Program Overview

Guillermo Pereyra is the Security Analyst of LACNIC’s CSIRT, whose mission is to carry out the necessary coordination functions to strengthen incident response capabilities related to Internet resources in Latin America and the Caribbean. Guillermo holds the CERT Incident Response Process Professional certification from the Software Engineering Institute (SEI) at Carnegie Mellon University. Guillermo has over 15 years of experience in IT. He formerly worked for six years, as an incident responder at Uruguay's national ISP CSIRT.

This talk delivers a practical, no-nonsense view of real-world incident response, showing how the fundamentals left undone — VPN without MFA, lack of IT hygiene, unprotected credentials — remain the most exploited attack vectors, even as threat actors operate with global scale, division of labor, and insider recruitment. Drawing from incidents our team responded to over the past months, we explore how attackers are evolving — combining social engineering, session hijacking, abuse of development pipelines, and RaaS operations — while the defender's side still struggles with the same unpatched basics year after year. We also discuss who we're actually up against: operators, affiliates, malicious recruitment, and the business behind ransomware-as-a-service — because understanding the adversary matters just as much as fixing your firewall. The talk closes with actionable recommendations grounded in reality, not theory: CIS Controls 1–6, Active Directory hardening, network segmentation, Zero Trust as a concept rather than a product, and minimum logging practices that actually help during an incident. Key takeaway: It doesn't matter how sophisticated the attack is — almost every incident we respond to has a basic IT hygiene failure at its root that amplifies the impact. The attackers already have HR, time zones, and queues. The defender needs, at minimum, an inventory, logs, and MFA.

Hector Gussella is a cybersecurity professional with a background in telecom and infrastructure. He works as SecOps Coordinator at Soow Sigma, with experience in incident response, SOC operations, and digital forensics. His work focuses on managing crises in customer environments, improving incident handling processes, strengthening cyber defense capabilities, and leading technology migration initiatives in mission-critical environments.

Alencar Silva is a cybersecurity professional and CSIRT Manager at Soow Sigma, with experience in incident response, SOC operations and digital forensics. His work focuses on strengthening cyber defense capabilities, improving incident handling processes, and supporting security maturity initiatives.

Ariel Cessario se desempeña como Coordinador de un CERT nacional en Argentina. Su trabajo se especializa en la respuesta a incidentes de ciberseguridad con un enfoque directo en el análisis y la mitigación de amenazas.

Ariel Cessario serves as the coordinator of a national CERT in Argentina. His work specializes in cybersecurity incident response, with a direct focus on threat analysis and mitigation.

La presentación comparte la experiencia de CEDIA SOC-CSIRT con DALIA, una arquitectura multiagente de inteligencia artificial orientada a apoyar el triaje, la correlación y la priorización durante la respuesta a incidentes. A partir de un caso operacional anonimizado, se mostrará cómo la integración de señales provenientes de distintas fuentes permite reducir la incertidumbre y fortalecer la toma de decisiones.

La sesión abordará los principales desafíos, controles y lecciones aprendidas, manteniendo un principio central: la IA apoya el análisis y la priorización, mientras que las decisiones críticas y las acciones de contención permanecen bajo responsabilidad humana.

This presentation shares CEDIA SOC-CSIRT's experience with DALIA, a multi-agent artificial intelligence architecture designed to support triage, correlation, and prioritization during incident response. Through an anonymized operational case, the session shows how integrating signals from different sources can reduce uncertainty and strengthen decision-making.

The presentation will cover the main challenges, safeguards, and lessons learned, while maintaining a central principle: AI supports analysis and prioritization, while critical decisions and containment actions remain under human responsibility.

Freddy Gómez es profesional de ciberseguridad en CEDIA SOC-CSIRT, con experiencia en operaciones SOC, respuesta a incidentes, gestión de vulnerabilidades, exposición externa y automatización de procesos de seguridad. Su trabajo se enfoca en la integración y correlación de información de distintas fuentes para fortalecer el análisis, la priorización y la toma de decisiones durante la respuesta a incidentes.

Freddy Gómez is a cybersecurity professional at CEDIA SOC-CSIRT, with experience in SOC operations, incident response, vulnerability management, external exposure, and security process automation. His work focuses on integrating and correlating information from multiple sources to strengthen analysis, prioritization, and decision-making during incident response.

Graciela Martínez is the Head of LACNIC’s CSIRT (Computer Security Incident Response Team). LACNIC CSIRT provides the requisite services to reinforce computer security incident response capabilities where incidents may involve Internet addresses, Autonomous System Numbers and Reverse Resolution within Latin American and Caribbean region. Graciela has over 25 years of experience in IT, of which she has dedicated more than 15 years to information security and outreach activities within the LAC CSIRT community as well as with other international information security communities. LinkedIn profile: https://www.linkedin.com/in/graciela-martinez-giordano/ Twitter: @Grace_GMMG

Universities face a complex cybersecurity environment in which technical incidents can quickly become institutional challenges requiring coordinated detection, analysis, containment, communication, and recovery. This presentation shares lessons learned from two significant cybersecurity events handled by a university security team in 2026 and how these experiences contributed to the development of a structured university CSIRT capability aligned with the FIRST CSIRT Services Framework.

The first case involves a confirmed security incident affecting an Internet-exposed Apache Solr service, where the investigation identified unauthorized access to administrative endpoints, configuration changes, dynamic loading of Java libraries, external infrastructure, and indicators associated with scanning and exploitation.

The second case involves the identification of 5,588 credential records associated with institutional domainsthrough proactive threat intelligence activities. Technical validation confirmed 326 active credentials, while mandatory multi-factor authentication helped prevent successful access to protected institutional services.

Beyond the technical details, the presentation examines what these cases revealed about incident handling, threat intelligence, vulnerability management, monitoring, coordination, containment, and lessons learned. These experiences demonstrated the need to evolve from individual, reactive responses toward structured and repeatable cybersecurity services.

The presentation concludes with the evolution of the university's cybersecurity capabilities and the development of an integrated cyber defense approach incorporating SOC operations, threat intelligence, vulnerability management, security monitoring, incident response, and continuous improvement. The objective is to share practical lessons that can be adapted by universities and CSIRTs across Latin America and the Caribbean.

Fredy Alvarez heads the Cybersecurity Division at the Autonomous University of Ciudad Juárez (UACJ), where he works to strengthen the institution’s cybersecurity capabilities. He has more than 15 years of experience in information technology and is currently involved in the implementation and consolidation of the UACJ’s Security Operations Center (SOC), as well as in the development of institutional incident response capabilities through a university CSIRT and CERT. Fredy holds a master’s degree in Applied Computer Science, with a focus on cybersecurity. He is currently pursuing a Ph.D. in Advanced Engineering Sciences, where his research focuses on developing an advanced source of intelligence on cyberthreats for the Latin American context using machine learning and big data techniques

Desarrollador empresario mexicano, socio fundador y CEO de Truxgo con más de 10 años de experiencia en programación. Implementó la mayor parte de las bases estructurales de Truxgo para su funcionamiento y creó el proyecto de ciberseguridad CERT TRUXGO desde su formación hasta obtener el nombramiento ante Carnegie Mellon University. Actualmente dirige Truxgo en las relaciones de negocios, estableciendo y formando un Internet Exchange Point (IXP), búsqueda y desarrollo de peering, políticas de ruteo, implementación a MANRS, soluciones avanzadas de IPv4-IPv6, así como la creación de nuevas tecnologías y soluciones de ciberseguridad.

Graciela Martínez is the Head of LACNIC’s CSIRT (Computer Security Incident Response Team). LACNIC CSIRT provides the requisite services to reinforce computer security incident response capabilities where incidents may involve Internet addresses, Autonomous System Numbers and Reverse Resolution within Latin American and Caribbean region. Graciela has over 25 years of experience in IT, of which she has dedicated more than 15 years to information security and outreach activities within the LAC CSIRT community as well as with other international information security communities. LinkedIn profile: https://www.linkedin.com/in/graciela-martinez-giordano/ Twitter: @Grace_GMMG

This training addresses the analysis and management of security incidents related to websites that host or distribute malicious content and activities linked to the use of cryptocurrencies, including incidents that may be associated with criminal activity. Through case studies and practical exercises, participants will learn to identify, analyze, correlate, and manage relevant technical information, ensuring the preservation of available data and evidence so that it can contribute to a subsequent investigation and facilitate the identification of the infrastructure and, when possible, the responsible parties involved.

The training will place special emphasis on the proper handling of information generated during incident management, the identification of relevant sources, the correlation of different elements, and the documentation of findings, as well as on collaboration and information sharing among CSIRTs, investigators, and other relevant stakeholders. The practical exercises will allow participants to apply these concepts to simulated situations and develop criteria for achieving effective information processing that facilitates the work of researchers and other actors involved in the response.

En Español:

Título: Incidentes de seguridad vinculados a contenido malicioso y criptomonedas: análisis, gestión y preservación de información

Descripción: Este entrenamiento aborda el análisis y la gestión de incidentes de seguridad relacionados con sitios que alojan o distribuyen contenido malicioso y con actividades vinculadas al uso de criptomonedas, incluyendo aquellos incidentes que puedan estar asociados a hechos delictivos.

A través de casos y ejercicios prácticos, los participantes aprenderán a identificar, analizar, correlacionar y gestionar información técnica relevante, procurando preservar los datos y evidencias disponibles de forma que puedan contribuir a una investigación posterior y facilitar la identificación de la infraestructura y, cuando sea posible, de los responsables involucrados. El entrenamiento pondrá especial énfasis en el tratamiento adecuado de la información generada durante la gestión de un incidente, la identificación de fuentes relevantes, la correlación de diferentes elementos y la documentación de los hallazgos, así como en la colaboración e intercambio de información entre CSIRTs, investigadores y otros actores relevantes. Los ejercicios prácticos permitirán a los participantes aplicar estos conceptos a situaciones simuladas y desarrollar criterios para lograr un tratamiento efectivo de la información que facilite el trabajo de investigadores y otros actores involucrados en la respuesta.

Cristian Fabian Mancilla es un especialista en informática forense y cibercrimen de la Policía Federal Argentina, con amplia experiencia en la recolección, preservación y análisis de evidencia digital. Se desempeña como perito forense en el Departamento Técnico del Cibercrimen, donde lidera pericias oficiales en el Laboratorio Forense Digital y dicta capacitaciones sobre maniobras técnicas como el “Triage”. Además, ha sido docente en el Instituto Universitario de la Policía Federal Argentina (IUPFA) y en el Plan Anual de Capacitación durante varios años, transmitiendo sus conocimientos a nuevas generaciones de investigadores.

Walter Daniel Trullet es integrante de la Policía Federal Argentina, donde desarrolla actividades vinculadas con la investigación y el análisis de delitos relacionados con las nuevas tecnologías y los criptoactivos. Cuenta con capacitación especializada en análisis de criptomonedas, tecnología blockchain y herramientas de investigación como Chainalysis Reactor e i2 Analyst's Notebook.

Su experiencia se encuentra orientada al seguimiento y análisis de transacciones en blockchain, la identificación de movimientos vinculados con operaciones sospechosas y el tratamiento de información digital como parte de investigaciones criminales. Asimismo, posee formación en investigación criminal, crimen organizado y ciberdelito.

Adrián Acosta - Argentine Federal Police

The cybersecurity landscape is evolving faster than many organizations can adapt. AI-driven attacks, shrinking remediation windows, credential theft, supply chain risks, and increasing automation are reshaping how incidents occur and how defenders respond. This presentation explores practical lessons drawn from real-world incidents, threat intelligence, and emerging trends affecting CSIRTs in 2026. Rather than focusing on formal red team exercises, it highlights warning signs that security teams, especially those operating with limited resources, should be watching for today. Topics include attack surface management, AI-assisted threats, credential and API key compromise, automation pitfalls, and evolving supply chain risks. The session concludes with practical, low-cost measures that can strengthen resilience, improve detection capabilities, and support better risk-based decision-making.

Jacson Querubin is a cybersecurity professional at ITAIPU Binacional, a photographer by passion, and a retired clown. He is a SIM3 auditor (OpenCSIRT) and holds a Master's degree in Computer Science. His work spans cyber threat intelligence, incident response, cyber risk management, and critical infrastructure protection, helping strengthen cyber resilience across both IT and operational technology (OT) environments. His interests include threat intelligence, incident handling, supply chain security, and the practical application of risk-based methodologies to support cybersecurity decision-making and organizational resilience. While he holds a number of cybersecurity and IT certifications, he still considers remembering the tar command options by heart.

La Administración Pública es infraestructura crítica, pero rara vez se gestiona como tal. En Gobiernos subnacionales, la capacidad de respuesta a incidentes suele estar limitada por un problema anterior a la detección: la telemetría existe, pero fragmentada entre organismos, sin correlación temporal, sin contexto de activos y sin trazabilidad suficiente para sostener una decisión operativa. La presentación desarrolla una tesis y su límite: uno defiende lo que ve — y por eso el monitoreo, que solo muestra lo que alguien decidió mirar de antemano, resulta insuficiente frente a un incidente real. La observabilidad, entendida como la capacidad de formular preguntas que no fueron anticipadas al instrumentar, es precondición de la respuesta y no su consecuencia. Se expone la experiencia del CSIRT-NQN en la construcción de esa capa, articulada con el primer despliegue en Latinoamérica del programa D-SOC (SOC Distribuido Desplegable) del CCN-CERT de España, financiado por la Unión Europea en el marco de Ciberescudo: criterios de suficiencia adoptados, arquitectura, instrumentos jurídicos y de alcance técnico que hicieron viable la cooperación entre un CERT nacional europeo y un CSIRT subnacional latinoamericano, y lecciones aprendidas —incluidos errores de secuenciamiento propios—. El cierre plantea un problema abierto: el hueco de visibilidad entre un CSIRT con responsabilidad jurisdiccional de coordinación y las infraestructuras críticas que debería coordinar.

English:

Public administration is critical infrastructure, yet it is rarely managed as such. In subnational governments, incident response capability is typically constrained by a problem that precedes detection: telemetry exists, but it is fragmented across agencies, lacking temporal correlation and the asset context needed to support an operational decision. This talk develops a claim and its limit: you defend what you see — which is precisely why monitoring, showing only what someone decided in advance to look at, falls short during a real incident. Observability, understood as the ability to ask questions that were not anticipated at instrumentation time, is a precondition for response rather than a consequence of it. On that basis, the session presents CSIRT-NQN's experience: the sufficiency criteria adopted, the architecture, the legal and technical-scope instruments that made cooperation with CCN-CERT viable, and lessons learned — including our own sequencing mistakes. It closes with an open problem: the visibility gap between a CSIRT holding jurisdictional coordination responsibility and the critical infrastructure it is expected to coordinate.

Víctor Figueroa coordinates CSIRT-NQN, the Incident Response Team of the Province of Neuquén/AR, and serves as Provincial Director of ICT Services and CISO for the Provincial Government. He led the cooperation with Spain's CCN-CERT that brought the first Latin American deployment of the D-SOC/Ciberescudo program to Neuquén. He is a doctoral candidate in Advanced Computing Technologies at the University of Castilla-La Mancha and teaches information security in Argentina and Spain.

Rodrigo Torrealba is Head of Cybersecurity Analysts at CSIRT-NQN and operational lead of the D-SOC/Ciberescudo deployment,  the first implementation of CCN-CERT Spain's program in Latin America.