PUBLICATIONS



I try to put my publications online as soon as they are available, either in PDF or in HTML format. Most of them are in French.
I will keep this page up to date. By now, you can find below:



Conferences and Presentations


ROOMn 2016

ROOMn is an international conference about digital and mobile business, with obviously some security aspects.

See the program of the event.
Table ronde: Smart City, la ville mobile, digitale et collaborative (mars 2016).


FIC 2016

The FIC (Forum International de la Cybersécurité) is an international conference about cybersecurity and fight against cybercrime.

See the program of the event.
Table ronde: Quel rôle pour les collectivités territoriales dans les Smart Cities ? (jan 2016).


Les Assises de la Sécurité 2015

See the program of the event.
Table ronde: Industrie 4.0 : quelle place pour la sécurité ? (oct 2015).


Innovative City 2015

Innovative City is an international conference about Smart City and its real life applications.

Table ronde: Smart City et Cybersécurité, enjeu majeur de la transformation numérique et de la transition énergétique (juin 2015).
See the program of the event.
Download the presentation slides (PDF format).


GSDays 2014

The GSDays are a French technical conference about IT Security organized by the Global Security Mag newspaper.

Conférence plénière: Protection des libertés individuelles et respect de la vie privée, peut-on encore y croire ? (mars 2014).
See the program of the event.


CESIN

The CESIN (Club des Experts de la Sécurité Informatique et du Numérique) is a closed community of senior IT security executives and CISO's.

Quelle nouvelles responsabilités pour le RSSI ? Quelle formation ? (fev 2014).


Les Assises de la Sécurité 2013

- Table ronde: Sécurité des systèmes SCADA (Supervisory Control And Data Acquisition) (oct 2013).
- Animation de la table ronde: Le "RSSI Groupe virtuel", vers la mutualisation et la rationalisation des solutions de sécurité (oct 2013).


JSSI 2013

The JSSI is a French technical conference about IT Security organized by the OSSIR (Observatoire de la Sécurité des Systèmes d'Information et des Réseaux).

Retours d'expérience sur des campagnes d’audit de sécurité (mars 2013).
Download the presentation slides (PDF format).


Les Assises de la Sécurité 2012

Animation de la table ronde: Mobilité et sécurité, quels risques pour quels usages ? (oct 2012).


RIAMS 2012

Les RIAMS: les Rencontres de l'Identité, de l'Audit et du Management de la Sécurité.

Sécurité applicative: frein ou accélérateur ? (mai 2012)
Download the presentation slides (PDF format).


Conférence IDC Cloud Computing 2012

Lien vers la conférence IDC.

Protection des données dans le Cloud (jan 2012)
Download the presentation slides (PDF format).


Conférence annuelle sur le Traitement des Données Personnelles 2012

DII (Development Institute International) a organisé la 5ème conférence annuelle sur le Traitement des Données Personnelles.

Protection des données dans le Cloud (jan 2012)
Download the presentation slides (PDF format).


NetFocus

De la défense périmétrique à la défense en profondeur: dépérimétrisation, où en est-on ? (oct 2011)
Download the presentation slides (PDF format).


Les Assises de la Sécurité 2011 (Monaco)

Animation de la table ronde: Classification des données sensibles (oct 2011).


NetFocus 2011

NetFocus is a closed community of senior IT security executives and CISO's. In 2011, the annual conference took place in Lyon (France).
Roundtable: "Evolution du métier de RSSI dans l'entreprise, de la sécurité informatique à la gestion des risques opérationnels." (sep 2011)


Le Cercle Européen de la Sécurité des SI

"Le Cercle Européen de la Sécurité des SI" (IT Security European Club).
Roundtable about "myths and reality of IT Security" (jun 2011).
See the program of the roundtable and the report of the roundtable on SecurityVibes.


Matinée Sécurité Informatique - CIO / Le Monde Informatique

Roundtable about Risk Management and IT Security (jun 2011).
See the program of the roundtable.


JSSI 2011

The JSSI is a French technical conference about IT Security organized by the OSSIR (Observatoire de la Sécurité des Systèmes d'Information et des Réseaux).

Anonymisation de données en masse (mar 2011)
Download the presentation slides (PDF format).


Marcus Evans ERM 2009

Marcus Evans organizes an annual conference on Enterprise Risk Management (ERM).
Conference program.

IT Security Risks Management (dec 2009).
Download the presentation slides (PDF format).


Les Assises de la Sécurité 2009 (Monaco)

"Les Assises de la Sécurité" is an annual summit for CSO's and CISO's.
Roundtable about Enterprise Security Architecture (oct 2009).


Marcus Evans Enterprise Architecture 2009

Marcus Evans organizes an annual conference on IT Architecture and Urbanisation.
This year, I gave the Web Services Security talk (mar 2009).
Download the presentation slides (PDF format).


JSSI 2008

The JSSI is a French technical conference about IT Security organized by the OSSIR (Observatoire de la Sécurité des Systèmes d'Information et des Réseaux).

Protection des données personnelles et de la vie privée chez un opérateur de téléphonie mobile: aspects juridiques et techniques (may 2008)
Download the presentation slides (PDF format).


NetFocus 2008

NetFocus is a closed community of senior IT security executives and CISO's. No journalist is allowed to publish the content of the presentations. In 2008, the annual conference took place in Lyon (France).

Web 2.0 Security in theory and in practice (apr 2008)


Bars des Sciences

The "Bars des Sciences" organize informal talks about scientific subjects for the general public. The audience is generally very diversified.

Alerte aux virus (feb 2008)
See the summary of the roundtable.


Tables rondes EBG

EBG (Electronic Business Group) is an international business network which purpose is to boost innovation, new technologies, Internet and digital medias.

Obligations juridiques des Systèmes d'Information et implémentation technique (may 2007)
See the summary of the roundtable.


EUROSEC 2007

EUROSEC is a European conference for professionnal experts interested in the latest developments as well as the future prospects for IT security (technical and legal issues).

Créer un tableau de bord de Sécurité SI en 4 fois sans frais (may 2007)
Download the presentation slides (PDF format).


EUROSEC 2006

EUROSEC is a European conference for professionnal experts interested in the latest developments as well as the future prospects for IT security (technical and legal issues).

Démarche de sécurité dans les projets: théorie et réalité (avr 2006)
Download the presentation slides (PDF format).


Journées de la Sécurité des Systèmes d'Information du CELAR 2005

The CELAR JSSI (alias CESAR: Computer & Electronics Security Applications Rendez-vous) is a security conference organized by the CELAR, the French military center for electronics and computer science.

GIMLI: a hybrid simulator for IT Security (oct 2005)
GIMLI, like a flight simulator, is designed to train learners how to defend their own network against attacks.


EUROSEC 2005

EUROSEC is a European conference for professionnal experts interested in the latest developments as well as the future prospects for IT security (technical and legal issues).

Google hacking: quand Google devient un outil d'attaque (mar 2005)
Download the presentation slides (PDF format).


Conference ANAJ - IHEDN

You can find a description of this conference organized by the ANAJ - IHEDN (Institut des Hautes Etudes de Défense Nationale) here.

Cyber-terrorism: myth or reality ? (sep 2004)
Download the presentation slides (PDF format).


BlackHat USA 2004 (USA)

BlackHat is the most reknown international congress of security professionals. It takes place in Las Vegas.


Ph-neutral (Germany)

Ph-neutral is an invitation-only party in which people interested in computer security can share ideas/codes/success. It takes place in Berlin.

Information leakage in proprietary documents (may 2004)
Download the presentation slides (PDF format).


BlackHat Europe 2004 (Holland)

BlackHat is one of the most reknown international congresses of security professionals. It takes place in Amsterdam.

Security Patches Management on a Windows Infrastructure (may 2004)
Download the presentation slides from BlackHat Web site (PDF format).


EUROSEC 2004

EUROSEC is a European conference for professionnal experts interested in the latest developments as well as the future prospects for IT security (technical and legal issues).

La gestion des correctifs de sécurité dans un parc Windows (mar 2004)
Download the presentation slides (PDF format).


JIP 2004 (Tunisia)

JIP (Journées d'Informatique Pratique) is a Tunisian congress of IT professionals coming from several countries. In 2004, it took place in Rades, and the main theme was security.

  • Conference: La sécurité des réseaux sans fil
  • Conference: Emergence des applications intranet

Solutions Linux 2004

Solutions Linux is a French congress about Linux and free software solutions.

Fuite d'informations et Spyware dans Office et Windows (feb 2004)
Download the presentation slides (PDF format).


SPIRAL 2003 (Luxembourg)

SPIRAL is a European series of conferences for IT professionals. They take place in Luxembourg.

Exemple de scenario catastrophe technologique pour une entreprise (jun 2003)
Download the presentation slides (PDF format).


JIA 2003 (Tunisia)

JIA (Journées d'Informatique Appliquée) is a Tunisian congress of IT professionals coming from several countries. In 2003, it took place in Sousse, and the main theme was security.

  • Workshop: Securing Windows 2000 Server
  • Conference: Web Applications Security
  • Workshop: Security techniques in an intranet

EUROSEC 2003

EUROSEC is a European conference for professionnal experts interested in the latest developments as well as the future prospects for IT security (technical and legal issues).

La sécurité des applications Web - Pourquoi les firewalls sont impuissants (mar 2003)
The presentation is about the common vulnerabilities of Web applications and describes some solutions to secure them.
Download the presentation slides (Powerpoint format) from EUROSEC Web site (not available any more).


SPIRAL 2003 (Luxembourg)

SPIRAL is a European series of conferences for IT professionals. They take place in Luxembourg.

Vulnérabilités et sécurisation des applications Web (feb 2003)
Download the presentation slides (PDF format).


INFOSEC 2002

INFOSEC is a European congress of security professionals.

Attaques et sécurisation des applications Web (may 2002)
The presentation is about the new attacks against Web applications and the solutions to protect them.
Download the presentation text (Word format)


Le salon de la sécurité informatique 2000

Le salon de la sécurité informatique (INFOSECURITY) is an European congress of security professionals.

Sécurisation d'un réseau exploité sous Windows 2000 (nov 2000)
The presentation is about Windows 2000 network security and about a vulnerability database for Windows 2000.
Download the PDF


OSSIR

OSSIR (Observatoire de la Sécurité des Systèmes d'Information et des Réseaux) is a French association of security professionals.

The presentations are usually put online on the OSSIR Web site:
http://www.ossir.org/ftp/supports




Articles


01 Net

01 Net is one of the most read French newspapers about IT.


01 Informatique

01 Informatique is a French newspaper about IT in general.

  • Carte blanche : La sécurité du SI a sa place dans l'Architecture d'Entreprise (No 2020, 17 dec 2009). 
    Read online
  

MISC

MISC (Multi-system & Internet Security Cookbook) is a French newspaper specifically aimed at information security. The subjects are mostly technical ones.


Confidentiel Sécurité

Confidentiel Sécurité is a French newspaper about information security (both organisational and technical) and corporate risks.


Information Security Bulletin (ISB)

ISB is an international journal for IT security and information assurance professionals.


Linux Magazine

Linux Mag is a French newspaper written by Linux aficionados. Some special issues deal with security.


Internet Professionnel

Internet Professionnel is a French monthly newspaper and is basically targeted to Internet professionals.

  • Etablissez une stratégie IPSec entre vos serveurs Windows 2000 (avr 2001)
    Read online
  • Une MMC personnalisée pour réinitialiser les mots de passe (mar 2001)
    Read online
  • Sécuriser Windows 2000 sur Internet (2ème partie) (fev 2001)
    Read online
  • Sécuriser Windows 2000 sur un Intranet (1ère partie) (jan 2001)
    Read online
  • Sécurisation d'un serveur Web avec le Security Configuration Tool Set (mar 2000)
    Read online
  • Développez un outil de sécurité NT avec ADSI et WSH (sep 1999)
    Download the PDF
  • Authentification par certificats X.509 avec IIS (mar 1999)
    Download the PDF
  • 10 mesures pour améliorer l'efficacité de Microsoft Proxy Server 2.0 (dec 1998)
    Download the PDF
  • Administrez vos comptes utilisateurs NT à distance avec ASP et ADSI (nov 1998)
    Download the PDF


Programmez !

Programmez ! is a French monthly newspaper dedicated to development. A special issue was dealing with security, so I published a series of 3 articles about Windows NT 4.0 and Windows 2000 security:


Online

Some articles (both on the same subjects as above and on new ones) have been published online on the Edelweb Web site:




Books

Windows 2000 Security: Step-by-Step (English, 2001)
This book was published by the
SANS Institute and is the result of a collaborative work with some security experts.
The SANS Institute (System Administration, Networking, and Security) is a cooperative research and education organization through which a great number of system administrators, security professionals, and network administrators share the lessons they are learning and find solutions to the challenges they face.
I cannot make this book available online, but you can buy it and download a PDF version on the SANS Store Web site (note that I do not get any money for it).

ResEdit (French, 1996)
This book presents the principles and the advantages of Macintosh resources, then shows a great numbers of hacks made possible by ResEdit, the most powerful tool to play with resources.
Writen in 1995, it still remains useful since the Macintosh System still uses the kind of resources that are studied in this book.
You may be able to download a PDF version of this book manuscript here one day or the other.




Trainings and Courses

Some of the security trainings I gave (CELAR, Forum des Compétences, ...) cannot be made public.
Some other courses (
DESS Sécurité de l'Information de Limoges, ENSIMAG de Grenoble, ENST, ...) could be made available.

Check also the CEA summer school 2004.




Committees




Security advisories

I stopped to publish security advisories for the moment (lack of time... and new laws !). Here is an old one that is still worth reading, because the vulnerability has not been patched by Microsoft yet:

- IIS vulnerability: IIS 4.0 and 5.x metabase can reveal plaintext passwords