Global AppSec Dublin 2023
2023-02-15..2023-02-16
Dublin, Ireland
as the organisers put it
Global AppSec Dublin 2023 on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
who it's for
application security engineers, developers, security engineers, devops engineers, security managers, mobile developers
topics
privacy threat modeling; AI-assisted coding security; api penetration testing techniques; runtime application self-protection (RASP); serverless application security; mobile app security and MASVS; supply chain security with Dependency Track; OpenSSL implementation issues; Kubernetes cluster scanning results; EVM smart contract CFG construction; GitHub Actions vulnerabilities and mitigations; passwordless authentication with WebAuthn and passkeys
| title | author | length |
|---|---|---|
| Opening Remarks | Grant Ongers | 07m |
Huge turnout for the first in‑person unmasked conference with two days of preconference training taught by top instructors, volunteers in bright yellow… | ||
| A Taste Of Privacy Threat Modeling by Kim Wuyts | Kim Wuyts | 51m |
Claims a practical four-step process (what, what can go wrong, fixes, review) and offers the Linden privacy threat modeling knowledge base (trees, cards)… | ||
| Why Winning In Cybersecurity Means Winning More Everyday | Jessica Robinson | 58m |
Focuses on concrete leadership moves and outcomes: an emergency 45-day NYDFS deadline implementation, coordination through a $20bn merger, and a regulator… | ||
| Shifting Security Everywhere | Tanya Janca | 01h 04m |
Argues that shifting left alone fails and shows concrete alternatives: create short one-hour threat models, add lightweight secure design checks to project… | ||
| AI-Assisted Coding: The Future; Between Challenges And Benefits | Magda Chelly | 51m |
Claims that GitHub Copilot and similar tools turn what once takes 34 hours per 1,000 lines into 1,000 lines in 10 minutes, with cost comparisons from developer… | ||
| Hacking And Defending APIs: Red And Blue Make Purple | Matt Tesauro | 53m |
A practical run‑through of an API pentest that names tools and tradeoffs: passive recon, active discovery with local proxies and bruteforcers like Kite Runner… | ||
| Empowering The Guardians Of Your Code Kingdom | Gabriel L. Manor | 43m |
Claims concrete changes: replace weekend credential backdoors with a pull not push deployment model, move final deploy authority into a single GitOps… | ||
| Log Story Short: Chopping Through Forests Of Data | Moti Harmats | 40m |
Monitoring developer error logs yields real vulnerabilities not just noise — a year-long program at Wix parses 5,000 microservices and ~130 TB of logs with a… | ||
| Threat Modeling In And For Your Organization | Izar Tarandach | 58m |
Practical recipe for turning threat modeling into an org program: concrete goals, reproducible process, measurables and templates. Claims a continuous threat… | ||
| "Mobile Wanderlust"! Our Journey To Version 2.0! | Sven Schleier | 43m |
Project announces MAS v2.0 with concrete changes: storage drops from ~15 controls to 2, storage now splits “securely stores sensitive data” and “leakage” with… | ||
| Philosophizing Security In A "Mobile-First" World | Sergiy Yakymchuk | 52m |
Argues that engineering bias misses real threats and gives concrete findings: user error is the single biggest breach cause, apps now carry 80% of online time… | ||
| Don't Let Bug Bounty Kill Your Appsec Posture | Zohar Shchar | 40m |
Company runs app platform with about 5,000 microservices, 20,000 endpoints and ~2,500 developers and builds an internal SQLi detection tool. Bug bounty program… | ||
| OWASP Coraza: The Way To WAF In 2023 | Felipe Zipitria, Juan Pablo Tosso | 55m |
Concrete claims and working demos: a community OWASP WAF library is stable, 40× faster than ModSecurity in Go benchmarks, and 100% compatible with the Core… | ||
| Constructing A Dynamic CFG For EVM Based Smart Contracts | Syue Siang Su | 30m |
Builds a dynamic, execution‑accurate control flow graph for EVM bytecode by running a full gas‑bounded simulation that records jump targets and stack/memory… | ||
| A Weakness In Chrome & A New Hacking Technique | Gil Cohen, Omri Inbar | 48m |
Finds a real Chrome bug that lets CRLF injection in HTTP/2 turn common 301/302 responses into exploitable redirects, builds end-to-end proof of concept and… | ||
| What We've Learned From Scanning 10K+ Kubernetes Clusters | Ben Hirschberg | 51m |
Scans of roughly 17,000 clusters and 40M Kubernetes objects feed the open source Cubescape scanner and Armo platform and reveal concrete, repeatable problems… | ||
| Overcoming The Inundation Of Noisy Security Alerts | Adam Berman | 54m |
Claims that reachability analysis cuts SCA noise by flagging only code paths that touch vulnerable functions and that writing targeted rules plus PR guardrails… | ||
| Preventing Subdomain Takeover /w OWASP Domain Protect | Paul Schwarzenberger | 53m |
OWASP Domain Protect scans Route 53 Cloudflare and GCP DNS, writes findings to DynamoDB and notifies via SNS/Slack, and deploys with Terraform and GitHub… | ||
| Non-traditional Encryption Problems And Solutions | Chuck Willis | 41m |
Covers concrete tradeoffs: FF1 vs FF3-1 for format‑preserving encryption, warns FF1 patent risk and recommends ~1,000,000 effective values; shows FF1 ≈ eight… | ||
| Removing Secrets To Make Your Mobile Apps More MASVS-Secure | Skip Hovsmith | 48m |
Claim: eliminate secrets at rest in mobile apps by moving signing keys and API secrets to a cloud App Authentication Service that issues short-lived JWTs… | ||
| OWASP SERVERLESS TOP 10 | Tal Melamed | 46m |
Clear, actionable takeaways: OWASP Serverless Top 10 lists concrete risks like event injection (e.g. command in an S3 filename) and shows a demo that steals… | ||
| OpenSSL Deep Dive: The Good, Bad And Not-So-Ugly | Dan Murphy, Frank Catucci | 53m |
Deep dive into an OpenSSL post‑release bug shows a 3,133‑line diff that boils down to an off‑by‑one one‑character check in OpenSSL 3.0, requires a client… | ||
| Inc. Your sw Assurance /w OWASP SAMM V2.1 | Seba Deleersnyder, Bart De Win | 55m |
Describes concrete outcomes: release of stream guidance and a practitioner list, tooling pointers like Samwise and the Sami tool, and a formal mapping to NIST… | ||
| Reduce Your Perms. Mgmt. Time While Protecting Your Users | Marine Du Mesnil | 29m |
Project migrates permission logic out of Django into Okta SaaS, Okta SSO for authentication and group-based roles, removes the ad hoc superuser model (team… | ||
| Testability Patterns For Web Apps - A New OWASP Project | Luca Compagna | 53m |
An OWASP project defines concrete testability patterns for SAST (catalogs of ~100+ patterns per language) and a Python framework with Docker that integrates… | ||
| JavaScript Realms: The Blank Spot In Web App Runtime Security | Gal Weizman | 35m |
Web apps have a blind spot: same-origin child realms can evade runtime monkey patches and even import clean prototypes to manipulate the main window, so… | ||
| The Power Of DevSecOps In Web3 And Blockchain | Ken Toler | 52m |
Argues that DevSecOps must be a developer‑first mindset and shows concrete practices: threat modeling hybrid DApp architectures, using chain explorers and Dune… | ||
| How To Have Visibility And Security OF A CICD Pipeline | Pramod Rana | 42m |
Claims an open source tool called CI CD Guard that builds a node and edge graph of pipelines and spots misconfigurations across GitHub repos GitHub Actions… | ||
| Automated Security Testing With OWASP Nettacker | Sam Stepanyan | 56m |
OWASP Nettacker scans IP ranges and subdomains at scale, running modular Python probes (port, subdomain, X‑Powered‑By, vapalizer tech fingerprinting, brute… | ||
