AppSecUSA 2017 - OWASP Leaders Session
Comprehensive review of OWASP Project and Chapter Leaders' working session, discussing key decisions and actions affecting global operations. Essential viewing for OWASP leadership.
The Unabridged History of Application Security - Keynote
Comprehensive overview of application security's evolution, highlighting industry improvements and OWASP's global impact. Offers optimistic perspective on progress and future challenges in software security.
Fail, Learn, Fix - Improving Security the Old-Fashioned Way
Explore how past failures can drive future security improvements. Learn from historical examples to enhance cloud application security practices and foster collaborative problem-solving.
How to Slay a Dragon - A Three-Step Strategy for Solving Complex Security Problems
Discover a three-step strategy for tackling complex security challenges in Chrome, focusing on incremental progress, accepting imperfections, and considering long-term costs.
Fast Forwarding Mobile Security with the Mobile Security Testing Guide
Explore mobile security advancements and best practices using the Mobile Security Testing Guide (MSTG) in this comprehensive OWASP presentation.
Automated Gadget Chain Discovery for Deserialization Vulnerability Remediation
Explore automated discovery of Java deserialization gadget chains for vulnerability assessment and prioritized remediation, with insights on a new FOSS toolkit for evaluating security risks.
Threat Model-as-Code: Integrating Security into the Software Development Lifecycle
Integrating threat modeling into software development lifecycle using "Automaton" framework, enabling actionable outputs and automated security testing for improved product security.
Growing Security Champions: Scaling SDL Through Development Partnerships
Scaling application security through Security Champions: strategies for selection, training, and empowering developers to handle security activities within their teams, improving overall security posture.
Teaching Sustainable Security in DevOps and Agile Environments - AppSecUSA 2018
Strategies for sustainable security in DevOps teams: assessment, training, coaching, automation, and risk management. Avoid common pitfalls and empower teams for long-term security success.
Creating an AppSec Pipeline with Containers in a Week
Explore the journey of setting up an AppSec pipeline using Docker containers, addressing challenges, managing false positives, and optimizing security tools for seamless integration with development teams.
Monitoring Application Attack Surface and Integrating Security into DevOps Pipelines
Explore methods for calculating and tracking web application attack surface evolution, and learn to integrate security testing into CI/CD pipelines using metrics-based policies.
Securing C Code That Seems to Work Fine
Explore strategies for securing C codebases in high-performance environments, balancing best practices with startup culture. Learn from real-world successes and failures in implementing application security controls.
Popular Approaches to Preventing Code Injection Attacks are Dangerously Wrong
Explores limitations of current code injection prevention methods and introduces Name Space Layout Randomization (NSLR) as a novel approach to secure Java applications against known and zero-day vulnerabilities.
Making Vulnerability Management Less Painful with OWASP DefectDojo
Streamline vulnerability management with DefectDojo: automate reporting, metrics, and scanner consolidation. Learn how this open-source tool can enhance your AppSec program's efficiency and effectiveness.
Measuring End-to-End Security Engineering
Introducing a new SDL approach: End-to-End Security Engineering. Covers full product lifecycle, defines 'perfect secure system', and produces metrics to measure security state at each point. Focuses on collective understanding and effectiveness.
Juggling the Elephants - Making AppSec a Continuous Program
Strategies for implementing a continuous AppSec program that integrates security initiatives, enables DevOps, and addresses portfolio-wide coverage while prioritizing risks and fostering continuous improvement.
Slack App Security: Securing Workspaces from a Bot Uprising
Explore Slack app security, potential risks, and solutions for safeguarding workspaces. Learn about the app directory's history, unique security challenges, and Slack's efforts to enhance user protection.
Lessons in Securing Internal Apps - AppSecCali 2019
Lessons and strategies for securing internal applications, including authentication, TLS, Content Security Policy, and leveraging WAFs. Insights on scalable approaches and using internal apps to train security engineers.
Secure Development - Why Some Product Teams Excel in Security and Others Don't
Explore how product team culture impacts security, using metrics from bug bounty programs and security reviews to identify successful practices and improvement areas for agile organizations.
A Pragmatic Approach for Internal Security Partnerships
Strategies for effective security partnerships with engineering teams, focusing on shared risk views, automation, and integrating security into product roadmaps.
Netflix's Layered Approach to Reducing Risk of Credential Compromise
Discover Netflix's multi-layered security approach to protect against credential compromise, featuring innovative tools and strategies for robust infrastructure protection.