AppSecUSA 2015
| title | author | length |
|---|---|---|
| Keynote: Cybersecurity Partnership, Technology and Trust | Dr. Phyllis Schneck | 51m |
Department of Homeland Security describes concrete programs: a federal intrusion detection platform Einstein that produces cyber threat indicators, a… | ||
| Keynote: 50 Shades of AppSec | Troy Hunt | 01h 05m |
The AppSec industry is enormously diverse and it only continues to diverge as we put more software into more things with more connections. It’s an industry… | ||
| Keynote: The Moral Imperatives and Challenges for Modern Application Security | Alex Stamos | 46m |
Argues that the vuln‑research‑patch loop fails at scale and that the median new internet user is on a $50 phone in a developing country, not a patched MacBook… | ||
| Ah mom, why do I need to eat my vegetables? | John Pavone | 55m |
Argues that application security succeeds only when integrated into Agile/DevOps with measurable practices: start with an OpenSAM baseline, compute inherent… | ||
| Chimera: Securing a Cloud App Ecosystem with ZAP at Scale | Tim Bach | 45m |
Chimera is a cloud service that runs ZAP plus nikto and nmap on Heroku to scan an AppExchange of roughly 2,800–3,000 apps, handling authenticated scans with an… | ||
| Continuous Cloud Security Automation | Rohit Pitke | 35m |
Claims a client‑server security automation framework that exposes a REST API controller and lets teams add any CLI scanner with a 15 lines of JavaScript… | ||
| QARK: Android App Exploit and SCA Tool | Tushar Dalvi, Tony Trummer | 50m |
A command-line tool called Quick Android Review Kit performs static code analysis plus source-to-sink tracing, runs multiple decompilers to recover Java… | ||
| Going Bananas for Cloud Security: AWS deployment with security_monkey | Patrick Kelley | 37m |
security_monkey monitors and audits dozens of AWS accounts, polling Amazon APIs (boto) and saving revisions to RDS/Postgres so it records every IAM S3 ELB SSL… | ||
| Enterprise-wide SSL Automation w/Lemur + CloudCA | Kevin Glisson | 42m |
Heartbleed forces reissue of hundreds of certificates and reveals no visibility or tooling, so Lemur + CloudCA appear as an orchestration stack that actually… | ||
| Future Banks Live in The Cloud: Building a Usable Cloud with Uncompromising Security | Rob Witoff | 53m |
Coinbase builds on AWS with hardened CoreOS AMIs and Docker containers, keeps 99% cold air-gapped storage and root tokens in safes, and burns hosts on… | ||
| Turtles All the Way Down: Storing Secrets in the Cloud and the Data Center | Daniel Somerfield | 48m |
Argues that storing secrets needs concrete choices not buzzwords and that the bootstrapping problem is unsolved but can be isolated into stages he calls… | ||
| Building your own large scale web security scanning infrastructure in 40 minutes | Bishan Kochar, Albert Yu | 39m |
Repository delivers a working, open source web scanner implemented in Go (two‑month port) that uses DOM rendering with PhantomJS, HTML Simhash deduplication… | ||
| 'SecureMe Droid' Android Security Application | Vishal Asthana, Abhineet Jayaraj | 47m |
An Android app called SecureMe Droid checks installed apps against the NVD CVE XML database to notify users of known vulnerabilities by matching app name… | ||
| Detecting and managing bot activity more efficiently | David Senecal | 54m |
Akamai claims visibility over 15–30% of global web traffic and reports concrete case numbers: a ticketing site shows ~30% bot traffic, an e‑commerce site ~43%… | ||
| Game of Hacks: The Mother of All Honeypots | Igor Matlin | 43m |
A viral Node.js honeypot runs for six months and records every live exploit against a quiz game that draws 200K users in 2 weeks and 35K in 24 hours… | ||
| A New Ontology of Unwanted Web Automation | Colin Watson | 44m |
A concrete ontology of unwanted web automation is published as an OWASP project and a short handbook, claiming a distilled set of about 20 threat types derived… | ||
| Secure Authentication without the Need for Passwords | Don Malloy | 27m |
Claims that behavioral biometrics using keystroke timing only can remove passwords and scale as a frictionless second factor, backed by numbers — 665 million… | ||
| Sinking Your Hooks in Applications | Richard Meester, Joe Rozner | 44m |
Claims automatic runtime hardening works without source changes and shows it with code: a Java agent with Javassist that rewrites bytecode to block script… | ||
| PHP Security, Redefined | Chris Cornutt | 43m |
PHP claims actual security progress: over 80% of the web runs PHP and WordPress covers 58% of CMS sites, PHP 5.5+ adds native password_hash and… | ||
| Modern Malvertising and Malware web-based exploit campaigns | James Pleger | 54m |
Walkthrough shows a real malvertising chain: ad creatives or iframes redirect to a traffic distribution system that rotates targets via a simple rotator PHP… | ||
| Wait, Wait! Don't pwn Me! | Joshua Corman, Shannon Lietz, Mark Miller, Jacob West | 38m |
A live quiz format mines recent AppSec news and gives concrete takeaways: Ashley Madison breach — CEO resigns in 10 days, Volkswagen emissions scandal — CEO… | ||
| AppSensor: Real-Time Event Detection and Response | John Melton | 49m |
AppSensor claims to put detection and automated response inside applications with a free v2 reference implementation and a clear architecture: apps emit events… | ||
| New Methods in Automated XSS Detection | Ken Belva | 41m |
Claim is that automated XSS detection no longer relies on static payload signatures but on traced character tables built by mapping input to output and testing… | ||
| Hack the Cloud Hack the Company: the Cloud Impact on Enterprise Security | Kevin Dunn | 56m |
Attacker‑modeled penetration tests show cloud services becoming easy pivots rather than safe havens: simple Excel macro payload and targeted spearphishing… | ||
| nothing matches | ||