Recent and Upcoming Public Talks & Workshops

This talk covers: What is OWASP PurpleTeam? Why you would want it in your build pipelines. How you go about setting it up? What the work-flows look like, along with the recent donation of the cloud environment to OWASP.

Let’s get your Web Apps and APIs under security regression testing with OWASP PurpleTeam.

This talk covers: What is OWASP PurpleTeam? Why you would want it in your build pipelines. How you go about setting it up? What the work-flows look like.

This talk visits: The past, present and future of how our Development Teams have and will measure the security maturity of the software delivered.

This talk covers: What is OWASP PurpleTeam? Why you would want it in your build pipelines. How you go about setting it up? What the work-flows look like.

This talk covers: What is OWASP PurpleTeam? Why you would want it in your build pipelines. How you go about setting it up? What the work-flows look like.

This talk covers: What is OWASP PurpleTeam? Why you would want it in your build pipelines. How you go about setting it up? What the work-flows look like.

Talk by Chris and Kim on Incident Response and Application Intrusion Detection

Planning for this years Meetup sessions followed by a discussion on Covid

Developers / Engineers know that a build pipeline is an essential part of creating robust and reliable software, but what to put in it? This talk covers the creation of purpleteam from PoC to Alpha release, and why it’s an ideal fit for the security regression testing slot of your build pipeline.

Workshop to initialise, train and deploy the Jade Security Champions across the Jade Development Teams.

The security defaults of Docker are designed to get you up and running (“just work”) quickly, rather than being the most secure. There are many default configurations that can be improved upon. In this talk Kim will walk through improving the security of Docker hosts, containers, networking and deployments.

CHCon 2018: A conference for security professionals and hackers in Christchurch, NZ.

The eighth OWASP New Zealand Day conference, held at the University of Auckland.

Kim’s flagship Software Developer focussed training, this time at OWASP New Zealand Day conference.

At BSides Wellington: Kim discusses that Quality (security included) does not have to be neglected when you’re planning, building and running a high performance development team. He discusses how we fail and how to succeed.

CHCon 2017: A conference for security professionals and hackers, based in Christchurch, NZ.

Kim’s flagship Software Developer focussed training, this time at Christchurch Hacker Conference (CHCon).

Kim discusses how and why Agile Development Teams fail at security, and how to stop failing.

Attacking a set of carefully curated questions around info-sec, white hat, black hat, attack and defense.

The eighth OWASP New Zealand Day conference, held at the University of Auckland.

At JS Remote Conf: Kim examines and demonstrates a collection of essential attacks, commonly used in the exploitation and demise of many individuals and organisations today.

At NZ.JS: Kim examines and demonstrates a collection of essential attacks, commonly used in the exploitation and demise of many individuals and organisations today.

DevSecCon, Singapore: Quality (security included) does not have to be neglected when you’re planning, building and running a high-performance development team.

Kim will set the stage with how and why Agile development teams fail, explained with a familiar anecdote taken from his new book “Holistic Info-Sec for Web Developers”, coupled with how you can change this.

Kim will walk us through a collection of PowerShell delivery (RAM, not disk) techniques for a common reverse shellcode.

Join Kim at AgileNZ 2016 for an exploration into an insightful set of steps he has learned, from an architectural, engineering and penetration testing perspective.

Kiwicon hands-on threat modelling, attack and defence strategy training for Web Developers wishing to understand their attackers better, stay ahead of them and create cost effective defence strategies.

CHCon 2016: A conference for security professionals and hackers in Christchurch, NZ.

At AWS Auckland, Kim will demonstrate the OWASP Zap API with NodeGoat, which helps you identify vulnerabilities in your web application as you create it, rather than at the end of a project.

NodeJS Auckland: Kim will demonstrate the OWASP Zap API with NodeGoat, which helps you identify vulnerabilities in your web application as you create it, rather than at the end of a project.

This time in Kilkenny of Ireland, Kim will demonstrate the OWASP Zap API with NodeGoat, which helps you identify vulnerabilities in your web application as you create it, rather than at the end of a project.