| Supply Chain Sec /w Dependency Track | V. Anandan, M. Bhargava, N.J. Duster | 54m |
Shows concrete results not buzz: ingest CycloneDX SBOMs from build tooling, correlate advisories from OSS Index Snyk and Google OSV, and present a full… | ||
| Vulnerabilities Are Ingredients And OWASP Top 10 The Seasoning- Meghan Jacquot | Meghan Jacquot | 53m |
Project Zero raw data shows zero days rising and 67% memory corruption in 2021–22, with ~22% variants and ~50% reworked patched bugs; a 30‑day bug‑bounty… | ||
| Developer Driven Security In High-Growth Environments | Jakub Kaluzny | 43m |
Claims that engineers own security and that a risk assessment takes under five minutes, with product security only handling about 10–20% of reviews. Implements… | ||
| Introducing Threat Modelling To Established Teams | Sarah-Jane Madden | 57m |
Begins with a failed launch: threat modeling as indulgence produces excitement but no fixes, then discovers a concrete list of Jira defects that wouldn’t exist… | ||
| Server Side Prototype Pollution | Gareth Heyes | 41m |
Claims a safe black‑box way to detect server‑side prototype pollution without causing denial‑of‑service by flipping subtle behaviors rather than crashing the… | ||
| Attacking And Protecting Artificial Intelligence | Rob Van Der Veer | 55m |
Launches an OWASP AI security and privacy guide and points to ISO 5338 and dataset/versioning as concrete standards to adopt. Demonstrates real attacks: data… | ||
| Credential Sharing As A Service: The Dark Side Of No Code | Michael Bargury | 54m |
Claims that enterprises accumulate 100,000 apps of local no‑code with thousands of reusable connections that are actually shared refresh tokens, demonstrates… | ||
| Ten DevSecOps Culture Failures | Chris Romero | 43m |
The presenter lists ten concrete DevSecOps failures and gives actionable remedies: replace the infinity graph with explicit pipelines not infinity graphs, use… | ||
| [T]OTPs Are Not As Secure As You Might Believe | Santiago Kantorowicz | 45m |
Short numeric OTPs and typical delivery windows let brute force succeed over time: math and an open‑source simulator show 91% chance in one day for a 4‑digit… | ||
| Passwordless Future: Using WebAuthn And Passkeys In Practice | Clemens Hübner | 59m |
Explains concrete claims and demos: WebAuthn produces a public/private keypair via the browser, a live USB security key demo shows registration and… | ||
| GitHub Actions: Vulnerabilities, Attacks, And Counter-Measures | Magno Logan | 55m |
Shows concrete exploitation: attackers upload actions that run XMrig and mine on Azure VMs, abuse Windows Linux and Mac runners, and automate forked pull… | ||
| More /w Less ScreenTime: An Application Security Toolchain | Spyros Gasteratos | 39m |
A concrete claim: Dracon unifies many open tools into one workflow and actually runs them — tfsec, tfsec-like IaC checks, dependency-check and 3v for… | ||
| Trusting Software: Runtime Protection Is The Third Alternative | Jeff Williams | 59m |
Argues that runtime protection (RASP) instruments apps at load time to add concrete checks — taint tracking, untrusted data boundary enforcement, sandboxing of… | ||
| Narrow – SCA Reachability Analysis Without The Effort | Josiah Bruner | 56m |
Narrow is an open source Python tool that extracts fixes from CVE references (commits and PRs), finds changed functions via patch extraction, builds a static… | ||
| Closing Ceremony | Matt Tesauro | 25m |
OWASP announces a formal name change to Open Worldwide Application Security Project and confirms conference logistics: seven board members, active volunteers… | ||
| Squeezing The Last Drop Out Of OWASP Juice Shop | Bjoern Kimminich | 58m |
A modern vulnerable web app for training that actually delivers: 101 hacking challenges with six difficulty tiers, a built-in scoreboard and 26 coding… | ||
| nothing matches | ||