OWASP Foundation Courses

Nemo Resideo - Managing Application Security Through Rapid Change

Discover strategies for managing application security in rapidly evolving environments through expert insights on adapting security practices to constant technological change.

• YouTube
• 50 minutes
• Self-Paced
• Free Video

Mobile Application Security: OWASP MAS Developments and MASWE Introduction

Explore OWASP Mobile Application Security developments with project leaders as they introduce MASWE concepts, demonstrate analysis techniques, and showcase new test apps designed to enhance mobile security testing and vulnerability detection.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

The Next 25 Years of OWASP

Explore OWASP's 25-year journey, achievements, challenges, and future vision with Andrew van der Stock's perspective on what remains to be done in web application security.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

AI Under the Hood: Unmasking Hidden Threats

Explore a meta-analysis of 14 AI threat modeling frameworks, offering streamlined questions for AI/ML threat analysis and discussing how expert review refined this library for seamless integration into manual analysis.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

Learning from Past Security Breaches: Strengthening AppSec Efforts and Focus

Explore real-world security breaches to understand proactive AppSec measures and effective post-incident remediation strategies for improving organizational resilience against future attacks.

• YouTube
• 33 minutes
• Self-Paced
• Free Video

An Exploration of Container Escapes - Improving Security with Behavior Analysis

Explore innovative approaches to container security using behavior analysis during CI testing to generate native policies for Kubernetes, replacing manual definitions with automated, effective protection mechanisms.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

The Missing Link - How to Collect and Leverage SBOMs

Discover how to collect and leverage Software Bill of Materials (SBOMs) for enhanced vulnerability management, with real-world examples from Log4j and OpenSSL incidents.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Automatic Application Hardening by Leveraging Container Runtime Behavior Analysis

Discover how to improve containerized application security through runtime behavior analysis during CI processes, generating native policies for Kubernetes without third-party tools.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

Practical Software Supply Chain Security Solutions

Discover practical strategies to defend against software supply chain attacks, including repo jacking, poisoning, typo squatting, and dependency confusion, as threats from nation states and ransomware gangs increase.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Maturing Your Application Security Program with ASVS-Driven Development

Discover how to mature your application security program using ASVS-driven development, turning security requirements into automated test cases and creating a common language across the SDLC.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

5 Steps to VEX Success: Managing the End-to-End Workflow

Discover how to implement VEX (Vulnerability Exploitability eXchange) effectively through a five-step workflow to combat CVE overload and streamline vulnerability remediation in your organization.

• YouTube
• 48 minutes
• Self-Paced
• Free Video

AI Code Generation - Benefits, Risks and Mitigation Controls

Explore the benefits and risks of AI code generation tools, including security vulnerabilities, quality issues, and potential biases, while learning effective mitigation strategies for safe implementation.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

Self-Discovering API Key Permissions and Resources

Discover a new method for enumerating API key permissions and resources without accessing provider UIs. Learn to assess SaaS provider permissions through string analysis and HTTP request techniques, with a demo of an open-source automation tool.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

Escaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams

Discover practical solutions to "Vulnerability Hell" through AI, penetration testing, and improved collaboration between developers and security teams for more effective web application security.

• YouTube
• 1 hour 6 minutes
• Self-Paced
• Free Video

Striding Your Way to LINDDUN: Threat Modeling for Privacy

Explore the LINDDUN privacy threat modeling framework to identify, analyze, and mitigate privacy risks in software systems, enabling privacy by design through a practical demonstration with a fictional application.

• YouTube
• 48 minutes
• Self-Paced
• Free Video