Dio - Aplicativos resilientes e seguros em Swift.

•

0 j'aime•30 vues

Slides da palestra do evento Aceleração Global Dev #11 - Santander. Link: https://digitalinnovation.one/aceleracoes/aceleracao-global-dev-11-santander

Technologie

Thales Sigoli Frigo
IT Engineer Specialist
Aplicativos Resilientes
e Seguros em Swift

Objetivos do Case
1. Resiliência
2. Segurança
3. Dúvidas?

[Nome do palestrante]
[Posição]
[Nome do curso]
[Nome da aula]
Parte 1: Resiliência
fatalError("ouch 🤖")

Be careful, it's built in Objective-C 👻, what you gonna do?

[Nome do palestrante]
[Posição]
[Nome do curso]
[Nome da aula]
Parte 2: Segurança
print(user.cpf)

Aplicativo
✔ Exposição excessiva de dados
✔ Proteção contra debug
✔ Proteção conta jailbroken

Armazenamento
✔ Armazenamento de dados
✔ Armazenamento de chaves

[Nome do palestrante]
[Posição]
[Nome do curso]
[Nome da aula]
Dúvidas?

[Nome do palestrante]
[Posição]
[Nome do curso]
[Nome da aula]
Obrigado 😉

Contenu connexe

Similaire à Dio - Aplicativos resilientes e seguros em Swift.

Secure coding practices

Scott Hurrey

How to Use OWASP Security Logging

Milton Smith

First Steps with Java Card

Eric Vétillard

Real World Application Threat Modelling By Example

NCC Group

Security incident response is a well-understood operation, with established best practices like the MITRE Att&ck Framework and the Lockheed Martin Kill Chain. Tooling to aid and automate incident response exists, but not all of it is applicable to cloud-native platforms. For example, playbook apps are generally applicable, but the steps to move compromised workloads to an isolated forensics network are platform-specific, and new implementations are needed for the cloud-native world. In this talk, Matt and Francesco will * Recap incident response 101 * Introduce some cloud-native tech including Kubernetes, Istio, and GitOps * Show an Operator built by Matt for dynamically adding complex layer-7 traffic rules in response to changes in the environment, which will be used as part of the demo * Walk you through a response to a log4shell attack against a workload in a k8s cluster: sensor alert, SIEM analysis, IRP automation (honeypots, isolation), building the IoC, and killing the attack.

Automated Cloud-Native Incident Response with Kubernetes and Service Mesh

Matt Turner

Talk given by Chris Rutter Avoiding The Security Brick An exploration of some common scenarios when security teams and processes seriously impact product delivery and result in questionable security benefits, and some battle-proven techniques on how to work more effectively with security while delivering at pace Chris Rutter. A Security Engineer / Transformation specialist who cut his teeth writing Java in Agile environments, then moved into Security Architecture and now helps teams secure their systems by making security technical rather than a tick box.

Avoiding the security brick

Equal Experts

Application and Website Security -- Developer Edition:Introducing Security I...

Daniel Owens

3.Secure Design Principles And Process

phanleson

The (Memory) Safety Dance - SAS 2017 keynote

MarkDowd13

See the improved version: https://www.slideshare.net/ApostolosGiannakidis/mitigating-java-deserialization-attacks-from-within-the-jvm-improved-version A talk about the existing ways to mitigate Java deserialization attacks from the JVM. The talk was presented at the BSides Luxembourg conference on October 2017. It describes the use of Instrumentation Agents and Serialization Filtering and their limitations. It also talks about Runtime Virtualization and Runtime privilege de-escalation. At the talk there was also a PoC demo that demonstrated how an Instrumentation Agent could be tampered from a file upload vulnerability at the application level.

Mitigating Java Deserialization attacks from within the JVM

Apostolos Giannakidis

ITARC15 Workshop - Architecting a Large Software Project - Lessons Learned

João Pedro Martins

https://2022.pythonwebconf.com/presentations/why-should-developers-care-about-container-security Container scanning tools, industry publications, and application security experts are constantly telling us about best practices for how to build our images and run our containers. Often these non-functional requirements seem abstract and are not described well enough for those of us that don't have an appsec background to fully understand why they are important. In this session, we will: go over several of the most common practices to best containerize Python applications show examples of how your application can be exploited in a container and most importantly, how to easily spot issues and fix your Dockerfiles and deployment manifests before you commit your code

Python Web Conference 2022 - Why should devs care about container security.pdf

Eric Smalling

How to bring down your own RTC platform. Sandro Gauci

Alan Quayle

TADSummit 2022 - How to bring your own RTC platform down

Sandro Gauci

Break it while you make it: writing (more) secure software

Leigh Honeywell

4.Security Assessment And Testing

phanleson

This session will show that writing secure code and constructing secure systems is not as hard as it may sound. First, we will briefly dissect some well-known security vulnerabilities which were the result of only minor programming errors and we will demonstrate how easy insecurely written Java code can be exploited. However, writing secure code from the start is just as easy. For this we will present a handful of basic rules and tools every secure Java developer must know. This session will discuss the secure usage of open source libraries and it will present basic security patterns to construct secure system architectures. By the end of this session you will have a higher security awareness and a set of simple tools for your daily work. The talk was delivered at the JavaOne 2015 in San Francisco. #JavaOne

Secure JEE Architecture and Programming 101

Mario-Leander Reimer

Container Stranger Danger - Why should devs care about container security

Eric Smalling

Presenting at All Things Open 2022 Presented by Eric Smalling Title: Why Should Developers Care About Container Security? Abstract: Container scanning tools, industry publications, and application security experts are constantly telling us about best practices for how to build our images and run our containers. Often these non-functional requirements seem abstract and are not described well enough for those of us that don’t have an appsec background to fully understand why they are important. In this session, we will: - go over several of the most common practices to best containerize applications - show examples of how your application can be exploited in a container - and most importantly, how to easily spot issues and fix your Dockerfiles and deployment manifests before you commit your code

Why Should Developers Care About Container Security?

All Things Open

ATO 2022 - Why should devs care about container security.pdf

Eric Smalling

Similaire à Dio - Aplicativos resilientes e seguros em Swift. (20)

Secure coding practices

How to Use OWASP Security Logging

First Steps with Java Card

Real World Application Threat Modelling By Example

Automated Cloud-Native Incident Response with Kubernetes and Service Mesh

Avoiding the security brick

Application and Website Security -- Developer Edition:Introducing Security I...

3.Secure Design Principles And Process

The (Memory) Safety Dance - SAS 2017 keynote

Mitigating Java Deserialization attacks from within the JVM

ITARC15 Workshop - Architecting a Large Software Project - Lessons Learned

Python Web Conference 2022 - Why should devs care about container security.pdf

How to bring down your own RTC platform. Sandro Gauci

TADSummit 2022 - How to bring your own RTC platform down

Break it while you make it: writing (more) secure software

4.Security Assessment And Testing

Secure JEE Architecture and Programming 101

Container Stranger Danger - Why should devs care about container security

Why Should Developers Care About Container Security?

ATO 2022 - Why should devs care about container security.pdf

Dernier

The value of a flexible API Management solution for Open Banking Steve Melan, Manager for IT Innovation and Architecture - State's and Saving's Bank of Luxembourg Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The value of a flexible API Management solution for O...

apidays

Effective data discovery is crucial for maintaining compliance and mitigating risks in today's rapidly evolving privacy landscape. However, traditional manual approaches often struggle to keep pace with the growing volume and complexity of data. Join us for an insightful webinar where industry leaders from TrustArc and Privya will share their expertise on leveraging AI-powered solutions to revolutionize data discovery. You'll learn how to: - Effortlessly maintain a comprehensive, up-to-date data inventory - Harness code scanning insights to gain complete visibility into data flows leveraging the advantages of code scanning over DB scanning - Simplify compliance by leveraging Privya's integration with TrustArc - Implement proven strategies to mitigate third-party risks Our panel of experts will discuss real-world case studies and share practical strategies for overcoming common data discovery challenges. They'll also explore the latest trends and innovations in AI-driven data management, and how these technologies can help organizations stay ahead of the curve in an ever-changing privacy landscape.

