LocoMocoSec 2020: Hawaiʻi Product Security Conference (Virtual)
The Hawaiʻi product security conference went online for two days of single-track talks: recovering from a public breach at Segment, modern end-user authentication and OAuth 2 essentials, eliminating secrets at Snap, account recovery in a 2FA world, security OKRs, dependency management and Log Canary PII detection, web isolation at Google, Netflix crown-jewel protection, Lyft Cartography and zero trust.
→ See editor’s top picks at LocoMocoSec 2020: Hawaiʻi Product Security Conference (Virtual)
- Survive Your Security Incident ...and Thrive Again — Coleen Coolidge
In "Survive Your Security Incident ...and Thrive Again," Coleen Coolidge, CISO at Segment, delivers a compelling and deeply human perspective on navigating the aftermath of a public security…
- Serving the Right Recipe for End-User Authentication — Philippe De Ryck
In this insightful LocoMocoSec talk, "Serving the Right Recipe for End-User Authentication," Philippe De Ryck, founder of Pragmatic Web Security, delves into the critical landscape of user…
- The End of the AppSec Team — Justin Collins
In his thought-provoking LocoMocoSec 2020 talk, "The End of the AppSec Team," Justin Collins, a seasoned security engineer and Product Security Lead at Gusto, challenges the conventional wisdom…
- Secrets, Secrets Are No Fun... So We Got Rid of Them! — Savanah Frisk, Winston Howes
In this insightful LocoMocoSec talk, Savanah Frisk and Winston Howes from Snap Inc. shared their journey to drastically reduce secret proliferation within their organization. Titled "Secrets…
- Designing Customer Account Recovery in a 2FA World — Kelley Robinson
In "Designing Customer Account Recovery in a 2FA World," Kelley Robinson, an expert in account security at Twilio, delves into the critical and often overlooked aspects of implementing robust…
- Building Effective Security OKRs — Alex Smolen
In this insightful talk from LocoMocoSec, Alex Smolen, Director of Security at LaunchDarkly, tackles a pervasive challenge faced by security teams: demonstrating value and aligning their efforts…
- Keeping Up with the Dependencies — Dhivya Chandramouleeswaran
In this insightful LocoMocoSec talk, Dhivya Chandramouleeswaran, a Security Engineer at Lyft, delves into the multifaceted challenges and strategic approaches required for effective dependency…
- Canary in the Datamines: Using Log Canary to Find PII — Ryan Slama
In "Canary in the Datamines: Using Log Canary to Find PII," Ryan Slama from Slack's Product Security Foundations team addresses a perennial and critical challenge in software development: the…
- Product Security Lessons from Incident Response — Astha Singhal
In this insightful talk from LocoMocoSec, Astha Singhal, Director of Application Security at Netflix, challenges the traditional dichotomy of proactive versus reactive security functions. Often…
- OAuth 2 Essentials — Torsten Lodderstedt
In "OAuth 2 Essentials," Torsten Lodderstedt, CTO of yes.com and a veteran in identity and standardization, provides a practitioner's guide to navigating the often-complex world of OAuth 2.0. The…
- Isolation: The Next Web Application Security Frontier — Artur Janc
In this insightful LocoMocoSec talk, Artur Janc, a Senior Staff Information Security Engineer at Google, delves into the critical and often overlooked realm of web application isolation. Titled…
- Securing Your Company's Crown Jewels While the World Watches The Crown — Scott Behrens, Lakshmi Sudheer
In this insightful talk from LocoMocoSec, Scott Behrens and Lakshmi Sudheer, both from Netflix's security teams, present Netflix's comprehensive strategy for securing its vast and complex data…
- Pushing the SOC Left to Achieve Nash Equilibrium — O'Shea Bowens
In this insightful LocoMocoSec talk, O'Shea Bowens, CEO and Founder of Null Hat Security, introduces a compelling framework for integrating Security Operations Center (SOC) functions earlier into…
- Lyft Cartography: Using Graphs to Improve and Scale Security Decision-Making — Alex Chantavy
In today's rapidly evolving technological landscape, security teams face an uphill battle against ever-increasing complexity and speed. Modern cloud infrastructures, characterized by hyper-growth…
- Zero Trust: Palekana — Dave Lewis
In his LocoMocoSec talk, "Zero Trust: Palekana," Dave Lewis, Global Security Advocate at Akamai Technologies (formerly Global Advisory CISO at Duo Security, part of Cisco Systems), delves into the…
- Yield the Mallet: Getting Out of Security Whack-a-Mole — Jorge Lopez
In his LocoMocoSec talk, "Yield the Mallet: Getting Out of Security Whack-a-Mole," Jorge Lopez, then Principal Security PM Manager at Microsoft and former lead of the Vulnerability Response Team…