OWASP Foundation Courses

AppSec - From Outsiders to Allies

A keynote tracing application security’s evolution and explaining how security teams and developers can become allies through shared accountability and better development processes.

• YouTube
• 56 minutes
• Self-Paced
• Conference Talk

Extending WAFs at the Application Layer

Extend web application security at the application layer with Sanwaf, using data sanitization, configurable datatypes, regular expressions, filtering, and logging.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Social Media Botnet Detection with Linkage Analysis and Machine Learning

Explore how linkage analysis and machine learning can detect spam botnets across social media.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Why Developers Struggle with AppSec

Why developers struggle with AppSec, from trust and production bias to developer-native tools and the case for addressing security before production.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Supplier Risk - Where OSS Collides With Vendor Management

Explores how open-source software creates supplier-management risks through maintenance gaps, concentration, transparency, regulatory mandates, and potential sabotage.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Yes, You Too Can Break Crypto - Exploiting Common Crypto Mistakes

Explore common cryptographic mistakes through XOR, randomness, one-time pads, stream and block ciphers, integrity, and authenticated encryption.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

Real Time Vulnerability Alerting by Using Principles from the United States Tsunami Warning Center

Applies tsunami warning center principles to real-time cybersecurity vulnerability alerting and prioritization.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

OWASP SAMM 2 - Your Dynamic Software Security Journey

Learn how OWASP SAMM 2 uses maturity levels, scoring, assessment tools, and dashboards to guide a dynamic software security improvement journey.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Magecart 2020 - The New Face of XSS

Examines Magecart as a new form of XSS, covering injection techniques, payment skimmer case studies, attack complexity, and prevention.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

MLSec Going Deeper

Explore adversarial attacks on machine-learning models, from attack procedures to adversarial training and robustness tools.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Enabling Message Level Protection at Uber

Explores Uber’s field-level encryption architecture, including envelope encryption, ciphertext schemas, encrypted search, and support for legacy flows.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

Application Logging in the Era of GDPR

Learn how GDPR principles shape application logging, data classification, and security practices for production logs.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Insider Threat Detection & Automation by Behaviour Analytics

Explore insider threat detection through behavior analytics, UEBA, anomaly analysis, statistical models, and data-driven use cases.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk

A Dancefloor that is Literally Just Banana Peels - AppSec Awareness Program Pitfalls

An experience-based guide to avoiding common mistakes when designing and implementing an Application Security awareness program.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Before It's Out the Door - Securing Outbound Open Source

Learn how to establish open source governance and security practices, review code, prepare releases, and protect projects before software goes out the door.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk