You are viewing content from a past/completed QCon

Track: Trust, Safety & Security

Location: Pacific DEKJ

Day of week: Wednesday

It comes to no surprise, that any microservice, any security control you use to build applications, will eventually be broken (or fail). Under certain pressure, some components will fail together.  

The question is – how do we build our systems in a way that security incidents won't happen even if some components fail. And the data leaks won't occur even if a database server is misconfigured. Security engineers know that failure of single security control is a question of time, failure of security system is a question of design.  

This track is about building secure, yet usable, systems: security architecture, security engineering, cryptography.

Track Host: Anastasiia Voitova

Head of Customer Solutions, Security software engineer @CossackLabs

Anastasiia is a software engineer with a wide background, she started her career as a mobile developer, then deepen into security engineering. Now she has focused on cryptography/applied security, she helps companies to build secure yet usable systems (oh yes, it takes efforts).   Anastasiia maintains open-source cryptographic library Themis, conducts secure software development training, often speaks at international conferences, co-organizes cyber-security events and leads security chapter at WomenWhoCode Kyiv.

10:35am - 11:25am

Exploiting Common iOS Apps’ Vulnerabilities

Many mobile developers still believe that it’s not possible to extract information embedded inside the application bundle. However, it's not true.  

My area of interest is the reverse engineering of mobile apps. In this talk, I'll walk through some of the most common vulnerabilities on iOS apps and show how to exploit them. All these vulnerabilities have been found on real production apps of companies that have (or don't have) bug bounty program. This talk is useful for those connected with mobile app development or those who do use mobile apps to work with sensitive data.

Ivan Rodriguez, Software Engineer @Google

11:50am - 12:40pm

How to Use Encryption for Defense in Depth in Native and Browser Apps

Encryption is one of the most effective technical security measures. It massively reduces the impact and cost of a data breach. But encryption is typically focused on “infrastructure-level” elements like TLS and full-disk encryption. These are important tools, but they rely on assumptions about the infrastructure instead of the application code.    

As developers, infrastructure isn’t our strength, and sometimes it’s not even our job, so encryption takes a back seat to application-level features. But adding encryption to the application itself can insulate our systems from infrastructure-level failures, adding an important element of defense in depth.  

In this talk, we will discuss the pros and cons of application-level and end-to-end encryption. Since browsers are a nearly unavoidable element of modern application development, we will also cover the attack surface of application-level encryption in the browser, how it is very different from native clients, and how WebAssembly and WebCrypto help.

Isaac Potoczny-Jones, Founder @Tozny & Authentication and Privacy Specialist

1:40pm - 2:30pm

Security Culture: Why You Need One and How to Create It

Strong cultures permeate people’s mentality and the way that they behave, their receptiveness to new ideas and thoughts, and their motivation to do security tasks.  Organizations with a positive security culture have immense capability to build resilient products and reduce security debt.    

Every organization has a security culture, either good or bad, even if a security team or company has never invested in it. It is the underlying driver of why people choose to do what they do around security. This is exactly why security teams and their organizations need to take ownership and proactively shape the culture into a direction that supports the security well-being of the organization.    

This talk will go into understanding how to measure your organization's current security culture and how to define where you want to go. From there we will look into techniques and cases studies of how to begin to shape your organization’s security culture to become more resilient and enable people-powered security.

Masha Sedova, Co-Founder @hello_Elevate

2:55pm - 3:45pm

Small Is Beautiful: How to Improve Security by Maintaining Less Code

Project Zero has reported over 1500 vulnerabilities in commonly used software, including Windows, Android, iOS, browsers and may others. A common factor in many of these vulnerabilities is unnecessary attack surface. This presentation explains several causes of unnecessary attack surface and how to avoid them. It includes examples of vulnerabilities reported by Project Zero and explains how developers can prevent similar bugs.

Natalie Silvanovich, Security Researcher @Google

4:10pm - 5:00pm

Reflecting on a Life Watching Movies and a Career in Security

Things change, and people and industries adapt. Individuals and businesses that can spot the trends and adjust quickly are likely to be more successful. With this as an underlying thesis, we'll talk about some trends in the movie industry that relate well to similar changes in technology and security. We'll also run through some tips and lessons learned to help security teams stay ahead as they navigate technical and operational changes.

Jason Chan, VP Information Security @Netflix

Last Year's Tracks

  • Monday, 16 November

  • Social Responsibility: Implications of Building Modern Software

    Software has an ever increasing impact on individuals and society. Understanding these implications helps build software that works for all users

  • Non-Technical Skills for Technical Folks

    To be an effective engineer, requires more than great coding skills. Learn the subtle arts of the tech lead, including empathy, communication, and organization.

  • Clientside: From WASM to Browser Applications

    Dive into some of the technologies that can be leveraged to ultimately deliver a more impactful interaction between the user and client.

  • Languages of Infra

    More than just Infrastructure as a Service, today we have libraries, languages, and platforms that help us define our infra. Languages of Infra explore languages and libraries being used today to build modern cloud native architectures.

  • Mechanical Sympathy: The Software/Hardware Divide

    Understanding the Hardware Makes You a Better Developer

  • Paths to Production: Deployment Pipelines as a Competitive Advantage

    Deployment pipelines allow us to push to production at ever increasing volume. Paths to production looks at how some of software's most well known shops continuous deliver code.

  • Tuesday, 17 November

  • Java, The Platform

    Mobile, Micro, Modular: The platform continues to evolve and change. Discover how the platform continues to drive us forward.

  • Security for Engineers

    How to build secure, yet usable, systems from the engineer's perspective.

  • Modern Data Engineering

    The innovations necessary to build towards a fully automated decentralized data warehouse.

  • Machine Learning for the Software Engineer

    AI and machine learning are more approachable than ever. Discover how ML, deep learning, and other modern approaches are being used in practice by Software Engineers.

  • Inclusion & Diversity in Tech

    The road map to an inclusive and diverse tech organization. *Diversity & Inclusion defined as the inclusion of all individuals in an within tech, regardless of gender, religion, ethnicity, race, age, sexual orientation, and physical or mental fitness.

  • Architectures You've Always Wondered About

    How do they do it? In QCon's marquee Architectures track, we learn what it takes to operate at large scale from well-known names in our industry. You will take away hard-earned architectural lessons on scalability, reliability, throughput, and performance.

  • Wednesday, 18 November

  • Architecting for Confidence: Building Resilient Systems

    Your system will fail. Build systems with the confidence to know when they do and you won’t.

  • Remotely Productive: Remote Teams & Software

    More and more companies are moving to remote work. How do you build, work on, and lead teams remotely?

  • Operating Microservices

    Building and operating distributed systems is hard, and microservices are no different. Learn strategies for not just building a service but operating them at scale.

  • Distributed Systems for Developers

    Computer science in practice. An applied track that fuses together the human side of computer science with the technical choices that are made along the way

  • The Future of APIs

    Web-based API continue to evolve. The track provides the what, how, and why of future APIs, including GraphQL, Backend for Frontend, gRPC, & ReST

  • Resurgence of Functional Programming

    What was once a paradigm shift in how we thought of programming languages is now main stream in nearly all modern languages. Hear how software shops are infusing concepts like pure functions and immutablity into their architectures and design choices.