BEGIN:VCALENDAR VERSION:2.0 PRODID:-//Pentabarf//Schedule 0.3//EN CALSCALE:GREGORIAN METHOD:PUBLISH X-WR-CALDESC;VALUE=TEXT:Security devroom X-WR-CALNAME;VALUE=TEXT:Security devroom X-WR-TIMEZONE;VALUE=TEXT:Europe/Brussels BEGIN:VEVENT METHOD:PUBLISH UID:9349@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T103000 DTEND:20200201T105500 SUMMARY:Threat Modelling for Developers DESCRIPTION:
What threats do we need to take into account when building a system? A key method for answering this question is an approach called threat modelling, whereby security problems can be anticipated during the design phase. This talk discusses major threat-modelling approaches, and includes concrete examples of how to apply them to software-intensive systems.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_threat_modelling_for_developers/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Arne Padmos":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:10571@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T110000 DTEND:20200201T112500 SUMMARY:AMENDMENT Custom Crypto Policies by Examples DESCRIPTION:Management of allowed cryptographical algorithms to disallow algorithms not allowed due to weaknesses or restrictions by certification standards is complicated task. The talk will introduce system-wide crypto-policies concept and implementation as an attempt to help system administrators with this task.
This talk replaces "OSINT" talk which was schedulled initially, but David Busby could not attend on the short notice.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_custom_crypto_policies/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Tomáš Mráz":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:10272@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T113000 DTEND:20200201T115500 SUMMARY:Securing Existing Software using Formally Verified Libraries DESCRIPTION:Security vulnerabilities are still very common in todays software. Formal methods could improve the situation, but program verification remains a complex and time-consuming task. Often, the verification of existing software is infeasible and a complete rewrite can be prohibitively expensive. Both, however, is not necessarily required to improve on the current state. By replacing critical parts of an existing software by verified code, security can be strengthened significantly with moderate effort.
We show the feasibility of this approach by the example of a FLOSS TLS implementation. The basis of our PoC is the TLS 1.3 library Fizz which is written in C++. The existing message parser was replaced by a verified version implemented in the SPARK language. Our RecordFlux toolset was used to automatically generate the parser based on a formal message specification. With the SPARK tools we can prove automatically that an attacker cannot cause any overflows, runtime errors or undefined state by sending malformed messages to the modified library. Because of mismatches in the data structures used in C++ and SPARK, some glue code had to be written manually to integrate the verified parser into Fizz. Still, the modified TLS implementation shows only a slight performance loss while providing higher security.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_securing_existing_software_using_formally_verified_libraries/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Tobias Reiher":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:10390@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T120000 DTEND:20200201T122500 SUMMARY:SpecFuzz: Bringing Spectre-type vulnerabilities to the surface DESCRIPTION:Spectre-type attacks are a real threat to secure systems because a successful attack can undermine even an application that would be traditionally considered safe.SpecFuzz is the first tool that enables fuzzing for such vulnerabilities.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_specfuzz_bringing_spectre_type_vulnerabilities_to_the_surface/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Oleksii Oleksenko":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:9182@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T123000 DTEND:20200201T125500 SUMMARY:Falco Internals 101 : Syscalls processing for security analysis DESCRIPTION:Linux Syscalls can be used as an entrypoint to do security analysis on Linux. However reading and processing every system call in userspace creates a very unique set of challenges.In this talk we are going to see exactly what those challenges are and how we solved them in the Falco project.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_falco_internals_101/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Lorenzo Fontana":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:10218@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T130000 DTEND:20200201T132500 SUMMARY:Docker Security considerations & Incident Analysis DESCRIPTION:In this presentation we take under consideration the increased use of Docker in corporate environments.It is a fact that Docker has found wide spread of use during the past years, mostly because of itbeing very easy to use , economic w.r.t resources used, fast and easy to deploy when compared witha full blown virtual machine. More and more servers are being operated as Docker hosts on whichmicro-services run in containers. From a security point of view, two aspects of it arise in thecontext of this talk and the inherent time-limitations it has. Firstly, the aspect of the alreadyquite talked-through question, “is it secure ?”.Secondly the less analyzed aspect of incident analysisand the changes introduced with respect to known methods and evidence.In this presentation we willbriefly outline some security considerations about Docker and the average user and then we will tryto examine how Docker introduces changes to the workflow related to incident analysis and forensics in its environment.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_docker_security_considerations_incident_analysis/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="John Lionis":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:10370@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T133000 DTEND:20200201T135500 SUMMARY:Incrementality and deck functions DESCRIPTION:Protocols in symmetric cryptography are often built from block ciphers, with a fixed input and output size, while variable sizes are handled through their modes of use. Incrementality, namely, the ability to efficiently compute the output for increasing inputs, or to request longer outputs, is often a property of the implementation rather than an explicit feature of a mode.
A doubly-extendable cryptographic keyed (or deck) function is a new kind of object that makes incrementality an integral part of its definition. Writing modes for various applications, such as authenticated encryption of a network channel or disk encryption with a wide block cipher, on top of a deck function turns out to be a simple exercise and leads to less error-prone implementations than on top of a block cipher. We illustrate this with the session-supporting authenticated encryption modes SANE and SANSE. (Sessions naturally protect a continuous flow of messages or a client-server dialog.)
While a deck function can be constructed from existing primitives, like a block cipher, we show two more natural ways of making a deck function in practice.
The first one is based on the well-known permutation-based duplex construction, of which a nice instantiation is the Strobe protocol framework. Strobe was showcased in Noise+Strobe=Disco as an advantageous replacement to all kinds of primitives in the Noise protocol framework, resulting in much simpler specifications and a lighter implementation. Xoodyak, our candidate to the NIST Lightweight Cryptography competition, is another example.
The second one is based on the recent Farfalle construction, which relies on the parallel application of a permutation. Farfalle's inherent parallelism yields deck functions that are at the same time simple and efficient on a wide range of platforms. In particular, we point out the nice performance of Kravatte and Xoofff, two deck functions based on the Keccak-p and the Xoodoo permutation, respectively. It is worth noting that Kravatte and Xoofff are much faster than AES-128 in software, and at least competitive with and often faster than AES-128 using dedicated AES instructions on the more recent Intel and AMD processors!
How Transparent Data Encryption is built in MySQL and Percona Server ?- keyrings – what are they used for ? What is the difference between using a server back-end (keyringvault) versus file back-end (keyringfile). How it affects server startup and why? Why per server separation is needed in Vault Server?- How Master Key encryption works ? How it is build on page level ? How do we know which key we should fetch to decrypt a table ? How do we know that used key is the correct one ? How do we make sure that we can decrypt a table when we need it ?- What crypto algorithms are used ?- How Master Key rotation works ? Why is it needed ?- What is KEYRING encryption and what are encryption threads?- How binlog encryption works in 5.7 and how it works in 8.0 ?- How undo log/redo log encryption works ?
