OWASP Foundation Courses

Core Rule Set for the Masses

Insights on fine-tuning ModSecurity Core Rule Set for large-scale deployments, reducing false positives, and optimizing web application firewall performance.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

This Old App - A Guide to Renovating Apps for the Cloud

Explore strategies for migrating legacy applications to the cloud, considering various approaches, security implications, and organizational capabilities needed for successful cloud transitions.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Beyond Takeover - Attacker's In. Now What?

Explore the aftermath of phishing attacks through a unique research perspective, uncovering attacker behaviors, account takeover dynamics, and essential cybersecurity insights for organizations.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

Handling of Security Requirements in Software Development Lifecycle

Explore a unified process for handling security requirements in large companies, focusing on SecurityRAT tool for automated requirement management and issue tracking integration.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

When Molehill Vulnerabilities Become Mountainous Exploits

Explore how seemingly minor vulnerabilities can escalate into major security threats through live demonstrations, emphasizing the importance of comprehensive code scanning and proactive security measures.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

An Overview of API Underprotection

Explores API security challenges, threats, and emerging technologies. Covers OAuth2, API keys, mobile app security, TLS pinning, and advanced techniques like app hardening and software attestation.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

WAFs FTW! A Modern DevOps Approach to Security Testing Your WAF

Explore modern DevOps approach to security testing Web Application Firewalls (WAFs) using Framework for Testing WAFs (FTW). Learn objective WAF evaluation, rapid prototyping, and continuous testing strategies.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

Federated Login CSRF

Explore federated login CSRF vulnerabilities in OpenID Connect and OAuth 2.0, examining attack scenarios, risks, and mitigation strategies for secure identity linking in web applications.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

An Agile Framework for Building GDPR Privacy and Data Protection Requirements into SDLC

Agile framework for integrating GDPR privacy and data protection requirements into software development lifecycle, using a tag-based approach to identify and implement necessary features efficiently.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Androsia - A Tool for Securing In Memory Sensitive Data

Innovative tool for securing sensitive data in Android apps through static analysis and bytecode transformation, enhancing defense-in-depth even after compromise.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Where We're Going, We Won't Need Passwords

Explore enterprise-wide multifactor authentication deployment, addressing technical challenges, user experience, and lessons learned for seamless workforce authentication across devices and legacy systems.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Building Secure ASP.NET Core MVC Applications

Explore ASP.NET Core MVC security features, including XSS and CSRF protection. Learn to build robust web applications with modular architecture and cross-platform compatibility.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Fixing Broken Enterprise Threat Models with OWASP Efforts - Commissioning AppSec Professionals for Real Change

Explore how OWASP projects can revolutionize enterprise threat modeling, addressing compliance issues, undefined attack surfaces, and risk distortions to create measurable security impact.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

Crafting the Next-Generation Man-in-the-Browser Trojan

Explore next-gen Man-in-the-Browser trojans, their evolution, and defense strategies. Learn about advanced attack techniques, client-side defenses, and future cybersecurity challenges in this comprehensive talk.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

Cookie Security - Myths and Misconceptions

Debunking cookie security myths and exploring lesser-known facts about cookie attributes, including recent browser improvements for enhanced web application protection.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk