In this course we'll take an existing .NET application available in GitHub and work our way through securing it's supply-chain. Starting with code, depedencies, building and releasing our software. This training will be a combination instructions followed by a lab to putting it into practice.

Working with source and Git commit signing

Understanding used 3rd party libraries and used containers using SBOM and OpenVEX

Working with Software-Bill of Materials (SBOM) using CycloneDX and Syft/Docker for Containers

Google SLSA (Supply-chain Levels for Software Artifacts)

Microsoft Secure Supply Chain Consumption Framework (S2C2F)

Google GUAC: Graph for Understanding Artifact Composition

Oh no our supply-chain got hacked! Now what?


The attendee needs to bring their own .NET development machine with .NET9 SDK, Docker Desktop, your favorite IDE installed and have access to GitHub.

Although most of this workshop is driven from GitHub, I'll make sure to also share similar examples/references how same can be achieved on different platforms (e.g. GitLab/Azure DevOps/Tekton).

2 Days

Securing your .NET application software supply-chain

Security

.NET

This workshop is here to give you the skills you need to make your APIs secure. We're going to think like an attacker to test APIs and like a defender to figure out the best ways to protect them. With deep-dive talks, real-world demos, fun quizzes, and hands-on labs, you'll learn how to lock down your APIs.
During this hands-on training, we'll explore:

The security model of API-based web applications

Recognizing and addressing authorization failures

Understanding Broken Object Property Level Authorization (BOPLA)

Fixing Broken Object Level Authorization (BOLA)

Testing the security of APIs that use JWTs

Best practices for making JWTs secure in modern APIs

Identifying, exploiting, and fixing Server-Side Request Forgery (SSRF) issues

Understanding Cross-Origin Resource Sharing (CORS)

Configuring secure CORS policies for various use cases

Tracking user authentication securely with sessions or tokens

Relying on OAuth 2.0/2.1 for securing APIs

Q & A throughout the workshop to clear up any doubts


This workshop is about more than theory. We're all about giving you practical security tips you can use right away as an API developer. We dig into the root causes of API threats and how to handle them. We don't just skim the surface of problems and solutions - we get into the why's and how's, looking at common fixes, why some fall short, and which ones are currently the best way to go.
By the end of this workshop, you'll be up-to-speed on the best practices for API security. You'll also leave with a handy list of steps to check and boost the security of your applications.




This training is perfect for developers and architects who work a lot with APIs. If your role involves building, testing, or designing modern apps, this workshop will give you a thorough, up-to-date understanding of the best ways to keep things secure. We'll often use NodeJS, Flask, and Spring Boot in our code examples and demos, but you'll easily be able to apply what you learn to other languages and frameworks.




These testimonials from previous workshops give you a good idea of what to expect:

Trainer is great and an expert in the domain. All of the topics are very relevant. Practical examples for most of the topics. Excellent communication and addressing of questions.

Even though the topic is broad, there was no single moment where my focus went astray. Philippe talks in a way to keep you interested to listen to him.

I liked the the pleasant and relaxed way of speaking and the fresh style of presentation of this kind of dry stuff :)

Philippe is a friendly and knowledgable trainer and delivered an interesting course that was well presented. Questions were answered promptly and in a detailed way.


To participate in this training, you should have some experience with building API-based applications. Knowledge of application security can be helpful, but is not required.




To participate in the lab sessions, participants need a computer with a full-featured modern browser installed (preferably Chrome).


Bulletproof APIs: Hands-On API Security

What if it didn't have to be like that? What if you could write code that never fails? Believe it or not - you can.

Functional programming is a style of writing code that has been around since the 1960s, and has been becoming increasingly popular in recent years, with the advent of technologies like Serverless and async.

It's a style of code that removes side effects and unpredictable behaviour from your applications, making them just about impossible to break in production.

It enables nearly 100% unit test coverage, increasing the quality of the code that you deploy.

It doesn't have issues of resource contention or race conditions relating to state, making it ideal for asynchronous & distributed processing of data.

All of this is accomplished with out-of-the-box C#. No need to pay for new software licences or install additional software packages.

Using the techniques from this workshop, you will be able to immediately improve the quality of your production code, without it costing anything!

Write Code that NEVER Fails - Functional Programming With C#

Functional Programming

This workshop will teach you everything you need to know to start building distributed systems in .NET and 

 Core and how to combine multiple services to choose the right tool for each use case you might encounter. We will define clear requirements for a system and proceed to build the entire system using all the services and tools you will use to build your own systems later at your company.

Defining the system we need to build with clear requirements

Understanding Monoliths and Microservices

Understanding what “cloud native” means

Implementing observability with OpenTelemetry

Using .NET Aspire to run our system locally

This workshop is for backend developers with some experience writing web applications using C# and 

 Core. You must be able to read, write, and debug C# at a decent level and have some experience with 

Visual Studio, JetBrains Rider or VS Code

Building scalable, cloud native, distributed systems in .NET

This workshop will challenge that assumption. It will show you how Rust isn't just a low-level systems programming language that requires a deep computer science background and how you can use it to build modern business applications. Throughout the workshop we'll take a practical approach to learning Rust. Instead of focusing on language internals, you'll learn practical skills to help you be a productive Rust developer. Along the way parallels will be drawn with building applications in .NET to help you transfer your existing knowledge to working with Rust.

