Sonja Henies Plass 4
0185 Oslo - Norway
Phone: +47 21 61 90 93


5 St. Johns Lane, Farringdon
EC1M 4BH - London - UK
Company Number: 11965764
Phone: +44 (0)20 7549 2880


L26, 44 Market Street
NSW 2000 - Sydney, Australia


C/O Lethert, Skwira, Schultz & Co LLP
170 Seventh Place East
St. Paul, MN 55101, USA
Phone: +1 (763) 333-7598
Email: 

C/O Christensen Kjærulff
Store Kongensgade 68,1264 Copenhagen, Denmark


C/O Porto IO
Rua Cândido dos Reis, no 81
4050 152 Porto, PT


NDC Conferences delivers high-end events for software developers, ranging from large 5-day conferences to smaller events and tailor made workshops.

NDC Conferences

Most of us will know the names of the most commonly used asymmetric encryption algorithms, RSA and ECDSA. But how many of us know how they actually work? What are their drawbacks and limitations, and where are they vulnerable?

Join me for a mathematical deep dive into one of the most fundamental underpinnings of our security infrastructure, journeying from the inception of these algorithms and their algebraic foundations to their modern day usage. We'll talk about why ECDSA has superseded RSA, why it's still not good enough in a post-quantum world, and what's next for asymmetric encryption.

We all rely on asymmetric encryption every day, both as developers and consumers. It's what keeps our web traffic safe, what lets us sign our git commits, and what powers almost every single authentication flow.

Fortify

mend.io

SecureFlag

Veeam
Veeam® is the leader in Backup solutions that deliver Cloud Data Management™. Veeam provides a single platform for modernizing backup, accelerating hybrid cloud and securing your data. With 365,000+ customers worldwide, including 81% of the Fortune 500 and 66% of the Global 2,000, Veeam customer-satisfaction scores are the highest in the industry at 3.5x the average. Veeam’s global ecosystem includes 70,000+ partners, including HPE, NetApp, Cisco and Lenovo as exclusive resellers. Veeam was recently acquired by American Insight Partners and has offices in more than 30 countries. To learn more, visit https://www.veeam.com​ or follow Veeam on Twitter @veeam.​

Veeam

NDC Security Oslo 2024

Radisson Blu Scandinavia Hotel

Eli has been in tech since being released back into the wild from studying maths at university 7 years ago. They've spent their time working in industries ranging from telecoms to biotech to analog circuit design, continually getting nerd-sniped along the way. These days, they're a freelancer who speaks at conferences, runs  workshops, and learns whatever they want. In their spare time, they like to play video games, knit and sew, and hang out with their cat.

Eli Holderness

Asymmetric Encryption: A Deep Dive

Security Tooling

Architecture

Privacy

However, Privacy Engineering is a nascent and relatively new field with many of the same goals and objectives. From Threat Modeling to Cryptography, our knowledge and experience can help accelerate Privacy.

Privacy Engineering is an emerging field. The field of Security Engineering has existed for many decades. We’ve changed cultures, shifted left, evangelized, and automated. 

Samuel is a Security Engineer with a curiosity of Privacy Engineer. He began his career building security teams and security cultures. He studied cyber security at The University of Alabama in Huntsville, and is currently a Senior Security Engineer at Spotify. 

Samuel Kelemen

Fundamentals of Privacy Engineering

AI/ML

Process

We levelled up the threat modeling war game. Engaged in CTF-style challenges, your team will battle for control over an offshore wind turbine park.

The level of this training is Beginner/Intermediate. Participants who are new to threat modeling are advised to follow our self-paced Threat Modeling Introduction training (which is about 2 hours and is included in this training).

As highly skilled professionals with years of experience under our belts, we're intimately familiar with the gap between academic knowledge of threat modeling and real-world practice. To minimize that gap, we have developed practical use cases, based on real-world projects. Each use case includes a description of the environment, together with questions and templates to build a threat model.

Students will be challenged in groups of 3 to 4 people to perform the different stages of threat modeling:

• Diagram techniques applied on a travel booking service
• Threat model a cloud-based update service for an IoT kiosk
• Create an attack tree against a nuclear research facility
• Create a SOC Risk Based Alerting system with MITRE ATT&CK
• Mitigate threats in a payment service build with microservices and S3 buckets
• Apply data protection by design and default on a loyalty app
• Apply the OWASP Threat Modeling Playbook on agile development
• Threat modeling the CI/CD pipeline
• Battle for control over "Zwarte Wind", an offshore wind turbine park

After each hands-on exercise, the results are discussed, and students receive a documented solution. All participants get our Threat Modeling Playbook to improve you threat modeling practice, and a one-year access to our online threat modeling learning platform.

