NDC Security 2022
2022-04-06..2022-04-07
Oslo, Norway
[NDC Security 2022, NDC Security 2023, NDC Security 2024, NDC Security 2025, NDC Security 2026]
who it's for
application security engineers, security engineers, software developers, devops engineers, cloud engineers, security managers, incident responders
topics
Semgrep and developer SAST; internal bug bounty programs; cloud IAM and key exposure; kubernetes RBAC misconfigurations; package supply chain attacks; GitHub security workflows; API security with FAPI 2.0; OpenID Connect federation gateways; SAML2 protocol weaknesses; binary exploitation and heap attacks; side channel AES analysis; detecting malware in encrypted traffic
| title | author | length |
|---|---|---|
| Keynote - The Abridged History of Application Security | Jim Manico | 39m |
A 50-year timeline shows concrete wins: Polish researchers build the first modern cryptanalysis tools in WWII, 1979 Lint starts static analysis, 1995 SATAN… | ||
| Gamify your Security | Jillian Ratliff | 48m |
Argues that an internal bug bounty cuts external noise and fits a budget, then lays out concrete setup: centralize findings in the ticketing system, script… | ||
| Cloud Hacking Scenarios | Michal Brygidyn | 36m |
Finds concrete exploit chains: admin AWS keys in JS comments lead to immediate cloud access; public k8s API with RBAC disabled exposes base64 secrets, yields… | ||
| On Building Teams | Niall Merrigan | 56m |
Practical lessons on building security teams and culture: a red‑team proof‑of‑concept uses bucket-stream piped to a bucket‑finder to enumerate exposed S3… | ||
| Classic Vulnerabilities | Patricia Aas | 01h 05m |
A 2000-era unlink heap exploit (Solar Designer) is reproduced against Chocolate Doom: crafted heap metadata corruption creates a write-what-where when freed, a… | ||
| Sharing Health Information Through APIs | Steinar Noem | 01h 01m |
Describes a Norway health-sector trust framework that pairs legal, organizational, semantic and technical layers to safely share sensitive records via APIs… | ||
| AppSec is Too Hard!? | Philippe De Ryck | 50m |
Shows concrete failures and fixes: a 2021 Apache Pulsar bug accepts crafted alg=none JWTs because Java parsing APIs are ambiguous, Burp plugins automate the… | ||
| Hyper Speed: When Big Data Blooms | Scott Helme | 01h 00m |
Report URI ingests browser telemetry and now handles spikes of almost 65,000 JSON payloads per second, routinely receiving one million POSTs in 11.2 seconds… | ||
| Protect Yourself Against Supply Chain Attacks | Rob Bos | 01h 02m |
Pipeline attacks include typo squatting, namespace squatting and injected build-time malware and happen in practice — an npm incident squatted 218 packages and… | ||
| Protect your code with GitHub security features | Rob Bos | 58m |
Repository-level instructions include commit signing enforced via GPG and a beta vigilant mode that flags unsigned or mismatched authors, plus branch… | ||
| Security Control Enhancements | Jim Manico | 52m |
Timeline of concrete Java security changes from Java 8 → 17: SHA‑3 hashing and SHA‑3‑based signatures appear (Java 16), TLS 1.3 and AES‑GCM support mature… | ||
| Why We Should Kill Saml2 | Anders Abel | 45m |
Clear claim: SAML2 routinely fails the practical needs of web SSO — brittle metadata discovery, opaque redirect encoding, fragile XML signature semantics, and… | ||
| Opening The Playbook; What to do when you've been hacked | Heather Wilde | 01h 01m |
Evernote traces a 2013 intrusion that exposes 50 million users after attackers leverage prior leaked credential lists to crack hashed and salted passwords… | ||
| It doesn't take much to be above average | Alexander Lystad | 48m |
Most small software companies underinvest in security and sit in a defined danger zone: ~40 FTE, ~5 MEUR revenue, yet large gains are cheap and practical… | ||
| Common Python Coding Mistakes | Christopher Van Der Made | 59m |
Claims that arbitrary code execution is the most common Python security mistake and demonstrates how using eval on user input allows system commands to run… | ||
| Sandboxing a Linux Application | Martin Ertsås | 01h 02m |
Shows exactly how to build a Linux sandbox: create a new user namespace to become “root-ish,” make a private mount namespace and pivot_root into a tmpfs-based… | ||
| ASP.NET Core Meets Owasp Top 10 | Anders Abel | 54m |
ASP.NET Core defaults to safe patterns: middleware handles auth, static files run first unless reordered, and Identity uses PBKDF2 (HMAC‑SHA256, 10,000… | ||
| Getting API Security Right | Philippe De Ryck | 53m |
A study of 30 UK healthcare apps finds 77% hard-coded API keys and 7% with embedded usernames/passwords, and every tested API shows authorization flaws… | ||
| Passwords are not going away | Per Thorsheim | 01h 05m |
Core claims: passwords stay; mandatory frequent rotation reduces security; length beats complexity. Practical fixes include make password a sentence, require… | ||
| Measuring DevSecOps | Victoria Alamzova | 47m |
Argues that DevSecOps needs measurable KPIs tied to outcomes not artifacts, recommends starting with about 5–6 metrics that combine DevOps measures (change… | ||
| Vulnerabilities that Hide from your Tools | Jillian Ratliff | 41m |
Automation misses whole classes of flaws: business logic errors, misconfigured AWS IAM and security groups, denial of service paths, rogue insiders and secrets… | ||
| Demostrating Binary Exploitation | Marit Iren Rognli Tokle, Christian Resell | 22m |
Demonstrates a recent one‑year‑old heap overflow in Sudo by walking through vulnerable C snippets, showing how overflowing a 16‑byte buffer overwrites age… | ||
| Breaking AES with side channel analysis | Turid Herland | 59m |
Demonstrates extracting an AES‑128 key from a 32‑bit embedded CPU by measuring power with a resistor and oscilloscope, using ChipWhisperer hardware and Python… | ||
| Minimum Viable Security | David Melamed | 33m |
Claim: a small, automated baseline of security controls can be baked into configs and CI to catch most obvious risks early. Demonstration adds seven tools to a… | ||
| HelseID | Dag Helge Østerhagen, Rune Andreas Grimstad | 01h 03m |
HelseID is a national OAuth2/OpenID Connect authorization service that now protects most Norwegian eHealth APIs and issues about a million access tokens and… | ||
| Secure Data Exchange in Digital Government Context | Petteri Kivimaki | 46m |
X-Road is an MIT‑licensed data exchange layer that actually runs nationwide in Estonia, Finland and Iceland, implements security servers that handle TLS… | ||
| Secure Coding Back to Basics | Erlend Oftedal | 59m |
Argues that shifting validation into small, typed domain primitives and using DTOs/contract objects avoids bugs that become vulnerabilities, shows… | ||
| Centralized Policy Management | Noaa Barki | 36m |
Claims that centralized policy management prevents common Kubernetes misconfigurations (after reading over 100 failure stories), and shows how to enforce… | ||
| How to detect Malware in Encrypted Traffic Without Decryption | Christopher Van Der Made | 46m |
Claims ability to label encrypted TLS flows as benign or malicious without decryption by fusing client hello fingerprints, SNI and five‑tuple context… | ||
| How to use GitHub Actions with Security in mind | Rob Bos | 56m |
Covers concrete risks and fixes for GitHub Actions: the marketplace has 12,500+ public actions that runners download wholesale, self-hosted runners can… | ||
| nothing matches | ||