Session 1:

Developers: your first line of defense against cyber threats

With the increasing number of cyber security attacks at the application level, the developers play a pivotal role in implementing a proper cyber resilience program for your company.

Speaker:

Mr. Eric Bariaux

Eric is currently Secure Delivery Director at Approach, where he focuses on bringing cyber security best practices to all aspects of the software development lifecycle. He leads a team of highly qualified experts in providing secure, end to end solutions to high profile organisations.

Having worked as senior developer, software architect and team leader for customers in the financial, insurance, telecommunication and healthcare sector, Eric brings a practical approach to making security and privacy an integral part of the development process.

Session 2:

Business Aligned Security

Recently, the french ANSSI (Agence Nationale de la Sécurité des Systèmes d'Information) has released an open-source AES library for ARM microcontrollers. This software implementation aims to provide a practical protection against side-channel attacks with state-of-the-art techniques. Additionally, the ANSSI has provided a first security analysis in which no attack could succeed with less than 100,000 observed encryptions.

In this presentation, a bottom-up approach is followed in order to analyze the security of this software. First, the implemented countermeasures and their expected behaviors are detailed. Second, the attack path and the methodology to extract useful information are described from a higher perspective. Third, the attack efficient is evaluated: we show that a full encryption key is recovered in less than 30 seconds (2,000 measurements). The improvement compared to the ANSSI's security analysis mainly comes from the introduced methodology called "Countermeasure's Dissection". As a conclusion, I argue that such a fine grain security evaluation is hard to automate without the knowledge of the target and under realistic timing constraints. If not done under these assumptions, the effective level of security may be over-estimated. Such case would be damaging for the long-term security of an infrastructure.

Speaker:

Mr. Koen Maris