Not a week goes by without a breaking story on a major software security incident. Most of us shrug off the incident, often forgetting that these incidents have a deep impact on the people behind the code. Judging and shaming are easy, but how often do you really think about the story behind an incident?

This keynote reflects on several real-life security incidents and their impact on the people behind the code. From each incident, we will extract lessons learned and translate them into best practices for building secure software. These best practices are easy to comprehend, but they might be challenging to follow.

Training overview:

Your project intends to use a physical device and thereby enters the world of Internet of Things (IoT)? Your app uses state-of-the-art security but how does the IoT device impact the overall security? Does the device jeopardize the success of the company by exposing your data and making the project prone to a data breach? In this bootcamp you will learn the essential tasks to assess an IoT device and for its security evaluation.

This training slips you into the role of a full-stack engineer of the (fictitious) startup “TrackR4”. Your company is leading the vehicle tracking industry. The last year your team developed a new app and it is ready to ship. Besides the app the company decides to introduce a new hardware tracking solution last minute. The all-in-one box provides GPS, Internet via 3G, ethernet as well as serial and digital interfaces. You get two days to assess some evaluation devices and to report in with a Go/NoGo decision to buy 10 000 pieces. No pressure 😉

This bootcamp aims to teach the process of security testing of an Internet of Things (IoT) device. You will will learn to use tools and vender resources and the device itself to conduct tests in order to evaluate the security of the device and its ecosystem. This hands-on-training is lab based. After teaching the theoretical background and methods, you will be provided with challenges which are based on the device under test. The labs are guided by the instructors and outlined by a written guide.

Target group: Any software engineers, interested in learning the process of security testing of an Internet of Things (IoT) device.

Participant requirements: Software engineering or system administration background with limited or no skills in hardware security.

Training content:

This training aims to cover the most common and hazardous security vulnerabilities of Internet of Things (IoT) devices, based on the OWASP IoT Top 10. First, we will start with basic penetration testing techniques like port scanning, service discovery and a wireless wiretap. After creating a threat model and populating it with vendor information, more advanced attacks are developed. Via extraction of the firmware the security test moves from a black box test to a grey box test and we will test for known vulnerabilities as well as discover new vulnerabilities. After spotting a possible vulnerability an exploit is prototyped, in order to proof the exploitability and to assess the resulting risk. After that, we will move from software attacks to hardware assessment, so that you learn to analyze the circuit board (PCB) and possible attack vectors.
With a logic analyzer, we will capture the logic signal of some wires and you will learn to transform the signals in a form usable with a computer. With this ability the hunt for debug interfaces begins. Is the device prone to manipulation, as the attacker opens the case? You will learn the stages of the boot process and how to interfere with it. The last part is a man-in-the-middle attack between on-board components of the PCB.

After the technical evaluation of the device, we will learn to rate vulnerabilities and how to communicate with the vendor of the device in order to improve the quality of the next builds.

• Methodology of security tests
• IoT threat model
• Device fingerprinting
• Using vendor information and open source intel
• Vulnerability discovery
• Firmware extraction
• Reverse engineering of firmware
• PoC exploit development
• Dumping firmware via hardware and software
• Circuit board (PCB)
• Bus communication systems and interfaces
• Debug interfaces
• Boot loader
• Man-in-the-middle attacks
• Vendor communication

Further information:

Hardware requirements: All participants should bring a Laptop (see below) and are provided with a Virtual Machine.

• Dual core processor (i5/i7), 8GB RAM, 40 GB of harddisk (SSD)
• Run VMs
• Connect USB devices
• Change IP address of the host system

Maximum number of participants: 12

Training overview:

Whether you like it or not, we all live in a world of Single Page Applications. Frontend JavaScript frameworks such as Angular and React have changed the way we build web applications. However, did you know that these frameworks also disrupt the security landscape? For example, Angular and React change the nature of XSS as we know it. They also conflict with modern security measures, such as Content Security Policy.

In this bootcamp, you will learn how to build secure Single Page Applications. We cover changes in the security model of an application, common threats to an application, framework features that increase security, and state-of-the-art security technology you should start using. This training course is not just any training course. It is packed with in-depth and up-to-date content. We do not merely brush over a threat and defense but focus on the underlying cause and consequences. Why do we have this problem? Which mitigations are often used? Why are some ineffective? Which one is the current best practice? These are the questions that will be answered throughout the training.

