Security Does Not Need to Be Fun: Ignoring OWASP to Have a Terrible Time
summary
OWASP documents 242 projects (about 155 usable) with 18 flagships, 36 labs and 114 incubators, and maps many tools to the SDLC so teams can act instead of panicking. Practical steps: start with the Top 10 to cut 80–90% of common attacks, run Juice Shop as a deliberately broken app for hands‑on training, exercise the ZAP HUD to surface real alerts, and use SecureFlag or CycloneDX and OpenCRE to automate checks and trace dependencies.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:02What is good security
- 3:08All unhappy families look alike
- 4:40Security teams are way outnumbered
- 5:26Congratulations devops team
- 6:10OASP
- 7:11Projects
- 10:00Other Projects
- 11:18OAS
- 12:40Education
- 13:53Resources
- 14:17Who is this for
- 15:23The Top Ten
- 18:03Cheat Sheets
- 18:50Web Goat
- 21:56Zap
- 24:49Why are there not more people in this room
related talks
27mSecurity Does Not Need to Be Fun: Ignoring OWASP to Have a Terrible Time
36mApp Security Does Not Need To Be Fun: Ignoring OWASP To Have A Terrible Time
38mFree security resources that your competitors use!
45mLeveraging Projects and Tools to Transform Your SDLC
27mHow to Start Security Testing Without Fear
57mThe Developer's Field Guide to Software Security
38mFrom Zero To Hero - Or How OWASP Saved My Holiday
42mBuilding an AppSec Program with a Budget of $0: Beyond the OWASP Top 10