Pwning IoT Devices Through Their Applications - From AppSec to IoT Security
Explore IoT device vulnerabilities through application security techniques, from firmware analysis to code review, leading to six new CVEs and insights on responsible disclosure.
Harmonizing OWASP API and Application Top 10 Security Risks - Combining Lists for Comprehensive Coverage
Explore API security risks, comparing OWASP's API and Application Top 10 lists. Learn detection and prevention strategies for vulnerabilities in web services, APIs, and GraphQL.
Application Threat Modeling Implementation Tips and Tricks
Learn essential tips and techniques for implementing application threat modeling, including DFD design for microservices and client-side frameworks, and effective threat identification and risk analysis strategies.
Magecart - The Rising Threat to E-commerce Websites
Explore Magecart, a cybercrime group targeting e-commerce sites through digital skimming. Learn about their tactics, technical aspects, and mitigation strategies for protecting user data.
How to Build a Security Mindset Through Storytelling
Discover how to cultivate a security mindset using storytelling and mutual teaching inspired by Maori culture. Learn effective strategies to improve workplace security practices and behaviors.
The How and Why of the OWASP Top Ten 2021
Explore the OWASP Top Ten 2021 update, its significance, and data-driven insights. Learn about critical application security risks, analysis methodologies, and industry impact.
Data at Rest Encryption - Addressing Modern Attacks Beyond the Basics
Explore advanced data encryption techniques beyond basics, addressing modern security threats like ransomware and insider attacks. Learn about Application-Level Encryption, Field-Level Encryption, and best practices for robust data protection.
Automating Architectural Risk Analysis with Open Threat Model Format
Explore automating architectural risk analysis using Open Threat Model format. Learn to create OTM files, integrate threat modeling into DevSecOps, and address challenges in software development security.
Security Design Anti-Patterns: Creating Awareness to Limit Security Debt
Explore security design anti-patterns, their impact on SDLC, and strategies to identify and mitigate them early. Learn to create awareness and limit security debt in software development.
Data-Driven AppSec Champions Programs - Benchmarking Your Program with Numbers
Insights from a survey of 26 innovative AppSec champions programs, covering best practices in recruitment, training, communication, and ROI measurement to enhance software security.
Building Security Champions - Creating and Sustaining Effective Programs
Learn to build an effective security champions program: recruiting, training, engaging, and motivating champions to scale security efforts across your organization.
Bots Gone Phishing - Defending Against Automated Attacks and Phishing
Explore techniques to defend against phishing bots using obfuscation and one-time tokens, increasing costs for attackers while protecting web applications and APIs from automated threats.
How to Thwart Malicious Automation and Kick Bot Butt for $0
Learn to defend against malicious bots and automated attacks using free, open-source solutions. Gain insights on threat profiling, defensive tactics, and implementation strategies for effective cybersecurity.
Roadblocks for Content Security Policy (CSP) Implementation - Developer Challenges and Solutions
Explore challenges in implementing Content Security Policy (CSP) for web security, including complexity, legacy code, and browser support. Learn strategies to overcome obstacles and enhance CSP deployment.
OWASP Leaders Meeting - Updates and Collaboration
Learn about OWASP's latest updates, share experiences, and discuss strategies to advance web application security. Connect with leaders across projects, chapters, events, and committees.
OWASP API Security: Sufficient Logging and Monitoring for API Protection
Explore real-world examples and best practices for implementing sufficient API logging and monitoring to enhance security, observability, and incident response capabilities.
OWASP Open Application Security Curriculum
Comprehensive overview of OWASP's initiative to develop an open, standardized application security curriculum for undergraduate and postgraduate education, addressing the skills gap in the security sector.
Ending Injection Vulnerabilities
Learn how programming languages can prevent injection vulnerabilities by distinguishing trusted developer strings from potentially attacker-controlled input, ensuring safer handling of user values in sensitive contexts.
Securing Modern Applications and APIs Against Attacks
Explore effective API security strategies for modern applications, focusing on deep application knowledge and user behavior to protect against evolving threats in cloud-native architectures.
Who's in Control: Human or Machine? - Behavioral Detection in Cybersecurity
Explore advanced behavioral detection methods for protecting critical web APIs against sophisticated attacks, focusing on user behavior analysis and biometric detection techniques.
How to Use Your Vulnerabilities to Train Developers on Security
Learn to leverage your vulnerabilities for targeted developer security training. Discover common coding mistakes, effective fix strategies, and how to create adaptive training plans using real-world examples.