11,000 Voices - Experts Shed Light on 4-Year Open Source and AppSec Survey
Experts discuss findings from a 4-year study on open source security practices, revealing surprising trends in policy enforcement, vulnerability tracking, and organizational preparedness for security threats like Heartbleed.
Building Your Application Security Data Hub - The Imperative for Structured Vulnerability Information
Learn how to create an integrated application security program by breaking down silos, enabling data flow between teams and tools, and implementing metrics to measure performance and improvement.
AppSecUSA 2014 Builders Track - Friday Sessions
Explore key AppSec topics: mobile security, threat modeling, continuous security, and component vulnerabilities. Gain insights from industry experts to enhance your application security practices.
Application Security Management Strategies - OWASP AppSecUSA 2014
Explore key AppSec topics: structured vulnerability data, training programs, open source surveys, lean security for SMBs, and adaptive strategies. Gain insights from industry experts at OWASP's AppSecUSA 2014.
Fix the Damned Software - Improving Application Security Design
Explore strategies for building security into software development, moving beyond vulnerability discovery to secure design and implementation. Learn from industry experience and BSIMM data.
OWASP Top 10 Mobile Risks: 2014 Reboot
Explore the updated 2014 OWASP Top 10 Mobile Risks, comparing changes since 2011, understanding new threats, and learning recommended fixes for iOS, Android, and Windows Phone platforms.
Developing Secure Open Source Software - Mentorship Session
Explore best practices for developing secure open source software with expert guidance on risk mitigation, vulnerability management, and collaborative security measures.
Managing Audits for Critical Open Source Projects
Learn how OSTIF manages security audits for critical open source projects, connecting experts with maintainers to improve overall security posture and patch vulnerabilities.
VEXing Open Source Security - Vulnerability Data for Everything
Explore the Vulnerability Exchange Format (VEX) standard for improving vulnerability management in open source projects and enterprise software security.
What's in a Name - Vulnerabilities, SBOMs, and the Challenge of Software Identity
Explore software identity challenges in supply chain security, examining existing naming standards, potential risks, and collaborative solutions for effective vulnerability management.
Are We Forever Doomed to Software Supply Chain Security?
Explore software supply chain security challenges, recent incidents, and strategies for mitigating vulnerabilities in open-source ecosystems. Learn about maintainer account security and registry management.
A Different Kind of S3 - First Line Security of the Supply Chain
Explore three core areas for securing the software supply chain: Software Bill of Materials (SBOM), Signing, and Slimming. Learn practical methods to enhance first-line security controls and minimize attack surfaces.
Future of CVE - Challenges and Developments in Vulnerability Identification
Exploring CVE's evolution, challenges, and future directions in cybersecurity, including ID reservation, counting methods, new services, and emerging issues like cloud vulnerabilities.
Securing Open Source Software - End-to-End, at Massive Scale, Together
Explore strategies for securing open source software at scale, focusing on collaborative approaches and end-to-end solutions for robust protection in the digital ecosystem.
Open Source Runs the World - Why Not Vulnerability Identifiers?
Explore the critical role of open source in vulnerability identification and management, emphasizing its potential to enhance global cybersecurity efforts.
Vulntology - A Methodology to Characterize Vulnerabilities with Granular and Intuitive Structure
Explore a methodology for characterizing vulnerabilities with granular, intuitive structure. Learn about vulnerability objects, scenarios, barriers, actions, and impacts in cybersecurity.
Hijacking.gov.uk - Identifying and Communicating Risks to the Digital State
Explore digital security risks in government domains and learn effective strategies for identifying and communicating vulnerabilities to protect critical online infrastructure.
From Log4shell to OpenSSL - Reflections on a Year of Open Source Software Security
Explore the impact of Log4shell on open source software security, progress made, and future challenges. Gain insights into enhancing OSS security and its role in critical infrastructure.
Simplifying Coordinating Vulnerabilities and Disclosures in Open Source Projects
Learn best practices for handling vulnerability disclosures in open source projects. Discover tools and templates to streamline the process and reduce stress when dealing with security reports from researchers.
Security Advisory Programs: Creating Transparency in Software Supply Chain
Strategies for implementing transparent security communications programs in software products, addressing customer demands for vulnerability disclosure and open source patching accountability.
Where Is the GUAC? - Understanding Artifact Composition in Software Supply Chains
Explore GUAC: a tool for comprehensive software supply chain analysis, integrating metadata to identify vulnerabilities, assess trust, and enhance security through GraphQL-powered insights.