AppSec USA 2017
2017-09-19..2017-09-22
Orlando, United States
| title | author | length |
|---|---|---|
| Building a Culture of Security at The New York Times | Runa A. Sandvik | 44m |
The New York Times runs security with a three-person InfoSec group protecting ~1,300 reporters and 3.3M paid subscribers by mixing policy and hands-on… | ||
| Fixing Threat Models with OWASP Efforts | Tony UcedaVelez | 43m |
Enterprises run on broken threat models: a federal SCAP/Oval rollout never fully adopted across ~1,000,000 nodes and a commercial insurer loses ~$650,000/hour… | ||
| Passive Fingerprinting of HTTP/2 Clients | Elad Shuster | 38m |
Akamai analyzes 10 million HTTP/2 connections and extracts fingerprints for over 40,000 user agents across hundreds of implementations, using defaults sent at… | ||
| Bug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation | Michael Gallagher, Cassio Goldschmidt, Sean Martin, Sean Melia, Michael Stoker | 50m |
Start a program start private with vetted researchers (HackerOne/Bugcrowd can supply invite lists), define tight scope and SLAs, and use a platform or managed… | ||
| Differences Between Web Application Scanning Tools when Scanning for XSS and SQLi | Robert Feeney | 40m |
Controlled tests pit two open source scanners and two commercial styles (one automated, one proxy) against four vulnerable apps and measure SQLi and XSS… | ||
| Crafting the next-generation Man-in-the-Browser Trojan | Pedro Fortuna | 54m |
A proof-of-concept MITB is implemented as a Chrome extension (built from Zeus code) that uses the webRequest API to remove headers (CSP/HPKP/HSTS), injects… | ||
| NoSQL Is Not NoVulnerable | Johannes Ullrich | 35m |
NoSQL systems often ship without fine-grained controls and get widely scanned and abused: honeypots see thousands of Elasticsearch/MongoDB probes per day and… | ||
| Cookie Security Myths and Misconceptions | David Johansson | 49m |
Explains concrete failures and fixes: shows a live MITM that overwrites a Secure cookie to bypass a double-submit CSRF token, runs a JavaScript demo that uses… | ||
| Friday the 13th: Attacking JSON | Alvaro Munoz, Oleksandr Mirosh | 41m |
Shows concrete RCE chains against Java and .NET JSON parsers by abusing type discriminators and setter calls, with working ObjectDataProvider gadget that… | ||
| ReproNow: Save time Reproducing and Triaging Security bugs | Vinayendra Nataraja, Lakshmi Sudheer | 44m |
Open-source browser extension that records screen plus HTTP traffic, packages the network JSON inside an MKV so a single file embeds network JSON into MKV, and… | ||
| HUNT: Data Driven Web Hacking & Manual Testing | JP Villanueva | 44m |
HUNT is a Burp extension that converts Bugcrowd bounty data into parameter-level alerts so manual testers get concrete places to look instead of vague topics… | ||
| Where we’re going… we won’t need passwords | Matt Hajda, Michael Stewart | 30m |
Claims enterprise rollout of passwordless-style access for a 30,000+ workforce by centralizing authentication, retrofitting legacy apps and using pragmatic… | ||
| Building Secure ASP.NET Core MVC Applications | Niels Tanis | 32m |
Shows that ASP.NET Core MVC defaults reduce common mistakes but require explicit fixes: controllers are convention‑discovered, model binding enables… | ||
| What We Learned Remediating XSS in GitHub Open Source Projects | Mike Fauzy, Demetria Robertson | 49m |
Built an automated remediation tool that targets XSS in JSPs across GitHub open-source repositories, downloading ~160,000 repos and isolating thousands of JSP… | ||
| A Static Tainting Analysis Method for Aspect-Oriented Programs | Evan H. Dygert | 37m |
Introduces a static tainting method that finds where untrusted inputs flow into sensitive sinks in AspectJ-style code by building an interprocedural… | ||
| iGoat: A Self Learning Tool for iOS App Pentesting and Security | Swaroop Yermalkar | 26m |
An open‑source iOS training app teaches specific exploits and fixes: a client‑server iGoat with lessons that demonstrate plaintext local storage, hard‑coded… | ||
| Enhancing Physical Perimeter Defense Using SDR | Yitao Wang | 24m |
