OWASP Foundation Courses

Open Software Supply Chain Attack Reference (OSC&R) - OWASP Foundation

Explore the OSC&R framework for software supply chain security, analyzing real-world attacks and improving DevSecOps programs to enhance overall security posture.

• YouTube
• 42 minutes
• Self-Paced
• Free Video

Policy-as-Code Across the Stack

Explore Policy-as-Code implementation using open-source frameworks for enhanced security and compliance across the technology stack, reducing manual intervention and improving risk management.

• YouTube
• 49 minutes
• Self-Paced
• Free Video

Ignoring the Hype - Designing Cloud Architecture for Any Provider

Explore universal cloud architecture principles, focusing on security and observability. Learn actionable strategies to design robust cloud environments across providers, emphasizing best practices and key building blocks.

• YouTube
• 41 minutes
• Self-Paced
• Free Video

Detecting Malicious Dependencies at Scale with Static Analysis

Explore static analysis techniques for identifying malicious dependencies in open-source packages, including Semgrep rules and metadata analysis to enhance software supply chain security.

• YouTube
• 54 minutes
• Self-Paced
• Free Video

Unsafe at Any Speed - Cybersecurity Lessons from Automotive History

Explore the parallels between automotive safety history and cybersecurity challenges. Learn how advocacy, regulation, and perseverance can drive societal change in addressing digital vulnerabilities.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Automated Security Testing with OWASP Nettacker

Explore OWASP Nettacker, a powerful automated penetration testing framework. Learn its features, benefits, and practical applications for enhancing network and application security through live demos and examples.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Refactoring Mobile App Security - OWASP MASTG v2 and MAS Profiles

Discover the latest updates to OWASP MASTG v2, including new MAS profiles, automation advancements, and "atomic tests" for enhancing mobile app security standards and practices.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

Could Passwordless Authentication Be Worse Than Passwords?

Explores risks and vulnerabilities of passwordless authentication in web applications, highlighting potential security breaches and best practices for implementation and protection.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

Hacking and Securing Android Applications - Vulnerabilities and Prevention

Explore Android app vulnerabilities, learn detection methods, and discover how 'safe to run' library can enhance security in this talk on mobile application security.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Application Security Metrics: Identifying Key Indicators and Potential Red Flags

Explore application security metrics, learn to identify valuable indicators, and understand how to effectively communicate security data to stakeholders for informed decision-making and improved security posture.

• YouTube
• 50 minutes
• Self-Paced
• Free Video

Discovering Shadow Vulnerabilities in Popular Open-Source Projects - A Journey Through Reverse-Fuzzing

Explore hidden vulnerabilities in open-source libraries, their impact on high-profile projects, and the challenges of detection and mitigation. Learn about "Shadow Vulnerabilities" and their implications for software security.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

ASVS Testing: Understanding Access Requirements for Verification

Analyzing ASVS requirements to identify necessary access for accurate verification, aiding test case generation and helping companies understand the effort required for comprehensive security assessments.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

Everything-as-Code: Pushing the Boundaries of SAST

Explore the evolution of SAST in the "everything as code" era, examining challenges in analyzing infrastructure, contracts, and circuits, with focus on Bicep and Solidity languages.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

No Code You Shall Use, Malware You Shall Get - Security Risks in Low-Code/No-Code Platforms

Explore security risks in Low-Code/No-Code platforms' marketplaces, including malicious components and vulnerabilities. Learn about potential threats and see demonstrations of outcomes from compromised LCNC components.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Credential Sharing as a Service - The Dark Side of No-Code

Explore attack techniques exploiting enterprise No-Code platforms, including account takeovers, privilege escalation, and data exfiltration. Learn how attackers leverage shadow IT vulnerabilities in low-code applications.

• YouTube
• 44 minutes
• Self-Paced
• Free Video