CRESTCon and IISP Congress 2018

This record brings together an organiser's programme and a surviving presentation associated with the 2018 conference. The programme tells us what was scheduled; the presentation gives readers a particular piece of material they can examine for themselves.

Independent archive: Serallo Domains Ltd publishes this reference page. We are not CREST, IISP, BCS or Netscylla, and do not represent the speakers. Current CREST events are listed by the organiser.

Event record

The event was advertised for 3 May 2018 at the Royal College of Physicians, London. 44CON's contemporary announcement, published as an exhibitor, also identifies the addition of the BCS Security Conference as a third stream. Despite the old year in that announcement's URL, its heading and content concern 2018.

The March 2018 CREST bulletin supplies the technical running order below. It also announces a training-provider stream. We do not claim to have recovered every stream's full agenda.

Documented technical programme

These are concise subject labels, not reproductions of the presentation abstracts. Times are those advertised in the bulletin; this table is not evidence that every session ran unchanged.

The bulletin's programme pages also include breaks, lunch, prize giving and evening networking. Consult the original for those arrangements and the original session titles. Historical registrations and sponsorship offers should not be treated as current services.

The Davies and Medvenics presentation

A 67-page PDF hosted by Netscylla survives. Its cover describes traps and pitfalls in red-teaming, and its opening pages identify Andy Davies and Jon Medvenics. Its year, people and subject strongly match the programme entry. We have not established byte-for-byte identity with the file formerly hosted on this domain.

The slides bring offensive and defensive perspectives together and include infrastructure, email, web traffic and reporting topics. They are a historical presentation, not a current testing manual. Brand names, product behaviour, technical examples and legal references inside an old deck require their own current verification.

The old document address directs readers to the speaker-hosted PDF. We have not republished the slides or presented a new article as if it were the original download.

How to read this material usefully

Start with a question that the deck can help you examine. For example: what would make the outcome of an exercise difficult for a customer to interpret? Make notes about the distinction between the activity performed, the evidence collected and the conclusion being offered.

For each useful point, record three things:

1. The slide or page you actually read.
2. The claim you think it makes, written in your own words.
3. What would need checking before applying that idea to your own environment.

Do not infer missing demonstrations from a short bullet or a screenshot. If the slide depends on an oral explanation that is not available, mark the gap. This produces a stronger research note than assuming the most plausible explanation was what the speaker meant.

A worked reading note

Question: Could our next exercise produce a useful remediation decision?

Available evidence: a historical presentation and a programme entry. These establish a topic and a resource, not the outcome of our own proposed test.

Our proposed next step: write a fictional finding with a business owner, evidence reference and verification method before commissioning the engagement. Ask the provider whether the proposed report would support that decision.

Boundary: this is an editorial exercise using the archive as a starting point. It is not a claim about what the presenters recommended or what happened at a particular client.

Current guidance

• Assessment types compares the questions different engagements can answer.
• Scoping and authorisation helps turn an exercise idea into agreed boundaries.
• Reading a report shows how evidence, severity and limitations fit together.
• Retesting fixes follows the result through to a recorded closure decision.

For the next documented year, see the 2019 programme and materials. The source register records the evidence behind both pages and the gaps that remain.