{"id":487,"date":"2025-10-03T10:25:10","date_gmt":"2025-10-03T14:25:10","guid":{"rendered":"https:\/\/bsidesmtl.ca\/?page_id=487"},"modified":"2026-08-31T10:45:13","modified_gmt":"2026-08-31T14:45:13","slug":"workshop-fr","status":"publish","type":"page","link":"https:\/\/bsidesmtl.ca\/fr\/workshop-fr\/","title":{"rendered":"Workshop | FR"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Workshop | Take the Helm: Living Through a Cyber Crisis<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

You’re the CIO of a mid-sized company. It’s Saturday morning, systems are down, and nobody can tell you
why. In this hands-on workshop, you take the helm of the victim organization and live through an incident
from the inside \u2014 not as a forensic exercise, but as the operational and human scramble it really is.
Working in small teams, you’ll get a network diagram, a set of backups you think you have, and 30
minutes to make sense of what’s happening and produce a plan. Then we start asking the questions that
hurt: Who’s talking to the press? Do you have legal counsel on retainer? What do you tell the journalist
who just got tipped off by someone inside? Where’s the documentation you needed an hour ago? Injects
land in real time and the picture keeps changing. In the final segment we debrief together and connect
every painful moment back to the controls, documentation, and incident response plans that would have
made it easier \u2014 drawing on established response frameworks and public playbooks you can take home
and use. Come prepared to decide under pressure. Facilitated by two practitioners who have run and
lived through the real thing.<\/p>

What participants will take away<\/strong>
1. Where preparation actually pays off \u2014 documentation, asset inventory, and tested backups stop being
abstractions the moment you need them and don’t have them.
2. The crisis behind the incident \u2014 technical containment is only half the job; press, legal, executive, and
client communications run in parallel and on a faster clock.
3. How to think under capacity overload \u2014 recognizing when the team is past its limits, and what to triage,
delegate, or escalate.
4. Decision-making with incomplete information \u2014 practising the calls you’ll have to make before you have
the full picture.
5. A concrete set of resources \u2014 response frameworks and public incident response playbooks, mapped to
the specific questions the drill raised.<\/p>


Who it is for<\/strong>
Open to the full BSides audience \u2014 analysts, engineers, consultants, GRC, and managers. No prior incident
response experience is required, and the exercise is deliberately not deeply technical: the skills practised here
are the ones that matter as participants move into leadership roles where an incident becomes a business crisis.
Analysts get a preview of the decisions their future selves will make; managers and executives get repetitions
they rarely get outside a real event.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Bio:<\/strong><\/p>

Stefan Timotijevi\u0107<\/strong> \u2014 Founder & CEO of Akbko and creator of CyberSensei.ai, and founder of the nonprofit
Hackeurs Sans Fronti\u00e8res (hsf.sh). 25+ years across governance, compliance and resilience, including CISO-level roles in retail, defence and aerospace. Designs and runs cyber crisis simulations.
Alexandre Blanc<\/strong> \u2014 Cyber risk and network architecture expert, ranked 4th in Favikon’s Top 50
cybersecurity experts in Canada. LinkedIn Top Voice in Technology and Cyber Sentinel Award laureate,
with two decades protecting sensitive infrastructure and analyzing the global threat landscape daily.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t\t
\n\t\t\t\t\t<\/path><\/svg><\/div>\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Workshop 2 | Windows Forensics for Insider Threat<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n
Windows Forensics for Insider Threat is an immersive workshop built for beginners looking to get into digital forensics to uncover the traces of malicious insider activity. This session focuses on the artifacts that insiders leave behind when interacting with Windows systems \u2014 covering file access, program execution, USB storage usage, Recycle.Bin analysis, disk imaging, file recovery, and browser activity. Through guided activities, you\u2019ll learn how to connect these evidence sources into meaningful timelines that reveal intent, method, and impact.<\/div>\n
<\/div>\n
No prior forensics experience is required. We\u2019ll start from first principles, explain how and why artifacts are created, and guide you through hands-on exercises that demonstrate how investigators reconstruct user actions from raw evidence.<\/div>\n
<\/div>\n
Note: This will mostly be repeated content of last years Windows Forensics for Insider Threat if you have already taken the workshop.<\/div>\n
<\/div>\n
Attendees should have:<\/b><\/div>\n
\u2022A Windows 10\/11 environment (native or virtual) with admin rights.<\/div>\n
\u2022Ability to work with disk images and external media.<\/div>\n
\u2022Adequate storage (~10 GB free).<\/div>\n
\u2022Access to PowerShell and command-line utilities.<\/div>\n
<\/div>\n
Pre-requisites for attendees:<\/b><\/div>\n
\u2013 A working knowledge of Windows internals and basic DFIR concepts (artifacts, imaging, hashing) is recommended.<\/div>\n
\u2013 Some prior exposure to security operations or investigative workflows will help maximize the value of the exercises.<\/div>\n
\u2013 A full list of required tools and data sets will be distributed to registered attendees in advance.<\/div>\n<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Bio:<\/strong> Tyler Chevrier, is a Senior Cybersecurity Specialist at Commissionnaires du Quebec and a part-time Cyber Operator for the 34 Signal Regiment. With a specialization in Digital Forensics and Incident Response, Tyler holds 5 years of experience in the field consulting and leading real-world DFIR investigations. Tyler has delivered numerous presentations on digital forensics and penetration testing concepts.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t\t
\n\t\t\t\t\t<\/path><\/svg><\/div>\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Places limit\u00e9es<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tInscription<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Un montant symbolique est demand\u00e9 \u00e0 l’inscription pour confirmer votre int\u00e9r\u00eat. Veuillez noter que les workshops ne sont offerts qu’en anglais.<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Workshop | Take the Helm: Living Through a Cyber Crisis You’re the CIO of a mid-sized company. It’s Saturday morning, systems are down, and nobody can tell you why. In this hands-on workshop, you take the helm of the victim organization and live through an incident from the inside \u2014 not as a forensic exercise, […]<\/p>\n","protected":false},"author":1,"featured_media":452,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","footnotes":""},"class_list":["post-487","page","type-page","status-publish","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/bsidesmtl.ca\/fr\/wp-json\/wp\/v2\/pages\/487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bsidesmtl.ca\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/bsidesmtl.ca\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/bsidesmtl.ca\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bsidesmtl.ca\/fr\/wp-json\/wp\/v2\/comments?post=487"}],"version-history":[{"count":13,"href":"https:\/\/bsidesmtl.ca\/fr\/wp-json\/wp\/v2\/pages\/487\/revisions"}],"predecessor-version":[{"id":1028,"href":"https:\/\/bsidesmtl.ca\/fr\/wp-json\/wp\/v2\/pages\/487\/revisions\/1028"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bsidesmtl.ca\/fr\/wp-json\/wp\/v2\/media\/452"}],"wp:attachment":[{"href":"https:\/\/bsidesmtl.ca\/fr\/wp-json\/wp\/v2\/media?parent=487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}