OWASP Foundation Courses

Moving Fast and Securing Things

Discover how Slack balances rapid development with robust security through an innovative Secure Development Lifecycle process, featuring self-service tools and chat-based workflows that foster a security mindset among developers.

• YouTube
• 42 minutes
• On-Demand
• Conference Talk

Secure Product Lifecycle as a Service

Learn to design, implement, and scale a Secure Product Lifecycle (SPLC) program using automation and security ambassadors. Gain insights from Adobe's successful approach to integrating security into software development.

• YouTube
• 34 minutes
• On-Demand
• Conference Talk

How to Stop Worrying About Application Container Security

Learn how to embrace container security for sensitive workloads, exploring challenges, benefits, and best practices. Gain insights from a real-world journey of adopting containers in production environments.

• YouTube
• 38 minutes
• On-Demand
• Conference Talk

Building a Culture of Security at The New York Times

Insights on building a culture of security at The New York Times, focusing on adapting to new challenges, fostering collaboration, and implementing practical strategies for newsroom protection.

• YouTube
• 44 minutes
• On-Demand
• Conference Talk

Attribute Based Access Control - Why, What, How

Explore digital identity trends, ABAC implementation, and data protection in finance. Learn from ABNAMRO's experience with Attribute Based Access Control and its impact on security and regulation compliance.

• YouTube
• 46 minutes
• On-Demand
• Conference Talk

A Series of Unfortunate Events - Where Malware Meets Murphy

Exploring a real-world ransomware incident, its challenges, and unexpected failures in security infrastructure and recovery processes. Learn valuable lessons for better incident preparedness.

• YouTube
• 27 minutes
• On-Demand
• Conference Talk

Common REST API Security Pitfalls

Explore common REST API security pitfalls, their root causes, and best practices for protection. Learn to assess and improve API security for robust, future-proof applications.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

Don't Trust the DOM - Bypassing XSS Mitigations via Script Gadgets

Explores novel XSS attack technique using script gadgets to bypass mitigations, demonstrating vulnerabilities in modern JavaScript libraries and advocating for preventive security measures.

• YouTube
• 42 minutes
• On-Demand
• Conference Talk

Test Driven Security in the DevOps Pipeline

Learn to implement Test Driven Security in DevOps, focusing on baseline controls, continuous testing, and preventing common vulnerabilities through specific, actionable security practices.

• YouTube
• 42 minutes
• On-Demand
• Conference Talk

Core Rule Set for the Masses

Insights on fine-tuning ModSecurity Core Rule Set for large-scale deployments, reducing false positives, and optimizing web application firewall performance.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

This Old App - A Guide to Renovating Apps for the Cloud

Explore strategies for migrating legacy applications to the cloud, considering various approaches, security implications, and organizational capabilities needed for successful cloud transitions.

• YouTube
• 30 minutes
• On-Demand
• Conference Talk

Beyond Takeover - Attacker's In. Now What?

Explore the aftermath of phishing attacks through a unique research perspective, uncovering attacker behaviors, account takeover dynamics, and essential cybersecurity insights for organizations.

• YouTube
• 49 minutes
• On-Demand
• Conference Talk

Handling of Security Requirements in Software Development Lifecycle

Explore a unified process for handling security requirements in large companies, focusing on SecurityRAT tool for automated requirement management and issue tracking integration.

• YouTube
• 39 minutes
• On-Demand
• Conference Talk

When Molehill Vulnerabilities Become Mountainous Exploits

Explore how seemingly minor vulnerabilities can escalate into major security threats through live demonstrations, emphasizing the importance of comprehensive code scanning and proactive security measures.

• YouTube
• 39 minutes
• On-Demand
• Conference Talk

An Overview of API Underprotection

Explores API security challenges, threats, and emerging technologies. Covers OAuth2, API keys, mobile app security, TLS pinning, and advanced techniques like app hardening and software attestation.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk