Mehri Yahyaei
Mehri Yahyaei brings over 17 years of expertise in cybersecurity evaluation, software quality assurance, and the application of international standards across both industry and academic environments. Her professional focus encompasses Common Criteria (ISO/IEC 15408), ISO/IEC 27006, FIPS 140-2/3, as well as sector-specific standards in automotive cybersecurity such as ISO/SAE 21434 and ISO 26262.
She is actively engaged in global cybersecurity technical communities. As a member of the United Nations Open-Ended Working Group (OEWG), representing the NGO sector, she contributes to international dialogues on cyber stability and responsible state behavior. Her affiliations span a range of expert forums, including international software and systems engineering committees (such as JTC1/SC27), Common Criteria technical and user communities, and global initiatives promoting diversity and innovation in AI and cybersecurity.
An invited speaker at leading international conferences, including the International Cryptographic Module Conference (ICMC) in 2019 and 2020, and ICCC 2025. Her academic and professional development includes specialized training in cybersecurity engineering, intelligent threat modeling, software quality and security evaluation, uncertainty estimation, and conformity assessment aligned with standards such as ISO/IEC 17025.
Session
OpenSSL is everywhere, powering secure communication in the systems we rely on
daily. However, that reach also makes it a prime target for attackers. In this
session, we will walk through how to use threat modeling, with a focus on
STRIDE and attack trees, to uncover weak spots and vulnerabilities in OpenSSL-based systems before
attackers do. We will look at where vulnerabilities tend to creep in, from
unsafe defaults and risky configurations to flawed assumptions in system
design. I will also share what a solid incident response plan looks like when
cryptographic components are involved, especially under standards like FIPS
140-3. Whether you are writing code, securing infrastructure, or preparing for
the next zero-day, you will leave with practical strategies to reduce risk and
respond more effectively when something breaks.