Julien B. Grenier

Why Governments and Sensitive Industries Must Build Their Own Security Data Lakes

In an era of escalating cyber threats and geopolitical complexities, the strategic imperative for governments and sensitive industries to establish independent cybersecurity capabilities has never been more critical. This talk challenges the conventional reliance on third-party vendors for core security monitoring, arguing that true cyber sovereignty and enhanced assurance stem from owning and controlling one's security data.

We will explore how building an in-house security data lake enables organizations to "watch the watchers," ensuring that security controls like EDRs are not bypassed or abused, potentially by foreign entities. With the advent of AI, the capacity for internal teams to construct sophisticated, custom-made cybersecurity stacks is more accessible than ever, leading to significant long-term cost reductions, undeniable data ownership, and freedom from vendor lock-in.

Drawing on over a decade of experience building security platforms from the ground up, from a startup acquired by a consulting giant, to a modern iteration at another consulting firm, this session will dissect the strategic benefits, common pitfalls, and best practices for cultivating a nimble, highly capable internal security engineering team. I will also present a practical mindmap outlining the technological, human resource, and cost considerations for such an undertaking.

A Systematic Purple Team Evaluation of Modern Defense Controls

This presentation reveals critical vulnerabilities discovered during a comprehensive evaluation of three major categories of enterprise security controls: Application Control, Endpoint Detection and Response (EDR), and Next-Generation Firewalls with Zero Trust Edge Agents. Through systematic offensive testing followed by defensive analysis, this research demonstrates how attackers can systematically bypass leading security solutions and provides actionable guidance for security teams to detect, prevent, and respond to these techniques.

Application Control Bypass: Attendees will learn how to analyze enforcement mechanisms in application control software to identify systematic bypasses that enable command and control (C2) establishment. We'll demonstrate techniques to tamper with self-protection mechanisms and achieve complete security software removal.

EDR Evasion: Discover how forgotten techniques can be modernized to achieve C2 execution while evading current detection capabilities. Learn specific threat hunting methodologies to identify these techniques in your environment.

NGFW & Zero Trust Edge Evasion: See how two different C2 frameworks can be configured to communicate seamlessly through enterprise network security controls, and understand the detection opportunities defenders are missing.