Target group: This security training specifically targets modern web developers. Anyone involved in building single-page applications (e.g., Angular, React) or managing development teams should be here.

Participant requirements: To participate in this bootcamp, you should have development experience with single-page applications and the underlying APIs. Familiarity with
the basics of security (e.g., simple XSS attacks) is helpful, but not required. The training will talk about Angular and React specifically, but also applies to other frameworks, such as EmberJS or Vue.js.

Training content:

• XSS in Angular and React
• Advanced injection attacks
• The limitations of CSP in Single Page Applications
• Recent developments in CSP
• Protecting yourself against malicious third-party content
• JWT abuse and best practices
• The intricacies of Cross-Origin Resource Sharing
• Recent developments in using OAuth 2.0 and OpenID Connect

The training consists of both lectures and hands-on lab sessions. Lectures go into depth on security threats and mitigation strategies. Labs are conducted in a custom-built competitive lab environment. Security challenges give you hands-on experience with attacks and defenses. You will walk away from this training with an overview of current best practices, along with actionable advice on implementing them.

Further information:

Hardware requirements: To participate in the lab sessions, participants need an internet-accessible laptop with a modern browser installed (E.g., Chrome, Firefox).

Maximum number of participants: 25

Training overview:

Threat modeling is the primary security analysis task performed during the software design stage. Threat modeling is a structured activity for identifying and evaluating application threats and vulnerabilities. The security objectives, threats, and attacks modeling activities during the threat modeling are designed to help you find vulnerabilities in your application and the supporting architecture. You can use the identified vulnerabilities to help shape your design and direct and scope your security testing. For this training, we will teach an iterative and incremental threat modeling method that is integrated in the development and deployment pipeline.

Threat modeling allows you to consider, identify, and discuss the security implications of user stories in the context of their planned operational environment and in a structured fashion. It also allows consideration of security issues at the component or application level. In this bootcamp you will learn how to perform threat modeling through a series of workshops, where our trainer will guide you through the different stages of a practical threat model based on an AWS and microservices migration from a classical web application.

Target group: DevOps Engineers

Participant requirements: Participants should be familiar with basic knowledge of microservices, cloud architectures and AWS.

Training content:

Threat modeling introduction

• Threat modeling in DevOps
• What is threat modeling?
• Why perform threat modeling?
• Threat modeling stages
• Diagrams
• Identify threats
• Addressing threats
• Increment a threat model

Diagrams – what are you building?

• Understanding context
• Doomsday scenarios
• Data flow diagrams
• Trust Boundaries
• Hands-on: diagram B2B web and mobile applications, sharing the same REST backend

Identifying threats – what can go wrong?

• STRIDE introduction
• Spoofing threats
• Tampering threats
• Repudiation threats
• Information disclosure threats
• Denial of service threats
• Elevation of privilege threats
• Attack trees
• Hands-on: Threat identification as part of migrating the booking system application to AWS

Addressing each threat

• Cloud Service Provider mitigation patterns
• Microservices mitigation patterns
• Authentication: mitigating spoofing
• Integrity: mitigating tampering
• Non-repudiation: mitigating repudiation
• Confidentiality: mitigating information disclosure
• Availability: mitigating denial of service
• Authorization: mitigating elevation of privilege
• Hands-on: AWS threat mitigations for the booking system build on microservices

Practical threat modeling as part of the DevOps pipeline

• Typical steps
• Inception threat modeling
• Effective threat model workshops
• Communicating threat models
• Updating threat models
• Integrating threat modeling as part of sprint planning
• Threat modeling examples and scenarios for a Three Amigos meeting

Attack libraries

• Attack libraries
• CAPEC
• OWASP Top 10
• Other lists
• Create your own checklist
• Hands-on: Building an attack library for CI/CD pipelines

Threat modeling resources

• Open-Source tools
• Commercial tools
• General tools
• Threat modeling tools as part of the DevOps toolchain

Threat Modeling – Real-Life Use Cases

As highly skilled professionals with years of experience under our belts we know that there is a gap between academic knowledge of threat modeling and the real world.

