Multi-platform, multi-client, and highly-mobile users bring a new set of challenges, so the approaches of the past are no longer appropriate for modern applications. This two-day workshop is your chance to dive into all things security related to these new technologies. Learn how to securely connect native and browser-based applications to your back-ends and integrate them with enterprise identity management systems as well as social identity providers and services.


.NET Core, ASP.NET Core, MVC, Web APIs, Claims, OpenID Connect, OAuth 2.0, WS-Federation, SAML, JSON Web Tokens, Single Sign-on and off, Federation, Delegation, Home Realm, Discovery, CORS

Social Logins (e.g. Google, Facebook, Twitter, etc.)


Attendees will need to bring a computer with the latest .NET Core SDK and the IDE of your choice (e.g. Visual Studio) installed.

2 Days

Identity & Access Control for modern Applications and APIs using ASP.NET Core 7

.NET

Security

"Hack Yourself First" is all about building up defensive skills in developers. It looks at security from the attacker's perspective and takes them through the steps necessary to exploit vulnerable software on the web so that they can experience hacking first hand. Workshop participants are set specific goals they must complete that involve probing for risks and then exploiting discrete vulnerabilities in a specially built vulnerable application. The interactive nature of the workshop means that multiple attack vectors are usually identified across the spectrum of participants and each person contributes their own unique perspective as to how specific risks are exploited.

The objective of the workshop is that each person walks away with demonstrated experience across a broad spectrum of specific risks. They not only learn about but also demonstrate practical experience across a range of different vulnerabilities targeted to the specific needs of the group.

Courses run for two days on the following schedule:

The first day build fundamental security skills that all technology professionals delivering applications on the web should posses:

- Discovering Risks via the Browser
- Using an HTTP proxy
- XSS
- SQL Injection
- CSRF
- HTTPS
- Framework Disclosure

The second day delves deeper into online risks, covering more advanced topics in greater depth:

- Password Cracking
- Account Enumeration
- FiddlerScript
- Content Security Policy
- Session Hijacking
- Subresource integrity
- Brute Force Attacks
- Automating Attacks and Review

Attendees will get taught the mechanics of each of these risks and of course the defensive patterns required to defend against them. But more than that, they get exposed to how to think about security; how to apply it in depth via multiple defences, how to choose appropriate controls based on the specific risk of the feature and how to have the discussion about what makes sense in different circumstances.

Above all though, security is just one factor in delivering working software and it has to be applied appropriately. Sometimes it comes with a trade-off against usability or cost and decisions have to be made about not what's just most secure, but what's in the overall best interests of the product being built. This workshop helps those who attend have the right discussions about when and where to invest in security.

- Software Developers
- System Administrators
- Testers

This workshop is aimed at any software developer, system admin or tester who wants to get a better understanding what is going on in cyber space if it comes to hacking and cracking of systems. This workshop enables you to take a pro-active approach and you learn how hackers will try to break your system. This workshop will be an eye opener for most attendees and it is the starting point of becoming a better developer. It all starts with awareness and improving your own habits. So start hacking yourself first, to become a better developer!

Attendees will need to use their own computer with one of following software options installed: Fiddler: 

https://portswigger.net/burp/communitydownload

If possible please also bring your smartphone.

Hack Yourself First: How to go on the Cyber-Offence

The training will provide its students with:

knowledge on how to use tools to find vulnerabilities in native applications

give a hands-on experience in some exploitation techniques

 - Slack: Will be setup a week in advance to facilitate resolving of any technical issue

 cloud instance: guarantees same environment

This training is explicitly targeted at security professionals with some programming experience in C or C++.

Demystify exploitation, show that exploitation is a mindset, not a set of techniques

Demonstrate the motivation for mitigations in the platforms, languages and tools

Show that C++ and C are not easy to reason about

Teach the students to recognize constructs that have a higher risk of having vulnerabilities

Teach the students which tools can be used to find bugs

DAY 1 - FINDING VULNERABILITIES USING FUZZING

Exploitable: UB and Compiler Optimizations

DAY 2 - EXPLOITATION AND WRITING SHELLCODE

Exploit: Return Oriented Programming (ROP)

(In)Secure C++: Sec Edition

Through in-depth lectures, hands-on labs, live demos and interactive quizzes, this workshop will teach you how to build secure applications for the modern web. We explore fundamental challenges that drive the design of your applications. We also introduce common vulnerabilities in frontend and backend and investigate relevant defenses. Additionally, we dive into coding guidelines and defense-in-depth strategies that allow you to increase the security of your applications.