Getting set up with Rust tooling on your machine

Core ideas, principles and syntax for building applications in Rust

Dependency Injection in Rust applications

Containerizing and getting "production ready"

No prior Rust knowledge is necessary for this workshop. However, it is designed for backend developers with experience building web applications with C# and ASP.NET core. As ideas are introduced in Rust parallels will be drawn to similar ideas in C# and ASP.NET.

Rust for .NET Developers

Rust


This workshop teaches advanced, cutting edge techniques based on ongoing research that are designed to identify and decrease risk, improve confidence in decision making and protect your architecture when the domain is characterized by uncertainty.

The workshop introduces ideas on the philosophy of architecture, forcing participants to think outside of the technology and relate decision making to markets, culture, economic and societal concerns. It teaches practical techniques in stressor analysis and the use of matrices to make component decisions and gives participants the chance to work with these techniques in labs and groups.


This workshop is suitable for senior developers who want a head start into the world of architecture, for teams embarking on large, risk filled projects, and for seasoned architects seeking new techniques. It has also been successful in unting teams around a common definition of architecture.

Concrete Complexity for Software Engineering

Modelling stress: socio-economic architecture

Contagion analysis and component decisions


Good understanding of software design. A laptop with Excel will be necessary.

Advanced Software Architecture with Residuality Theory

Architecture

Microservices

Soft Skills

These business processes are usually non-trivial, exceed the boundaries of a single method- or service invocation, and require us to redefine certain concepts, including coupling and time.

If you've been exposed to the basic building blocks of messaging and want to transition your system from a collection of meaningless and often highly-coupled service-to-service calls to one composed of carefully designed processes that reflect your business domain, this workshop is for you. Throughout this workshop, we'll discuss numerous real-world scenarios based on years of experience in the banking and retail domains, making you better equipped to recognize patterns in whichever domain you may be working on.


Have a foundational understanding of messaging as an architectural style and the benefits it offers.

Understand the basic message-based communication patterns, including request-reply and publish-subscribe.

Have experience using message brokers, such as Azure Service Bus, RabbitMQ, or other queuing or broker technologies.


Throughout this workshop, you’ll learn to:

How to identify complex business processes within your domain

Techniques to help identify the right service boundaries

Coordinate complex business processes with orchestration and choreography

Engage in thorough tradeoff analysis to get to the right design

Manage requirements that need to occur at different points in time

Test complex, long-running processes in an automated way

Leverage observability to troubleshoot issues where they matter most: in production!

Throughout this workshop, we'll divide into smaller groups for design exercises that require nothing more than your imagination and something to write with. Later, we'll switch gears and get more hands-on with some coding exercises to bring those ideas to life using C#.

Join me and unlock the secrets of messaging's real-world superpowers!


This is a Bring Your Own Device (BYOD) workshop. Therefore, attendees are required to bring their own device with the necessary software already installed:

In addition, it's helpful to have accounts ready to use for:

Microsoft, so that you can access the Azure portal

GitHub, for access to exercises and additional material

Untangle complex business processes with message-based architectures

Introducing the modular monolith; all the benefits of a monolith such as reduced complexity, ease of deployment, easier debugging, and so on - but ready to be easily decomposed into services as required.

Join us as we explore the principles, patterns, and practices that empower developers to build robust, flexible, and extensible applications without prematurely involving the complexities of microservices and distributed systems.

In this workshop, we will use the fictional case study of a thriving business aspiring to expand, exploring key topics.

We'll investigate the different requirements that need to be met, starting with a code kata and how we can apply various design patterns to our way of thinking.

We'll then move on to actually building out a functioning, all-be-it, contrived application in .NET 8 and C#, learning as we go.

Modular Design Principles: Learn how to break down your application into cohesive modules that encapsulate distinct functionalities, promoting code reuse and easier maintenance.

Dependency Management: Discover techniques for managing dependencies between modules, ensuring clear boundaries and minimising tight coupling.

Scalable Architecture: Explore strategies for designing monoliths that can scale vertically and horizontally to accommodate growing demands.

Architecture enforcement: Dive into architecture testing and other approaches that help with maintaining the architecture and design.

Performance Optimization: Gain insights into optimizing module communication and data flow to enhance the overall performance of your application.

Future Migration Considerations: Explore how modular monoliths can serve as a stepping stone towards a microservices architecture, and the factors to consider when planning a future migration.

Reverse migration: Understand the considerations and techniques for reverse migration from distributed system back to a monolithic architecture.

We'll also cover aspects of event-driven architecture, messaging, No-SQL databases, and various supporting design patterns.


This workshop is aimed at backend developers with some experience writing web applications using C# and .NET. The workshop will not cover .NET Framework.


This is a hands-on practical workshop where you will be writing a lot of code. You will need to have the following to effectively participate:

SQL Server 2017 or later, with SQL Server Management Studio or Azure Data Studio

NDC { Oslo }

Workshops

09:00 - 17:00 (UTC+02)

Securing your .NET application software supply-chain

Niels Tanis

Write Code that NEVER Fails - Functional Programming With C#

Simon Painter

Rust for .NET Developers

James Eastham

Building Future-Proof Apps with the Modular Monolith

Layla Porter

Advanced Software Architecture with Residuality Theory

Barry O'Reilly

Untangle complex business processes with message-based architectures

Laila Bougria

Bulletproof APIs: Hands-On API Security

Philippe De Ryck

Building scalable, cloud native, distributed systems in .NET

Nick Chapsas