Contain Yourself: Containers & Serverless

Speaker: TBD  

Containers and Serverless, both have become foundational components of modern application development and deployment. However, there are tradeoffs and design decisions that has to be taken into account.

WebAuthn: Hands on with Duo

Speaker: Duo Security  

The goal of WebAuthn is to standardize an interface for authenticating users to web-based applications and services using public-key cryptography. It strengthens the authentication of users to websites, services, and applications significantly, WebAuthn takes web authentication beyond the limitations of passwords, improving data security while making user login faster and easier than ever before.

In this session we will walk-thru an example of using WebAuthn

Advanced Security in B2C Solutions

Speaker: Andrew Cameron  

Probably the most difficult task in building a CIAM (Customer Identity Access Management) solution is being able to strike a balance between Security and User Experience. Any missteps in 'Over Securing' your customer experience will drive customers away from your service and damage your business. An effective CIAM strategy should enable your business in ‘speed to market’ and not compromise the security posture of your organization or your customers. This session will dive into best practices around advanced CIAM security topics such as Authentication, Identity Analytics, Profile Management, and Privacy and Compliance. By the end of the session you will have guidance in how to implement advanced security principles into your own CIAM solutions that are based on key industry standards and fundamental practices."

Managing Secrets across Multiple Clouds

Speaker: Eric Jones  

While there are many tools that manage some secrets, most tools are designed specifically for one platform (i.e. Docker), or a small subset of platforms. Then, there are application password management tools that can broadly manage application passwords, eliminate hardcoded and default passwords, and manage secrets for scripts. In this session we will introduce you to HashiCorp Vault, a secrets management platform thats cloud agnostic. It gives you the flexibility of deploying your application across multiple clouds using a single tool for storing and retrieving secrets. We will walk-thru an example of how to integrate Vault into your application.

Keeping Your Deployment Pipeline Secure: Zero Trust in the Cloud

Speaker: Xavier D. Johnson 

At this point, we have all at least heard about the SolarWinds breach. We will provide an high-level overview of how this breach occured and provide some approaches on how to minimize this from happening to your organization.

In this session we will walk-thru how to inject checks to validate that the components being deployed into your cloud environment has not been compromised. Also, we will discuss how continous integration and deployment can contain the amount of damage a rogue hacker can do in your environment.