Concretely, we will cover the following topics in this hands-on training:

The security model of modern web applications

Cross-Site Scripting problems in modern frontends

Using Trusted Types to eradicate XSS vulnerabilities

Assessing and improving your authorization policies

JWT security failures in modern applications

API security testing to avoid common misconfigurations

Server-Side Request Forgery (SSRF) attacks and defenses

At the end of this workshop, you will understand modern application security best practices and you walk away with a list of actionable items to assess and improve the security of your applications.

This security training specifically targets developers and architects building modern web frontends / APIs. Anyone involved in building, testing, and designing modern applications should be here. This training course gives you an up-to-date and in-depth look at current security best practices. We do not merely brush over a threat and defense but focus on the underlying cause and consequences. Why do we have this problem? Which mitigations are often used? Why are some ineffective? Which one is the current best practice? These are the questions that will be answered throughout the training.

These testimonials from previous workshops give you a good idea of what to expect:

Trainer is great and an expert in the domain. All of the topics are very relevant. Practical examples for most of the topics. Excellent communication and addressing of questions.

Even though the topic is broad, there was no single moment where my focus went astray. Philippe talks in a way to keep you interested to listen to him.

I liked the the pleasant and relaxed way of speaking and the fresh style of presentation of this kind of dry stuff :)

Philippe is a friendly and knowledgable trainer and delivered an interesting course that was well presented. Questions were answered promptly and in a detailed way.

To participate in this training, you should have development experience with web applications and APIs. Familiarity with the basics of security is helpful but not required. The training will include Angular / React / NodeJS / Java Spring / .NET Core examples but is just as relevant for other frameworks and technologies.

To participate in the lab sessions, participants need a computer with a full-featured modern browser installed (E.g., Chrome, Firefox).

A Builder's Guide to Securing Modern Applications

In this hands-on workshop, the instructors will dive into the methods used to perform a successful real world Kubernetes security audit. Attendees will learn through instructor-led scenarios how to perform cluster / workload inventory, rapidly assess the security posture of workloads, enforce least privilege for end-users and service accounts, and comply with established compliance standards.

Each workshop attendee will be provided with a pre-configured public cloud environment running real-world Kubernetes workloads. The tools and methodologies covered in this workshop will give attendees the real world experience to perform a rapid Kubernetes security posture audit in their own organization’s clusters.

The audience for this workshop is anyone who wants to get some hands-on experience assessing the security of modern Kubernetes environments. This is ideal for developers, platform engineers, security engineers, and anyone who needs to level up quickly on the ins and outs of Kubernetes security. The audience will gain knowledge of the tools and techniques used by security professionals who are faced with a Kubernetes environment that needs assessed quickly and efficiently.

Batten Down the Hatches! A Cluster Security Journey

Kubernetes

Root, UID transitions, and capabilities (*)

Creating a child process in a new namespace: clone()

Combining user namespaces with other namespaces

What does it mean to be superuser in a namespace?

The BPF virtual machine and BPF instructions

The primary audience comprises designers and programmers building privileged applications, container applications, and sandboxing applications. Systems administrators and DevOps engineers who are managing such applications are also likely to find the workshop of benefit.

The workshop consists of a mixture of presentations coupled with practical exercises that allow participants to apply the knowledge learned in the presentations.

Participants should be familiar with fundamental system programming topics such as file I/O using system calls, signals, and the system calls that define the lifecycle of a process (

). For a refresher on these topics, you can download the course materials available at 

. In addition, participants should have a reading knowledge of the C programming language. (Note, however, that the practical sessions do not require writing C programs.)

You'll need a laptop with Linux installed - either as a native install or inside a virtual machine (VM). You should ensure that you have a fairly recent Linux distribution.

NDC { Security }

Workshops

09:00 - 17:00 (UTC+01)

Identity & Access Control for modern Applications and APIs using ASP.NET Core 7

Anders Abel

(In)Secure C++: Sec Edition

Patricia Aas

A Builder's Guide to Securing Modern Applications

Philippe De Ryck

Hack Yourself First: How to go on the Cyber-Offence

Scott Helme

Batten Down the Hatches! A Cluster Security Journey

Jimmy Mesta

Steve Wade

Linux Security and Isolation APIs Fundamentals

Michael Kerrisk