Every application at some point needs to tackle user permissions. It may be early for some systems or much later in others, but one thing for certain is that as soon as you have more than one user type, the logic will slowly evolve into spaghetti code. And then each time you need to update it will take longer and longer to complete.

In this talk, we’ll proselytize about why decoupling authorization logic is the absolute best solution to the spaghetti code problem and other common authorization pitfalls. We'll look at real-world(ish) permissions implementations using open-source solutions. We'll try things like adding new role-based access controls to an application and evolving it to fine-grained attribute-based access controls. Along the way, we will run into typical blockers and try out ways to solve them. We'll also look at best practices for authorization (role management, policy evolution, the filtering problem, etc.) and when to just use the most obvious solution.

Join us for a presentation where we share the mysteries of anti-bot systems, protected websites, APIs, and mobile applications!

🌐📲🛠️ What's in Store:

1/ Exploring the Defence LayersUncover the intricate layers of defence with TCP Fingerprint, TLS Fingerprint, HTTP/2 Fingerprint, and Browser Fingerprint. 🤯🔍

2/ Anti-Bot Reputation Score DemystifiedDelve into the workings of the anti-bot reputation score, understanding how it operates across various layers to fortify websites. 🛡️💡

3/ Strategies for EvasionDiscover crafty strategies to navigate through these defences, unveiling techniques to outsmart detection mechanisms. 🕵️♂️💨💼 Equip Yourself

After this talk, you'll emerge well-equipped with knowledge to navigate and comprehend the nuances of these protective measures! 🚀🔒Don't miss this opportunity to gain insights into the fascinating world of anti-bot systems. 🌐🔓

Types in programming languages protect us from doing mistakes. It depends on the chosen language how strict and often these type checks are performed. One code smell you may have heard of is called “Primitive Obsession.” It occurs when you are relying too much on built-in data types like integers and strings. Type systems gained a lot of power over the last decades. Many programming languages allow us to embed business rules and security properties directly into types. This enables the compiler to statically enforce these rules. Preventing mistakes and vulnerabilities by design is our goal.

In this talk I will show you a couple of examples how to encode business work flows and constraints into types. The examples will be in a variety of programming language, demonstrating the wide applicability of this approach.

There are so many bits that fight to occupy our time and attention. How do we know what is critical to prioritize and how it impacts other things? This is true of our every day personal and professional lives, but is especially true in the cyber world.

In this session, we will see how graph databases focus on the entities and the connections between them to make contextualizing data incredibly simple. We will walk through how to dump cyber data into a graph and use the power of relationships and accompanying tools to uncover hidden connections and patterns. Gathering tips and tricks will help us optimize the model for querying and access the data through queries, visualization, and applications.

Join us to harness the power of graph databases to find and act upon critical data for security threats.