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc

Keynote 2: APIs in 2030: The Risk of Technological Sleepwalk Paolo Malinverno, Growth Advisor - The Business of Technology Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

apidays

Retrieval augmented generation (RAG) is the most popular style of large language model application to emerge from 2023. The most basic style of RAG works by vectorizing your data and injecting it into a vector database like Milvus for retrieval to augment the text output generated by an LLM. This is just the beginning. One of the ways that we can extend RAG, and extend AI, is through multilingual use cases. Typical RAG is done in English using embedding models that are trained in English. In this talk, we’ll explore how RAG could work in languages other than English. We’ll explore French, Chinese, and Polish.

Introduction to Multilingual Retrieval Augmented Generation (RAG)

Zilliz

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

apidays

Accelerating FinTech Innovation: Unleashing API Economy and GenAI Vasa Krishnan, Chief Technology Officer - FinResults Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...

apidays

DBX First Quarter 2024 Investor Presentation

Dropbox

Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows. We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases. This video focuses on the deployment of external web forms using Jotform for Bonterra Impact Management. This solution can be customized to your organization’s needs and deployed to support the common use cases below: - Intake and consent - Assessments - Surveys - Applications - Program registration Interested in deploying web form automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Jeffrey Haguewood

Understanding the FAA Part 107 License ..

Christopher Logan Kennedy

Architecting Cloud Native Applications

WSO2

Exploring Multimodal Embeddings with Milvus

Zilliz

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Juan lago vázquez

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Zilliz

Vector Search -An Introduction in Oracle Database 23ai.pptx

Remote DBA Services

CNIC Information System with Pakdata Cf In Pakistan

danishmna97

ICT role in 21st century education and its challenges

rafiqahmad00786416

Three things you will take away from the session: • How to run an effective tenant-to-tenant migration • Best practices for before, during, and after migration • Tips for using migration as a springboard to prepare for Copilot in Microsoft 365 Main ideas: Migration Overview: The presentation covers the current reality of cross-tenant migrations, the triggers, phases, best practices, and benefits of a successful tenant migration Considerations: When considering a migration, it is important to consider the migration scope, performance, customization, flexibility, user-friendly interface, automation, monitoring, support, training, scalability, data integrity, data security, cost, and licensing structure Next Wave: The next wave of change includes the launch of Copilot, which requires businesses to be prepared for upcoming changes related to Copilot and the cloud, and to consolidate data and tighten governance ShareGate: ShareGate can help with pre-migration analysis, configurable migration tool, and automated, end-user driven collaborative governance

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

sammart93

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

Dubai, often portrayed as a shimmering oasis in the desert, faces its own set of challenges, including the occasional threat of flooding. Despite its reputation for opulence and modernity, the emirate is not immune to the forces of nature. In recent years, Dubai has experienced sporadic but significant floods, testing the resilience of its infrastructure and communities. Among the critical lifelines in this bustling metropolis is the Dubai International Airport, a bustling hub that connects the city to the world. This article explores the intersection of Dubai flood events and the resilience demonstrated by the Dubai International Airport in the face of such challenges.

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

Orbitshub

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

Edi Saputra

Dernier (20)

Apidays New York 2024 - The value of a flexible API Management solution for O...

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Introduction to Multilingual Retrieval Augmented Generation (RAG)

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...

DBX First Quarter 2024 Investor Presentation

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Understanding the FAA Part 107 License ..

Architecting Cloud Native Applications

Exploring Multimodal Embeddings with Milvus

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Vector Search -An Introduction in Oracle Database 23ai.pptx

CNIC Information System with Pakdata Cf In Pakistan

ICT role in 21st century education and its challenges

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

AWS Community Day CPH - Three problems of Terraform

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving