The Path of Secure Software
summary
Starts from OWASP ASVS and the OWASP Proactive Controls, maps specific defenses to Top 10 risks: use PreparedStatement parameter binding to stop SQL injection, validate all input (including DB-sourced) to prevent second‑order injection, apply contextual encoding with the OWASP Java Encoder to prevent XSS, enable HSTS and AES for transport/rest confidentiality, record the six intrusion indicators in logs, and automate vulnerable‑component checks with dependency-check against the NVD. Concrete examples include slot‑machine RNG failures, Ashley Madison and Equifax breaches.
AI-written summary · about
chapters (25)
- 0:00Intro
- 1:55OWASP Top 10 Risks 2017 - RC2
- 3:43Cyber attacks
- 5:39OWASP Application Security Verification Standard
- 7:51Verify for Security Early and Often
- 10:30Parameterize Queries
- 12:19XSS Payloads
- 14:05Encode Your Output DO YOU WANT RSS
- 14:53Contextual Encoding OWASP Java Encoder Project
- 15:39Example of Validations
- 16:122nd Order SQL Injection Example
- 17:41Vulnerabilities Addressed - All Top10!
- 18:15Implement Authentication Controls
- 19:03Strong cryptographic algorithms
- 20:52Secure Password Storage
- 21:47C5. Password Storage - How Not To Do It!
- 23:27Implement Appropriate Access Controls
- 25:44Implement Logging and Intrusion Detection
- 26:44Examples of Intrusion Detection Points
- 29:31Vulnerabilities Addressed - All Top 10!
- 31:27Unmanaged 3rd Party Components
- 36:56Design Patterns for Integration
- 38:52Best Practices
- 40:18Don't leak information
- 44:25Project Page
related talks
58m: The OWASP Top Ten Proactive Controls 2018
53mOWASP Top Ten Proactive Controls
45mOWASP for Developers
52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVS
41mSecurity Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities
01h 01mTop Ten Proactive Web Application Controls
43mSecurity Vulnerabilities Decomposition: Another way to look at Vulnerabilities
01h 30mCommon Webapp Vulnerabilities and What to Do About Them