"Have you ever wonder how attacking web applications looks like? How would you retrace the attacker’s steps in order to identify what has been done? In this workshop, you will have the chance to understand everything from both the attacker’s and the defender’s perspective, allowing you to actively participate in the process, breaking down the reasoning behind the decisions that eventually, will lead the application to be compromised. The aftermath will be a detailed analysis through all the breadcrumbs left by the attacker, resulting in its footprint."

In a live evocation of the recent O'Reilly title Hacking Kubernetes (Martin, Hausenblas, 2021), this ultimate guide to threat-driven Kubernetes defence threat models and details how to attack and defend your precious clusters from nefarious adversaries. This broad and detailed appraisal of end-to-end cluster security teaches you how to attack and defend against a range of historical and current CVEs, misconfigurations, and advanced threats: See the historical relevance of CVEs and demonstrations of attacks against your containers, pods, supply chain, network, storage, policy, and wider organisation. Understand when to use next-generation runtimes like gVisor, firecracker, and Kata Containers. Delve into workload identity and advanced runtime hardening. Consider the trust boundaries in soft- and hard-multitenant systems to appraise and limit the effects of compromise. Learn to navigate the choppy waters of advanced Kubernetes security.

Building Java applications today means that we take a step further from writing code. We use open-source dependencies, create a Dockerfile to deploy containers to the cloud, and orchestrate this infrastructure with Kubernetes. Welcome, you're a cloud native application developer! As developers, our responsibility broadened, and more software means more software security concerns for us to address. Join me for a hands-on Java and cloud native live-hacking session, to show common threats, vulnerabilities, and misconfigurations. Most importantly, we'll also show how you can protect your application with actionable remediation and best practices for each exploit we demonstrate.

Agenda:

• Intros & Ice Breaker What is DevSecOps?
• Live Hack: Application Code
• Live Hack: Open Source
• Dependencies Open Source Supply Chain Security
• Live Hack: Containers Overview: Infrastructure as Code Vulnerabilities
• What is the Solution?
• Q&A

Traditional application security and more modern API security approaches often focus on writing secure code, and righteously so. But building secure APIs goes way beyond coding alone. One common example is the use of an API gateway to enforce security.In this session, we look at how to improve API security by designing a robust API architecture. We investigate security patterns and components that you can use, along with their pros and cons. You will walk away from this session with a solid understanding of best practices to secure your API architecture.