OWASP Foundation Courses

All Our APIs Are Belong to Us

Explores Snapchat's strategies to protect users from third-party API abuse, detailing server-side and client-side defenses, their effectiveness, and lessons learned in the ongoing security challenge.

• YouTube
• 53 minutes
• Self-Paced
• Conference Talk

Closing the Security Talent Gap

Practical strategies to address the growing security talent gap, including partnerships with academia, promoting security in job roles, and fostering diversity in the field.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

5 Steps to Drive Enterprise Software Security

Learn a disciplined five-step approach to implement enterprise-wide software security initiatives, addressing organizational challenges and ensuring productive application security efforts.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Myths of Threat Modeling - AppSec California

Debunking common misconceptions about threat modeling in software security, providing insights to initiate and improve this crucial design activity for better application protection.

• YouTube
• 55 minutes
• Self-Paced
• Conference Talk

To Bounty or Not to Bounty - Security@ Insights from 500 Organizations

Insights from 500 organizations on vulnerability disclosure programs, analyzing key factors for success and providing a framework to assess program performance and impact.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

Sinking Your Hooks in Applications

Techniques for automatically enhancing application security through code hooking and injection, demonstrated across Java, .NET, and Ruby frameworks without requiring developer intervention.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

The Node.js Highway - Attacks Are At Full Throttle

Explore Node.js security vulnerabilities, attack vectors, and best practices for safeguarding applications in this comprehensive overview of potential threats and defensive strategies.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Client-Side Protection Against DOM-Based XSS Done Right

Comprehensive overview of client-side protection against DOM-based XSS attacks, covering vulnerabilities, prevention techniques, and practical solutions for web security professionals.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Windows Phone App Security for Builders and Breakers

Explore Windows Phone app security for developers and testers, covering encryption, secure data handling, and protection against common vulnerabilities and attacks.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

Security DevOps - Staying Secure in Agile Projects

Explore security integration in agile projects through dynamic depth, static depth, intensity, and consolidation axes. Learn practical DevOps techniques for maintaining security throughout development.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Lessons From DevOps - Taking DevOps Practices Into Your AppSec Life

Explore DevOps practices for enhancing application security, including workflow optimization, improved feedback loops, and automation techniques to streamline AppSec processes.

• YouTube
• 45 minutes
• Self-Paced
• Conference Talk

Securing the Internet of Things

Explore IoT security challenges and solutions, covering smart devices, common verticals, technologies, and key vulnerabilities in this comprehensive talk on securing the Internet of Things.

• YouTube
• 48 minutes
• Self-Paced
• Conference Talk

Building an AppSec Pipeline - Keeping Your Program, and Your Life, Sane

Learn to build an efficient AppSec pipeline to streamline your security program, improve workflow, and enhance overall productivity in application security management.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Scaling Security in Agile Scrum

Learn strategies for integrating security into Agile Scrum development, optimizing interactions between security and engineering teams, and fostering in-house security expertise for efficient monthly releases.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

The Emperor’s New Password Manager - Security Analysis of Web-based Password Managers

Security analysis of web-based password managers, revealing vulnerabilities in features like one-time passwords and bookmarklets. Explores diverse root causes and provides guidance for improving password manager security.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk