OWASP Foundation Courses

The State of Secure DevOps - Security Enables Velocity

Explore how integrating security into software development enhances organizational performance, drives velocity, and fosters collaborative cultures. Learn key metrics and strategies for successful transformation.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

OpenCRE.org - Universal Translator for Security Standards

OpenCRE.org connects security standards, documentation, and tooling, serving as a universal translator for various roles in application security. It links topics across multiple standards and provides a comprehensive guide.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Level Up Your Security Champions Program - Enhancing Application Security

Enhance your security champions program with clear roles, mentorship, feedback, and metrics. Learn strategies to address common challenges and demonstrate value to leadership.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

How to Avoid Potholes When Scaling Your Application Security Program

Learn strategies for building and scaling an effective application security program in large or rapidly growing organizations, focusing on maturity levels, hiring, tool optimization, and vulnerability management.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Bootstrap Your Software Security with OWASP SAMM 2.1

Discover OWASP SAMM 2.1, a framework for analyzing and enhancing secure development lifecycles. Learn its application, assessment tools, and new self-paced training to improve your organization's software security practices.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

Rethinking "Shift Left" in Software Security

Exploring the limitations of "shift left" in software security and proposing a new approach to integrate it as part of a broader management strategy for improved application security.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Moving Forward by Looking Back - Data Collection and Analysis at OWASP

Explore OWASP's data-driven approach to information security, leveraging past insights for future improvements. Learn about centralized data collection, analysis, and visualization techniques to enhance organizational security practices.

• YouTube
• 41 minutes
• Self-Paced
• Free Video

Influencing Without Authority - Foundations of a Successful Security Department of Yes

Learn strategies to transform security teams into collaborative partners, driving adoption of best practices through influence and empowerment rather than obstruction, applicable to organizations of all sizes.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

New Web Platform Security Features to Protect Modern Web Applications

Learn how modern browser features can protect web applications from common high-risk vulnerabilities such as XSS, CSRF, and Spectre-related threats.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

NOSQL Web Application Vulnerabilities and Mitigation

Examina cómo las aplicaciones web basadas en NoSQL pueden sufrir inyecciones y CSRF, y qué medidas ayudan a mitigar esas vulnerabilidades.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

OWASP Serverless Top 10 - Security Risks and Protections

A look at how serverless changes application security risks, with defenses for the OWASP Serverless Top 10 and a vulnerable app for illustration.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

The How and Why of the OWASP Top Ten 2021

Explore how data from more than half a million applications informed the OWASP Top Ten 2021, and what that analysis can and cannot reveal.

• YouTube
• 50 minutes
• Self-Paced
• Free Video

Data at Rest Encryption - Addressing Modern Attacks Beyond the Basics

Explains why common low-level encryption for stored data falls short, and compares application- and field-level approaches to protect against modern attacks.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Automating Architectural Risk Analysis with Open Threat Model Format

Learn how Infrastructure as Code and the Open Threat Model format can automate architectural risk analysis and bring threat modeling into DevSecOps workflows.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Data-Driven AppSec Champions Programs - Benchmarking Your Program with Numbers

Survey findings benchmark AppSec champions programs, highlighting how organizations recruit, train, and communicate with champions and measure program returns.

• YouTube
• 28 minutes
• Self-Paced
• Free Video