Multi-platform, multi-client, and highly-mobile users bring a new set of challenges, so the approaches of the past are no longer appropriate for modern applications. This two-day workshop is your chance to dive into all things security related to these new technologies. Learn how to securely connect native and browser-based applications to your back-ends and integrate them with enterprise identity management systems as well as social identity providers and services.


.NET Core, ASP.NET Core, MVC, Web APIs, Claims, OpenID Connect, OAuth 2.0, WS-Federation, SAML, JSON Web Tokens, Single Sign-on and off, Federation, Delegation, Home Realm, Discovery, CORS

Social Logins (e.g. Google, Facebook, Twitter, etc.)


Attendees will need to bring a computer with the latest .NET Core SDK and the IDE of your choice (e.g. Visual Studio) installed.

2 Days

8-9 Jan

Identity & Access Control for modern Applications and APIs using ASP.NET Core 7

.NET

Security

"Hack Yourself First" is all about building up defensive skills in developers. It looks at security from the attacker's perspective and takes them through the steps necessary to exploit vulnerable software on the web so that they can experience hacking first hand. Workshop participants are set specific goals they must complete that involve probing for risks and then exploiting discrete vulnerabilities in a specially built vulnerable application. The interactive nature of the workshop means that multiple attack vectors are usually identified across the spectrum of participants and each person contributes their own unique perspective as to how specific risks are exploited.

The objective of the workshop is that each person walks away with demonstrated experience across a broad spectrum of specific risks. They not only learn about but also demonstrate practical experience across a range of different vulnerabilities targeted to the specific needs of the group.

Courses run for two days on the following schedule:

The first day build fundamental security skills that all technology professionals delivering applications on the web should posses:

- Discovering Risks via the Browser
- Using an HTTP proxy
- XSS
- SQL Injection
- CSRF
- HTTPS
- Framework Disclosure

The second day delves deeper into online risks, covering more advanced topics in greater depth:

- Password Cracking
- Account Enumeration
- FiddlerScript
- Content Security Policy
- Session Hijacking
- Subresource integrity
- Brute Force Attacks
- Automating Attacks and Review

Attendees will get taught the mechanics of each of these risks and of course the defensive patterns required to defend against them. But more than that, they get exposed to how to think about security; how to apply it in depth via multiple defences, how to choose appropriate controls based on the specific risk of the feature and how to have the discussion about what makes sense in different circumstances.

Above all though, security is just one factor in delivering working software and it has to be applied appropriately. Sometimes it comes with a trade-off against usability or cost and decisions have to be made about not what's just most secure, but what's in the overall best interests of the product being built. This workshop helps those who attend have the right discussions about when and where to invest in security.

- Software Developers
- System Administrators
- Testers

This workshop is aimed at any software developer, system admin or tester who wants to get a better understanding what is going on in cyber space if it comes to hacking and cracking of systems. This workshop enables you to take a pro-active approach and you learn how hackers will try to break your system. This workshop will be an eye opener for most attendees and it is the starting point of becoming a better developer. It all starts with awareness and improving your own habits. So start hacking yourself first, to become a better developer!

Attendees will need to use their own computer with one of following software options installed: Fiddler: 

https://portswigger.net/burp/communitydownload

If possible please also bring your smartphone.

Hack Yourself First: How to go on the Cyber-Offence

This workshop is here to give you the skills you need to make your APIs secure. We're going to think like an attacker to test APIs and like a defender to figure out the best ways to protect them. With deep-dive talks, real-world demos, fun quizzes, and hands-on labs, you'll learn how to lock down your APIs.
During this hands-on training, we'll explore:

The security model of API-based web applications

Recognizing and addressing authorization failures

Understanding Broken Object Property Level Authorization (BOPLA)

Fixing Broken Object Level Authorization (BOLA)

Testing the security of APIs that use JWTs

Best practices for making JWTs secure in modern APIs

Identifying, exploiting, and fixing Server-Side Request Forgery (SSRF) issues

Understanding Cross-Origin Resource Sharing (CORS)

Configuring secure CORS policies for various use cases

Tracking user authentication securely with sessions or tokens

Relying on OAuth 2.0/2.1 for securing APIs

Q & A throughout the workshop to clear up any doubts


This workshop is about more than theory. We're all about giving you practical security tips you can use right away as an API developer. We dig into the root causes of API threats and how to handle them. We don't just skim the surface of problems and solutions - we get into the why's and how's, looking at common fixes, why some fall short, and which ones are currently the best way to go.
By the end of this workshop, you'll be up-to-speed on the best practices for API security. You'll also leave with a handy list of steps to check and boost the security of your applications.




This training is perfect for developers and architects who work a lot with APIs. If your role involves building, testing, or designing modern apps, this workshop will give you a thorough, up-to-date understanding of the best ways to keep things secure. We'll often use NodeJS, Flask, and Spring Boot in our code examples and demos, but you'll easily be able to apply what you learn to other languages and frameworks.




These testimonials from previous workshops give you a good idea of what to expect:

Trainer is great and an expert in the domain. All of the topics are very relevant. Practical examples for most of the topics. Excellent communication and addressing of questions.

Even though the topic is broad, there was no single moment where my focus went astray. Philippe talks in a way to keep you interested to listen to him.

I liked the the pleasant and relaxed way of speaking and the fresh style of presentation of this kind of dry stuff :)

Philippe is a friendly and knowledgable trainer and delivered an interesting course that was well presented. Questions were answered promptly and in a detailed way.


To participate in this training, you should have some experience with building API-based applications. Knowledge of application security can be helpful, but is not required.




To participate in the lab sessions, participants need a computer with a full-featured modern browser installed (preferably Chrome).


Bulletproof APIs: Hands-On API Security

The training will provide its students with:

knowledge on how to use tools to find vulnerabilities in native applications

give a hands-on experience in some exploitation techniques

 - Slack: Will be setup a week in advance to facilitate resolving of any technical issue

 cloud instance: guarantees same environment

This training is explicitly targeted at security professionals with some programming experience in C or C++.

Demystify exploitation, show that exploitation is a mindset, not a set of techniques

Demonstrate the motivation for mitigations in the platforms, languages and tools

Show that C++ and C are not easy to reason about

Teach the students to recognize constructs that have a higher risk of having vulnerabilities

Teach the students which tools can be used to find bugs

DAY 1 - FINDING VULNERABILITIES USING FUZZING

Exploitable: UB and Compiler Optimizations

DAY 2 - EXPLOITATION AND WRITING SHELLCODE

Exploit: Return Oriented Programming (ROP)

(In)Secure C++: Sec Edition

Many organisations find themselves drowning in "possible vulnerabilities", struggling to streamline their processes and not sure how to measure their progress. If you use these tools in your organisation, this may sound familiar.

There are a lot of general resources about application security and automating application security testing. However, there is almost no guidance on how to actually make the tools work effectively within an organisation, and in particular the manual processes required to operationalize the automated tools.

In this unique course you will learn how to address these problems and more (in a vendor-neutral way), with topics including:

The problems these tools should be solving for you?

Customising and optimising these tools effectively

Building tool processes which fit your business

Automating workflows using CI/CD without slowing it down.

Showing the value and improvements you are making

Faster and easier triage through smart filtering

How to focus on fixing what matters and cut down noise

Techniques for various alternative forms of remediation

Comparison of the different tool types covered.

To bring the course to life and let you apply what you learn, you will work in teams (or individually if you prefer) on table-top exercises where you design processes to cover specific scenarios and have the opportunity to explain and justify your decisions to simulated stakeholders. You will also practice evaluating real vulnerabilities to prioritise your remediation efforts and focus on what really matters.

For these exercises, you will work based on specially designed process templates (which we will provide) which you can use afterwards to apply these improvements within your own organisation.

Upon completion of this training, attendees will take away:

A deep understanding of how each tool really works, the differences between them, and how to build effective processes around each of them.

Efficient approaches to triaging application vulnerabilities, cutting down noise and addressing what matters most.

Sample process documents with guidance on the key pointers for evaluating, implementing, optimising, and operating these tools.

Tablet or laptop with an internet connection.

Devices should be able to use Microsoft Office or Google Docs.

Detailed process worksheet templates for each class of tool.

Vulnerability triage workflow for each class of tool.

Course slides and supporting materials used in the exercises.

Access to the sample projects/scripts used in the exercises.

Feedback on their responses to the exercises and further suggestions.

Dedicated chat channel to use during and after the course to discuss and ask questions.

For lots more details including a full course outline and previous participant feedback, see the course page at 

Building a High-Value AppSec Scanning Programme

DevOps

Tools

Testing

Application Security

People

Process

Security Tooling

Day 1: General Agnostic Secure Coding Advice:On the first day of this intensive course, participants will dive into the fundamental principles and best practices for secure coding. They will gain a solid understanding of secure coding principles that can be applied across various programming languages and frameworks. The day will include theoretical discussions, practical examples, and suitable-for-work-memes.


Introduction to a Secure System Development Life Cycle (S-SDLC)

The 17 Commands of Secure Coding (according to Alice and Bob Learn Application Security, the book)

What Developers Need to Know if There’s a Security Incident

Day 2: Day two of this training will focus on how to use a Semgrep, a next generation static analysis tool, to enforce secure defaults and code quality standards, at scale. There will be hours of hands on exercises, starting from very simple to more advanced topics, using the open source and free version of Semgrep, so that you can immediately go back to you office and use what you learned to implement your own secure defaults at work.

Overview of static analysis and its benefits

What: Making the Secure Way the Easier Way

Understanding secure coding rules and secure default configurations

Integrating static analysis into the development process

Configuring secure coding rule sets based on industry standards

Analyzing code for security vulnerabilities and quality issues

Incorporating secure coding into CI/CD pipelines

Hands-on with Semgrep (and bring your own code!)


Understand the importance of secure coding and its impact on application security
Acquire practical knowledge of secure coding principles and best practices
Gain familiarity with common vulnerabilities and effective mitigation techniques
Master the use of static analysis tools to enforce secure coding standards
Learn how to establish secure defaults in code configurations
Strengthen the ability to identify and remediate security vulnerabilities
Develop strategies to integrate secure coding practices into development workflows

Join us for the "Secure Coding and Secure Defaults" course and equip yourself with the essential skills and techniques to ensure that security is at the core of your code. Let's work together to build robust and resilient applications that withstand the ever-growing security challenges. Enroll today and secure your coding future!


Anyone who writes code for a living or works in application security.

A basic understanding of software and how it is built (the SDLC). You will need to know how to code in one web related programming language other than HTML, but it does not matter which one. Ideally you’ve used GitHub before, but if not it’s no big deal; we can show you.

You will need wifi, a modern web browser (Chrome or Firefox), and a free GitHub account.

NDC { Security }

Workshops

09:00 - 17:00 (UTC+01)

Identity & Access Control for modern Applications and APIs using ASP.NET Core 7

Anders Abel

Hack Yourself First: How to go on the Cyber-Offence

Scott Helme

(In)Secure C++: Sec Edition

Patricia Aas

Bulletproof APIs: Hands-On API Security

Philippe De Ryck

Building a High-Value AppSec Scanning Programme

Josh Grossman

Secure Coding and Secure Defaults

Tanya Janca

Claudio Merloni