Like most of the harder challenges we face in software development, increasing the security of software is a journey that takes careful planning, a lot of collaboration, and a healthy dose of iterating as you learn more. It’s the type of complex journey that goes more smoothly when you have a map.


In this workshop, we’ll look at what secure software roadmaps are, why they’re a useful tool to use as part of your overall software security approach, and how you can build one of your own.


Over the course of 2 days, you will go from a basic understanding of what makes a good application security program to having planned your own program roadmap- ready for you to go back to your company and implement.

Understanding what an application security program and roadmap are, why they are important and how they are structured

How to measure and understand your current maturity level including how to use OWASP SAMM and OWASP ASVS for measuring your existing programs or practices from a product and lifecycle perspective.

Setting realistic expectations and goals for your program

Defining what actions you can take to weave security through your software development lifecycle

Understanding how to measure progress as you implement your program

Anticipating and planning for common challenges we encounter when developing and implementing an application security program.


Software development leads who wish to support application security across their projects and teams.

Cyber security leaders and application security engineers looking to expand their approach to be more development aware

Those who wish to move towards application security in their organisation in a structured and measurable way.

A solid understanding of the concepts covered

A draft application security program roadmap that is tailored to your organisation and its current maturity level

2 Days

Build your own application security program

Security

The class is a combination of lectures, security testing demonstrations, code review, and interactive threat modeling discussions. Students will learn the most common threats against applications. More importantly, students will learn how to code secure software via a variety of techniques such as secure design practices, defense-based coding, the use of security libraries and services, and the use of a variety of web security standards.

As part of this course, we will explore the use of third-party security libraries and frameworks to speed and standardize secure development. We will highlight production quality and scalable controls from various languages and frameworks including Java, PHP, Python, Javascript, and .NET, but any developer building web applications and webservices will benefit from this class.

Familiarity with the technical details of building web applications and webservices from a software engineering point of view.

Any laptop that can run an updated web browser and "Burp Community Edition".

Day 1 of the course will focus on web application basics.

Introduction to Security Goals and Threats

Day 2 of the course will focus on API secure coding, Identity, and other advanced topics.

Webservice, Microservice, and REST Security

The course will include several hacking and secure coding labs!

Building Secure API's and Web Applications

This hands-on workshop will take you through an end-to-end software lifecycle, starting with GitHub Issues and Projects for planning, GitHub Codespaces for a super efficient inner loop of development, and GitHub Actions to take your applications into production.

How to effectively plan and track your work using GitHub Issues

How to manage your projects within and across repositories in your organisation

The free and paid options for coding in the cloud, including the web editor and GitHub Codespaces

How and when to use GitHub Actions for non-CI/CD automation

Techniques and strategies for safe and effective software engineering using GitHub tooling

Techniques for effective collaboration in remote teams

Software engineers, team leads, and DevOps specialists, regardless of their level of GitHub adoption.

Any laptop with a keyboard and a browser.

In fact, you could probably get by with a tablet - it's a new world!

End-to-end DevOps with GitHub

DevOps

If this sounds familiar, then this workshop is for you. We cover both the theory and patterns of Domain-Driven Design, and connect it to code with hands-on examples in .NET 6.

Where DDD fits in to software delivery and what business problems it addresses

How to craft and enforce a ubiquitous language

The role of refactoring in shaping and reshaping our model

How to define bounded contexts and microservices

Realizing a pragmatic implementation with ASP.NET Core 6 and EF Core 6

We spend day 1 on the theory and concepts of DDD and day 2 applying it to a real-world, complex example with hands-on code exercises.

Attendees will need to bring a laptop with the following installed:

Visual Studio 2022 Professional or higher

Domain-Driven Design: Theory and Practice

.NET

Microservices

Architecture

In this tutorial, we will look at why asynchronous messaging is often the preferred solution to the problems of integrating and distributed solution, and look at the implementation of common messaging patterns.

If you have ever been put off moving from RPC-based solutions to messaging because of the need to learn how to implement messaging based solutions, this workshop will get you started. if you have been using messaging but want to gain a firmer understanding

The session will be a hands-on introduction and take you from simple messaging scenarios like "Hello World" through to more complex ideas like routing, brokers, and publish-subscribe.

Day 1: Messaging Architectures and Simple Patterns

Day 2: Distributed Systems Advanced Patterns

There will be hands on coding exercises in C#, JavaScript, Python and Go enabling you to implement simple and more complex messaging scenarios.


We will use Rabbit MQ for examples. You need not have the latter installed on your machine, but you should have Docker installed on your machine, as exercises will use Docker Compose.This is a Bring Your Own Device (BYOD) course. At BYOD courses delegates are required to bring their own laptop with the necessary software installed

NDC { Sydney }

Workshops

09:00 - 17:00 (UTC-11)

End-to-end DevOps with GitHub

Damian Brady

Michelle Mannering

Build your own application security program

Laura Bell

Building Secure API's and Web Applications

Jim Manico

Domain-Driven Design: Theory and Practice

Jimmy Bogard

Practical Messaging

Ian Cooper