Program Overview

For years, ASUS relied on other CVE Numbering Authorities to assign IDs for vulnerabilities in our own products — workable, but slow, and largely out of our hands. In September 2024, ASUS became a CNA in our own right. Two years in, we're still learning what that responsibility actually costs. Almost immediately, our new CVD pipeline met a force we hadn't fully planned for: external researchers increasingly using AI tools to hunt for vulnerabilities at a pace and volume no manual intake process was built for. The result isn't more findings from us — it's a heavier, noisier stream of inbound reports from the outside: more near-duplicates, more AI-generated write-ups of varying quality, arriving faster than our engineering teams can validate them. At the same time, downstream consumers and suppliers of our advisories increasingly expect CSAF/VEX machine-readable output, adding a second layer of pressure on a process we'd only just stood up.

This talk walks through what broke in our intake and triage workflow as a brand-new CNA, what we changed in response, and — more importantly — a handful of questions we still don't have good answers for: Should AI-assisted reports be triaged differently from human ones, and who decides that? Does "coordinated" disclosure still mean the same thing when external reporters can scale their output faster than any vendor's engineering team can respond? And if vendors eventually lean on AI themselves to keep CSAF statements current, who is actually coordinating with whom? We don't claim to have solved these — we're bringing them to this room because every vendor CNA and national CERT in the region will run into them soon, if they haven't already.

TJ Hsu is a Cyber Security Senior Manager at ASUS, where he leads the company's CSIRT and PSIRT operations and serves as ASUS's official representative to FIRST and as a CVE Numbering Authority (CNA). His work centers on turning vulnerability data and threat intelligence into risk-based mitigation strategies and executive guidance across ASUS's global business.

Before joining ASUS, TJ spent several years as a security consultant with two of the Big Four (EY and Deloitte), delivering defense-in-depth security architecture, large-scale infrastructure audits, and technical security assessments for clients across the financial, government, technology, chemical, and aviation sectors. He also built and operated a cybersecurity testing laboratory from the ground up to full ISO/IEC 17025 accreditation.

TJ holds CISSP, CISM, CEH Master, CTIA, CPSA, and ISO 27001 LA certifications. Outside of work, he's an avid traveler and landscape photographer, always chasing a good meal or a clear night sky for a shot of the Milky Way.

Rex Kao is a Detection & Response Analyst at ASUS, operating within the company's CSIRT and PSIRT workflows. He specializes in threat intelligence analysis, incident response, and vulnerability management, driving proactive risk mitigation across enterprise and product ecosystems. With a decade of experience spanning enterprise defense architecture, Big Four consulting (Deloitte), and hands-on network engineering, Rex brings deep expertise in Zero Trust transformation, multi-cloud security, and ISMS/AI governance. He holds several premier industry certifications, including CISSP, CEH Master, GCP Professional Cloud Security Engineer, AWS Certified AI Practitioner, and ISO 27001/27701/42001 Lead Auditor credentials.

Cyber Threat Intelligence (CTI) has become a cornerstone of modern cybersecurity programs, transforming raw technical data into actionable insights that enable proactive and intelligence-driven defense. As threat actors grow more sophisticated - leveraging automation, supply-chain compromise, and hybrid attack vectors-organizations must evolve from reactive incident response toward strategic, intelligence-led security practices. CTI fills this gap by systematically collecting, analyzing, and contextualizing information about adversaries, their motivations, tactics, and infrastructures.

This presentation addresses the foundational question, “What is CTI?” by offering a structured definition that spans strategic, operational, and tactical levels. It aims to dispel the confusion often introduced by marketing-driven narratives in this rapidly commercializing discipline. The content is grounded in my doctoral research at the Purdue Military Research Institute (PMRI) and enriched by the insight and feedback of FIRST CTI SIG members who have supported this work throughout its development.

Beyond synthesizing academic and doctrinal perspectives, the session highlights the practical applications of CTI and its role in enhancing situational awareness, supporting risk-based decision-making, and strengthening detection and response across security operations centers, vulnerability management, incident response, and executive leadership. It also examines common organizational use cases and maturity levels observed across CTI teams.

Attendees will leave with a clear, comprehensive understanding of CTI’s purpose, value, and future direction within an increasingly complex and dynamic threat landscape.

Dr. Krassimir Tzvetanov has served as a Graduate Researcher at Purdue University for the past six years, focusing on Homeland Security, Cyber Threat Intelligence (CTI), and Influence Operations. Concurrently, he has served as Instructor of Record for graduate-level courses in Cybersecurity and Homeland Security.

For the past three years, Dr. Tzvetanov has also served as Director of Security Engineering at Hydrolix. Prior to this role, he held positions including CTI Lead, Principal Security Engineer and Architect, and Red Team Operator at major technology companies such as Cisco, Yahoo!, and Google. Throughout his career, he has authored training materials, white papers, and academic publications covering distributed denial-of-service (DDoS) attack mitigation and investigation, cyber threat intelligence, privacy, and influence operations. He has also contributed to numerous law enforcement investigations, including providing expert witness testimony in federal court.

Dr. Tzvetanov is an active contributor to the global cybersecurity research and incident response communities. He has served on program committees for ShmooCon, FIRST, NANOG, BayThreat, and the Underground Economy. He is an active participant in several Special Interest Groups within the Forum of Incident Response and Security Teams (FIRST), has contributed to the Honeynet Project, and was a principal organizer of the BayThreat security conference. He also led the Radio Communications Department at DEF CON.

Dr. Tzvetanov holds a Ph.D. and an M.S. in Technology, both with a concentration in Homeland Security; an M.S. in Digital Forensics and Investigations; and a B.S. in Electrical Engineering with a concentration in Radio Communications.

Bring Your Own Vulnerable Driver (BYOVD) is an increasingly common technique for bypassing kernel-level security by abusing legitimately signed but vulnerable drivers. Although Microsoft and security vendors have introduced various mitigations, many defenders still do not know which controls are truly effective, where the gaps remain, or how attackers continue to bypass them. This uncertainty makes it difficult to accurately assess risk and prioritize the most effective defensive measures.

In this talk, we evaluate BYOVD from both the attacker's and defender's perspectives. We examine Microsoft's current mitigations, reverse engineer two real-world vulnerable drivers to understand their root causes and exploitation techniques, and present practical strategies for preventing, detecting, and responding to BYOVD attacks.

The talk covers:

• The evolving BYOVD threat landscape and why it remains relevant.
• An evaluation of Microsoft's mitigations, including where they are effective and where they fall short.
• Reverse engineering and root cause analysis of two vulnerable drivers, including their exploitation techniques.
• Practical detection, prevention, and mitigation strategies for defending against BYOVD attacks. The target audience includes CSIRT/CERT teams, SOC analysts, DFIR analysts, threat hunters, malware analysts, and security architects.

Dennis Tan is a cybersecurity professional with several years of experience in malware analysis and reverse engineering. Drawing on his background in red team operations, where he built and managed adversarial infrastructure firsthand, he brings an attacker's mindset to every analysis, helping organisations understand not just what malware does, but how and why threat actors deploy it.

The Vietnam CyberSecurity Real Exercise (RCSE) model has been implemented since 2021 at the direction of the former Vietnam National CERT (VNCERT/CC). To enhance its effectiveness, we developed the new model of Incident Response Real Exercise (IRRE) to help organizations and businesses improve their incident response plan (IRP) for real-time response to incidents from their real systems. Improving incident response will help the blue teams' capacity for incident response and also test recovery capacity, requirements such as RTO in their current IRP.

Nguyen Huu Nguyen is the former Vice Director of former VNCERT/CC of Vietnam

This presentation presents findings from a smart factory OT honeypot operated in a Busan-based laboratory environment. The study examines how CSIRTs can distinguish routine Internet scanning from OT-aware reconnaissance, control-oriented interaction, and behavior resembling legitimate operator activity. The test environment includes PLC and HMI components, engineering workstation services, Modbus/TCP, and network monitoring sensors. Collected telemetry is analyzed using protocol awareness, session duration, function-code usage, register access patterns, write attempts, multi-stage behavior, and command-sequence similarity. Based on these observations, the presentation proposes a practical classification and escalation model that separates statistical noise from actionable OT threat intelligence. Selected behaviors are also mapped to MITRE ATT&CK for ICS. The session will cover the honeypot architecture, data-collection method, key observations, operational limitations, and a minimum OT telemetry set that regional CSIRTs can share for cross-border analysis and coordinated incident response.

Kwangsik Lee is a cybersecurity and incident response professional with more than 18 years of experience in national-level cyber incident handling, threat analysis, and security operations. He previously served as a Team Leader and Incident Commander at KrCERT/CC, Korea Internet & Security Agency, where he coordinated responses to large-scale cyber incidents affecting critical organizations and infrastructure. His current work focuses on operational technology security, industrial incident response, OT threat detection, and the development of practical monitoring and assessment methods for smart manufacturing environments. He is also conducting applied research using PLCs, HMIs, industrial protocols, network sensors, and OT honeypots to distinguish routine Internet activity from behavior that may indicate genuine intent to observe or manipulate industrial processes. His professional interests include OT threat intelligence, evidence-driven incident response, cyber-physical monitoring, and regional CSIRT collaboration.

Software has always contained vulnerabilities – most minor, some severe. Discovering and exploiting serious vulnerabilities has traditionally required rare expertise, deep system knowledge and significant time. As a result, many vulnerabilities have remained undiscovered and unexploited for years. This presentation will discuss how AI is changing this dynamic – by lowering the cost effort and expertise required to discover and exploit vulnerabilities in software – and how organisations can prepare.

Michael Boyd is the Director of the National Cyber Watch Office, where he leads Australia’s technical engagement and response during cyber security incidents impacting Australian critical infrastructure, organisations and government services. In this role, he serves as a central point connecting government, industry, and international partners, ensuring that Australia’s technical response to cyber threats is timely, informed, and collaborative. Michael also represents Australia as Chair of the Asia Pacific Computer Emergency Response Team (APCERT). This is the Asia Pacific’s largest cyber security community where Michael contributes to regional cooperation and strengthening collective cyber resilience across the region.

Michael’s career began in the Royal Australian Army. His military experience, shaped by operations as well as deployments and technical missions around the world, instilled a calm, methodical approach to crisis situations that has become one of his defining strengths. After leaving the Army, Michael transitioned into the delivery of secure, enterprise grade IT solutions. He led complex software projects requiring rigorous security, precision, and stakeholder coordination.

Michael went on to join the Australian Cyber Security Centre, where he now leads the National Cyber Watch Office. He has played a central role in leading the government’s technical response to several of Australia’s most significant cyber incidents, including large scale ransomware attacks and breaches affecting essential services, working closely with industry partners to mitigate impacts and restore critical services.

Known for his steady leadership and open, approachable style, Michael is a strong advocate for genuine partnership between government and industry during cyber crises. He brings a blend of operational experience, technical insight, and calm crisis management that makes him a trusted voice in Australia’s cyber security landscape

As CERTs/CSIRTs we have no shortage of tactical information to provide our constituency. You can buy it, find it or collect it yourself. These indicators of compromise or vulnerability can be acquired either by first, second, or third person scanning. But what if you could identify constituents that have trouble with their cyber security operations, instead of sending endless notifications of their vulnerabilities. The intelligence requirement topic being addressed is if an organisation displays difficulties in patching and determine their actual reaction rate. This presentation will summarise the process of creating a report about "most at need of help" constituent organisations, with regards to CVE's, or group them according to their industry sector to have a footprint of actual time-to-patch and compare them to industry recommendations.

With twenty (20) years in IT and fifteen (15) of them in IT security, Geoffroy Thonon is based in Australia to work for AUSCERT after founding and working in Macao for MOCERT. Geoff, in the time he has served for computer emergency response teams, has had the opportunity to create, use and adjust, incident notification processes and well as share experience whilst facilitating training for CERT/CSIRTs operations. Also, keeping touch with his IT audit background, Geoff supports the CERT Community with process reviews, training as well as releasing code related to CERT work. From AUSCERT, Geoff liaises with like-minded computer emergency response teams for the purpose of creating a safe, clean and reliable cyber space through global collaboration.

In cloud-native environments, the ephemeral nature of containers creates a critical blind spot for incident responders. When an attacker compromises a public-facing pod, they often leverage weak network configurations and over-privileged permissions to perform lateral movement before destroying the initial container to erase digital evidence. This 20-minute session introduces a pragmatic forensic framework to hunt, trace, and reconstruct these hidden container-to-container pivoting paths. Based on recent real-world threat intelligence from cryptocurrency platforms, we will dissect a live attack scenario: starting from web shell exploitation on a frontline pod, moving to Service Account token theft, and concluding with unauthorized cross-namespace code execution via Kubernetes API calls. To overcome the limitations of vanished container disks, we present a robust three-layered forensic correlation methodology: Control Plane: Identifying suspicious exec patterns (.../pods/pod-B/exec) within Kubernetes API Server Audit Logs by mapping source IPs and stolen user.username credentials. Data Plane: Detecting anomalous internal network scans (SYN packet spikes) across local subnets using CNI logs and flow infrastructures. Host OS: Extracting volatile artifacts, such as modified files and bash history, from the worker node’s Overlay FS upper directory, coupled with eBPF-based runtime syscall tracking (curl, chmod).Finally, we translate these forensic insights into actionable defense, providing declarative Network Policies and service account hardening blueprints. Attendees will walk away with the practical knowledge required to make invisible cloud-native threats completely visible.

Seokhoon Park holds a Ph.D. in Digital Forensics. With 30 years of experience in IT, 17 of which are in IT security, SeokHoon Park is based in Korea, working as CISO for NIRS-CERT after serving as CISO(Chief Information Security Officer) & CPO(Chief Privacy Officer) at S-Group.

New cyberattack techniques appear day by day and information security landscape is constantly evolving. Therefore, CSIRT activities must continually adapt to these changes and improve. At the same time, since IT technology plays a central role in organizational and societal activities, incident handling require speed and reliability. CSIRTs must balance updating their operations and maintaining them high quality. In this training session, as a method for CSIRT reliable management with continuous improvement, we will introduce the CSIRT Maturity Model: SIM3 and conduct exercises to help participants understand SIM3. We will begin with an overview of SIM3. Through hands-on exercises, help participants understand its structure and usage, focusing on the 11 criteria required for FIRST applications. We will also introduce examples of SIM3 usage, such as the three maturity baselines required of national CSIRTs in EU member states and the baselines used by the European CSIRT community (TF-CSIRT) to certify mature CSIRTs, as well as initiatives aimed at advancing CSIRT maturity in Japan and Asia.

Seiichi "Ichi" Komura, Certified SIM3 Trainer and Auditor, CISSP He is member of steering committee, the chair of SIM3 promotion committee and the leader of CSIRT evaluation and maturity model WG of Nippon CSIRT Association (NCA). He conducts CSIRT related presentations, lectures and training in several communities and universities. He is a Senior manager of NTT Advanced technology corporation, works as a POC of internal CSIRT, a consultant on building and improving CSIRT, and a trainer of information security.

Scams, including voice phishing and smishing, cause severe financial damage by complexly exploiting telecommunication services, malicious apps, and social engineering techniques. To strengthen resilience against evolving threats, close collaboration across cybersecurity, telecommunications, law enforcement, and financial sectors is essential. This presentation introduces South Korea's integrated scam response framework and the role of the Korea Internet & Security Agency (KISA) in addressing caller ID spoofing and malicious apps.

We will also look at real examples of how working closely with the National Police Agency turns threat data into real-world action—like shutting down phone numbers, blocking C2 servers, and protecting victims.

We illustrate how combining the response capabilities of multiple agencies effectively disrupts infrastructure exploited for crimes and prevents additional damages.

Finally, we outline practical lessons for CERTs/CSIRTs regarding rapid responses to evolving attack vectors, inter-sectoral collaboration, and cross-border cooperation, while discussing strategic directions to enhance global resilience against transnational scam threats.

As the Head of the Voice Phishing Response Team within the KrCERT/CC of the Korea Internet & Security Agency (KISA), Ji Hee Seok leads initiatives to establish voice phishing prevention policies and strengthen inter-agency joint response frameworks. Her core responsibilities include countering caller ID spoofing, preventing the malicious misuse of telecommunication services, and driving strategic cooperation and information-sharing with law enforcement and telecom operators. Previously, she oversaw regulatory improvements and operations for illegal spam mitigation. Committed to fostering a safe and trusted communication environment, he/she continues dedicated research into policies and technologies against voice phishing and spam.

