OWASP Foundation Courses

Practical Tips for Running a Successful Bug Bounty Program

Practical tips for running a successful bug bounty program, including scope definition, communication strategies, and vulnerability rating. Insights from experienced professionals on managing crowdsourced security testing effectively.

• YouTube
• 52 minutes
• On-Demand
• Free Video

Why Using SMS in Authentication is Risky and Better Alternatives - AppSecUSA 2016

Explore limitations of SMS-based authentication and discover more secure alternatives using push notifications for improved user experience and enhanced security in two-factor authentication.

• YouTube
• 1 hour 2 minutes
• On-Demand
• Free Video

Patterns of Authentication and Self-Announcement in IoT

Explores authentication and self-announcement patterns in IoT, addressing unique security challenges due to physical access, limited computation power, system vulnerabilities, and privacy concerns in various IoT scenarios.

• YouTube
• 47 minutes
• On-Demand
• Free Video

Needle: Finding Issues within iOS Applications

Discover Needle, an open-source framework for streamlined iOS app security assessments. Learn about its modular architecture, capabilities, and how it simplifies vulnerability detection in iOS applications.

• YouTube
• 21 minutes
• On-Demand
• Free Video

Attacking Wearable Device Communication over BLE - When Encryption Is Not Enough

Explores vulnerabilities in Bluetooth Low Energy communication between wearables and mobile apps, highlighting encryption weaknesses and proposing secure design strategies.

• YouTube
• 43 minutes
• On-Demand
• Free Video

Best Practices for Structuring Effective Bug Bounty Programs

Explore best practices for structuring effective bug bounty programs, addressing concerns like security, privacy, and legal issues while maximizing vulnerability identification.

• YouTube
• 55 minutes
• On-Demand
• Free Video

Containerizing Your Security Operations Center

Explore containerizing security operations for improved deployment, maintenance, and collaboration. Learn to build a cloud-based SOC using containers, enhancing visibility and streamlining security workflows.

• YouTube
• 47 minutes
• On-Demand
• Free Video

Scaling Security Assessment for DevOps - Norad Framework Introduction

Learn to scale security assessments for DevOps with Norad, a distributed testing framework. Automate open-source and vendor tools, aggregate results, and develop custom security tests using the SDK.

• YouTube
• 50 minutes
• On-Demand
• Free Video

Practical Tips for Web Application Security in the Age of Agile and DevOps

Practical tips for adapting web application security to agile and DevOps environments, focusing on lightweight controls, visibility, and measuring maturity in modern development practices.

• YouTube
• 53 minutes
• On-Demand
• Free Video

Protect Containerized Applications with System Call Profiling

Explore system call profiling for containerized application security. Learn to develop accurate profiles, monitor runtime behavior, and detect anomalies with low performance overhead and false positives.

• YouTube
• 53 minutes
• On-Demand
• Free Video

Breaking and Fixing Dockerized Environments

Comprehensive analysis of Docker security vulnerabilities and best practices for securing containerized environments, covering image security, runtime protection, and ecosystem tools.

• YouTube
• 57 minutes
• On-Demand
• Free Video

HTTPS and TLS Security Practices - Front Line Insights 2016

Comprehensive overview of modern HTTPS and TLS security practices, covering protocol vulnerabilities, certificate fundamentals, and best practices for implementing strong encryption in web services.

• YouTube
• 1 hour 1 minute
• On-Demand
• Free Video

Everything is Terrible: Building, Configuring, and Securing Software - Three Perspectives

Explore perspectives on building, configuring, and securing software from developers, operations, and security experts. Learn strategies for collaboration, empathy, and optimizing workflows across teams.

• YouTube
• 49 minutes
• On-Demand
• Free Video

Putting an "I" in Code Review - Turning Code Reviewing Interactive - AppSecUSA 2016

Interactive code review techniques using debugging for efficient and effective application security testing, combining penetration testing and code review benefits.

• YouTube
• 43 minutes
• On-Demand
• Free Video

Misconfigured CORS and Web Application Security Challenges

Explore CORS misconfiguration vulnerabilities and the challenges of implementing advanced browser security features, with insights on balancing security and operational complexity.

• YouTube
• 40 minutes
• On-Demand
• Free Video