The document discusses context automation and how it connects information between websites for users. Context automation is enabled by trends like cloud computing, extensible browsers, and internet identities. It can augment websites with additional context through approaches like JavaScript, media toolbars, search tools, and context platforms. Key technologies that help enable context automation include Kynetx, which uses a rule language called KRL, and information cards, which can securely store user identity and data. Context automation provides benefits to users like a more individualized and structured browsing experience with improved privacy and security.
Protect Your Passwords, Secure Your ServersSteven Davis
There have been too many sites compromising personal data. There is no excuse. It is not hard to stop most, if not all hackers. All you have to do is care about your customers. This module describes how you can easily and effectively stop many hack attacks and protect your customer data on your servers.
For more information, tools, and resources, visit http://free2secure.com/.
If you are interested in keeping up with the latest books, articles, and tools from me at Free2Secure send me an email steve @ free2secure.com with the subject “Subscribe”.
If you have any security questions, issues, or shoot me a note to steve @ free2secure.com with the subject “Help”.
My 2012 homerun in IT-security: For many years nothing happened in Web security - with respect to security-enabling the HTTP stack. This is not true anymore: game-changing innovations do emerge right now. Their impact will - likely - be pervasive. It is important to understand what exactly is being launched, why this is happening and which forces are driving this. This presentation establishes this context and elaborates on the implications.
Sogeti Cloud Seminar Identity In The CloudsRon Moerman
Cloud computing is hot. Identity Management is crucial for succesful cloud solutions. There are multiple clouds, so identities have to be managed trhoughout all these environments, and also the internal IT environment. This presentation gives insight in the challenges, the technologies and 8 takeaways to start with identity in the cloud.
Identity, Security, and XML Web Services -- The Importance of Interoperable S...Jorgen Thelin
Abstract
The use of security credentials and the concepts of single-sign-on and \"identity\" will play a big
part in Web Service products as the technology matures and developers start writing true enterprise-
grade line-of-business applications. The emerging XML security standards such as SAML
are reviewed, along with the various \"identity\" standards such as Passport and Liberty, to provide
an overview of the evolution of Web Service platform products to support these. This paper
examines just how \"identity aware\" Web Service implementations need to be, and the value a
Web Services platform can add in masking developers from the complexity in this area. Lessons
are drawn from the experience of using EJB security technology for real-world security scenarios.
Protect Your Passwords, Secure Your ServersSteven Davis
There have been too many sites compromising personal data. There is no excuse. It is not hard to stop most, if not all hackers. All you have to do is care about your customers. This module describes how you can easily and effectively stop many hack attacks and protect your customer data on your servers.
For more information, tools, and resources, visit http://free2secure.com/.
If you are interested in keeping up with the latest books, articles, and tools from me at Free2Secure send me an email steve @ free2secure.com with the subject “Subscribe”.
If you have any security questions, issues, or shoot me a note to steve @ free2secure.com with the subject “Help”.
My 2012 homerun in IT-security: For many years nothing happened in Web security - with respect to security-enabling the HTTP stack. This is not true anymore: game-changing innovations do emerge right now. Their impact will - likely - be pervasive. It is important to understand what exactly is being launched, why this is happening and which forces are driving this. This presentation establishes this context and elaborates on the implications.
Sogeti Cloud Seminar Identity In The CloudsRon Moerman
Cloud computing is hot. Identity Management is crucial for succesful cloud solutions. There are multiple clouds, so identities have to be managed trhoughout all these environments, and also the internal IT environment. This presentation gives insight in the challenges, the technologies and 8 takeaways to start with identity in the cloud.
Identity, Security, and XML Web Services -- The Importance of Interoperable S...Jorgen Thelin
Abstract
The use of security credentials and the concepts of single-sign-on and \"identity\" will play a big
part in Web Service products as the technology matures and developers start writing true enterprise-
grade line-of-business applications. The emerging XML security standards such as SAML
are reviewed, along with the various \"identity\" standards such as Passport and Liberty, to provide
an overview of the evolution of Web Service platform products to support these. This paper
examines just how \"identity aware\" Web Service implementations need to be, and the value a
Web Services platform can add in masking developers from the complexity in this area. Lessons
are drawn from the experience of using EJB security technology for real-world security scenarios.
Hitachi ID Password Manager:
Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications
Integrated credential management for users: passwords, encryption keys, tokens, smart cards and more.
http://hitachi-id.com/
Cloud security - The Cloud is as Secure as you want it to be! - Indicthreads ...IndicThreads
Session presented at the 2nd IndicThreads.com Conference on Cloud Computing held in Pune, India on 3-4 June 2011.
http://CloudComputing.IndicThreads.com
Abstract:As part of this session I intend to provide a technical overview of how cloud computing can be made secure across various networks architectures and deployments such as
(a) Security in public cloud deployments – data and application security. This will cover methods such as data encryption, multi tenancy, data wipeout, what type of data to place in public clouds, autentication methods.
(b) Security by using public/private mix hybrid cloud deployments. This will cover using hybrid clouds effectively to segregate some portions of data in the public and some in hybrid and how a request can be moved across these. It would also cover options for enterprises to make their solutions secure.
(c) Security features provided by current cloud vendors.
(d) How a cloud deployer can ensure the solution they are providing is secure.
Key Takeaway after this session: An understanding of various security solutions that developers, deployers, architects can use when using cloud computing solutions
Speaker: Debashis Banerjee is a technology professional with 12+ years of expertise in development and leading global teams in development of Cloud, Security, Internet based and Telecom products. He is currently a Senior Engineering Manager with Yahoo! India.
A Code Signing Certificate is a digital signature technology allows authorized software publishers to sign their software code, script and content to authenticate their identification over internet.
Using Federation to Simplify Access to SharePoint, SaaS and Partner ApplicationsNovell
Identity federation has become the standard method for delivering access to services across organizational boundaries. More recently, federation has become the preferred method for managing user access within Microsoft SharePoint environments.
In this session, you will get an overview of the federation capabilities in Novell Access Manager. Specifically, the presenters will provide an introduction to identity federation, cover basic setup and configuration, and show you how to enable federated access to Microsoft SharePoint and Google applications. No previous knowledge of federation standards is required for this session.
FIDO Authentication Opportunities in HealthcareFIDO Alliance
A case study for healthcare leader, Aetna on how they are developing a digital competitive advantage. As part of their strategy to improve user experience and protect members, they have deployed FIDO Authentication.
Authentication is among the most important concepts in security, but most people take a fatally simplistic approach to the matter. We will explore some of the concepts of authentication, including an idea for a more advanced view of authentication that violates common wisdom regarding a related topic.
Security On The Edge - A New Way To Think About Securing the Internet of ThingsForgeRock
ForgeRock proposes a new approach for IoT security, where identity principles are used to ensure the authenticity of IoT devices and their communications. We call this upcoming technology, ForgeRock Edge Security. Using secure, standards-based tokens and providing comprehensive, policy-based controls for controlling access to data from devices, this is the next generation of IoT edge security. With examples from industrial and automotive IoT environments, learn how this new way of providing security “on the edge” can provide a rock solid layer of security for your IoT deployments.
How to Make Your IoT Devices Secure, Act Autonomously & Trusted SubjectsMaxim Salnikov
The ForgeRock Identity Platform and Edge security solution can turn any IoT device into a secure, trusted active subject enrolled and on-boarded from a hardware based root of trust to become an autonomous entity in your business relationship eco system represented by a digital twin.
Hitachi ID Password Manager:
Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications
Integrated credential management for users: passwords, encryption keys, tokens, smart cards and more.
http://hitachi-id.com/
Cloud security - The Cloud is as Secure as you want it to be! - Indicthreads ...IndicThreads
Session presented at the 2nd IndicThreads.com Conference on Cloud Computing held in Pune, India on 3-4 June 2011.
http://CloudComputing.IndicThreads.com
Abstract:As part of this session I intend to provide a technical overview of how cloud computing can be made secure across various networks architectures and deployments such as
(a) Security in public cloud deployments – data and application security. This will cover methods such as data encryption, multi tenancy, data wipeout, what type of data to place in public clouds, autentication methods.
(b) Security by using public/private mix hybrid cloud deployments. This will cover using hybrid clouds effectively to segregate some portions of data in the public and some in hybrid and how a request can be moved across these. It would also cover options for enterprises to make their solutions secure.
(c) Security features provided by current cloud vendors.
(d) How a cloud deployer can ensure the solution they are providing is secure.
Key Takeaway after this session: An understanding of various security solutions that developers, deployers, architects can use when using cloud computing solutions
Speaker: Debashis Banerjee is a technology professional with 12+ years of expertise in development and leading global teams in development of Cloud, Security, Internet based and Telecom products. He is currently a Senior Engineering Manager with Yahoo! India.
A Code Signing Certificate is a digital signature technology allows authorized software publishers to sign their software code, script and content to authenticate their identification over internet.
Using Federation to Simplify Access to SharePoint, SaaS and Partner ApplicationsNovell
Identity federation has become the standard method for delivering access to services across organizational boundaries. More recently, federation has become the preferred method for managing user access within Microsoft SharePoint environments.
In this session, you will get an overview of the federation capabilities in Novell Access Manager. Specifically, the presenters will provide an introduction to identity federation, cover basic setup and configuration, and show you how to enable federated access to Microsoft SharePoint and Google applications. No previous knowledge of federation standards is required for this session.
FIDO Authentication Opportunities in HealthcareFIDO Alliance
A case study for healthcare leader, Aetna on how they are developing a digital competitive advantage. As part of their strategy to improve user experience and protect members, they have deployed FIDO Authentication.
Authentication is among the most important concepts in security, but most people take a fatally simplistic approach to the matter. We will explore some of the concepts of authentication, including an idea for a more advanced view of authentication that violates common wisdom regarding a related topic.
Security On The Edge - A New Way To Think About Securing the Internet of ThingsForgeRock
ForgeRock proposes a new approach for IoT security, where identity principles are used to ensure the authenticity of IoT devices and their communications. We call this upcoming technology, ForgeRock Edge Security. Using secure, standards-based tokens and providing comprehensive, policy-based controls for controlling access to data from devices, this is the next generation of IoT edge security. With examples from industrial and automotive IoT environments, learn how this new way of providing security “on the edge” can provide a rock solid layer of security for your IoT deployments.
How to Make Your IoT Devices Secure, Act Autonomously & Trusted SubjectsMaxim Salnikov
The ForgeRock Identity Platform and Edge security solution can turn any IoT device into a secure, trusted active subject enrolled and on-boarded from a hardware based root of trust to become an autonomous entity in your business relationship eco system represented by a digital twin.
Building an IoT Massive Multiplayer Game in 60 Minutes - TechBash 2017Eran Stiller
The slide deck for my session at TechBash 2017 on "Building an IoT Massive Multiplayer Game in 60 Minutes".
Sample code can be found at https://github.com/estiller/iot-game
Identity Live Sydney 2017 - Daniel RaskinForgeRock
You still need to protect employees in the digital age, but the real opportunity for digital transformation lies in using identity not just to protect employees, but to get to know, interact with, and connect to prospects and customers across any channel–whether cloud, social, mobile, or the Internet of Things (IoT).
Customer Identity Management requires going above and beyond a secure login. From a security perspective, you need continuous security that follows the user throughout their entire session.
And as customers share data, from demographics to preferences to buying habits, you can use it to create authentic, engaging customer experiences that lead to lasting customer relationships. Better yet, you can earn customer trust while meeting privacy regulations like GDPR, by giving customers control over who has access to their data and for how long.
Cybersecurity Legos - We're all part of something biggerBen Boyd
Presentation by Ben Boyd during the 2018 Northwest Arkansas Community College Cyber Security Awareness Symposium.
Building a Cyber Security program is more than just technology or architecture. Managing Cyber Risk is the duty of anyone with a digital asset.
CIS14: Identity Management for the CloudCloudIDSummit
Jim Scharf, Amazon
What’s different in providing identity and access management for one of the largest cloud providers, some of the key technology and design decisions made along the way, and how AWS is working to make it even easier to federate with existing social and enterprise identity providers.
NIC 2017 Azure AD Identity Protection and Conditional Access: Using the Micro...Morgan Simonsen
A common trend in today’s cloud based world is identity driven security. As the name implies this makes user identity really important; user identity is now the key to unlock everything. Building the infrastructure to support this trend is very hard; you bear all the responsibilities and can rely on only your own signal data and threat detection. With Azure AD there is a better way! Come join this session to see how Azure AD Identity Protection is using signals from the global Microsoft cloud, Big Data and Machine Learning to protect your users’ accounts, and also how Azure AD Conditional Access makes it easy to enforce application access policies based on things like location and device. We will show you how to set it all up, what works and what doesn’t and how it integrates with other Microsoft protection services in the cloud, and your existing systems. Come and be safe!