In order to minimize that gap we have developed practical Use Cases, based on real life projects. Each use case includes a description of the environment, together with questions and templates to build and iteratively improve a threat model. Using this methodology for the hands-on workshops we provide the participants with a robust training experience and the templates to incorporate threat modeling best practices in their daily DevOps work.

The participants will be challenged to perform practical threat modeling in squads of 3 to 4 people covering the different stages of threat modeling on an incremental business driven CI/CD scenario:

• Sprint 1: Modeling a hotel booking web and mobile application, sharing the same REST backend
• Sprint 2: Threat identification as part of migrating the booking system application to AWS
• Sprint 3: AWS threat mitigations for the booking system build on microservices
• Sprint 4: Building an attack library for CI/CD pipelines

After each hands-on workshop, the results are discussed, and the students receive a documented solution.

Further information:

Participant package: The course students receive the following package as part of the course:

• Hand-outs of the presentations
• Work sheets of the use cases
• Detailed solution descriptions of the use cases
• Template threat model
• Template to calculate risk levels of identified threats
• Receive certificate

Hardware requirements: Participants should bring their own laptop or tablet to read and use the training handouts and exercise descriptions. No further requirements.

Maximum number of participants: 25

In this talk we will cover the basics of Mobile (Android and iOS) App Security.
We will first start with an introduction and motivation, talking about why do you need to care about app security, what are the important things to protect, and try to understand the motivation an attacker might have to hack your application.
After that we will move on to more technical details, and we will cover the things you (as a developer) can do to protect your applications against the most common security threads. This includes secure networking, user data protection, root/jailbreak detection (and understanding the effects of a rooted device), IP protection, etc.

In large cluster environments with hundreds of different users with their respective permissions, access management is sometimes difficult to apply. Common approaches are using a corporate PKI to issue individual client certificates or adding webhooks. Another way is verifying signed JWT tokens (OpenID Connect) which is well-suited for companies who already using directory services (like Active Directory or OpenLDAP).

In this talk, ÖBB and WhizUs will demonstrate a real-live example of how we manage multiple kubernetes clusters in multiple projects with hundreds of different users by connecting to the company's Active Directory Service through Keycloak for JWT validation.

Participants will learn how it is possible to configure and operate multiple, including larger, Kubernetes clusters in terms of centralized user and rights management. In particular, best practices, open source solutions and common enterprise setups will be presented.

Legal liability for insecure software - "write once, cause damage anywhere"

• Are there acceptable vulnerabilities?
• Liability for off-the-shelf vs. custom software
• Liability in the SaaS context

Surface attack, networking complexity and data explosion and siloed teams and services are consequences of moving to microservices architectures. In this introductory talk, you learn what the different challenges this type of architecture – and less decoupled ones, half way between monolith and microservices – mean in terms of development and security and how we cope with them at GitLab.

According to the Department of Homeland Security, 90% of security incidents result from exploits against defects in the design or code of software. This is even so in 2002 Bill Gates already requested a paradigm shift from features to security in his trustworthy computing memo with the sentence "So now, when we face a choice between adding features and resolving security issues, we need to choose security." Lucas v. Stockhausen will show in his talk how applications can be built in a secure way using existing technologies and how developers can be best involved into this.

User authentication has become so complex that developers should not touch it anymore. Anyone building a modern application should consider using an identity provider that handles authentication. However, doing so requires the use of OpenID Connect (OIDC), which brings its own complexity.

In this talk, we look at securely implementing OIDC in an Angular application. We investigate which flow to use in which scenario. We look at the security properties in OpenID Connect, and how to ensure your application respects them. In the end, you will walk away with practical advice on implementing authentication with OIDC in Angular.

Ever thought of encrypting uploaded files in the web browser before they hit the server? Most web browsers nowadays offer encryption modules via the Web Crypto API for the encryption itself, but we’ll soon see that this isn’t enough. What about the correct cipher modes? How can we ensure confidentiality, integrity and authenticity? What about big files and limited memory availability. In this talk, we’ll cover the following topics:

• Issues you’ll face when implementing end-to-end file encryption in the browser
• The crypto basics behind file and metadata encryption
• The Web Crypto API
• The FileReader API for chunked uploads
• The ReadableStream API for chunked downloads
• Service Workers and how they’ll help us
• Browser compatibility of the mentioned APIs
• What we can do to support older browsers
• The hardest part: key distribution