WERKSPOORTALKS #2

How not to wipe out

A snow sports enthusiast's guide to cybersecurity

Every ski school teaches the same ten FIS rules: control your speed, respect the signs, help when someone falls. Software security has its own version of those rules, and most wipeouts happen when we blindly rely on our ability to ship like it's a Schuss.

We start where a ski day normally ends: in the hut, during the après, talking over our wildest crashes. What went wrong at Odido, and what is going on with Albert Heijn? Then we take the first lift back up and go down for a few runs: static analysis (SAST), dynamic testing (DAST), reviewing AI-written code, AI-assisted adversarial reviews, and we test our stuff against a deliberately vulnerable .NET app. We finish off-piste, where AI-driven bots are hunting for your endpoints, and where you can lead them into a whiteout of honeypots and endless generated nonsense (preferably without opening yourself up to a Denial of Wallet attack).

For developers who ship like they ski/snowboard, and want to keep it that way without ending up in the safety netting.

The weird and wonderful world of dotNet

Twenty years of .NET, told through its weirdest features, with a few things built in C# that probably shouldn’t exist.

From a 2002 Windows-only framework to a cross-platform runtime that goes places nobody planned, .NET has picked up some strange habits along the way. We’ll walk through the history of .NET Framework and .NET Core, then dive into the dark corners the docs barely mention: undocumented keywords, unsafe and unchecked magic, and code that has no business compiling.

You’ll leave with a handful of “wait, that’s allowed?” facts and a new respect for what people will build in C# just because they can.

Meat proxies en Denial of Wallet

De impact van AI op security, in de breedste zin

In deze talk nemen we je mee in de impact van AI op beveiliging, in de breedste zin. Het bouwen van exploits gaat van maanden naar minuten. Modellen hacken ongevraagd andere bedrijven om hun doel te behalen.

Mensen die blind AI-output versturen worden gezien als "meat proxy" en verliezen het vertrouwen van naasten. OnlyFans-modellen hangen dure AI-abonnementen aan hun chat, wat leidt tot "Denial of Wallet"-aanvallen. Waar gaat dit heen, en hoe gaan we ermee om?

Alwin is de laatste 15 jaar bezig als ethical hacker, trainer en spreker. Het vinden en melden van kwetsbaarheden heeft hem plekken bezorgd in de Walls of Fame van Google, Microsoft, Philips en het NCSC.

Are We Ready For The Next Cyber Security Crisis Like Log4Shell?

“The AI era is bright, but full of terrors!”

In a world where vulnerabilities like Log4Shell, Shai-Hulud and the XZ Backdoor make headlines, securing our software ecosystem has never been more critical. In this session, Soroosh, a hands-on architect with experience working on security platform services for large enterprises like Rabobank, will share practical strategies and best practices for securing the software development process, applicable to both small startups and large organizations.

Expect a live demo of what a supply chain attack is and how dangerous it can be, and an example of lateral movement that starts with a basic SQL injection and escalates to root access on a Kubernetes cluster. We'll explore new attack vectors in the AI era and the strategies to detect, prevent and mitigate them.

You'll leave with the most effective practices to secure your CI/CD process, practical ways in which a Software Bill of Materials (SBOM) helps you prepare for the next Log4Shell, and a clear answer to what DevSecOps means and what its main objective is.