Global AppSec Lisbon 2024
2024-06-24..2024-06-28
Lisbon, Portugal
as the organisers put it
Global AppSec Lisbon 2024 on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
who it's for
application security engineers, security architects, devops engineers, platform engineers, engineering managers, security researchers, product security engineers
topics
ML-assisted web application firewall; access maps for threat modeling; security champions and culture; IoT security testing guide; DOM encapsulation defenses (lavadome); API design and contract testing; GitHub Actions repo jacking; software bill of materials and cryptographic governance; hardcoded secrets detection rollout; low-code no-code application security; LLM API integration risks; cloud-squatting and forgotten cloud assets
| title | author | length |
|---|---|---|
| Will Machine Learning Replace The WAF? | John Graham Cumming | 41m |
Claims that ML replaces signature WAFs are rejected while showing impact and limits: a production system built in 2022 runs 80 million HTTP requests per… | ||
| Hacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe? | Stephen Giguere | 32m |
Research identifies concrete attack paths against GitHub Actions: repo jacking lets an attacker recreate moved action repositories because actions download not… | ||
| Paved Roads To Express RBAC In Threat Models | Eden Yardeni | 37m |
Claims a small, reusable artifact called access maps that teams fill out (principals, entity type, situational flags, runtime dynamics) and bring into threat… | ||
| API Security By Design | Jose Haro Peralta | 43m |
Claim: fixing APIs at design time dramatically reduces exploitable issues and uncovers hundreds to thousands of problems when tested. Evidence: many public… | ||
| Leveraging Psychological Needs For Building A Security Culture Amongst Developers | Juliane Reimann | 52m |
Argues that shifting developer behavior by satisfying autonomy, competence, relatedness reduces human risk, not buying more tools. Integrates scanning… | ||
| AI Is Just Software, What Could Possibly Go Wrong? | Rob Van Der Veer | 52m |
Claim: treat generative models as software with software risks — not magic. Gives concrete failures: package hallucinations with fake npm packages (30k then… | ||
| IoT Security Testing Guide (ISTG) | Luca Pascal Rotsch | 24m |
Provides a concrete testing framework: a device model mapping hardware and software components, an attacker model with four physical and four authorization… | ||
| Start Covering Your Bases And Stop Chasing APT Headlines | Avishay Zawoznik | 42m |
Claims that old admin tools matter more than flashy zero days and demonstrates a full ransomware-style chain: phishing Word macro → PowerShell reverse shell →… | ||
| DOM Jungle - Can We Trust The UI? | Gal Weizman | 47m |
Claims a concrete defense: an open source project called lavadome encapsulates DOM subtrees to prevent JavaScript from reading secrets (demo: Metamask private… | ||
| Navigating The Landscape Of Client-Side Request Hijacking On The Web | Soheil Khodayari | 46m |
Claims that client-side request hijacking is widespread and practical: analysis of ~1M pages finds 7.9M API calls, 202,000 verified data flows across 961 sites… | ||
| Gridlock: The Dual-Edged Sword Of EV And Solar APIs In Grid Security | Vangelis Stykas | 35m |
Cloud‑facing EV and solar platforms show concrete failures: API IDORs and RCEs discovered with Burp, JADX, APKLab and Shodan, demo accounts or mailinator… | ||
| Trust Cards For AI | Isabel Praça | 39m |
Argues for expanded data and model identity cards that record robustness, explainability, fairness, privacy and operational KPIs rather than just accuracy… | ||
| Security Champions And Experiments: Building Blocks For Cultural Change | Mads Andersen | 48m |
Claim: embed security champions and run controlled experiments to change culture. Implementation at Bankdata: ~600 developers across 80 teams, aiming for ~30… | ||
| ModSecurity | Ervin Hegedüs | 18m |
Code ownership moves to OWASP in January and the modsecurity.org domain transfers on 8 July, the repo is reorganized into nine repositories and CI/CD pipelines… | ||
| A Race To The Bottom: Database Transactions Undermining Your AppSec | Viktor Chuchurski | 42m |
Shows a concrete failure mode: concurrent transfers let ten requests overdraw an account because defaults allow reads without locks. Reproduces it with a Go… | ||
| Automating Security Test Cases Based On ASVS | Aram Hovsepyan | 34m |