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_how_transparent_data_encryption_is_built_in_mysql_and_percona_server/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Robert Golebiowski":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:10210@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T143000 DTEND:20200201T145500 SUMMARY:Secure logging with syslog-ng DESCRIPTION:The design, implementation, and configuration of the secure logging service. Its aim is to provide tamper evident logging, i.e., to adequately protect log records of an information system against tampering and to provide a sensor indicating attack attempts. The secure logging service achieves this by authentically encrypting each log record with an individual cryptographic key used only once and protects integrity of the whole log archive by a cipher{based message authenticationcode. Each attempt to tamper with either an individual log record or the log archive itself will be immediately detected during log archive verification. Therefore, an attacker can no longer tamper with log records without being detected which greatly enhances the use of log archives in forensic investigations.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_secure_logging_with_syslog_ng/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Stephan Marwedel":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:9444@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T150000 DTEND:20200201T152500 SUMMARY:Protecting plaintext secrets in configuration files DESCRIPTION:Applications and services rely on configuration data in order to be customized and we will talk about how to keep them in a safer place other than plaintext configuration files.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_protecting_plaintext_secrets_in_configuration_files/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Moisés Guimarães":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:10388@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T153000 DTEND:20200201T155500 SUMMARY:Application Whitelisting in Linux Environment DESCRIPTION:Are you a sysadmin and feeling paranoid? Let's promote security hardening to another level.Perhaps, with the concept of Application Whitelisting you will be able to sleep again.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_application_whitelisting_in_linux_environment/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Radovan Sroka":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:10188@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T160000 DTEND:20200201T162500 SUMMARY:seccomp — Your Next Layer of Defense DESCRIPTION:Why should you allow all possible system calls from your application when you know that you only need some? If you have ever wondered the same then this is the right talk for you. We are covering:
Because your security approach can always use an additional layer of protection.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_seccomp/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Philipp Krenn":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:10585@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T163000 DTEND:20200201T165500 SUMMARY:Kernel Runtime Security Instrumentation DESCRIPTION:KRSI (Kernel Runtime Security Instrumentation) is an ongoing effort at Google to upstream an LSM (Linux Security Module) instrumentable using eBPF (extended Berkeley Packet Filter) to the Linux kernel.
KRSI allows system owners to dynamically attach eBPF programs to security hooks and write MAC and audit policies without having to reboot or patch the kernel thereby enabling a new class of system security and auditing software.
This talk presents the main concepts behind KRSI: it introduces the technologies leveraged and presents the API exposed to users.
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_kernel_runtime_security_instrumentation/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Florent Revest":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:9050@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T170000 DTEND:20200201T172500 SUMMARY:Using SELinux with container runtimes DESCRIPTION:Lukas Vrabec built a new standalone tool, udica, for generating SELinux policy profiles for containers based on automatic inspecting these containers. We will focus on why udica is needed in the container world and how it can make SELinux and containers work better together. We will show real examples where SELinux separation for containers had to be turned off because the generic SELinux type container_t was too tight. With a tool like “udica”, users and developers can easily customize the policy with limited SELnux policy writing skills. Come to see how easy also you can create custom SELinux policy for your containers!
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_using_selinux_with_container_runtimes/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Lukas Vrabec":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:10535@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T173000 DTEND:20200201T175500 SUMMARY:The hairy issue of e2e encryption in instant messaging DESCRIPTION:End-to-end encryption is often regarded as the holy grail of security. But when you start implementing it soon becomes a security hell. Does it really protect against the threats it should protect against? And watch out for the pitfalls when implementing it: almost everybody fails there!
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_the_hairy_issue_of_e2e_encryption_in_instant_messaging/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Winfried Tilanus":invalid:nomail END:VEVENT BEGIN:VEVENT METHOD:PUBLISH UID:9865@FOSDEM20@fosdem.org TZID:Europe-Brussels DTSTART:20200201T180000 DTEND:20200201T182500 SUMMARY:What you most likely did not know about sudo… DESCRIPTION:Everybody knows sudo, right? Sudo allows a system administrator to give certain users the ability to run some commands as root, while logging the executed commands and their arguments. It is installed by default on almost all Linux systems, and is available for most commercial UNIX systems. Still, even system administrators often only know it is the “prefix” to use before entering a command requiring root privileges. Learn how much more this simple looking tool can do!
CLASS:PUBLIC STATUS:CONFIRMED CATEGORIES:Security URL:https:/fosdem.org/2020/schedule/2020/schedule/event/security_what_you_most_likely_did_not_know_about_sudo/ LOCATION:UA2.114 (Baudoux) ATTENDEE;ROLE=REQ-PARTICIPANT;CUTYPE=INDIVIDUAL;CN="Peter Czanik":invalid:nomail END:VEVENT END:VCALENDAR