Security Essentials For Startups Taking Their First Steps As Cloud Providers.
This deck is based on the the below paper: https://chapters.cloudsecurityalliance.org/israel/papers/
Identity Live London 2017 | Daniel RaskinForgeRock
You still need to protect employees in the digital age, but the real opportunity for digital transformation lies in using identity not just to protect employees, but to get to know, interact with, and connect to prospects and customers across any channel–whether cloud, social, mobile, or the Internet of Things (IoT).
Customer Identity Management requires going above and beyond a secure login. From a security perspective, you need continuous security that follows the user throughout their entire session.
And as customers share data, from demographics to preferences to buying habits, you can use it to create authentic, engaging customer experiences that lead to lasting customer relationships. Better yet, you can earn customer trust while meeting privacy regulations like GDPR, by giving customers control over who has access to their data and for how long.
Blockchain Cyber Security is a unique security software that helps you to protect your data and information by creating a peer-to-peer network. It secures your transaction and makes it more secured, eliminating the chances of frauds, theft and other complexities that have always been associated with online transactions.
https://www.mobiloitte.com/blockchain-cybersecurity/
Blockchain Cyber Security is a unique security
software that helps you to protect your data
and information by creating a peer-to-peer
network. It secures your transaction and
makes it more secured, eliminating the
chances of frauds, theft and other
complexities that have always been
Khow More: https://bit.ly/3LPhw6A
Guarding the guardian’s guard: IBM Trusteer - SEP326 - AWS re:Inforce 2019 Amazon Web Services
Risk assessment associated with digital identity is at the core of any digital business transformation. Companies strive to provide their customers with the best possible service, but at the same time, they struggle with the challenges of digital identity risk. IBM Trusteer is a SaaS solution that is meeting the challenge head-on. In this talk, we present two stories. We look at some identity proofing techniques, and we also examine some of the tools and processes that are keeping Trusteer’s cloud safe and secure. This session also explores use cases involving IBM tools that are deployed in an AWS environment.
Una presentacion muy rapida y por eso nunca finalizada acerca de Windows Server Federation Services en Windows Server 2008, aunque tiene muchas fallas en el uso de informacion como la mezcla de idiomas, o muchos datos plasmados en el slide, puede servir de base para otra presentacion mejor
Trust, Blockchains, and Self-Soveriegn IdentityPhil Windley
This talk discusses sovereignty as a foundational model for a new kind of identity system that not only establishes all entities as peers, but also provides the means of using verifiable claims to build trustworthy relationships. A self-soversign identity system with verifiable claims provides increased privacy and control for individuals, more transparent consent, opens new opportunities for relying parties and third party claims providers, and reduces or eliminates integration costs while making systems simpler.
The Internet of Things will require a different programming model than the one we've used to build Web 2.0. This presentation discusses a proposed architecture for connecting everything based on persistent compute objects, or picos. Picos naturally supporting building microservices. The presentation makes use of a connected-car platform called Fuse (http://joinfuse.com) to illustrate the use of microservices in picos and evented systems.
The internet of things requires a different architectural model than what we've used to build Web 2.0. This presentation makes a proposal for what that architecture could look like and presents a working example based on the connected car platform Fuse (http://joinfuse.com)
A discussion of the Internet of Things and how I explored the use of an event-based API and microservices inside a unique architecture based on persistent compute objects, or picos, in the connected car platform called Fuse.
The internet of things will lead to a computing experience that is vastly different from what we have today. What will this experience be like and what will the architecture of an internet with trillions of nodes be like? This talk combines a look at this inevitable future with a discussion of some very practical experiments going on right now.
Persistent Compute Objects and the Fabric of CyberspacePhil Windley
Persistent Computer Objects, or picos, give rise to a new way to build internet-based applications to separates app and user data. Users control their own picos and thus the data and processing on them. This presentation describes what picos are, the new programming model they support, and shows Fuse, a sample application built using this new model.
I gave this presentation at Defragcon on November 5 2013.
