OWASP Foundation Courses

How Hackers Can Breach CI/CD Systems - Security Vulnerabilities and Mitigation

Explore vulnerabilities in CI/CD systems, including IDE leaks, role granularity issues, and environment leaks. Learn exploitation techniques and mitigation strategies through live demos and practical examples.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

Investigating WebSocket Server Security - Beyond HTTP

Investigates WebSocket server security, introducing new tools for endpoint discovery, server fingerprinting, and vulnerability detection. Focuses on implementation-level differences in open-source libraries.

• YouTube
• 48 minutes
• Self-Paced
• Free Video

Harmonizing OWASP API and Application Top 10 Security Risks - Combining Lists for Comprehensive Coverage

Explore API security risks, comparing OWASP's API and Application Top 10 lists. Learn detection and prevention strategies for vulnerabilities in web services, APIs, and GraphQL.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

Hacking Ethereum-based DApps - Security Vulnerabilities and Protections

Explore Ethereum-based DApps vulnerabilities and security measures. Learn attack techniques and protection strategies for blockchain applications.

• YouTube
• 46 minutes
• Self-Paced
• Free Video

Application Threat Modeling Implementation Tips and Tricks

Learn essential tips and techniques for implementing application threat modeling, including DFD design for microservices and client-side frameworks, and effective threat identification and risk analysis strategies.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

Magecart - The Rising Threat to E-commerce Websites

Explore Magecart, a cybercrime group targeting e-commerce sites through digital skimming. Learn about their tactics, technical aspects, and mitigation strategies for protecting user data.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

How to Build a Security Mindset Through Storytelling

Discover how to cultivate a security mindset using storytelling and mutual teaching inspired by Maori culture. Learn effective strategies to improve workplace security practices and behaviors.

• YouTube
• 48 minutes
• Self-Paced
• Free Video

The How and Why of the OWASP Top Ten 2021

Explore the OWASP Top Ten 2021 update, its significance, and data-driven insights. Learn about critical application security risks, analysis methodologies, and industry impact.

• YouTube
• 50 minutes
• Self-Paced
• Free Video

Data at Rest Encryption - Addressing Modern Attacks Beyond the Basics

Explore advanced data encryption techniques beyond basics, addressing modern security threats like ransomware and insider attacks. Learn about Application-Level Encryption, Field-Level Encryption, and best practices for robust data protection.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Automating Architectural Risk Analysis with Open Threat Model Format

Explore automating architectural risk analysis using Open Threat Model format. Learn to create OTM files, integrate threat modeling into DevSecOps, and address challenges in software development security.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Security Design Anti-Patterns: Creating Awareness to Limit Security Debt

Explore security design anti-patterns, their impact on SDLC, and strategies to identify and mitigate them early. Learn to create awareness and limit security debt in software development.

• YouTube
• 46 minutes
• Self-Paced
• Free Video

Data-Driven AppSec Champions Programs - Benchmarking Your Program with Numbers

Insights from a survey of 26 innovative AppSec champions programs, covering best practices in recruitment, training, communication, and ROI measurement to enhance software security.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

OWASP ESAPI - A Retrospective: The Good, the Bad, and the Ugly

Retrospective on OWASP ESAPI security library, exploring successes, failures, and challenges in developing and maintaining comprehensive web application defenses.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Building Security Champions - Creating and Sustaining Effective Programs

Learn to build an effective security champions program: recruiting, training, engaging, and motivating champions to scale security efforts across your organization.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

Web Application Honeypot Threat Intelligence - Techniques and Implementation

Explore web application honeypots for threat intelligence, using ModSecurity and OWASP Core Rule Set to capture attacker activity and protect software against emerging threats.

• YouTube
• 31 minutes
• Self-Paced
• Free Video