Jeff will also show you how you can use Runtime Application Self-Protection (RASP) to leverage instrumentation to prevent your application from being exploited in production. First, Jeff will introduce Interactive Application Security Testing (IAST) and show you how anyone can use instrumentation to accurately identify complex vulnerabilities without scanning. In this talk, Jeff will demonstrate the power of “security observability” by using instrumentation (like a profiler, debugger, or APM tool) to quickly and easily expose critical security vulnerabilities and attacks from inside an application while it’s running. We’ve spent decades trying to verify properties of software by analyzing the source code, scanning, fuzzing, pentesting, etc… But the lack of context always leads to false positives, manual effort, long feedback loops, large security backlogs, and MTTR measured in months not days. Software is incredibly hard to secure because it’s a black box. He holds a MSc in Information Security, BSc in IT along with certifications like CISSP, OSCP, CSSLP and CKS.ĭate/Time: July 14, 2020, 6:30 PM to 8:30 PM EDTĭevSecOps: Why Aren’t IAST and RASP in Your Stack? He has also worked as a systems integrator and have implemented security solutions such as SIEMs, PKI, WAFs and EDR solutions for enterprise clients. He is an experienced penetration tester with in depth knowledge in application, network, cloud and container security. We will also be looking at concepts such as dynamic secrets, secret rotation and expiration, and on attack vectors and misconfigurations that may allow an attacker to steal secrets.īoominda is a senior consultant at Security Compass with more than 8 years of experience in information security.

In this session, we will look at how secrets management works in container orchestration platforms like Kubernetes and in secret management solutions like HashiCorp Vault. Currently, he is working as a senior security consultant in the DevSecOps division of Securit圜ompass, Toronto.ĭate/Time: August 11, 2021, 6:30 PM to 8:30 PM EDTĬontainers need to store and access secrets for tasks such as communicating with other microservices, calling back-end databases, and accessing other resources. He has also authored a book on this topic. In this talk, the presenter will be talking about TOCTOU race conditions and tools and techniques to find and exploit them.Ībhi Balakrishnan is the creator of the OWASP TimeGap Theory project. OWASP TimeGap Theory is a deliberately vulnerable application focusing on TOCTOU race condition vulnerabilities. Introducing the OWASP TimeGap Theory project

We would like to thank the following organizations for their support andĬontribution to the local Toronto chapter!ĭate/Time: September 8, 2021, 6:30 PM to 8:30 PM EDT

Highest defcon level