Agenda

Uncover the Secrets of PKCE: Elevating OAuth2.0 for security of native clients

Security Stage — 30 minutes Security

Discover the power of PKCE (Proof Key for Code Exchange), an OAuth2.0 extension. 
OAuth has become the go-to authentication mechanism, with a multitude of users seamlessly logging into apps with well-known platforms like Google or Twitter. Join us as we explore the limitations of standard OAuth flows for native clients, uncover the risks and potential attack vectors associated with them, and showcase the case studies. Gain invaluable insights into how PKCE addresses these challenges head-on, fortifying your applications against potential attacks.
Read More...

• Alina Boshchenko [Software Engineer and Security Champion — JetBrains]

BYOD for everyone: How security

Security Stage — 45 minutes Security

The need to secure corporate laptops spans across all functions of the organization, and software application development is one of them. 
In this keynote, I retrace the origins of the secure laptop and explain how recent advances in virtualization and security mechanisms have enabled an entirely online delivery of secure environments for application development, literally putting an end to the necessity for physical incarnations of the secure developer laptop.
Read More...

• Laurent Balmelli [CEO and Head of Product — Strong Network]

Building a sustainable security requirements process with the ASVS

Security Stage — 45 minutes Security

But how do we do that? Not everyone can think up security requirements on demand and we need to do this constantly for each new feature or development.

As a project lead for the OWASP Application Security Verification Standard (ASVS), a list of requirements for building secure software, this is something I have spent time working on as well as discussing with a variety of development teams. In this talk I want to show you what we came up with.

After a brief overview of what the ASVS is, we will then talk about how to:

- Get buy-in for security at this stage
- Balance trade-offs and prioritize different security requirements
- Trim the ASVS to focus on your current context
- Make the process repeatable and maintain a view of security state

You should leave the talk with not only a better understanding of the ASVS but also clear ideas on how you can take this and implement it as part of your own organization's requirements process.
Read More...

• Josh Grossman [CTO and Application Security — Bounce Security]

Keynote powered by Stefanini

Security Stage — 30 minutes Security

• Madalin Dumitru [Founder & CEO @CSD — STEFANINI]
• Alex Bertea [Chief Cybersecurity Strategist — Stefanini EMEA]

The importance of asset management for cyber security

Security Stage — 45 minutes Security

• Zlatan Moric [Head of Cyber Security Department — Algebra University]