Prototype uses a bladeRF to run a short‑range fake GSM BTS that forces phones to 2G, powers up intermittently (uploader notes 30s on/30m off; demo cycles… | ||
| Black-Box Approximate Taint Tracking by Utilizing Data Partitioning | Boris Chen | 36m |
Proposes a black-box system that observes HTTP inputs and parsed outputs (SQL, JSON, CSV, shell) and flags cases where input partitions appear in multiple… | ||
| How To Approach InfoSec Like a Fed(eral Auditor) | Scott Cutler | 37m |
Explains how FIPS 140-2 and Common Criteria translate to five concrete practices: define security boundary down to every physical port and logical interface… | ||
| There’s a new sheriff in town; dynamic security group recommendations with Grouper and Dredge | Kevin Glisson | 31m |
Grouper ingests application metadata and, via Dredge mapping VPC flow logs to live instances, generates concrete AWS security group recommendations (tighten… | ||
| Androsia: A tool for securing in memory sensitive data | Samit Anwer | 38m |
A bytecode tool named Androsia finds precise last-use points for sensitive in-memory objects in Android apps and rewrites app code to clear them immediately… | ||
| Federated Login CSRF | Murali Vadakke Puthanveetil | 30m |
A multi-tenant cloud app allows an attacker to sign up a tenant, federate a malicious IdP, obtain an ID token for the attacker, and force a victim’s browser to… | ||
| An Agile Framework for Building GDPR Requirements into SDLC | Mina Miri | 35m |
Claims a vendor-agnostic, tag-based toolkit that encodes GDPR clauses into 14 tag classes and variants, mapping articles (e.g., Article 7 consent/withdrawal… | ||
| WAFs FTW! A modern devops approach to security testing your WAF | Christian Peron, Chaim Sanders, Zack Allen | 33m |
An open-source test harness called FTW automates quantitative WAF evaluation: tests are written in a readable YAML test format and executed via pytest against… | ||
| Leveraging Blockchain for Identity and Authentication in IoT is good for Security | Donald Malloy | 37m |
Argues that IoT identity should be a hash on a distributed ledger so personal data never leaves the device; claims an app hashes ID and verifies it against a… | ||
| Juggling the Elephants: Making AppSec a Continuous Program | Tony Miller | 46m |
Presents a repeatable Continuous AppSec Model: build an application portfolio profiling that scores 500+ apps objectively (Excel or Archer questionnaires), use… | ||
| An Overview of API Underprotection | Richard Taylor | 37m |
OWASP flags “underprotected APIs” and Gartner predicts a majority of mobile breaches through 2019 exploit app–server communication. Real cases: Pokemon Go… | ||
| Measuring End-to-End Security Engineering | Davit Mirzoyan, Garrett Held | 34m |
Twilio formalizes "End to End Security Engineering" by defining a perfect secure system and turning threat models into measurable artifacts: % of products… | ||
| Making Vulnerability Management Less Painful with OWASP DefectDojo | Greg Anderson | 40m |
DefectDojo centralizes scanner output (Nessus, ZAP, Qualys, OpenVAS) and ticket systems (JIRA) to automate consolidation, reporting and metrics; it moves teams… | ||
| How to detect CSRF vulnerability, reliably? | Umesh Salian | 42m |
Scans with Arachne, ZAP and a commercial scanner repeatedly detect reflected XSS but fail CSRF: Arachne gives false negatives, ZAP gives false positives, the… | ||
| When Molehill Vulnerabilities Become Mountainous Exploits | Matt Rose | 39m |
Live demo shows an Android money‑manager app whose world‑readable DB and a static encryption key — both rated medium — let a separate exploit app decrypt… | ||
| Popular Approaches to Preventing Code Injection Attacks are Dangerously Wrong | John Matthew Holt | 46m |
Claims a JVM runtime hardening called Name Space Layout Randomization that renames JRE packages on each boot so injected class files cannot reference… | ||
| Securing C code that seems to work just fine | Jonathan Foote | 29m |
Fastly builds an MVP self-service fuzzing pipeline that runs persistent fuzzers against private C repos (edge HTTP/2 services and a varnish-cache fork)… | ||
| Beyond Takeover: Attacker’s in. Now what? | Itsik Mantin | 49m |
Maintains 57 fake identities for six months, feeds their credentials into live phishing kits and public phishing-as-a-service feeds, and monitors hits with… | ||
| Handling of Security Requirements in Software Development Lifecycle | Rene Reuter | 39m |
A unified process and an open source tool called SecurityRAT maps ASVS to artifact properties and reduces 182 ASVS items to 107 requirements for a given… | ||
| Embedding GDPR into the SDLC | Steven Wierckx | 44m |
Maps GDPR articles to concrete SDLC actions and shows which artifacts change: Privacy Impact Assessment becomes a formal step in risk analysis, DPO sits on… | ||
| This Old App, a guide to renovating apps for the cloud | Christian Price, Christopher J. Wells | 30m |
Migrating a legacy app to the cloud requires concrete choices not platitudes: compare lift-and-shift (fast but brittle, risks lost session state and hidden… | ||
| Core Rule Set for the Masses | Tin Zaw | 37m |
Verizon Edgecast documents running ModSecurity + OWASP CRS across thousands of servers in 100+ locations, migrating from CRS 2.2.9 to 3.0 and using paranoia… | ||
| Test Driven Security in the DevOps pipeline | Julien Vehent | 42m |
Mozilla codifies a security baseline, embeds tests in CI/CD and blocks deploys that fail automated checks. Tooling includes headless OWASP ZAP in Docker with a… | ||
| Monitoring Application Attack Surface and Integrating Security into DevOps | Dan Cornell | 48m |
Claims a reproducible way to calculate a web app’s attack surface, funded by DHS, by merging static and dynamic results into a hybrid analysis mapping engine… | ||
| Leveraging the ASVS in the Secure SDLC | Derek Fisher | 38m |
Cerner uses OWASP ASVS v3 verification statements, rewrites them into four control types (functional, process, DevOps, tech‑design), and produces ~240 controls… | ||
| Top 10 Security Best Practices to secure your Microservices | Chintan Jain | 38m |
Ten concrete defenses: enforce TLS 1.2 with strong cipher suites; authenticate with short‑lived certs, mutual TLS, OAuth/OIDC and JWTs; do fine‑grained… | ||
| How to stop worring about application Container security | Brian Andrzejewski | 38m |
USCIS runs 30 microservices in production today with a plan for ~200 in a year and processes 7.6M applications annually; the team moves security left with… | ||
| Secure Product Lifecycle (SPLC) as a Service | Julia Knecht, Taylor Lobb | 34m |
Adobe builds a centralized automation platform that runs code scans on commit or on a schedule, parses results, injects findings into JIRA, and mails concise… | ||
| Moving Fast and Securing Things | Zachary Pritchard, Fikrie Yunaz | 42m |
Slack describes a Secure Development Lifecycle that scales a three-person product security team to thousands of engineers by shipping a self-service assessment… | ||
| Beyond End to End Encryption | Tom Leavy | 44m |
[SALVAGED BAD SOUND VERSION - SORRY!]
Beyond End-to-End Encryption: Threats Models For Secure Messaging
In an age of ever more sophisticated cybercrime and… | ||
| Capture the Flag for Developers | Mark Hoopes | 46m |
Argues that hands-on CTF events beat lectures for retention and gives concrete how‑to: avoid testing production code, deploy use cloud VMs per team (AWS VPC… | ||
| Practical Dynamic Application Security Testing within an Enterprise | Nicholas Doell, Nicholas Kenney | 33m |
Describes a Java-based scanner integrated into CI/CD and a RESTful API that delegates work to containers running passive scans, ingesting URLs from… | ||
| Building a Secure DevOps Pipeline | Aaron Weaver | 43m |
Shows how a security pipeline that normalizes scanner output into a central vulnerability DB and uses REST APIs, Docker, ZAP and Jenkins to weaponize Jenkins… | ||
| Supply Chain Anarchy - Trojaned Binaries in the Java Ecosystem | Jeff Williams | 37m |
Claims an automated pipeline that matches repositories, builds code, and runs a security diff across Java libraries, tolerating compiler noise so only real… | ||
| Automating TLS Configuration Verification | Steven Danneman | 31m |
Builds and releases TLS checks by adding Postgres and MySQL startTLS detection to testssl.sh, scans MySQL PostgreSQL and MongoDB defaults, and reports that… | ||
| nothing matches | ||