LASCON Courses

FAIR STRIDE - Building Business Relevant AppSec Threat Models

Combine STRIDE threat modeling with FAIR quantitative analysis to express application vulnerabilities as business losses and support strategic security decisions.

• YouTube
• 49 minutes
• Self-Paced
• Free Video

Design-Level Supply Chain Attacks in the Real World

Examines design-originated supply chain attacks, from constrained architectures and legacy requirements to malicious influence, with real-world examples and mitigations.

• YouTube
• 52 minutes
• Self-Paced
• Free Video

Securing Managed Kubernetes Clusters

Understand the Kubernetes threat model and actionable recommendations for securely running workloads in managed cloud Kubernetes clusters.

• YouTube
• 52 minutes
• Self-Paced
• Free Video

Close Encounters of the Vulnerable Kind - A DevSecOps Odyssey

An examination of how people, processes, and tools shape security across modern DevOps pipelines, from vulnerable dependencies and secrets to developer buy-in.

• YouTube
• 52 minutes
• Self-Paced
• Free Video

Spies, Saboteurs and Scoundrels - How Russia, China and Nefarious Actors Are Hacking IoT

Examines how nation-states, cybercriminals, and insiders exploit IoT, OT, and network devices for persistence, evasion, and attacks—and how to mitigate the risks.

• YouTube
• 1 hour 3 minutes
• Self-Paced
• Free Video

Irrational but Effective - Applying Parenthood Lessons to Cybersecurity

A humorous talk on how parenthood prepares cybersecurity leaders and how they can apply those lessons to improve organizational security.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

Detecting and Controlling Rogue Third-Party Scripts in Web Applications

Learn to detect rogue third-party scripts, expose client-side blind spots, and block attempts to access sensitive data in web applications.

• YouTube
• 49 minutes
• Self-Paced
• Free Video

API Security Through External Attack Surface Management

Learn how integrating APIs into External Attack Surface Management can reveal exposed assets and strengthen API security.

• YouTube
• 35 minutes
• Self-Paced
• Free Video

Auditing IT Management Tools: ITSM, ITOM, APM, and CMDB - Security Considerations

Learn how security audits can scrutinize monitoring, CMDB, ticketing, and automation systems—and map their risks to OWASP SAMM.

• YouTube
• 32 minutes
• Self-Paced
• Free Video

Social Engineering Metrics: Using Data Science for Valuable Reporting

Use statistically grounded metrics to assess social-engineering resilience beyond email opens and link clicks.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

OWASP Secrets Management Cheat Sheet Overview - Best Practices for Secure Handling

Review OWASP best practices for managing secrets, including CI/CD pipelines, encryption, detection, and response when secrets are exposed.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

Security Observability 101 - Thinking Inside the Box

Learn to expose software’s runtime behavior with JOT, creating security instrumentation without coding to analyze defenses, find vulnerabilities, sandbox applications, and enforce policy.

• YouTube
• 57 minutes
• Self-Paced
• Free Video

Making End User AppSec Training Engaging with Building Bricks

Use humorous LEGO minifigures and custom builds to make end-user application security training memorable.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Cloud Security at Scale: The Chaos Continues - Part 2

Real-world cloud security implementation and migration stories from finance and regulated industries, explored through the continuing misadventures of cartoon companies.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

TMI - The Kinds of Data Your Applications Are Leaking

A tour of web applications that hand out too much information, showing how to move between sites and pull data at will.

• YouTube
• 44 minutes
• Self-Paced
• Free Video