NDC Security 2023
2023-01-16..2023-01-19
Oslo, Norway
[NDC Security 2022, NDC Security 2023, NDC Security 2024, NDC Security 2025, NDC Security 2026]
who it's for
security engineers, backend developers, platform engineers, devops engineers, cloud engineers, site reliability engineers
topics
DPoP proof JWT; mutual TLS token binding; backend for frontend pattern; kubernetes RBAC hardening; OPA Gatekeeper policies; seccomp sandboxing; Linux kernel keystore; FIDO2 passwordless authentication; GitHub OIDC for CI/CD; tfsec checkov terrascan scanning; software supply chain attacks; WebAssembly for .NET
| title | author | length |
|---|---|---|
| OAuth and the long way to Proof of Possession | Dominick Baier, Steinar Noem | 58m |
OAuth lacked cryptographic binding for a decade and now two practical options exist: mutual TLS and DPoP proof JWT. Mutual TLS binds tokens by embedding an… | ||
| Securing SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern | Dominick Baier | 01h 03m |
Claim: move OAuth tokens out of the browser into a server-side BFF to avoid XSS and broken iframe tricks; demo shows an ASP.NET Core BFF issuing same-site… | ||
| The insecurity of OAuth 2.0 in frontends | Philippe De Ryck | 57m |
Claim: OAuth 2.0 flows run entirely in the browser are fundamentally insecure. Demonstrations build a toy restaurant app, a malicious server and an attack.js… | ||
| Introducing the OWASP Top 10 for Kubernetes | Steve Wade | 51m |
Kubernetes misconfiguration is the top risk with 60% experienced misconfiguration in one survey; common fixes are concrete: set pod securityContext (no root… | ||
| Return Oriented Programming, an introduction | Patricia Aas | 57m |
Shows a working 32‑bit x86 exploit that builds shellcode for execve /bin/sh by implementing close, open and execve via syscall numbers in eax and int 0x80… | ||
| Turbo Eureka | Mike Long, Øyvind Fanebust | 50m |
Stacc turns ISO27001 into continuous DevOps by recording SHA256 digests and build metadata at CI time, enforcing code review evidence in GitHub and Bitbucket… | ||
| RBAC to the Future: Untangling Authorization in Kubernetes | Jimmy Mesta | 35m |
Explains how Kubernetes RBAC actually enforces identity and authorization, with concrete failures and fixes: a default service account + cluster-admin binding… | ||
| NOPASSWD: Building a Passwordless Cloud Infrastructure | Kyle Kotowick | 40m |
Shows a working passwordless stack that replaces long-lived credentials end-to-end: FIDO2 for user auth, Azure AD as identity source, AWS IAM federated roles… | ||
| OAuth – the good Parts | Anders Abel | 01h 00m |
OAuth history condenses to concrete advice: prefer OAuth 2.0 (2.1 consolidates bad options), use only two flows in most cases — client_credentials for… | ||
| Improving the Chances of Success in Secure Software Development | Daniela Cruzes, Espen A. Johansen | 01h 00m |
Research of more than 300 teams and a live program across ~700 teams constructs concrete enablers: a security index that scores apps into… | ||
| Cyber Security vs. Statistics | Christopher Van Der Made | 55m |
Automates hourly parsing of Twitter hashtags (uses Python, regex) to extract IOCs, checks them against VirusTotal and a Cisco threat‑intel API (CTIA) and local… | ||
| Securely deploying Infrastructure as Code | Chris Ayers | 01h 00m |
Demonstrates how to automatically scan Terraform with tfsec, terrascan, checkov, surface results in PRs via JUnit uploads, and block bad commits with… | ||
| Lost and Found in Translation | Camilla Montonen | 54m |
Overview of ML-assisted decompilation and security implications: demonstrates using an encoder-decoder Transformer trained on automatically generated… | ||
| OPA everywhere! Exploring new opportunities in policy evaluation | Anders Eknert | 01h 06m |
Claim: compiling Rego to a low‑level IR lets policies run inside apps with near‑native speed but requires writing an evaluator and losing OPA’s management… | ||
| Defendable Products: How we try to improve security in our products | Ståle Pettersen | 01h 01m |
Three-year effort from a three-person team builds an application inventory that auto-discovers subdomains hourly and pulls scanner ownership, powering an… | ||
| GitHub Actions: Vulnerabilities, Attacks, and Counter-measures | Magno Logan | 57m |
Shows that GitHub Actions runners (Azure VMs) are abused at scale to mine cryptocurrency using an XMRig miner embedded in workflow steps and to persist via… | ||
| Is this okay!? How to review code for security issues | Rouan Wilsenach | 55m |
A checklist of eight questions for secure code review that flags concrete issues: a new PUT endpoint on an Express app introduces missing authorization and a… | ||
| Hacking the Juice Shop | Cecilia Wirén | 48m |
Shows how to run OWASP Juice Shop locally or via Docker, explains architecture (Node, Angular, SQLite) and practical tools: browser devtools, Postman and… | ||
| In Defence of PHP | Stephen Rees-Carter | 01h 00m |
Argues modern PHP is no longer the messy legacy era of php3/php4 and backs that with concrete tooling and results: adoption of PSR autoloading, the composer… | ||
| Building a sustainable security requirements process with the ASVS | Josh Grossman | 55m |
Argues for using the OWASP ASVS as a requirements standard but not raw — fork the ASVS and trim it to context so 280 sprawling checks become a focused set… | ||
| Attacking through the Software Supply Chain | Felix Leder | 58m |
Covers concrete supply-chain incidents and fixes: SolarWinds Orion backdoor that pushed malicious updates to global enterprise customers, NotPetya delivered… | ||
| What happens if I change this URI… oooooh | Halvor Sakshaug | 55m |
Broken Access Control is now OWASP Top 10 #1 and simple IDORs let attackers enumerate sequential IDs to view or change others’ data; real breaches include a… | ||
| Using seccomp to limit the Linux kernel attack service | Michael Kerrisk | 01h 03m |
Explains how Linux seccomp actually limits syscalls by loading BPF bytecode filters that inspect syscall numbers and up to six register arguments, showing… | ||
| What I learnt about automating security | George Coldham | 44m |
By 2025 there are 3.5 million open roles so automation must supplement scarce staff not replace them. Practical automations include infrastructure as code and… | ||
| Test Driven Application Security | Tobias Ahnoff, Martin Altenstedt | 53m |
Demonstrates a test-driven approach that turns OWASP Top 10 failure modes into automated checks: system tests (liveness/readiness, TLS 1.3, security headers… | ||
| Running system tests with active authn/z | Lars Skjorestad | 49m |
Shows a concrete pipeline: spin up the app and APIs in Docker compose, point them at a separate Office 365 developer tenant, switch login to resource owner… | ||
| How AI is impacting cybersecurity. Does it? | Victoria Almazova | 01h 02m |
Research shows GitHub Copilot (Codex) often suggests insecure code: experiments across Python and C using CWEs and CodeQL find 44% vulnerable top answers… | ||
| How hacking works | Espen Sande-Larsen | 55m |
Live demos show concrete exploits: a 32-bit ELF with no stack canary is return-oriented programming exploited via GDB to overwrite the return address and jump… | ||
| What is Linux kernel keystore and why you should use it in your next application | Ignat Korchagin | 58m |
Linux exposes a kernel keystore that holds keys as kernel objects, with session/process/thread keyrings that auto-destroy keys on logout or crash, and key… | ||
| Security as Code: A DevSecOps Approach | Joseph Katsioloudes | 52m |
A practical recipe: codify checks as queries, run them in CI/CD, and catch real bugs before deploy. Demonstrations use CodeQL queries integrated into GitHub… | ||
| Block DNS exfiltration with dnsmasq proxy | Magnus Longva | 43m |
Shows DNS used to steal secrets by turning environment variables into DNS names and by creating a two‑way tunnel (demoed with a dnscat‑style session after a… | ||
| What the log4j incident taught us about Secure by Design | Daniel Deogun, Dan Bergh Johnsson | 58m |
The claim is that the December 2021 log4j JNDI/LDAP lookup exploitation becomes far harder if applications use domain primitives to validate inputs early and… | ||
| Google Family Link field test | Mateusz Krzeszowiec | 55m |
Google Family Link screen limits and app blocks fail in concrete ways: a Google app camera/voice search path allows continued browsing after timeouts, and a… | ||
| A data driven approach to application security | Petter Kvalvaag, Kristian Reed | 50m |
Equinor builds a low-cost data platform that pulls Snyk and GitHub via nightly GitHub Actions into Postgres (JSONB), visualizes with Apache Superset and lets… | ||
| Using WebAssembly to run, extend, and secure your .NET application | Niels Tanis | 53m |
Shows how .NET runs inside browser and servers by compiling runtimes to WASM and using WASI: Blazor downloads DLLs and a .NET WASM CLR, server-side uses… | ||
| Keynote: Crypto means Cryptography! | Scott Helme | 58m |
A brisk tour from 4,000‑year‑old Egyptian secret glyphs and the scytale to Enigma and modern submarine cables shows how cryptography protects web traffic… | ||
| nothing matches | ||