Top Ten Proactive Controls

on YouTube ↗50m

" summary

The OWASP Proactive Controls lists concrete, testable requirements: adopt query parameterization to eliminate SQL injection, stop using fast salted hashes alone (GPU rigs can try ~50 billion guesses per second) and instead use HMAC-based password service or pbkdf2/scrypt/bcrypt, enable multifactor authentication and out‑of‑band reset tokens instead of fragile email links, use Google Keyczar or proper crypto libraries, prefer capability‑style access control (Apache Shiro), apply contextual output encoders and HTML sanitizers, and embed intrusion sensors (AppSensor) and certificate pinning to harden TLS.

AI-written summary · about

" chapters (24)

1. 0:00Intro
2. 0:22WARNING
3. 3:14Security Architecture and Design
4. 5:18Security Requirements (SDLC) Functional requirements
5. 10:22OWASP Java Encoder Project orgindex.php OWASP Java Encoder Project
6. 10:59Password Defenses
7. 14:46Leverage Keyed Functions
8. 18:47Multi Factor Authentication
9. 19:53Forgot Password Secure Design
10. 22:49Access Control Anti-Patterns
11. 23:14Most Coders Hard-Code Roles in Code
12. 27:03Solving Real World Access Control Problems with the Apache Shiro
13. 28:09Anatomy of a SQL Injection Attack
14. 28:43Query Parameterization (PHP PDO)
15. 29:35Query Parameterization (PERL DBI)
16. 31:57Anatomy of a XSS Attack
17. 32:54Contextual Output Encoding (XSS Defense)
18. 35:36Other Encoding Libraries
19. 37:50Solving Real World Problems with the OWASP HTML Sanitizer Project
20. 39:45Encryption in Transit (HTTPS/TLS)
21. 41:06Fixing the TLS and the Certificate Authority System
22. 45:22Solving Real World Crypto Storage Problems With Google KeyCzar
23. 46:34App Layer Intrusion Detection
24. 48:35OWASP AppSensor (Java)

" related talks

• 01h 01mTop Ten Proactive Web Application ControlsJim Manico · AppSec California 2014
• 53mOWASP Top Ten Proactive ControlsJim Manico · AppSec California 2015
• 58m: The OWASP Top Ten Proactive Controls 2018Jim Manico · NDC London 2020
• 46mThe Path of Secure SoftwareKaty Anton · Devoxx Belgium 2017
• 53mOWASP Top 10: What are them and how to prevent themAyesh Karunaratne · DrupalCon Amsterdam 2019
• 54m10 commandments of secure codingW. Dworakowski · 4Developers 2015
• 26mStop Hitting Yourself: How to Prevent Common Attacks to your ApplicationMike Arsenault · Commit Your Code 2025
• 41mFrom the OWASP Top Ten(s) to the OWASP ASVSPhilippe De Ryck · GOTO Berlin 2018