24 au 26 février, 2027
Montréal, Canada

Conférence Securité

La liste des présentations est sujette à changement sans préavis.
AI Under the Skin: Fail-Safe Recovery for In Vivo Systems
Securité AI-enabled in vivo systems can sense physiology, infer state, and trigger physical action. I examine poisoned inputs, compromised updates, sensor/model drift, and unsafe autonomous decisions. I show how independent monitors detect loss of trust, how bounded actuation and external override contain it, and how known-good recovery and re-attestation restore control. Attendees leave with a reusable fail-safe pattern for safety-critical edge AI.
Authentication is the easy half
Securité You asked for an ID before you opened the door. Who checks which rooms they open next? Authentication alone gets you almost nothing. Once a request is trusted, whole classes of failures open up: unauthorised reads, privilege grants, wrong balances, forgotten endpoints still answering, control panels wide open. I will walk you through the vulnerability and teach you the defence. Let's look at both halves and get authorisation right.
Claws Out: Identity-Aware Access for an Autonomous Agent
Securité Running an autonomous agent like OpenClaw without hardening access to it is a bad idea. This talk covers securing OpenClaw ingress: OIDC login, short-lived SSH certificates, per-connection policy, and live session revocation, using Pomerium, an open core (Apache 2.0) identity-aware proxy built on Envoy, a CNCF project. Includes a PR I contributed upstream (trusted-proxy auth mode) and a live demo killing an active session mid-task.
From the ISS to Aware AI: Presence & Quantum Security
Securité This session explores how AI agents move from demos into real-world environments. Drawing on technology first used for holographic communication with the ISS and later deployed in airports, healthcare, and training, I’ll share lessons on AI Presence, context-aware systems, edge vs. cloud decisions, unreliable networks, privacy, and post-quantum security. Attendees will learn practical approaches for building resilient, aware, secure AI.
Governing AI Before It Governs You
Securité Developers already ship code with agentic AI and MCP servers without governance. Blocking them kills velocity; ignoring them creates risk. This session shows how to build a centralized MCP broker with Amazon Bedrock AgentCore Gateway and Runtime, enforce identity-based permissions on agent requests, distribute a curated skills catalog with reusable blueprints, and embed security agents into the AI SDLC so you can govern AI without slowing it down
Guardians of the Containers
Securité Container security depends on several layers working together. The Guardians connect image and supply chain security, Kubernetes policies, runtime detection, network isolation, and observability. Practical examples with Trivy, Kyverno, and Falco show where each layer helps and where it falls short. Learn to harden images, limit workload privileges, spot suspicious behavior, and use network policies to contain an incident.
How artifact firewalls prevent software supply chain attacks
Securité The massive increase in supply chain attacks for trusted packages causes serious risks to many organizations. Packages get infected, versions get bumped and malicious code gets rapidly distributed at enormous scale.

In this presentation we’ll take a closer look at how an artifact firewall prevents you from pulling in infected packages by enforcing OSV.dev rules at request time, introducing quarantine windows, and offering an audit trail.
How Banks Protect Their Applications with FAPI
Securité FAPI is a security profile that protects APIs in high-value scenarios where heightened security is needed.
To be considered a FAPI 2.0 compliant implementation, your implementation must use the right set of OAuth's best current practices.

In this session you'll learn the concepts of each part and see a practical example on how it is implemented on both identity provider and client.
How To Publish To NPM In 2027
Securité NPM is the largest registry of public JavaScript source code, but lately it has been an attack vector for malicious code. To prevent the distribution of hacked code, the publishing process has been hardened against stolen credentials. In this presentation, I will explain the new trusted publishing process and how to follow safe code practices.
IA Agentique en Production : Sécuriser l'Imprévisible
Securité L'IA agentique passe du MVP à la PROD plus vite que la plupart des équipes sécu n'adaptent leurs modèles de menace.

Des agents autonomes qui appellent des outils, enchaînent des LLMs et communiquent entre eux via des protocoles comme MCP et A2A introduisent des surfaces d'attaque que l'OWASP Top 10 classique n'a jamais couvertes : le prompt injection comme vecteur de mouvement latéral, le tool-poisoning, l'exploitation de la confiance A2A
Inside the Layers, Metadata, and Security of Container Image
Securité Containers run from images, and images are created by Dockerfiles. But what is a layer? And what ends up inside the image? What files and executables are added? And how does the base image affect all of this? What if I use a different base image? Container Images aren't a black box. Lets open them up, and create a few from scratch. We'll also discuss how image internals help us our manage supply-chain security for SBOMs.
Keeping the Java Platform Secure
Securité Java is dominant in enterprises because of its trust, predictability, and security. This session overviews the latest Java security advancements and their impact on developers. It covers Post Quantum Cryptography (PQC) readiness, transitioning Java to have more frequent security updates, and Java's alignment with industry standards, including FIPS 140-3 compliance.
Kubernetes Security Hits: les failles que vous ne voulez pas
Securité Kubernetes est aujourd’hui la plateforme d’orchestration de conteneurs la plus utilisée dans le monde (cloud public, hybride, on-prem).
Sa complexité et son adoption massive en font une cible privilégiée pour les attaquants.
De nombreuses compromissions récentes montrent que les mauvaises configurations sont la première source de vulnérabilités, bien avant les failles logicielles.
OAuth 2.1 & OpenID Connect: The Good Parts
Securité OAuth has been around for a long time now, and has become the standard protocol for token-based security.
Like every popular technology that has been growing with its requirements, there are some things which work really well, and some that did not quite stand the test of time. This talk looks at the essentials you should know about, if you would enter the OAuth ecosystem today. Which protocol flows and extensions should you study, which
Package manager security: from client to central enforcement
Securité Package ecosystems like npm, PyPI, Maven, NuGet and Composer each have controls against software supply chain attacks. We'll compare their capabilities, expose the limits of client-side controls, and show how centralized policies can be enforced at the gate, before they reach the CI/CD pipeline.
We'll cover topics like centralized policy as code, dependency cooldowns, audit trails, OSV rules, and the need for a vendor-neutral artifact firewall.
PHP2Shell: Tales from the Front Lines
Securité In October 2026, a pair of critical vulnerabilities in PHP, termed "PHP2Shell," were disclosed. As a PHP 8.5 Release Manager, Daniel Scherzer had a front-row seat to the announcement of the PHP2Shell vulnerabilities and the distribution of their fixes. Join him for an in-depth account of what PHP2Shell is, the discovery and remediation process, how the fixes were built and disseminated, and much much more.
Post-quantum encryption: Why and How
Securité Quantum computing poses a looming threat to current encryption algorithms, so we need a new approach: post-quantum cryptography. This talk explores why we need PQC, how it works, why it's important to use it now, new standardised PQC algorithms like ML-KEM, industry adoption of these approaches, and practical migration steps for developers and ops people to protect our data, systems, and applications now and in the rapidly-approaching future.
Practical Docker Security
Securité Docker was created as a containerization system, but nowadays it also serves as a security mechanism for build isolation and sandboxing AI agents.

