BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.bsidescbr.com.au//bsides-canberra-2026//talk//ASV3U
 J
BEGIN:VTIMEZONE
TZID:Australia/Sydney
BEGIN:STANDARD
DTSTART:20250926T000000
TZNAME:AEST
TZOFFSETFROM:+1000
TZOFFSETTO:+1000
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20251005T030000
RDATE:20261004T030000
TZNAME:AEDT
TZOFFSETFROM:+1000
TZOFFSETTO:+1100
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20260405T030000
RDATE:20270404T030000
TZNAME:AEST
TZOFFSETFROM:+1100
TZOFFSETTO:+1000
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Identity Is the New SOC: Hunting Entra\, SCIM\, PIM\, and Password
  Manager Abuse - Maple
DTSTART;TZID=Australia/Sydney:20260926T120000
DTEND;TZID=Australia/Sydney:20260926T122500
DTSTAMP:20260727T185539Z
UID:pretalx-bsides-canberra-2026-ASV3UJ@cfp.bsidescbr.com.au
DESCRIPTION:Identity used to be the front door. Now it is the keys\, the k
 ey cabinet\, the floor plan\, the alarm panel\, and sometimes the weird em
 ergency exit nobody has checked since 2021. \n\nMost organisations have pu
 t serious effort into endpoint alerts\, phishing workflows\, firewall rule
 s\, and dashboards. But the thing that quietly decides who can access almo
 st everything is often treated as setup work: turn on MFA\, plug in SSO\, 
 add Conditional Access\, connect SCIM\, move on. \n\nThat is fine until so
 meone uses a break-glass account\, a privileged role lights up\, a passwor
 d manager owner gets added\, a Conditional Access exclusion becomes the ea
 siest path in\, or SCIM decides to "help" by removing the wrong person fro
 m the wrong place. \n\nThis talk is about hunting the identity control pla
 ne before it becomes an incident. We will walk through realistic Entra\, S
 CIM\, PIM\, and password-manager failure modes\, then turn those messy adm
 in events into useful detections\, triage paths\, and response actions. \n
 \nExpect practical examples\, awkward edge cases\, noisy logs\, bad assump
 tions\, and the occasional reminder that "we logged it somewhere" is not t
 he same thing as "someone can respond to it at 2am."
LOCATION:Off-Main Track
URL:https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ASV3UJ/
END:VEVENT
END:VCALENDAR