Threat Model-as-Code: Integrating Security into the Software Development Lifecycle
Integrating threat modeling into software development lifecycle using "Automaton" framework, enabling actionable outputs and automated security testing for improved product security.
Chromebooks and Network Motes: Enforcing Security Posture from Device to Cloud
Explore innovative security strategies using Chromebooks and network motes, balancing developer productivity with robust data protection in resource-constrained environments.
Growing Security Champions: Scaling SDL Through Development Partnerships
Scaling application security through Security Champions: strategies for selection, training, and empowering developers to handle security activities within their teams, improving overall security posture.
Empowering the Employee - Incident Response with a Security Bot
Explore how a Slack bot engages employees in incident response, enhancing security awareness and efficiency while providing valuable insights for quick, appropriate action.
Identity Theft: Attacks on SSO Systems
Explore vulnerabilities in SAML-based SSO systems, including XML signature attacks and user directory flaws. Learn how these issues can lead to identity theft and authentication bypasses in modern organizations.
Teaching Sustainable Security in DevOps and Agile Environments - AppSecUSA 2018
Strategies for sustainable security in DevOps teams: assessment, training, coaching, automation, and risk management. Avoid common pitfalls and empower teams for long-term security success.
Exploring the Ecosystem of Malicious Domain Registrations in the .eu TLD
Extensive analysis of malicious domain registrations in .eu TLD, revealing cybercriminal tactics and campaign patterns. Insights into automated processes and operational aspects of large-scale malicious activities.
Creating an AppSec Pipeline with Containers in a Week
Explore the journey of setting up an AppSec pipeline using Docker containers, addressing challenges, managing false positives, and optimizing security tools for seamless integration with development teams.
The Evil Friend in Your Browser - Browser Extension Security Risks
Explore the hidden dangers of browser extensions, their security model limitations, and potential risks to user privacy. Learn about real-world analysis findings and discuss improved security measures.
Monitoring Application Attack Surface and Integrating Security into DevOps Pipelines
Explore methods for calculating and tracking web application attack surface evolution, and learn to integrate security testing into CI/CD pipelines using metrics-based policies.
Embedding GDPR into the Software Development Lifecycle
Practical guide to integrating GDPR requirements into software development lifecycle, covering privacy awareness, risk analysis, secure coding, threat modeling, and breach notification processes.
Securing C Code That Seems to Work Fine
Explore strategies for securing C codebases in high-performance environments, balancing best practices with startup culture. Learn from real-world successes and failures in implementing application security controls.
Popular Approaches to Preventing Code Injection Attacks are Dangerously Wrong
Explores limitations of current code injection prevention methods and introduces Name Space Layout Randomization (NSLR) as a novel approach to secure Java applications against known and zero-day vulnerabilities.
Making Vulnerability Management Less Painful with OWASP DefectDojo
Streamline vulnerability management with DefectDojo: automate reporting, metrics, and scanner consolidation. Learn how this open-source tool can enhance your AppSec program's efficiency and effectiveness.
Detecting CSRF Vulnerability Reliably - Programmatic Approach
Explore a programmatic approach to reliably detect CSRF vulnerabilities in web applications, overcoming common shortcomings of existing tools and improving automated security testing.
Measuring End-to-End Security Engineering
Introducing a new SDL approach: End-to-End Security Engineering. Covers full product lifecycle, defines 'perfect secure system', and produces metrics to measure security state at each point. Focuses on collective understanding and effectiveness.
Juggling the Elephants - Making AppSec a Continuous Program
Strategies for implementing a continuous AppSec program that integrates security initiatives, enables DevOps, and addresses portfolio-wide coverage while prioritizing risks and fostering continuous improvement.
Enhancing Physical Perimeter Defense Using Software-Defined Radio
Explore innovative physical perimeter defense using software-defined radio to detect potential threats by simulating cell tower signals, enabling early reconnaissance identification and post-breach investigation.
Remediating XSS in GitHub Open Source Projects - Lessons Learned
Insights on scaling XSS remediation across GitHub open source projects, focusing on risk reduction, adding security controls, and automating code modification for diverse applications.
Creating Accessible Security Testing with ZAP - AppSecCali 2019 Lightning Talk
Introducing OWASP ZAP's Heads Up Display: A new UI that makes security testing more intuitive for developers and professionals, enabling efficient use of the attack proxy tool.
Slack App Security: Securing Workspaces from a Bot Uprising
Explore Slack app security, potential risks, and solutions for safeguarding workspaces. Learn about the app directory's history, unique security challenges, and Slack's efforts to enhance user protection.