OWASP Foundation Courses

AppSec Threats Deserve Their Own Incident Response Plan

Discover why AppSec incidents need a dedicated response plan. Learn about software supply chain attacks, trends, and a quick response playbook for effective incident management.

• YouTube
• 42 minutes
• Self-Paced
• Free Video

Fixing Broken Access Control - Cloud-Native Authorization Principles and Patterns

Explore cloud-native authorization principles, comparing OPA and Zanzibar models for robust access control systems. Learn about fine-grained controls to secure your applications and APIs.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Better Protect Sensitive Data in the Cloud with Client-Side Application Layer Encryption

Learn to implement client-side application layer encryption for enhanced data protection in cloud environments, reducing breach risks and maintaining control over sensitive information.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

Security Design and Guidance at Scale

Strategies for scaling application security in cloud-native environments: self-service design reviews, security champions program, and developer experience patterns for proactive risk reduction.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

From SBOMs to F-Bombs: Vulnerability Analysis, SCA Tools, and False Positives and Negatives

Explore vulnerability management in third-party software through a FOSS security library provider's perspective. Learn about SCA tools, SBOMs, and strategies to improve the process for AppSec engineers and developers.

• YouTube
• 46 minutes
• Self-Paced
• Free Video

Using WebAssembly to Run, Extend, and Secure Applications

Explore WebAssembly's evolution, security features, and applications beyond browsers. Learn to run, extend, and secure apps using WASM, WASI, and Trusted Execution Environments.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

OWASP Low-Code/No-Code Top 10 Security Risks

Explore top security risks in Low-Code/No-Code platforms, challenges, and mitigation strategies. Essential guide for organizations adopting these development environments.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

22 Years of Application Security - Progress, Challenges, and Lessons Learned

Explore the evolution of application security over 22 years, examining progress, challenges, and lessons learned. Gain insights into the future of AppSec from industry expert Alyssa Miller.

• YouTube
• 41 minutes
• Self-Paced
• Free Video

Global AppSec - Beyond Boundaries

Exploring the global implications of AppSec, challenging assumptions, and examining the need for inclusive, accessible security practices in software development across diverse contexts and communities.

• YouTube
• 49 minutes
• Self-Paced
• Free Video

ATOR - Authentication Token Obtain and Replace Burp Plugin V3

Streamline complex authentication testing with ATOR v3 Burp Plugin. Automate token handling, OTP validation for JavaScript frameworks. Simplifies configuration and debugging for efficient security assessments.

• YouTube
• 54 minutes
• Self-Paced
• Free Video

Breaking and Fixing Web Application Security

Explore web application security challenges, attack vectors, and proactive measures. Learn to identify vulnerabilities, implement secure coding practices, and safeguard user data in the digital realm.

• YouTube
• 55 minutes
• Self-Paced
• Free Video

Cross-Tenant Request Forgery Attack in Multi-Tenancy Environments

Unveiling security vulnerabilities in multi-tenant SaaS platforms using OAuth, focusing on the "Cross-Tenant Request Forgery" attack and discussing potential remediations for developers.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

Defining and Embracing Software Fragility - Balancing Complexity and Security

Exploring software fragility archetypes and the "Wellness" approach to strengthen software anatomy with a sustainable, secure foundation while balancing rapid development and security.

• YouTube
• 56 minutes
• Self-Paced
• Free Video

Enhancing CI/CD Secrets Security - The 3Rs Approach

Explore the 3Rs approach to enhance CI/CD secrets security: Reduce stored secrets, use short-lived credentials, and prevent leaks in source code. Practical tips for implementing these principles across various platforms.

• YouTube
• 49 minutes
• Self-Paced
• Free Video

Large-Scale Application Attack Surface Management

Comprehensive approach to managing attack surfaces in large-scale applications, covering APIs, web services, and mobile apps. Explores techniques, challenges, and lessons learned for effective security implementation.

• YouTube
• 45 minutes
• Self-Paced
• Free Video