As part of this training, you will be asked to create and submit your own threat model, on which you will get feedback. One month after the training we organize an individual coaching session with all the participants.


Course Syllabus/Outline

Agile Whiteboard Hacking - aka Hands-on Threat Modeling - Course Outline

Threat modeling introduction
• Threat modeling in a secure development lifecycle
• What is threat modeling?
• Why perform threat modeling?
• Threat modeling stages
• Different threat modeling methodologies
• Document a threat model
Diagrams – what are you building?
• Understanding context
• Doomsday scenarios
• Data flow diagrams
• Trust boundaries
• Sequence and state diagrams
• Advanced diagrams
• Hands-on: Diagram techniques applied on a travel booking service
Identifying threats – what can go wrong?
• STRIDE introduction
• STRIDE threats
• Hands-on: Threat model a cloud-based update service for an IoT kiosk
• Attack trees
• Hands-on: Create an attack tree against a nuclear research facility
• Attack libraries
• MITRE ATT&CK
• Hands-on: Create a SOC Risk Based Alerting system with MITRE ATT&CK

Addressing each threat
• How to address threats
• Mitigation patterns
• Value of standard mitigations
• Setting priorities through risk calculation
• Risk management
• Threat agents
• The mitigation process
• Hands-on: Mitigate threats in a payment service build with microservices and S3 buckets
Threat modeling and compliance
• How to marry threat modeling with compliance
• GDPR and Privacy by design
• Privacy threats
• LINDUNN and Mitigating privacy threats
• Threat modeling medical devices
• Threat modeling Industrial Control Systems (IEC 62443)
• Threat Assessment and Remediation Analysis for automotive (TARA, SAE 21434)
• Mapping threat modeling on compliance frameworks
• Hands-on: Apply data protection by design and default on a loyalty app
Advanced threat modeling
• Typical steps and variations
• Validation threat models
• Effective threat model workshops
• Communicating threat models
• Agile and DevOps threat modeling
• Improving your practice with the Threat Modeling Playbook
• Scaling up threat modeling
• Hands-on: Apply the OWASP Threat Modeling Playbook on agile development
• Hands-on: Threat modeling the CI/CD pipeline
Threat modeling resources
• Open-Source tools
• Commercial tools
• General tools
• Threat modeling tools compared
Examination
• Hands-on examination
• Grading and certification
Battle for control over "Zwarte Wind", an offshore wind turbine park
Red team versus Blue team battle for control over an offshore wind turbine park

Review session (online coaching session after 1 month)
• Hand-in of your own threat model
• Individual feedback on your threat model
• Review session


You will be challenged with hands-on threat modeling exercises based on real-world projects. You will get insight into our practical industry experience, helping you to become a Threat Modeling Practitioner. We included an exercise on MITRE ATT&CK, and we focus on embedding threat modeling in Agile and DevOps practices.

aikido

Auth0

Duende

SafeStack

NDC Security 2025

Sebastien Deleersnyder, CTO and co-founder of Toreon, has a deep cybersecurity background. He has trained many developers in secure coding practices, founded the Belgian OWASP chapter, and contributed significantly to OWASP projects like SAMM. Now, he’s focusing on integrating application security into DevOps and expanding the reach of threat modeling.

Sebastien Deleersnyder

Agile Whiteboard Hacking – aka Hands-on Threat Modeling

Application Security

Cloud Security

Hacking

SDLC

Representing a leading bank, we will share our first-hand experience of navigating these challenges and fortifying the protection of our customers' invaluable data and assets. Delve into the organizational hurdles we confronted from a cybersecurity perspective and gain insights into the measures we have implemented to safeguard privacy and ensure financial safety.

During our session, we will showcase a live demo, unveiling the impact of DeepFake on fraud. Discover the risks it poses to the banking sector and beyond, explore future implications, and learn about our proactive steps to mitigate these risks. Gain invaluable insights, practical advice, and stay ahead in the ever-evolving cybersecurity landscape. Don't miss this opportunity to safeguard your data and assets.

Join us in this gripping session as we peel back the layers of the banking sector's current state during these dark times. The industry faces relentless direct attacks and ingenious social engineering scams that have evolved with the digital era. As technology progresses, with the rise of DeepFake and powerful AI/ML tools like ChatGPT, scammers exploit these innovations, making cybersecurity an ever more critical pursuit.

An IT industry veteran with 15 years of experience, starting from hands-on technical roles to leading engineering teams in security-critical sectors. Passionate about coaching, development, teaching, and supporting others.

George started his journey as a professional chess player at the age of 6, and in 2004, he won the “Romanian Chess Champion” title with his club team. At the age of 16, George followed his entrepreneurial spirit and started his own ISP Company in Bucharest. CN was sold when he finished high school at the age of 18, having a maximum peak of 600 clients.

George continued his career in the IT field, working on positions ranging from engineer to manager, and at the age of 27 he joined the Executive MBA class of IMT Paris as the youngest student ever to be enrolled in this program.

In 2016 he was included in the "100 Faces of Innovation" volume published by Financial Times, and so far his courses on Cybersecurity, AI and NFTs attracted over 160K students.

At this point, George is working for ING Bank, while also participating in events related to DevOps, Cybersecurity and Blockchain/NFTs. 

George Proorocu

Banking Cybersecurity: Battling DeepFakes & AI-powered Scammers

Experience report

Passkeys are a new authentication technology that uses cryptography within the web browser to securely identify and authenticate users, automatically syncing across devices, to entirely eliminate the need for passwords. It's like magic! We'll learn what they are, how they work, and why they are (virtually) unhackable. Your users will love a simplified login flow, and you'll stop worrying about account takeovers.

Authentication is hard! Passwords are guessable, while SMS and app-based multi-factor authentication can be compromised. Even the promise of hardware tokens comes at a cost, being easy to lose and/or forget. Unfortunately, as developers, we're stuck trying to solve this difficult problem: how to make authentication work without putting our users at risk. Every option appears to have downsides... but there is hope!

Stephen is a security consultant and crusted-on PHP developer who spends his days doing Laravel Security Audits and Penetration Tests. When he’s not trying to hack his client’s websites, he teaches Laravel developers about security concepts through his Laravel Security in Depth mailing list. Stephen’s idea of fun is spending a year cleaning infected WordPress sites and picking locks. 

Stephen Rees-Carter

Passwords are Dead, Long live Passkeys!

Programming

In this presentation, we'll explore privacy engineering and discover how it can strengthen security. Privacy by design actually requires a very similar approach to security by design. This session will explore how privacy can be successfully integrated into security practices, such as threat modeling, while strengthening the security posture along the way.

Debunking this and other persistent privacy myths is highly overdue. Privacy is important! But how can privacy be implemented in practice? 

Dr. Kim Wuyts is a leading privacy engineering expert with over 15 years of experience in security and privacy. Before joining PwC Belgium as Manager Cyber & Privacy, Kim was a senior researcher at KU Leuven where she led the development and extension of LINDDUN, a popular privacy threat modeling framework. 

Her mission is to raise privacy awareness and get organizations to embrace privacy engineering best practices. She is a guest lecturer, experienced speaker, and invited keynote at international privacy and security conferences such as OWASP Global AppSec, BruCon, RSA, Troopers, CPDP, APF and IAPP DPC. In the last few years, Kim has been delivering privacy awareness and privacy threat modeling training at many events, including academic guest lectures and corporate training.

Kim is also a co-author of the Threat Modeling Manifesto+Capabilities, program co-chair of the International Workshop on Privacy Engineering (IWPE), and a member of ENISA’s working group on Data Protection Engineering.

Kim Wuyts

I don't need privacy, I got confidentiality!

Culture

This talk will cover the following topics:
- the quantum threat and the "store now, decrypt later" attack
- standardised quantum-safe algorithms and their properties
- how quantum-safe crypto is used today for TLS and messaging
- challenges using the new quantum-safe algorithms in practise
- opportunities using quantum-safe cryptography going forward

While this is a technical topic, it is mostly new to everyone, and most of the talk will be non-technical so that everyone with interest in quantum-safe cryptography can benefit from it.

This session will be about quantum-safe cryptography. The development of quantum computers is a looming threat against public key cryptography built upon factorization and discrete logarithm problems, such as RSA encryption and signatures, Diffie-Hellman key exchange, and elliptic curve digital signatures. This has led to the development of quantum-safe cryptography, which the world will transition to over the coming years.


Tjerand is a Security and Cryptography Expert at the cybersecurity company Pone Biometrics and an Associate Professor at the Department of Information Security and Communication Technology at NTNU. His main interests are quantum-safe cryptography, privacy-preserving computation, and anonymous communications. In 2020, the Norwegian Data Protection Agency awarded Tjerand and his team the "Bult-in privacy" award for designing a private contact-tracing protocol used by more than 1 million Norwegians.

NDC Conferences AS

NDC Conferences UK LTD

NDC Conferences Australia Pty Ltd

NDC Conferences USA, Inc

NDC Conferences DK APS

NDC Conferences Portugal, Unipessoal LDA