DEF CON 33 - How Nation-State Hackers Turn Human Error into Catastrophic Failures - N Case, J McCoy
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 36:02
This presentation details four critical infrastructure security incidents, emphasizing preventative security ("left of boom") over reactive responses 0:50-1:16.
Key Takeaways:
• Apartment Wi-Fi Risks: Shared networks in complexes enable malware to spread between tenants and later infect corporate devices 2:09-2:23.
• Bastion Host Compromise: Attackers often patch and maintain "most stable" bastion hosts to maintain persistence and avoid detection 7:31-8:04.
• Third-Party CI/CD Risks: Compromised service providers allow attackers to move laterally between clients and remain undetected for years 14:06-14:46.
• Air-Gap Failures: Systems assumed to be isolated are often breached via employee personal hotspots or unauthorized connections 22:22-22:36.
Conclusion: Presenters argue for "left of boom" (prevention) strategies, noting that modern attacks prioritize stealthy intelligence gathering rather than destructive "booms" 26:48-27:27.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hi, I'm Nathan Casease. Uh, we are here to talk about scary stuff. This is >> Oh, the This is not the end of the world, but you can see it from here. I'm John McCoy. I don't think your mic's working. >> Okay, I'm There we go. It's not the end of the world, but you can see it from here. And I'm John McCoy. So today what we're going to do is talk about at least three events depending on how fast we go and the fact that we just had technical difficulties. We might just do three. We've actually got four in the pipe, but we'll see what happens. Um the goal here is to basically give you three real world events. These events occurred on critical infrastructure. Does anybody know what we mean when we say critical infrastructure? Oh, good. That makes me happy. How many people don't know what critic…