Personal Cloud Application ArchitecturesPhil Windley
ersistent compute objects, or PCOs, are light-weight, event-based, cloud-hosted virtual machines that persistently store data and provide a programming model. PCOs represent a possible post-web architecture that supports privacy-by-design, breaks down application silos, and models real-world circumstances. This talk will present a model for PCOs based on standard Web technologies.
The future of personal clouds will be very different from what you have imagined. As more and more of our interactions move online, we increasingly have need of an online place that operates for us. Personal clouds must become more than appliances to achieve their real potential.
The web is moving from the Dynamic Query/Static Data model that has characterized Web 2.0 sites to a Dynamic Data/Static Query model that characterizes many of today's most interesting Internet interactions. What does this mean for your organization and how can you take advantage of this shift?
Shaping Strategies and the Live Web - Kynetx Impact 2011Phil Windley
Shaping strategies are business strategies wherein companies shape a market rather than exploiting niches in existing markets. This talk explores shaping strategies and gives examples. Of particular interest is the description of the Kynetx strategy and why it's a shaping strategy.
Elevating Tactical DDD Patterns Through Object CalisthenicsDorra BARTAGUIZ
After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!
GraphRAG is All You need? LLM & Knowledge GraphGuy Korland
Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs.
1. Unifying Large Language Models and Knowledge Graphs: A Roadmap.
https://arxiv.org/abs/2306.08302
2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs:
https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/
The Art of the Pitch: WordPress Relationships and SalesLaura Byrne
Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes?
All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.
PHP Frameworks: I want to break free (IPC Berlin 2024)Ralf Eggert
In this presentation, we examine the challenges and limitations of relying too heavily on PHP frameworks in web development. We discuss the history of PHP and its frameworks to understand how this dependence has evolved. The focus will be on providing concrete tips and strategies to reduce reliance on these frameworks, based on real-world examples and practical considerations. The goal is to equip developers with the skills and knowledge to create more flexible and future-proof web applications. We'll explore the importance of maintaining autonomy in a rapidly changing tech landscape and how to make informed decisions in PHP development.
This talk is aimed at encouraging a more independent approach to using PHP frameworks, moving towards a more flexible and future-proof approach to PHP development.
Unlocking Productivity: Leveraging the Potential of Copilot in Microsoft 365, a presentation by Christoforos Vlachos, Senior Solutions Manager – Modern Workplace, Uni Systems
Essentials of Automations: The Art of Triggers and Actions in FMESafe Software
In this second installment of our Essentials of Automations webinar series, we’ll explore the landscape of triggers and actions, guiding you through the nuances of authoring and adapting workspaces for seamless automations. Gain an understanding of the full spectrum of triggers and actions available in FME, empowering you to enhance your workspaces for efficient automation.
We’ll kick things off by showcasing the most commonly used event-based triggers, introducing you to various automation workflows like manual triggers, schedules, directory watchers, and more. Plus, see how these elements play out in real scenarios.
Whether you’re tweaking your current setup or building from the ground up, this session will arm you with the tools and insights needed to transform your FME usage into a powerhouse of productivity. Join us to discover effective strategies that simplify complex processes, enhancing your productivity and transforming your data management practices with FME. Let’s turn complexity into clarity and make your workspaces work wonders!
DevOps and Testing slides at DASA ConnectKari Kakkonen
My and Rik Marselis slides at 30.5.2024 DASA Connect conference. We discuss about what is testing, then what is agile testing and finally what is Testing in DevOps. Finally we had lovely workshop with the participants trying to find out different ways to think about quality and testing in different parts of the DevOps infinity loop.
Dr. Sean Tan, Head of Data Science, Changi Airport Group
Discover how Changi Airport Group (CAG) leverages graph technologies and generative AI to revolutionize their search capabilities. This session delves into the unique search needs of CAG’s diverse passengers and customers, showcasing how graph data structures enhance the accuracy and relevance of AI-generated search results, mitigating the risk of “hallucinations” and improving the overall customer journey.
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Albert Hoitingh
In this session I delve into the encryption technology used in Microsoft 365 and Microsoft Purview. Including the concepts of Customer Key and Double Key Encryption.
In his public lecture, Christian Timmerer provides insights into the fascinating history of video streaming, starting from its humble beginnings before YouTube to the groundbreaking technologies that now dominate platforms like Netflix and ORF ON. Timmerer also presents provocative contributions of his own that have significantly influenced the industry. He concludes by looking at future challenges and invites the audience to join in a discussion.
