WAFs FTW! A Modern DevOps Approach to Security Testing Your WAF
Explore modern DevOps approach to security testing Web Application Firewalls (WAFs) using Framework for Testing WAFs (FTW). Learn objective WAF evaluation, rapid prototyping, and continuous testing strategies.
Federated Login CSRF
Explore federated login CSRF vulnerabilities in OpenID Connect and OAuth 2.0, examining attack scenarios, risks, and mitigation strategies for secure identity linking in web applications.
Where We're Going, We Won't Need Passwords
Explore enterprise-wide multifactor authentication deployment, addressing technical challenges, user experience, and lessons learned for seamless workforce authentication across devices and legacy systems.
Building Secure ASP.NET Core MVC Applications
Explore ASP.NET Core MVC security features, including XSS and CSRF protection. Learn to build robust web applications with modular architecture and cross-platform compatibility.
Fixing Broken Enterprise Threat Models with OWASP Efforts - Commissioning AppSec Professionals for Real Change
Explore how OWASP projects can revolutionize enterprise threat modeling, addressing compliance issues, undefined attack surfaces, and risk distortions to create measurable security impact.
Crafting the Next-Generation Man-in-the-Browser Trojan
Explore next-gen Man-in-the-Browser trojans, their evolution, and defense strategies. Learn about advanced attack techniques, client-side defenses, and future cybersecurity challenges in this comprehensive talk.
Differences Between Web Application Scanning Tools When Scanning for XSS and SQLi
Investigates differences between web application scanning tools for XSS and SQLi, addressing challenges in modern web architectures and suggesting improvements for effective vulnerability detection.
Bug Bounty Programs - Successfully Controlling Complexity and Perpetual Temptation
Explore bug bounty programs with industry experts, covering implementation strategies, legal considerations, and best practices for effective vulnerability management and researcher collaboration.
Cryptography in the Age of Heartbleed
Cryptography expert discusses challenges in encryption, recent vulnerabilities in web protocols, and securing cryptographic software against sophisticated attackers, emphasizing the need for simplification.
Pushing Left Like A Boss - Application Security Foundations
Discover application security foundations and learn to 'push left' in the software development lifecycle. Explore strategies from vulnerability scanning to red team exercises for a proactive approach to security.
What the Kidnapping and Ransom Economy Teaches Us About Ransomware
Explore ransomware's parallels with real-world kidnapping, its economic dynamics, future trends, and strategies to combat this growing cyber threat in the digital age.
The DevSecOps Playbook - From A Practitioner's Perspective
Practical guide to implementing DevSecOps, covering mindset shifts, automation, communication strategies, skill requirements, and collaborative tools for safer software development.
Creating an AppSec Pipeline With Containers in a Week - How We Failed and Succeeded
Explore the journey of implementing an AppSec pipeline using Docker containers, addressing challenges, solutions, and best practices for effective security integration in development workflows.
Incremental Threat Modeling
Learn incremental threat modeling techniques for complex projects, focusing on efficient security analysis without extensive initial time investment.
The Ways Hackers Are Taking To Win The Mobile Malware Battle
Explore cutting-edge mobile malware techniques, security paradigms, and detection methods. Live demo showcases creation of undetectable malware, highlighting challenges in mobile security.
Practical Static Analysis for Continuous Application Security
Explore practical static analysis techniques for continuous application security, from simple grep to custom tools, enhancing software development lifecycle with targeted security checks.
Using Language-Theoretics and Runtime Visibility to Align AppSec with DevOps
Explore LANGSEC methodology and RASP tools for aligning AppSec with DevOps, enhancing runtime security visibility, and addressing vulnerabilities beyond traditional techniques.
Cleaning Your Applications' Dirty Laundry with Scumblr
Learn about Scumblr, an open-source tool for application security at scale. Discover how Netflix uses it for vulnerability management, risk tracking, and automating security tasks in a dynamic cloud environment.
Next Gen Web Pen Testing - Handling Modern Applications in a Penetration Test
Explore modern web application security testing techniques, including HTTP/2, WebSockets, CORS, REST APIs, and Content Security Policy. Learn to adapt penetration testing methods for evolving technologies.
Threat Modeling With Architectural Risk Patterns
Explore efficient threat modeling using architectural risk patterns, emphasizing software-centric methods to enhance speed and consistency in identifying security risks across enterprise environments.
Why Hackers Are Winning The Mobile Malware Battle - Bypassing
Explore mobile malware challenges, hacker tactics, and bypassing techniques in this insightful talk on the evolving landscape of mobile security threats and defenses.