RECAP: AISA CyberCon 2025
AISA CyberCon 2025 - Melbourne
Introduction
It’s that time of year once again. The 2025 edition of AISA CyberCon has just wrapped up after an action-packed three days filled with loads of informative and insightful talks covering everything from AI-driven hacking, automotive espionage, and wargames with Kali Linux to threat intelligence and, of course, one of my favourite topics — threat modelling!
Between all of the talks and think tank sessions, there was plenty of fun and games taking place throughout the massive vendor hall, which is always an exciting highlight, seeing what the latest trends are in the product/solution space and discovering which vendors have the best merch (Trend Micro got me with the McLaren F1 LEGO set!!).
Towards the end of day two, I had captured a decent amount of information in my notes app. With that, I figured it would be worth publishing an article highlighting some of the interesting insights and key takeaways from Australia’s premier cybersecurity conference.
AISA 2025: Insights, Notes, and Key Takeaways (INKT)
Opening Keynote from Brian Krebs (DAY TWO)
Open letter to third-party suppliers - JP Morgan Chase
Infostealers and authenticated token abuse
All the time and effort we’ve spent making the user authentication experience seamless and less onerous has created an attractive target for attackers. They want your (authenticated) access tokens! Much easier than brute-forcing passwords and sim-swapping to bypass MFA…Just give me your token that gives me everything!
Focus on adopting phishing-resistant multi-factor authentication (MFA) such as hardware security keys (e.g., FIDO2, WebAuthn) and device-bound biometrics to minimise credential and token theft risk across your organisation and any sensitive personal accounts.
Implement strict conditional access policies and Continuous Access Evaluation (CAE) to enforce access only from compliant, trusted devices and locations, and to revoke sessions when risk signals change.
Use short-lived tokens, automatic rotation, and enable immediate revocation for suspicious activity; bind tokens to specific devices where possible.
Store tokens and sensitive data only in secure platform enclaves (e.g., Windows Credential Manager, Apple Keychain); never in plain text, cookies, or local storage.
Employ behavioural monitoring, anomaly detection, and automated incident response to quickly spot and contain token abuse or infostealer activity.
Regularly educate users on phishing, social engineering, and infostealer tactics, with up-to-date real-world scenario training.
Deploy advanced Endpoint Detection and Response (EDR) to quickly identify, block, and remediate infostealer malware across all devices.
Conduct frequent audits of token use, permissions, admin consents, and privileged access; minimise token scopes and restrict app consent workflows to administrators.
Monitor the dark web and infostealer marketplaces for signs of compromised credentials and tokens relevant to your organisation
Inherent risks with SSO and the need to rethink ease of access for the sake of security.
SSO makes it easy for users to log in and access multiple systems with a single authenticated token, but this has become a goldmine, or more like a “digital skeleton key” for adversaries to target.
MCP vulnerabilities that every developer should know - Composio article
Always verify MCP code and tool sources; never trust automatically updated dependencies.
Pin tool versions and prefer signed/container images.
Check schemas for sneaky or unexpected parameters.
Never run MCP tools with excessive permissions. Strictly limit what your AI agent can access.
Demand proper OAuth implementation and session management.
Treat every new MCP integration as a security assessment opportunity.
Assume supply chain attacks are a matter of when, not if. Prepare accordingly.
How I would Choose and Hack a victim in the age of AI - Max Heinemeyer
Who typically gets DDoS’d? - AI Platforms?
Orgs sensitive to availability
Heavy reliance on AI is a ticking time bomb 💣—watch out for overreliance on AI tools and for integrating AI into critical business functions, as this can create a new single point of failure (SPOF).
Offensive security measures performed by large service providers - ISPs, vendors, etc.
Trust Attacks.
Changing your data - lasting damage.
Maximum damage / ROI.
Agent Teams - Significant increases in efficiency.
Align attack planning and methodology to kill chain - MITRE ATT&CK and Lockheed Martin.
Cyberbattlesim - Microsoft virtual network attack simulation platform.
Dynamite 🧨 phishing techniques - believable reply-all based attacks, weaponised to include malware/infostealers.
Wargames: Purple teaming with Kali Purple - Carsten Boeving
Preventive controls never really prevent a breach; they DELAY the breach.
Knowledge on its own doesn’t create skill. Beware of purely theoretical understanding - you need practical experience to really add value to your learning, and that creates the skill(s) you need to succeed, not just in cyber security, but in everything.
Knowledge + Experience is vital.
What does a cyber attack LOOK like? 👀
Before you look into something, say, when threat hunting, for example, know precisely what you’re going to do with the results. This will ensure that any findings from your analysis actually reach the right people and can be implemented without getting lost in a sea of indecision.
Practice as much as possible! How can you (actually) defend an attack if you have never SEEN and worked on an attack? [auto red-teaming in Kali Purple]
Threat modelling is great (but nobody does it) - Jamie McPherson & Harry Smith
Why TM typically fails:
Lack of time, stretched resources
Lack of buy-in from senior leaders
System/process complexity
Watch out for cyber threats that result in PHYSICAL disruption/harm. [When performing threat modelling on ICS/OT systems]
Avoid common pitfalls: overthinking, perfectionism, and rigidity of approach.
Start here: Threat Modelling Manifesto
Then go here: Threat Modelling with ATT&CK
Hypothesis-driven threat modelling.
Create threat events that model the most exposed/risky threat scenarios. Focus on vulnerable attack surfaces and security architecture weaknesses.
Conclusion
That’s all for now. So where to from here? Well, as the saying goes, knowledge is power, but without action it’s useless. Hopefully you found something useful in this piece that inspires you to dive further into and get your hands dirty, I know I certainly did.
For me, I think the biggest takeaway from the avalanche of information over those three days was about getting as close to an attack as possible — in a safe and simulated way of course, not by downloading Tor and going rogue!
It’s kind of surprising that most defenders can go years, if not decades without actually being involved in a real-world cyber attack/incident, and don’t get me wrong, this is a good thing! But I think finding a way (or ways) to get some hands-on exposure to simulated cyber attacks that mimic real-life adversary behaviour is not only a unique learning experience, but an incredibly valuable skill to have as a security professional.
Until next time!