For years, Korea's strict network separation and layered perimeter defenses have stood as the absolute benchmark for the safety of financial institutions' internal systems. Legally mandated network separation isolates internal systems from the internet, endpoint and boundary security products are deployed everywhere, and trusted management systems govern the isolated environment. Yet over the past few years, real incidents have repeatedly shown the opposite: the very controls trusted to keep attackers out have become the paths attackers ride in.

This talk examines the Paradox of Trust through recent breaches in Korea's financial sector.

Attackers rarely defeat these network-separation-based controls head-on. Instead they abuse the trust relationships those controls depend on. A trusted domestic security solution becomes a DPRK trojan horse; a trusted boundary VPN appliance becomes the entry point into a network-separated environment; and trusted management and connection systems become the bridge across segments meant to be isolated. What turns each of these components into a top-priority attack path is not a product defect but its trusted position itself.

Drawing on real 2025-2026 incident response (IR) data, we follow the attacker tradecraft (TTPs) behind these cases: how initial access rode trusted software and appliances, how lateral movement crossed separated segments through management infrastructure and tunneling, and the traces these operations left behind.

The conclusion is a defensive reframing. Trust relationships themselves become an attack surface. Trusted connection points inside a "protected" network, such as security software, boundary appliances, and management systems, must be assumed breached and inspected and monitored to the same standard as any internet-facing asset. Korea's network-separated financial sector is only the most extreme example; this paradox is a common threat facing every high-assurance, isolated network.

Network separation built a wall of trust, but that wall is now crumbling as the separation is deregulated and the environment shifts. The more it fades, the more the answer is no longer a wall but total visibility and zero trust: rigorously verifying every internal connection point, every external touchpoint, and the integrity of the traffic that crosses the boundary, and securing complete control over every flow that moves between networks.

Mohyun Park is a cybersecurity analyst specializing in threat intelligence at the Financial Security Institute (FSI). His expertise lies in translating incident investigation findings and external threat data into actionable insights to build proactive, threat-informed defense strategies.

Younghwan Kim is a cybersecurity analyst at the Financial Security Institute (FSI) of Korea, where he works on threat intelligence, security operations, malware analysis, and incident response for the financial sector. He performs first-hand incident investigations, extracts IOCs and uncovers TTPs, and builds correlation-based analysis across incidents.

Cyber Threat Intelligence teams are not short of information — they are short of time. Threat reporting, incident data, indicators, vulnerability intelligence and partner insights continue to grow, while analyst capacity remains limited. As a result, valuable intelligence often remains buried inside existing data, not because teams lack expertise, but because they lack the capacity to process, connect and operationalize it at scale. This presentation shares what my team and I are attempting to achieve as we introduce AI into CTI workflows to improve coverage, analysis, production and dissemination without increasing headcount. The session explores how Human-AI collaboration can help analysts work across larger datasets, identify relevant patterns, accelerate recurring intelligence tasks and create more room for higher-value activities. It also reflects on what we are learning along the way — including where AI helps, where it needs strong human oversight, and what must be in place to use it responsibly in operational intelligence environments. At the centre of the talk is the analyst as the editor-in-chief: AI can support research, summarization and analysis at a scale that was previously unrealistic, but humans remain responsible for deciding what matters, applying context, validating relevance and ensuring intelligence leads to action. The goal is not simply to produce more intelligence faster — it is to turn more of the intelligence already available to us into stronger defensive outcomes and a more resilient cyber defence posture.

Key takeaways • How AI can help CTI teams move from information overload to intelligence at scale. • How Human-AI collaboration can expand CTI capability and capacity without increasing headcount. • Why human judgement, context, validation and action remain central to trustworthy AI-assisted intelligence work. • What practical lessons emerge when AI is introduced into operational CTI workflows, including scale, trust and resilience considerations.

Karine Tobin is a Senior Cyber Threat Intelligence Analyst at Deloitte Global, supporting cyber intelligence activities that help protect Deloitte firms worldwide. Her work focuses on regional threat landscape analysis, campaign research, strategic intelligence reporting, forecasting, executive briefings and intelligence dissemination. Karine combines cyber threat intelligence experience with a background in marketing and communications across Australia and Europe, bringing a strong focus on clear, relevant and actionable intelligence products for both technical and leadership audiences. Her current interests include the practical use of AI to expand CTI capability and capacity, improve intelligence production and dissemination, support forecasting and analysis at scale, and help intelligence teams focus more time on the activities that drive defensive impact.