Removing Uninteresting Bytes in Software FuzzingAftab Hussain
Imagine a world where software fuzzing, the process of mutating bytes in test seeds to uncover hidden and erroneous program behaviors, becomes faster and more effective. A lot depends on the initial seeds, which can significantly dictate the trajectory of a fuzzing campaign, particularly in terms of how long it takes to uncover interesting behaviour in your code. We introduce DIAR, a technique designed to speedup fuzzing campaigns by pinpointing and eliminating those uninteresting bytes in the seeds. Picture this: instead of wasting valuable resources on meaningless mutations in large, bloated seeds, DIAR removes the unnecessary bytes, streamlining the entire process.
In this work, we equipped AFL, a popular fuzzer, with DIAR and examined two critical Linux libraries -- Libxml's xmllint, a tool for parsing xml documents, and Binutil's readelf, an essential debugging and security analysis command-line tool used to display detailed information about ELF (Executable and Linkable Format). Our preliminary results show that AFL+DIAR does not only discover new paths more quickly but also achieves higher coverage overall. This work thus showcases how starting with lean and optimized seeds can lead to faster, more comprehensive fuzzing campaigns -- and DIAR helps you find such seeds.
- These are slides of the talk given at IEEE International Conference on Software Testing Verification and Validation Workshop, ICSTW 2022.
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdfPaige Cruz
Monitoring and observability aren’t traditionally found in software curriculums and many of us cobble this knowledge together from whatever vendor or ecosystem we were first introduced to and whatever is a part of your current company’s observability stack.
While the dev and ops silo continues to crumble….many organizations still relegate monitoring & observability as the purview of ops, infra and SRE teams. This is a mistake - achieving a highly observable system requires collaboration up and down the stack.
I, a former op, would like to extend an invitation to all application developers to join the observability party will share these foundational concepts to build on:
A tale of scale & speed: How the US Navy is enabling software delivery from l...sonjaschweigert1
Rapid and secure feature delivery is a goal across every application team and every branch of the DoD. The Navy’s DevSecOps platform, Party Barge, has achieved:
- Reduction in onboarding time from 5 weeks to 1 day
- Improved developer experience and productivity through actionable findings and reduction of false positives
- Maintenance of superior security standards and inherent policy enforcement with Authorization to Operate (ATO)
Development teams can ship efficiently and ensure applications are cyber ready for Navy Authorizing Officials (AOs). In this webinar, Sigma Defense and Anchore will give attendees a look behind the scenes and demo secure pipeline automation and security artifacts that speed up application ATO and time to production.
We will cover:
- How to remove silos in DevSecOps
- How to build efficient development pipeline roles and component templates
- How to deliver security artifacts that matter for ATO’s (SBOMs, vulnerability reports, and policy evidence)
- How to streamline operations with automated policy checks on container images
Communications Mining Series - Zero to Hero - Session 1DianaGray10
This session provides introduction to UiPath Communication Mining, importance and platform overview. You will acquire a good understand of the phases in Communication Mining as we go over the platform with you. Topics covered:
• Communication Mining Overview
• Why is it important?
• How can it help today’s business and the benefits
• Phases in Communication Mining
• Demo on Platform overview
• Q/A
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
17. The Browser as Platform
Browsers tie Web sessions
together
18. The Browser as Platform
Browsers tie Web sessions
together
1B Firefox add-on
downloads since 2005*
19. The Browser as Platform
Browsers tie Web sessions
together
1B Firefox add-on
downloads since 2005*
That is about 17/sec*
20. The Browser as Platform
Browsers tie Web sessions
together
1B Firefox add-on
downloads since 2005*
That is about 17/sec*
Estimates are 2x-5x below
actual
21. The Browser as Platform
Browsers tie Web sessions
together
1B Firefox add-on
downloads since 2005*
That is about 17/sec*
Estimates are 2x-5x below
actual
*Justin Scott, Mozilla
24. The Identity Shift
Ad-hoc
IP Address
Machine
Cookie
Session
SSL
Security & privacy at
the expense of
convenience
Website dependent
identity only
25. The Identity Shift
Ad-hoc Structured
IP Address Browser
Machine Individual
Cookie Identity
Session Relationships
SSL Reputation
Security & privacy at
the expense of
convenience
Website dependent
identity only
26. The Identity Shift
Ad-hoc Structured
IP Address Browser
Machine Individual
Cookie Identity
Session Relationships
SSL Reputation
Security & privacy at Convenience with
the expense of privacy, security &
convenience relationships
Website dependent Consistent website
identity only independent identity
60. Kynetx Rule Language (KRL)
Sometimes a layer of indirection helps...
Domain specific language
61. Kynetx Rule Language (KRL)
Sometimes a layer of indirection helps...
Domain specific language
Browser and platform independent
62. Kynetx Rule Language (KRL)
Sometimes a layer of indirection helps...
Domain specific language
Browser and platform independent
Mental leverage via abstractions
imagine that the dots are Web sites and the user is going from web site to web site to accomplish some task.
existing browsers offer little help with this task
Nearly everything we do only involves multiple Web sites, but there’s no help in connecting them.
context is:
- relevant data to the Web task
- links multiple sites
- what the user cares about
CA generates a browsing experience that links together formerly disconnected experiences and ven modifies individual sites.
Cookies and sessions are a way of creating context within a single site
HTTP is designed to be stateless. Each page stands alone.
Single sign on is an example of cross-site context
- single purpose: authentication context
- still not leveraging this as we could. Having a single login that works on multiple sites isn’t the same as having a single authentication context for a given Web episode.
TrustWatch is a browser extension that provides a security context for users that uses a could-based service for site verification.
FF and IE have discovered that others will create interesting add-ons to their browsers. They encourage third party developers to build extensions to their platforms.
Still some work to do here. Safari not very open. Especially on iPhone.
FF and IE have discovered that others will create interesting add-ons to their browsers. They encourage third party developers to build extensions to their platforms.
Still some work to do here. Safari not very open. Especially on iPhone.
FF and IE have discovered that others will create interesting add-ons to their browsers. They encourage third party developers to build extensions to their platforms.
Still some work to do here. Safari not very open. Especially on iPhone.
FF and IE have discovered that others will create interesting add-ons to their browsers. They encourage third party developers to build extensions to their platforms.
Still some work to do here. Safari not very open. Especially on iPhone.
- Web 2.0 has made moves toward this individualization, but is stuck in the ad hoc rule. Web 2.0 drives the need for context.
- Web 2.0 has made moves toward this individualization, but is stuck in the ad hoc rule. Web 2.0 drives the need for context.
- Web 2.0 has made moves toward this individualization, but is stuck in the ad hoc rule. Web 2.0 drives the need for context.
- Web 2.0 has made moves toward this individualization, but is stuck in the ad hoc rule. Web 2.0 drives the need for context.
Fundamentally different than other solutions like OpenID. Cryptographically sound. Deep use cases, not shallow.
Fundamentally different than other solutions like OpenID. Cryptographically sound. Deep use cases, not shallow.
Fundamentally different than other solutions like OpenID. Cryptographically sound. Deep use cases, not shallow.
Fundamentally different than other solutions like OpenID. Cryptographically sound. Deep use cases, not shallow.
Greasemonkey - scripts on the browser not the cloud
Greasemonkey - scripts on the browser not the cloud
Greasemonkey - scripts on the browser not the cloud
Structure browsing - connects the dots and threads the experience
opt-in, user controlled
Structure browsing - connects the dots and threads the experience
opt-in, user controlled
Structure browsing - connects the dots and threads the experience
opt-in, user controlled
Structure browsing - connects the dots and threads the experience
opt-in, user controlled
No one’s ever surprised me with a GUI
No one’s ever surprised me with a GUI
No one’s ever surprised me with a GUI
The combination of browser as platform, cloud-based functionality, & strong identity yield an architecture for generating browsing experiences that are ...
The combination of browser as platform, cloud-based functionality, & strong identity yield an architecture for generating browsing experiences that are ...
The combination of browser as platform, cloud-based functionality, & strong identity yield an architecture for generating browsing experiences that are ...
The combination of browser as platform, cloud-based functionality, & strong identity yield an architecture for generating browsing experiences that are ...
The combination of browser as platform, cloud-based functionality, & strong identity yield an architecture for generating browsing experiences that are ...
The combination of browser as platform, cloud-based functionality, & strong identity yield an architecture for generating browsing experiences that are ...