This time for the students of University of Canterbury. An exploration into an insightful set of steps he has learned, from an architectural, engineering and penetration testing perspective. Based on the content of volume 0 & 1 of Kim’s new book “Holistic Info-Sec for Web Developers”. This time held at the University of Canterbury.

Join Kim at Agile Professionals Network for an exploration into an insightful set of steps he has learned, from an architectural, engineering and penetration testing perspective.

This time in New York City at OWASP, Kim will demonstrate the OWASP Zap API with NodeGoat, which helps you identify vulnerabilities in your web application as you create it, rather than at the end of a project.

Hackers On Planet Earth (HOPE) conference in New York City. An exploration into an insightful set of steps he has learned, from an architectural, engineering and penetration testing perspective. Based on the content of volume 0 & 1 of Kim’s new book “Holistic Info-Sec for Web Developers”.

Kim will demonstrate the OWASP Zap API with NodeGoat at the meetup he usually facilitates, which helps you identify vulnerabilities in your web application as you create it, rather than at the end of a project.

At CHC.js Kim will demonstrate the OWASP Zap API with NodeGoat, which helps you identify vulnerabilities in your web application as you create it, rather than at the end of a project.

Join Kim at CodeCamp Christchurch for an exploration into an insightful set of steps he has learned, from an architectural, engineering and penetration testing perspective.

AusCERT hands-on threat modelling, attack and defence strategy training for Web Developers wishing to understand their attackers better, stay ahead of them and create cost effective defence strategies.

The seventh OWASP New Zealand Day conference, held at the University of Auckland.

Kiwicon hands-on threat modelling, attack and defence strategy training for Web Developers wishing to understand their attackers better, stay ahead of them and create cost effective defence strategies.

Kim talks with his fellow Toastmasters about profiling peoples passwords and then brute forcing web applications with the shortlist of guessed passwords..

Kim talks with his fellow Toastmasters about the risks and countermeasures of luring targets to execute infectious media on their devices.

Taking the perspective of the penetration tester hired in by the target to find the defects in their security defences before the cyber criminals do.

At Functional Christchurch, due to popular demand. Taking the perspective of the penetration tester hired in by the target to find the defects in their security defences before the cyber criminals do.

At Test Professionals Network Christchurch, due to popular demand. Taking the perspective of the penetration tester hired in by the target to find the defects in their security defences before the cyber criminals do.

At CHCH.js Christchurch, due to popular demand. Taking the perspective of the penetration tester hired in by the target to find the defects in their security defences before the cyber criminals do.

At WDCNZ: Kim discusses and demonstrates how JavaScript can be used for good and evil.

In this 5 – 7 minute talk, Kim demonstrates (hands on) how easy it can be to compromise passwords using a collection of techniques. Kim discusses how most developers are failing at keeping their end users safe.

At CampJS, Melbourne, Australia: Join Kim in the exploration into an insightful set of steps he has learned, from an architectural perspective down to the zeros and ones. Also providing insights of how attackers of your systems think.

The sixth OWASP New Zealand Day conference, held at the University of Auckland.

At AgileNZ: Are you looking to get more out of your organisation’s software developers, increase your ROI, spend less money on fixing bugs or increase your development team’s business value and release rate? If so, this session is for you.

At CHC.js Kim will demonstrate write a blogging platform in JavaScript using Ember.js. The application had the functionality to display, edit and navigate blog posts written in markdown in about 35 lines of JavaScript on top of the handlebars templates.

At OWASP NZ Day: What are we doing with all the characters that get shoved into our applications? Have we considered every potential execution context?

At ANZTB: Hands-on insight into security testing. Kim will discuss some of the more common security vulnerabilities being found in today’s software implementations, and will demonstrate ways of testing them.

At Canterbury Software Cluster: In this session Kim went over the benefits of introducing TDD and BDD: How to introduce them, their differences, how to deal with push back from team members and upper management.

This was a presentation held at one of TSBCs Sprint Reviews after attending a Clarus Professional Scrum Master course.