrial processes.

Trainers

Kenneth Tong

Security Researchers

Manzel Seet

Security Researcher

"Know thy self, know thy enemy. A thousand battles, a thousand victories." — Sun Tzu "Prevention is better than cure." In essence, these two quotes summarise threat modelling. It allows us to understand how threat actors can attack our systems, and how we can pre-empt them whilst a system is still in the design phase. We begin with an introduction to threat modelling principles and well-known methodologies such as STRIDE-LM and the MITRE ATT&CK Framework. There are hands-on sessions using a threat modelling tool like the OWASP Threat Dragon, and multiple group exercises across both on-premise and cloud environments. For differentiated learning, the course runs in a two-track fashion: a base set of exercises covered in class, plus "Extra Mile" exercises for faster students to stretch themselves outside class time. Given sufficient time, modern topics such as threat modelling in AI systems and large language models (LLMs) will be discussed — including frameworks such as MITRE ATLAS, MAESTRO and AI DEFEND, as well as exploratory topics in this emerging domain.

Trainer

Donavan Cheah

Senior Cybersecurity Consultant, Thales

Ever wondered what's really going on behind the apps on your phone? They're a lot more breakable than you'd think. In this hands-on workshop, we'll dig into how mobile apps get pentested in the real world — starting with RASP, the runtime defences apps use to spot rooting, debugging and tampering, and how attackers get around them. Then we'll head past the phone to the APIs running the show behind the scenes, where you'll learn to intercept API traffic, sniff out weak spots in authentication and access control, and see why the backend is so often where things fall apart. No pentesting experience needed — just bring some curiosity and a willingness to break things (responsibly, of course).

Trainers

Mikayl Jalal

Security Consultant, Vantage Point Security

Ibrahim Sharul

Security Consultant, Vantage Point Security

This hands-on workshop is designed for security practitioners who want to move beyond theory and develop practical fluency in applying AI to both offensive and defensive operations.

Trainer

Joshua Tengeo

Founder, Terraxinyun

Why let AI have all the fun? The binary exploitation workshop aims to provide a (somewhat) progressive ramp, going through early exploitation techniques (with no exploit mitigations) to modern techniques that try to bypass modern mitigations. We'll start with the old-school buffer overflow with no stack protections, then start adding exploit mitigations one by one — tweaking our exploitation techniques as we go along, and introducing more vulnerability types (mostly involving the heap).

Trainer

KK Tan

Founder, counterShell Pte Ltd

LinkedIn ↗

YARA is a tool created for doing quick, (mostly) static signature-based detections. It is useful for scanning directories and hunting from samples when you have telemetry that can be used for quick tagging and quick wins. When doing threat hunting, or if there is a tip-off, we can make use of rules written by threat analysts and malware reverse engineers — or rules from open-source and paid data feeds — to look for potential infections quickly. The workshop is approachable even for less-technical participants who do not have much knowledge of assembly, and is not limited to just binaries.

Trainer

Lucas Tay

Security Researcher, Kaspersky

Find out how to get cyber threat intelligence (CTI) the legal way — and then find out how the professionals do it.

Trainer

Davis Zheng

Principal Researcher, Kinryū Labs