OWASP Foundation Courses

Working with Developers for Fun and Progress

Practical strategies for building strong relationships with developers to create an impactful AppSec program, featuring competition-based training, tooling implementation partnerships, and codebase contributions.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

Cache Me If You Can - Messing with Web Caching

Explore web caching vulnerabilities including Web Cache Deception, Edge Side Include Injections, and Web Cache Poisoning. Learn detection techniques and mitigation strategies for these emerging threats in application security.

• YouTube
• 45 minutes
• Self-Paced
• Conference Talk

Automated Account Takeover - The Rise of Single Request Attacks

Explore the rise of single request attacks in account takeovers, their sophistication, and effective mitigation strategies through real-world case studies and expert insights.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

Cloud Forensics - Putting The Bits Back Together

Explore cloud forensics challenges and solutions in AWS, focusing on server breaches, disk imaging, and incident response techniques for various EC2 instance types and EBS volumes.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

Remediate The Flag - Practical AppSec Training Platform

Hands-on platform for developers to find and fix security vulnerabilities in code. Offers real-time feedback, scoring, and customizable exercises to improve application security skills.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Running at Light Speed - Cloud Native Security Patterns

Explore cloud-native security patterns, including container isolation, control plane hardening, and network segmentation. Learn about authentication, authorization, and secrets management in cloud environments.

• YouTube
• 1 hour
• Self-Paced
• Conference Talk

How to Get the Best AppSec Test of Your Life

Learn strategies to maximize the value of AppSec testing, from tailoring tests to your needs to ensuring actionable reports, for both defenders and breakers in application security.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Authentication as a Microservice - Portable Customer Identity Management

Explore microservice-based authentication, portable identity management, and JWT security. Learn advantages, pitfalls, and best practices for decoupling user data in modern applications.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Human Factors That Influence Secure Software Development

Explores human factors influencing secure software development, including environmental conditions, developer characteristics, and team dynamics. Discusses strategies to identify and mitigate vulnerability-prone code before issues arise.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

Battle Tested Application Security

Insights on building effective Application Security programs, focusing on security culture, defensive capabilities, and organizational empowerment across different environments.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

Flying Above the Clouds - Securing Kubernetes

Explore Kubernetes security, from container isolation to authentication and authorization. Learn to build resilient cloud-native systems and deploy secure services in a distributed environment.

• YouTube
• 53 minutes
• Self-Paced
• Conference Talk

Breaking Fraud and Bot Detection Solutions

Demystifying browser fingerprinting and user behavior tracking in fraud detection, exploring vulnerabilities, and sharing real-world implementation flaws in bot prevention systems.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Serverless Infections - Malware Just Found a New Home

Explore serverless security risks through a live demo of RCE attacks, data infiltration, and self-duplicating malware in cloud environments. Learn best practices for securing serverless architectures.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

Deserialization - What, How and Why Not

Explore insecure deserialization risks, vulnerabilities, and prevention techniques through code examples and live demos, focusing on Java but applicable to other languages.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

A New Framework to Automate MSTG and MASVS in Your CI/CD Pipeline

Automate mobile app security testing using BDD and UI automation frameworks. Integrate OWASP MASVS/MSTG into CI/CD pipelines for faster, repeatable security checks at DevOps speed.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk