26 au 28 février, 2020
Montréal, Canada

Conférence Securité

5 Unicode vulnerabilities that could byte you
Securité The number of Unicode code points has never stopped to grow just like its integration in modern technologies. Your web application is likely to support input and output formatted in UTF-8 character encoding. In this talk, you will learn about the security implications. What are the potential side effects of normalizing a UTF-8 string? How encoding can affect security controls? What are the security risks brought by punycode domains?
Building a Secure Health App on Amazon Web Services
Securité Health data is some of the most private information your app can collect. You have a duty to your users to keep that data private, secure and encrypted. You also need to adhere to strict laws protecting that privacy, while scaling your company.

You'll learn about Protected Health Information (PHI) and how to protect it on Amazon Web Services.
Continuous Security: Integrate security into DevOps
Securité OWASP, a nonprofit composed of security experts from around the world, provides a number of free and open source tools designed by security experts to help your secure your applications. Learn how to integrate these tools - from active penetration tests to project dependency checkers - into your DevOps pipeline and deliver on the promise of continuous security.
Had I Only Known: Content Security Policy, Lessons Learned
Securité Content Security Policy is the most effective browser measure for web application security in a decade, and one of the reasons why browser developers start removing other security safeguards like their Cross-Site Scripting auditor. But creating an effective Content Security Policy is not always trivial. This session will discuss lessons learned from many CSP projects: what is working, where are issues, and what features can we look forward to?
How Hackers Attack GraphQL and What You Can Do About It
Securité As GraphQL is set to overtake RESTful architectures. This newfound popularity also draws the attention of hackers. Well-known companies have suffered from critical vulnerabilities hidden within GraphQL endpoints. I will show you what GraphQL looks like from a hacker's perspective and walk you through typical attacks against this technology. We will wrap up by discussing ways developers can protect their API from these threats.
How to Supercharge AppSec w Spring Security, OIDC & OAuth2
Securité In this session, you'll see how to leverage open source Spring Security to implement OpenID Connect & OAuth2 with ease, adding powerful & extensible mechanisms for authentication & authorization to provide end-to-end security for your critical systems.

This session is a live-coding "lock it down" exploration of how to secure your apps & assets now and maintain their security over time using 100% open source software.
Identify Vulnerabilities Within Your SDLC on a Budget
Securité As your code moves along the development and deployment pipeline, it becomes increasingly expensive to remediate security vulnerabilities. We will walk through each stage of this journey to introduce low cost and open source solutions to help you identify security issues before they are exposed to hackers. I will teach you how to use hacker tools to hack yourself first and protect yourself from breaches, on a budget.
Introducing privacy by design
Securité GDPR has brought privacy & security to the fore, but it's not obvious to developers how to make privacy part of everyday development. "privacy by design" has been around since 1995, but is only now receiving the attention it deserves, providing a clear set of principles that can be used to embed privacy into development workflows. Find out how we can use modern frameworks, tools, and automation to build auditable privacy into our applications.
It's new, it's shiny, it's... email?
Securité Email has been around forever and is taken for granted – but it has become more complicated in recent years. Newer features like SPF, DKIM, and DMARC are misunderstood and, judging by the questions I answer on Stack Overflow, many are getting even simple things wrong. So we'll go back to basics, review how email works, how to avoid common mistakes, take advantage of its new powers, and stay out of the spam folder of history.
No way, JOSE
Securité Is your first thought when thinking about cryptography, “nope, that’s not for me!”? There’s no need to. When explained with simple examples, you can see the basics are not that complicated. The Javascript Object Signing and Encryption, or JOSE for short is a framework that helps us deal with encryption. It describes ways to securely transfer data either signed (JWS) or encrypted (JWE). Let’s explore the wonderful world of cryptography together.
Passwords are so 1990
Securité As long as we’ve been using the internet, and way before that, we have been authenticating through some sort of username and password combination. It has become the standard. With the ever-increasing number of web-apps, we’re seeing more and more data breaches as well. What if we could build our authentication processes in a way the user doesn’t need a password?
Privacy in the Age of Analytica
Securité You are the product. The digital age has brought us many conveniences with the very real cost of our privacy as payment. The terms and conditions that none of us read have allowed companies to build a persona of who we are, and possibly better than we even know ourselves. Learn what your privacy looks like today, and take very real steps toward reclaiming the anonymity that allows you to move through the world without being constantly sold.
Protecting yourself against attacks through the build
Securité Organisations build software all the time, from developer machines to CI, even public pull requests.
There are security risks associated with these actions! Come discover what they are and how to mitigate them.

The build tool is about execution of modifications and thus inherently insecure. However risks can be mitigated through:
* Trusted dependencies
* Reproducibility
* Vulnerability tracking

Gradle will be used for examples
Safe Enough: Balancing Security and Usability
Securité Security and Usability have been at loggerheads since we realized we need to secure our digital existence with the secure option almost always being the least usable option. More recently we have developed more usable solutions and yet users still opt for the less secure option when they can. We’ll explore how users understand their security and how we can improve their security habits through good design.
systemd for developers and DevOps
Securité systemd is the default init system on several Linux distros amd can do more than just start services on boot. It maintains dependencies between services, can restart failing services or activate them on demand, handle temp files, and much more. Services can also directly interact with its API. I'll show you how to use systemd to run and monitor your complex application and add tighten security like private /tmp or resource restriction on top.
The Future of Authentication - An Introduction to WebAuthn
Securité In March 2019 the W3C released the Level 1 of the recommendation for the new Web Authentication Standard "WebAuthn". Supported by all major browser vendors, it strives to make passwords as well as phishing a thing of the past. Given millions of stolen credentials, the switch away from passwords should happen rather sooner than later. Learn what WebAuthn is about, how it works, and how to leverage its potential for you site today!

Explorez les 156 présentations

Montréal 2020 sponsored by

© 2010-2024 ConFoo. Tous droits réservés. Code de conduite