sec4dev 2021
as the organisers put it
sec4dev Dialogues – the exclusive security event for developers. Let's make security a first-class citizen in software development! The sec4dev Dialogues is a Vienna-based security event which targets one very specific group: people involved in software development. It is our mission to bring together the best industry professionals, thus having a sustainable and positive impact on the software security landscape.
| title | author | length |
|---|---|---|
| Token Security in Single Page Applications | Philippe De Ryck | 29m |
Explains that localStorage persists across tabs and restarts and is trivially readable by any same-origin script so XSS can steal access and refresh tokens… | ||
| Know Your Tools: Quirks And Flaws, Integrating SAST Into Your Pipeline | Artem Bychkov | 35m |
Explains why SAST often misses or misreports vulnerabilities: incomplete models from unresolved imports, weak language feature support, and different analyzer… | ||
| Mastering Security Requirements Engineering | Thomas Kerbl | 34m |
Explains how OWASP SAMM v2 frames security requirements as the foundation for architecture, testing and operations and recommends starting with ASVS and OWASP… | ||
| Security Issues In OAuth/OIDC Implementations | Amir Sharif | 27m |
Analyzes OAuth/OIDC implementations in mobile apps with concrete findings and fixes: 87 apps analyzed from Google Play reveal 6 compliant and widespread faults… | ||
| Rapid Risk Assessment: A Lightweight Approach | Julien Vehent | 34m |
A lightweight Rapid Risk Assessment (RRA) method developed at Mozilla in 2013 condenses threat modeling into a one‑hour review with four phases: information… | ||
| Catch Me If You can : Continuous Delivery vs. Security Assurance | Abdessamad Temmar | 32m |
Claims that heavy commercial AST/data‑flow scanners are expensive, slow and brittle, and that a pragmatic stack of simple checks plus framework constraints… | ||
| Is My AI Racist? Or How Not To Break The Law With Machine Learning | Lukas Feiler | 38m |
Covers how GDPR already restricts automated decisions, arguing Article 22 GDPR bars fully automated individual decisions unless contract necessity, national… | ||
| Adversarial Machine Learning: How Secure Is ML? | Rudolf Mayer, Tanja Šarčević | 36m |
Survey of attacks and defenses for image classifiers with concrete claims and tools: adversarial examples (evasion) use minimal pixel perturbations that… | ||
| The needed Information for AppSec Purposes? | Alexander Barabanov | 27m |
Proposes a lightweight, sprint-friendly checklist to collect microservice architecture details for AppSec: unique service IDs, repo links, short business… | ||
| Seccomp For Developers - Writing More Secure Applications | Alexander Reelsen | 36m |
Seccomp integration shows concrete libraries and demos: Python and Crystal examples block execve so a simple webserver calling /bin/ls fails when the policy is… | ||
| Let's Build And Break A Container By Hand Without Docker Or LXC | Reinhard Kugler | 31m |
Builds an Alpine+nginx container by hand and shows which kernel features actually isolate processes: creates a new root with unshare/pivot_root and overlayed… | ||
| Kubernetes Security: Attacking and Defending K8s Clusters | Magno Logan | 38m |
Demonstrates exploiting a Drupal CVE-2018-7600 RCE to get a shell in a pod, using the pod’s service account token for internal recon and then launching a… | ||
| nothing matches | ||