
Explore a programmatic approach to reliably detect CSRF vulnerabilities in web applications, overcoming common shortcomings of existing tools and improving automated security testing.

Introducing a new SDL approach: End-to-End Security Engineering. Covers full product lifecycle, defines 'perfect secure system', and produces metrics to measure security state at each point. Focuses on collective understanding and effectiveness.

Strategies for implementing a continuous AppSec program that integrates security initiatives, enables DevOps, and addresses portfolio-wide coverage while prioritizing risks and fostering continuous improvement.

Explore innovative physical perimeter defense using software-defined radio to detect potential threats by simulating cell tower signals, enabling early reconnaissance identification and post-breach investigation.

Introducing OWASP ZAP's Heads Up Display: A new UI that makes security testing more intuitive for developers and professionals, enabling efficient use of the attack proxy tool.

Explore Slack app security, potential risks, and solutions for safeguarding workspaces. Learn about the app directory's history, unique security challenges, and Slack's efforts to enhance user protection.

Explore how browser fingerprints can enhance web security by detecting session roaming and preventing account takeovers, using machine learning to identify anomalies in device configurations.

Applying adversarial threat models to supply chain systems, focusing on realistic attack patterns and emulating cybercriminal tactics to enhance defensive measures and risk reduction strategies.

Lessons and strategies for securing internal applications, including authentication, TLS, Content Security Policy, and leveraging WAFs. Insights on scalable approaches and using internal apps to train security engineers.

Explore nation-state cyber warfare through a realistic game scenario, examining decision-making, tools, and diplomatic challenges. Learn strategies for organizations to improve cybersecurity preparedness and response.

Explore how product team culture impacts security, using metrics from bug bounty programs and security reviews to identify successful practices and improvement areas for agile organizations.

Explore techniques to enhance account security using breach data, prevention strategies, and user engagement. Learn to correlate signals, improve detection rules, and encourage secure practices.

Strategies for effective security partnerships with engineering teams, focusing on shared risk views, automation, and integrating security into product roadmaps.

Explore a framework for managing dependencies in vulnerability response, enabling proactive PSIRT strategies and improving product security through early-stage decision-making and controls.

Explore open-source OWASP tools for efficient white box penetration testing. Learn about Code Pulse for real-time code coverage and Attack Surface Detector for comprehensive endpoint discovery to enhance security assessments.

Discover Netflix's multi-layered security approach to protect against credential compromise, featuring innovative tools and strategies for robust infrastructure protection.

Discover effective collaboration strategies for security professionals in the DevOps era, focusing on new skills, approaches, and speed to engage early and add value in software development.

CISOs discuss strategies for integrating security into rapid application development, sharing real-world experiences on managing evolving methodologies and pressures to publish securely.

Explore proactive security controls for developers to build safer applications. Learn techniques to address common vulnerabilities and integrate security throughout the development lifecycle.

Exploring linguistic theory's impact on security practices, this talk examines how names and metaphors influence organizational processes and interactions to enhance security posture.

Explore the future of DevSecOps with insights on seamless security integration, emerging technologies, and adoption strategies for the next three years in application development.