Building Agentic Applications: Secure By Design - Seth Law and Ken Johnson - DCTSG2027
Description
Name of Training: Building Agentic Applications: Secure By Design
Trainer(s): Seth Law and Ken Johnson
Skill Level: Beginner
Dates: March 5 – March 6, 2027
Time: 9 to 5 pm
Venue: TBD
Early Bird Cost: S$3,300 (incl. GST, until Dec 31, 2026)
Regular Cost: S$3,600 (incl. GST)
Short Summary
Build an agent that can retrieve data, use tools, and complete real tasks, then secure the boundaries that determine what it may see and do. Through hands-on labs using LangChain, Deep Agents, and Amazon Bedrock, students implement authorization, tool guardrails, execution limits, sandboxing, and adversarial tests against their own agentic application.
Course Description
Agentic applications combine model-generated decisions with access to data, tools, and systems that can change the world outside a chat window. A prompt can describe the agent’s task, but the application must enforce whose data the agent may retrieve, which tools it may invoke, and what happens when untrusted content redirects its behavior.
In this two-day course, students build a working engineering assistant and secure it as they add capabilities. Each lab introduces a realistic failure involving identity, tool use, prompt injection, poisoned context, excessive authority, or uncontrolled execution. Students reproduce the failure, implement a control in code, and verify the result. The course uses the OWASP Top 10 for Agentic Applications as a risk map while concentrating on practical architecture and implementation. Students finish with a secured application, a repeatable security test suite, and a proficiency assessment based on demonstrated controls. (genai.owasp.org)
Course Outline
View full outline
Hide outline
Day 1 — Build the agent and control its authority (8 hours)
Morning
Agent architecture, threat model, and lab setup (1 hour)
- Run the starter application and trace its model, tools, data, and execution path.
- Identify the authenticated user, untrusted inputs, privileged components, and actions.
- Exercise: map the application’s trust boundaries.
Bind the agent to the authenticated user (1.5 hours)
- Propagate user and tenant identity through the workflow.
- Scope retrieval before information enters model context.
- Authorize resource access outside model-generated tool arguments.
- Lab: reproduce and fix cross-user data access.
Build secure tools (1.5 hours)
- Design task-specific tools and structured arguments.
- Validate ownership, parameters, destinations, and side effects at execution time.
- Scope credentials and reject unauthorized or unknown operations.
- Lab: replace an unrestricted tool with bounded, authorized capabilities.
Afternoon
Implement layered guardrails (1.5 hours)
- Define allowed data access, tools, outputs, and actions.
- Enforce policy at retrieval and execution boundaries.
- Use structured output and validation where the workflow requires them.
- Lab: test and repair bypasses of a prompt-only guardrail.
Handle untrusted content and goal hijacking (1.5 hours)
- Examine injection through documents, repository content, and tool results.
- Keep retrieved material from acquiring the authority of application instructions.
- Lab: redirect the agent with poisoned content, then contain its effects.
Trace and review agent behavior (1 hour)
- Record tool calls, policy decisions, denials, and outcomes.
- Protect sensitive data in traces.
- Lab: diagnose a failed boundary from an execution trace.
Day 2 — Contain execution and verify security (8 hours)
Morning
Secure retrieval and memory (1.5 hours)
- Isolate retrieval and memory by user, tenant, and task.
- Control persistence, expiration, and ingestion of untrusted content.
- Lab: prevent poisoned memory from influencing a later session.
Sandbox the agent and minimize blast radius (1.5 hours)
- Separate model decisions from privileged execution.
- Constrain filesystem, network, credentials, runtime, and resources.
- Lab: contain an attempted unauthorized file or network action.
Keep the agent within its assigned workflow (1.5 hours)
- Bound permitted states, transitions, tool calls, retries, time, and cost.
- Separate proposed actions from execution.
- Bind human approval to the exact action and parameters.
- Lab: stop a redirected or looping agent before it changes state.
Afternoon
Build security regression tests (1 hour)
- Test authorization, injection, data leakage, tool misuse, approval bypass, and execution limits.
- Distinguish a plausible model answer from an enforced security property.
- Lab: add adversarial cases to a repeatable test suite.
Capstone: secure an expanded agent (2 hours)
- Identify defects spanning identity, tools, context, and execution.
- Implement controls and run functional and adversarial tests.
- Explain remaining risks and design decisions.
Individual proficiency evaluation and review (0.5 hours)
- Submit the secured implementation and complete individual validation tasks.
- Explain where the critical controls are enforced.
Difficulty Level
Beginner - The student has an interest in the topic presented and general technology knowledge that a power user or undergraduate student may have acquired.;
Suggested Prerequisites
Students should understand basic Python, HTTP APIs, authentication and authorization, and common application security concepts. They should be able to use an IDE and command line.
What Students Should Bring
A laptop on which they can run Python and the supplied lab environment, install dependencies, use an IDE and command line, and connect to the internet. Do NOT bring a machine that is heavily restricted by corporate IT or that has no access to wireless internet.
What the Trainer Will Provide
The starter application, lab instructions, test data, adversarial scenarios, reference implementations, and security test suite. The course will use LangChain and Deep Agents with models accessed through Amazon Bedrock. Trainers will provide the LLM compute resources and access to AWS’s Bedrock.
Trainer(s) Bio
Seth Law is the founder and principal consultant of Redpoint Security. His work spans application development, cloud architecture, network protection, security research, and tool development. He has taught and spoken at Black Hat, DEF CON, and other security events, and co-hosts the Absolute AppSec podcast with Ken Johnson. Seth brings a developer’s understanding of how security findings become practical engineering changes.
Ken Johnson is the CTO and co-founder of DryRun Security, where he builds application security technology centered on code context and agentic analysis. Previously, he led product security engineering work at GitHub and held technical and leadership roles in security consulting and corporate security. Ken has trained developers and security professionals at Black Hat and DEF CON and co-hosts the Absolute AppSec podcast with Seth Law.
Proficiency Exam
Every student receives the proficiency evaluation as part of the course. Students submit their capstone implementation and complete individual checks against a defined set of functional and adversarial scenarios. The rubric awards for user and tenant isolation, tool authorization, handling untrusted context, execution containment, and security tests. A passing result requires at least 80% overall and no successful cross-user data access or unauthorized state-changing tool call.
Registration Terms and Conditions
Trainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.
Between January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.
All trainings are non-refundable after Feb 28, 2027.
Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.
If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).
Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.
DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.
By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.
Several breaks will be included throughout the day. Please note that food is not included.
All courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.
