Conference Talks

OWASP Foundation

Practical Dynamic Application Security Testing within an Enterprise

Practical implementation of dynamic application security testing in enterprise DevOps, showcasing CI/CD pipeline integration and large-scale scanning methods for enhanced security coverage.

• YouTube
• 33 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Moving Fast and Securing Things

Discover how Slack balances rapid development with robust security through an innovative Secure Development Lifecycle process, featuring self-service tools and chat-based workflows that foster a security mindset among developers.

• YouTube
• 42 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Building a Culture of Security at The New York Times

Insights on building a culture of security at The New York Times, focusing on adapting to new challenges, fostering collaboration, and implementing practical strategies for newsroom protection.

• YouTube
• 44 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Common REST API Security Pitfalls

Explore common REST API security pitfalls, their root causes, and best practices for protection. Learn to assess and improve API security for robust, future-proof applications.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Don't Trust the DOM - Bypassing XSS Mitigations via Script Gadgets

Explores novel XSS attack technique using script gadgets to bypass mitigations, demonstrating vulnerabilities in modern JavaScript libraries and advocating for preventive security measures.

• YouTube
• 42 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Test Driven Security in the DevOps Pipeline

Learn to implement Test Driven Security in DevOps, focusing on baseline controls, continuous testing, and preventing common vulnerabilities through specific, actionable security practices.

• YouTube
• 42 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Handling of Security Requirements in Software Development Lifecycle

Explore a unified process for handling security requirements in large companies, focusing on SecurityRAT tool for automated requirement management and issue tracking integration.

• YouTube
• 39 minutes
• On-Demand
• Conference Talk

OWASP Foundation

An Overview of API Underprotection

Explores API security challenges, threats, and emerging technologies. Covers OAuth2, API keys, mobile app security, TLS pinning, and advanced techniques like app hardening and software attestation.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

OWASP Foundation

WAFs FTW! A Modern DevOps Approach to Security Testing Your WAF

Explore modern DevOps approach to security testing Web Application Firewalls (WAFs) using Framework for Testing WAFs (FTW). Learn objective WAF evaluation, rapid prototyping, and continuous testing strategies.

• YouTube
• 33 minutes
• On-Demand
• Conference Talk

OWASP Foundation

An Agile Framework for Building GDPR Privacy and Data Protection Requirements into SDLC

Agile framework for integrating GDPR privacy and data protection requirements into software development lifecycle, using a tag-based approach to identify and implement necessary features efficiently.

• YouTube
• 35 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Building Secure ASP.NET Core MVC Applications

Explore ASP.NET Core MVC security features, including XSS and CSRF protection. Learn to build robust web applications with modular architecture and cross-platform compatibility.

• YouTube
• 32 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Fixing Broken Enterprise Threat Models with OWASP Efforts - Commissioning AppSec Professionals for Real Change

Explore how OWASP projects can revolutionize enterprise threat modeling, addressing compliance issues, undefined attack surfaces, and risk distortions to create measurable security impact.

• YouTube
• 43 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Crafting the Next-Generation Man-in-the-Browser Trojan

Explore next-gen Man-in-the-Browser trojans, their evolution, and defense strategies. Learn about advanced attack techniques, client-side defenses, and future cybersecurity challenges in this comprehensive talk.

• YouTube
• 54 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Cookie Security - Myths and Misconceptions

Debunking cookie security myths and exploring lesser-known facts about cookie attributes, including recent browser improvements for enhanced web application protection.

• YouTube
• 49 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Differences Between Web Application Scanning Tools When Scanning for XSS and SQLi

Investigates differences between web application scanning tools for XSS and SQLi, addressing challenges in modern web architectures and suggesting improvements for effective vulnerability detection.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk