NDC Security Oslo 2020
who it's for
application developers, security engineers, devops engineers, cloud engineers, identity engineers, security managers, incident responders
topics
post-quantum cryptography (CRYSTALS-Kyber); quantum key distribution links; password managers and MFA/2FA; risk-limiting election audits; DevSecOps KPIs and metrics; TLS/SSL history and migration; OpenID Connect and OAuth2 best practices; cloud-native appsec (Kubernetes, OPA Gatekeeper); API security and JWT verification; modern web vulnerabilities (ESI injection, prototype pollution, HTTP desync); secure SDLC and compliance-as-code
| title | author | length |
|---|---|---|
| Keynote: Post Quantum Future | Jaya Baloo | 41m |
Separates hype from current European work, explains Google’s quantum supremacy as a benchmark not apocalypse, and claims a viable universal quantum computer… | ||
| A reasonable guide to security practices | Niall Merrigan | 01h 02m |
Advice: use a password manager (example LastPass) to generate 80–100 character passwords, rotate them every few months, and avoid reuse; add MFA/2FA everywhere… | ||
| Introduction to Election Security | Patricia Aas | 01h 02m |
Norway moves from un-audited machine-only counting to a manual preliminary count (used in two national elections) and a legal reframing of elections as… | ||
| Measuring DevSecOps: Building Metrics to Understand Effectiveness and Success | Victoria Almazova | 46m |
A talk about measuring DevSecOps effectiveness by building concrete KPIs and a demo dashboard that aggregates outputs from static and dependency scanners into… | ||
| 25 Years of SSL - Secure(ish) Sockets Layer | Scott Helme | 53m |
Timeline from 1994 to today traces concrete breakages and fixes: SSLv1 fails in initial demo, SSLv2 is broken in months, SSLv3 survives until POODLE… | ||
| Why Don't Users Do What They are Supposed to Do? A look at users and security | Silje Lærk | 01h 03m |
Argues that developers share blame for poor user security and cites the 2017 NIST change to don't expire passwords and allow long, Unicode passwords; shows… | ||
| The Internet of Pwned Things | Troy Hunt | 01h 01m |
HaveIBeenPwned aggregates 9.3 billion records across ~425 breaches; CloudPets leaves voice files in a public S3 with references in an open MongoDB, exposing… | ||
| OpenID Connect & OAuth 2.0 – Security Best Practices | Dominick Baier | 59m |
OAuth must drop risky flows: disable implicit & password grants and prefer authorization code + PKCE for all interactive clients. Require exact redirect URI… | ||
| The Future of AppSec is Cloud-Native | Jimmy Mesta | 56m |
Argues appsec shifts from scanners to platform work and shows concrete tooling and failures: builds an auditable GCP Kubernetes cluster with terraform TF files… | ||
| Common API Security Pitfalls | Philippe De Ryck | 53m |
Covers concrete API mistakes and fixes: rely never on the client for authorization, audit and centralize access policies to prevent broken object level access… | ||
| Modern Web Vulnerabilities 2020 | Erlend Oftedal | 56m |
Demos show an ESI injection where SVG uploads force the reverse proxy to fetch internal pages (PNG is blocked, SVG succeeds), enabling content theft, XSS or… | ||
| Designing a Secure Software Development Lifecycle with DevOps | Mike Long | 48m |
Argues that DevOps can deliver a provable SDLC for regulated orgs by pushing controls into pipelines: use compliance as code, record evidence in git as the… | ||
| Implementing OpenID Connect and OAuth 2.0 – Tips from the Trenches | Dominick Baier | 01h 00m |
Covers concrete implementation choices for OpenID Connect and OAuth 2.0: use the OIDC subject as the canonical user ID, distinguish public vs confidential… | ||
| .NET Core Data Security : Hope is not a Strategy | Stephen Haunts | 52m |
Hands-on rundown of .NET crypto primitives and how they combine: uses RNGCryptoServiceProvider for keys, SHA-256/HMAC for integrity, PBKDF2 (RFC2898) with… | ||
| The Cyberattack on Visma in 2018, experience sharing and views from the blue team | Espen Johansen | 45m |
August 2018 attackers use phishing and weak passwords (one was literally "August2018!") to access an exposed Citrix server, escalate with off‑the‑shelf tools… | ||
| nothing matches | ||