Empathy, Sympathy, and Compassion

We developers are fantastic at making the seemingly impossible possible, but there's a stereotype about us which has been hard to shake off: that we're curmudgeonly old so-and-so's.

It's actually something which goes way back to the start of the computer revolution in the '60s and '70s. At MIT, the system administrators used to call users "lusers" (i.e., "users with a silent L"). But it's time to break that cycle, we're not those people, and our users deserve better.

In this talk, I am to walk through some of the key skills that I think all developers and technologists should aim to build up, and none of them are technical in nature at all.

Remember: it's never the user's fault.

Unlocking HTTP Security Nirvana: From Zero to Hero in 45 Minutes

Ever wonder if simply deploying an HTTPS certificate is enough to ensure
your web application is secure? Think again! In this session, we'll take you on a journey from creating a public-facing HTTP application to securing the browser environment that powers it.

We'll explore some game-changing, free, and open-source packages and resources that will elevate your web application's security without breaking the bank. We'll cover the latest OWASP-recommended HTTP headers, their benefits, and how to implement them in an ASP.NET Core-based application.

No prior knowledge is required – just a willingness to learn! We'll walk you through the process of adding these essential headers manually and then demonstrate how to use the powerful OwaspHeaders.Core NuGet package to streamline the process with just one line of code. By the end of this 45-minute session, you'll be able to impress your colleagues and friends with a web application that's been fortified against common security threats.

Key Takeaways:

- Understand the importance of securing the browser environment
- Learn how to implement OWASP-recommended HTTP headers in an ASP.NET Core-based application
- Discover how to use the OwaspHeaders.Core NuGet package for easy, automated header implementation
- Get hands-on experience with implementing security best practices that will make you a hero in the eyes of AppSec teams and regulators alike!

Target audience: web developers (full stack, front-end, and back-end devs)
Technical requirements: working internet connection that presenter can use