The work analyzes 278 ASVS v4 requirements and concludes roughly ~2/3 automatable (~170–189 requirements) by unit, integration, acceptance or tooling… | ||
| Tracking And Hacking Your Career | Leif Dreizler, Misha Yalavarthy | 47m |
Keeps a running hype list of accomplishments with one‑sentence summaries, impact metrics and links, records work in weekly notes and project design docs, and… | ||
| DefectDojo | Matt Tesauro | 31m |
DefectDojo takes noisy outputs from scanners and normalizes, deduplicates and tracks them via a REST API and a SaaS offering, ingesting results from 179 tool… | ||
| AI Package Hallucination: Spreading Malicious Packages Using Generative AI | Bar Lanyado | 35m |
Claim: generative models like jgpt gini CH GPT and GPT 3.5 GPT 4 suggest package names that do not exist then attackers publish malicious packages with those… | ||
| Open Common Requirement Enumeration (OpenCRE) | Spyros Gasteratos, Paola Garcia Cardenas | 32m |
A live demo shows a working open catalog that maps standards into a graph via one common requirement ID so links replace exponential pairwise mappings; the… | ||
| Rollout Your Hardcoded Secrets Detection With Min Effort & Max Impact! | Yassine Ilmi, Arbër Salihi | 46m |
Concrete reference implementation available and tested rather than high-level platitudes: an trufflehog scanner wired into a Terraform + Python backend… | ||
| Privacy Toolkit: Privacy Awareness In The Digital Age | Stefano Di Paola, Martino Lessio | 42m |
A browser extension implements plugins that detect concrete failures: proxify serialization APIs to spot fields returned but never used, DOM scans and regexes… | ||
| Mobile Application Security (MAS) | Sven Schleier, Carlos Holguera | 20m |
The project refactors the massive MDG into modular tests, techniques, tools and apps and introduces mobile-specific weaknesses called MASWE that map to MSVS… | ||
| Traceability In Cyber Security:Lessons Learned From The Medical Sector | Konstantinos Papapanagiotou | 45m |
Covers concrete FDA milestones (2005 premarket software rules, 2014 cyber guidance, latest SPD update) and real incidents (2008 pacemaker, 2011 and later… | ||
| Back To The Future: Old Tricks Invading A New Attack Surface | Uriya Elkayam | 25m |
Demoed Power Automate SQL+HTML injection that lets a public form exfiltrate database fields and send phishing HTML from an internal address, a UiPath package… | ||
| Leaders Meeting | Grant Orgers | 01h 02m |
Membership and ops update: foundation reports 8,118 members with ~60% of leaders not paying, 226 projects and 282 chapters; Cloudflare is deprecating the… | ||
| Low-Code/No-Code Top 10 (LCNC) | Michael Bargury | 31m |
Project claims a growing OWASP low‑code/no‑code Top 10 and says large vendors and enterprises already adopt it, citing over a million apps inside some… | ||
| Modern Appsec vs. GenAI Application: Is Your Appsec Ready? | Balachandra Shanabhag | 47m |
Maps OWASP LLM Top 10 onto a modern AppSec stack and shows which risks are already handled and which need new work: prompt injection and… | ||
| Transitive Vulnerabilities Exploit In Real-life | Liad Cohen, Eyal Paz | 40m |
Claim: open‑source vulnerabilities in JavaScript are mostly transitive, and exploitability falls as dependency depth increases. A dependency‑graph +… | ||
| Maturing SDLC At A Fortune 500 Company Based On OWASP SAMM: Successes And Pitfalls | Jasyn Voshell | 44m |
Company adopts OWASP SAMM as measurable SDLC standard, rolls it out across 30 teams starting 2022, moves from spreadsheets to a COTS dashboard, enforces weekly… | ||
| Cryptographic Governance: Software Supply Chain Security With CBOM | Nicklas Körtge | 32m |
A cryptographic SBOM component is now part of CycloneDX 1.6, capturing metadata (not key values) for algorithms, certificates and protocols so teams can… | ||
| Token It Up A Notch: Elevating Payment Security | Yadi Abdalhalim, Jovon Itwaru | 49m |
Chime describes a homegrown tokenization service that uses envelope encryption with AWS KMS, S3 and Aurora, stores encrypted DEKs plus encrypted values, and… | ||
| Top-25 Parameters | Lütfü Mert Ceylan | 11m |
A publicly curated dataset of the “top‑25 parameters” for web vulns claims ranked likelihoods for XSS SQLi LFI SSRF and RCE with concrete examples (id highest… | ||
| Malice In Chains: Supply Chain Attacks Using Machine Learning Models | Tom Bonner, Marta Janus | 50m |
Model serialization routinely enables remote code execution through pickle arbitrary code execution and similar marshal/HDF5 flows, with hundreds of… | ||
