LASCON Courses

Build More Secure Apps with OWASP SKF and ASVS on Kubernetes

Learn how OWASP SKF integrates the ASVS to manage application security requirements and explore SKF Labs deployed on Kubernetes.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Scanning at Scale with OWASP ZAP - Technical Challenges and Improvements

Technical challenges of adapting and improving OWASP ZAP for large-scale security scanning.

• YouTube
• 53 minutes
• Self-Paced
• Free Video

A Visual Journey to Demystifying OAuth2 and OIDC - Why Do They Exist and How to Properly Use Them to Secure Your Applications

Visual explanation of why OAuth2, OIDC, JWT, and bearer tokens exist, how their workflows differ, and when to use them securely.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

The Case for Runtime Protection

Explore runtime protection that hardens web applications and APIs against entire classes of vulnerabilities without changing code, builds, tests, or deployments.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

Lessons Learned Building a Software Supply Chain Security Team

What a secure software supply chain really involves, and why SBOMs are only the beginning of building a dedicated security function.

• YouTube
• 56 minutes
• Self-Paced
• Free Video

Using API Specifications to Attack APIs

Learn how API specifications can expose APIs to attackers and how scanning tools reveal vulnerabilities caused by misconfigured API endpoints.

• YouTube
• 57 minutes
• Self-Paced
• Free Video

Building Trust-Based Networks with Dime Data Format

Explore how the open Dime data format builds trust-based networks, supports secure communication, and offers a modern alternative to X.509 certificates.

• YouTube
• 50 minutes
• Self-Paced
• Free Video

Defense-in-Depth Engineering Techniques for Secure Software Design

Learn to architect resilient software through defense-in-depth design, incident preparedness, extensibility, and overlooked web vulnerabilities.

• YouTube
• 55 minutes
• Self-Paced
• Free Video

Knowing What Risks Matter and Don't in Your Open Source

Learn how telemetry from real-world applications exposes which open-source libraries, vulnerabilities, and licenses create genuine software supply-chain risk.

• YouTube
• 42 minutes
• Self-Paced
• Free Video

The DevSecOps Playbook: A Step-by-Step Guide to Implementing DevSecOps

A five-domain playbook for integrating security teams, controls, and prioritized tasks into DevOps workflows across the software development lifecycle.

• YouTube
• 54 minutes
• Self-Paced
• Free Video

DSOMM from Theory to Enforcement - Applying Security in Cloud Native Environments

Applies the OWASP DevSecOps Maturity Model through live code demonstrations with open-source security tools.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

Hacking JavaScript Desktop Apps with XSS and RCE

Learn to audit Electron desktop apps by turning XSS vulnerabilities into remote code execution through preload scripts and IPC.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Automating App Security Tests in Development with Docker

Automate continuous application-security attacks in development by running Dockerized web applications and tools, integrating scans into CI/CD, and delivering results to developers.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Hacking and Defending APIs - Red and Blue Make Purple

Learn how attackers exploit API vulnerabilities and how defenders can detect, test, and protect against them using a purple-team approach.

• YouTube
• 53 minutes
• Self-Paced
• Free Video

Tips and Tactics for Creating Your Own CTF Event

Learn how to design, write, and manage Capture-the-Flag events that educate security audiences.

• YouTube
• 51 minutes
• Self-Paced
• Free Video