HH.security #16 @MOIA

Hello people,
we like to welcome you for two great talks about the wide aspects of information security.

There will be sandwiches as well as drinks and enough time to discuss the talks and do some networking.

Doors open is at 18:30, speakers will start ca. at 19:00.

"Data Security, Data Governance & Compliance and why this matters" by Lars Seinwill
Data security, data governance, and compliance are essential elements in protecting sensitive information. In the digital age, data breaches and security threats are widespread. Organizations need to safeguard their data, maintain customer trust, and adhere to regulatory requirements. This session will use examples to explain why security teams should also look into topics like:
• Passwords, API secrets, certificates with private keys, and many other sensitive pieces of information are often found in mailboxes or general storage areas within the company.
• Mailboxes frequently contain emails from an employee's entry to their departure
• Employees might use numerous non company web applications via their browsers.
• And many more

Additionally, there are statements like those from the GDV: " Wirtschaftskriminalität: Die gefährlichsten Täter kommen aus dem eigenen Unternehmen " which make it a topic worth discussing.
This talk aims to draw attention to a topic that often only receives the necessary attention after an incident and frequently falls under unclear responsibilities in advance.

"Performance impacts security (and vice versa)" by Josue Zarzosa and André Harms
Increasing performance to provide a better user experience or reduce
load on systems is a common thing. From a real world scenario around a web application we want to describe, what went wrong and how a performance improvement can influence the security of an application.

We will describe the problems we faced when trying to solve the specific problem with session handling using a generally accepted solution, and what our solution ultimately looks like to achieve better performance without compromising security.