This talk covers various security features, the limitations you need to know, and the most effective ways to properly secure your Docker containers.
Revue de code de sécurité avec les LLM
Securité Tanné des faux positifs et des failles manquées par vos outils de sécurité? Vous avez essayé les LLM, mais sans la magie promise?

Cette présentation propose un pipeline complet, pas juste des invites (prompts), pour exploiter efficacement les LLM en sécurité applicative. Réduisez vos faux positifs et repérez les failles ayant un réel impact.
Sécurité Java : l'impact des LLMs sur le cycle des CVE
Securité Cette session explore le cycle de vie des vulnérabilités du point de vue d'un mainteneur open source.
Suivez le triage d'une faille trouvée par l'IA, sa reproduction avec la CI, puis l'utilisation de l'IA pour créer et valider un correctif.
Nous publierons le fix et suivrons sa divulgation dans GHSA, CVE et OSV.
Découvrez comment ces données alimentent les scanners (Snyk, Dependabot) et comment automatiser la protection de vos dépendances.
Security in the age of AI
Securité Security reviews of PHP applications still depend on code review, static analysis, dependency audits, and expert judgment. AI can speed up that work. You can use it to scan large codebases, explain suspicious code, draft patches, and surface issues traditional tools may miss, while keeping the tools you already trust.
Stop the Spread: Cyber Defense Through Epidemiology
Securité Removing the first infected device does not establish that an attack is contained. I apply epidemiological methods to trace spread through identities, shared services and network connections. Using a simulated outbreak, we compare isolation, credential revocation and segmentation. Attendees learn to map transmission paths, account for undetected compromises and judge containment by secondary infections rather than declining alert counts.
Teach Your Agent to Forget
Securité Your agent finally remembers things. Congratulations, it is now a data leak with a personality. The whole room gets a link to one agent and your job is to ruin it: feed it lies, leak someone else's context, make it hold a grudge. We watch its memory fill up, then fix each failure with boring, fast tools: streams, structured records, vector search and expiry. You leave knowing what an agent must forget, and why that is where production breaks.
Ten Key Steps for Enhanced Web App Security
Securité Knowing the OWASP Top 10 does not tell you where to start on a codebase with no security headers, unvalidated input and CORS set to *. This is the prioritised checklist I wish I had: ten steps from preventing common vulnerabilities and hardening authentication to CI/CD security and DDoS defence, with live demos of the attacks and the fixes in real code, ordered by impact for effort, so you leave with a plan for Monday morning.
The Hard Parts of Good AI: Authentication and Authorization
Securité AI is powerful and eager to please. It will go anywhere to answer your question, including places it's not supposed to. Your job is to control what it can see, and what it can't. Join us and learn about the complicated world of authentication and authorization for AI. We'll dig deep into auth types, roles, grants and audit trails. From the high-level to annoying details, learn to build agents that are powerful, but respectful of their boundaries.
The Request Was Signed. Why Was It Still Unsafe?
Securité In our wallet, third-party services received digitally signed requests, so it was easy to assume that a valid signature meant the request was safe. It wasn’t. A signed request could still be replayed, retried after a timeout, arrive with clock skew, or leave important fields outside the signature. This talk looks at those failure cases and the practical use of nonces, idempotency, key rotation, and replay protection to handle them safely.
What's in a Token? Dissecting auth cookies and JWTs in .NET
Securité What's inside that (sometimes chunky) authentication cookie in an ASP.NET Core application? Why is your JWT 4KB and growing? And why does login break the moment you add one more claim?

We'll decode JWTs by hand, inspect the ASP.NET Core authentication cookie byte by byte, watch token negotiation happen in real-time with browser DevTools, and debug the kind of auth issues that make you clear all cookies in frustration.

Explorez les 185 présentations

Montréal 2027 sponsored by

Devenir commanditaire
© 2010-2026 ConFoo. Tous droits réservés. Code de conduite