Training
The best security strategy is to train and develop your team to be ready for an everchanging security world. In order to defend an environment one must understand how attackers work, think and operate, what to look for and how to turn that knowledge into resilience. To help grow and develop experts we're offering insights and guidance about various topics and aspects of IT-Security in three different training formats.
Three different formats
This workshop is an introduction into attacking Web applications. The attendees will be placed into the position of an attacker and guided through an attack chain in order to break into a targeted web application. The goal of this Workshop is to make first experiences from an attacker's perspective, understand the security implications of bad design decisions and develop ideas on how to subvert security and access controls.
Assessing modern web applications can be a challenge. [Burp Suite](https://portswigger.net/burp), the industry standard assessment tool, offers integrated extensions that facilitate the assessment process. This hands-on workshop will teach how to write a custom Burp Suite extension in Python.
A programming language agnostic workshop on best practices to develop secure web applications and APIs. Some common attacks are shown and it is possible to get your hands dirty by following along on your own machine.
Containers and Kubernetes have become cornerstones of modern software development. The workshop dives into common attack vectors and practical mitigations to secure containerized applications in Kubernetes clusters.
Besides their many advantages, heavy reliance on external (open source) dependencies as well as continuous integration and deployment (CI/CD) in modern software development have introduced many new threats to the software supply chain. As a result, the number and impact of supply chain attacks have increased dramatically in recent years. The workshop reviews potential attack vectors and provides practical measures to protect modern applications.
The workshop begins with an introduction to the Domain Name System (DNS) which is used in the Internet to map domain names onto IP addresses and other data. Participants will learn about the basic concepts and the limitations of DNS, in particular with respect to integrity guarantees. We will then explore how these issues can be addressed using DNS Security Extensions (DNSSEC), and show with practical examples how to properly configure a modern DNSSEC deployment.