| Winning Buy-In: Mastering The Art Of Communicating Security To Management | Ida Hameete | 50m |
Shows a repeatable method: translate security into management numbers and return on investment, pick two management metrics to prove impact, build allies… | ||
| Dep-scan | Prabhu Subramanian | 27m |
Dep-scan v6 claims fast, high‑quality composition and reachability: forward reachability analysis plus endpoint-focused and configurable depth/breadth scans… | ||
| Cornucopia | Johan Sydseter | 39m |
version 2 released, with print-ready decks in two sizes and six languages and a new mobile app edition mapped to MAS/MSVS tests. The project provides an online… | ||
| Building An Effective Application Penetration Testing Team | Ryan Armstrong | 56m |
Covers concrete practices and results for building a pen‑test team: hiring shifts from CTFs to a report‑review exercise for seniors, cohort training with a… | ||
| Designing Security And Privacy: A Dev's Guide To Threat Modeling With OWASP SAMM | Seba Deleersnyder | 43m |
A capability catalog for threat modeling is mapped to OWASP SAMM with level‑1, 2 and 3 assignments and a nine‑capability minimum viable program for small Agile… | ||
| How (Not) To Implement Secure Digital Identity: Study Of Poland's Digital ID System | Szymon Chadam | 46m |
Shows a server‑side logic flaw that lets a captured, government‑signed ID container be replayed to impersonate someone else; a proof uses a modified app and a… | ||
| Dependency Track Fortifying The Supply Chain | Aravind Parappil, Vinod Anandan | 24m |
Enterprise evidence: Dependency Track ingests CycloneDX SBOMs and continuously scans components so the build inventory is live not static. The talk gives hard… | ||
| Assessing 3rd Party Libraries More Easily With Security Scorecards | Niels Tanis | 48m |
Claim: automated security scorecards let teams quantify library risk quickly. Uses OpenSSF Scorecard checks, the scorecard CLI and public viewers plus… | ||
| XZ Backdoor: Navigating The Complexities Of Supply Chain Attacks Detected By Accident | Yoad Fekete | 42m |
Accidentally discovered malicious XZ backdoor binaries are injected into build artifacts so source looks clean while released packages in Fedora Debian and… | ||
| Developer Guide | Shruti Kulkarni | 14m |
OWASP Developer Guide presents a compact, practical roadmap for writing secure applications: concrete fixes (query parameterization, input validation), an… | ||
| Securing The Gateway And Mitigating Risks In LLM API Integration | Ayush Agarwal, Avneesh Hota | 27m |
Includes concrete breach examples and working exploits: prompt injection that exposed AWS secret key in an orom mini 3B deployment and a prompt that achieves… | ||
| I Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload | Anthony Harrison | 47m |
Claims: machine-readable SBOM and VEX artifacts let teams analyze, prioritize and communicate vulnerability risk instead of arguing over vague scans. Tools… | ||
| Build Strong Defenses By Participating In Standards! | Daniel Ehrenberg | 37m |
Standards work described here names concrete fixes, implementations and outcomes: Shadow Realms is at stage 2.7 with browser patches behind flags and aims to… | ||
| Deterministic GenAI Outputs With Provenance | Dinis Cruz | 54m |
Claims a method for deterministic GenAI outputs with provenance and shows an open source CI/CD pipeline that tags releases, builds AMIs and can run models… | ||
| 'The Rise And Fall' Of ModSecurity And The OWASP Core Rule Set | Davide Ariu | 40m |
Claims that machine learning tuned the CRS severity scores and that adversarial training improves robustness. Evaluation uses 50,000 samples (25k legit, 25k… | ||
| Exploiting Client-Side Path Traversal: CSRF Is Dead, Long Live CSRF | Maxence Schmitt | 38m |
Claims that client‑side path traversal lets a frontend reroute legitimate requests and bypass CSRF mitigations, demonstrated against Rocket.Chat and Mattermost… | ||
| Cloud-Squatting: The Never-ending Misery Of Deleted & Forgotten Cloud Assets | Abdullah Al-Sultani | 38m |
Claims that forgotten cloud IPs and CNAMEs get reassigned and let outsiders capture traffic and secrets with surprising scale — providers publish thousands of… | ||
| Growing A Security Champion Program Into A Security Powerhouse | Bonnie Viteri | 48m |
A security champions program grows from hobby to measurable engine by the specifics: a dashboard for one‑per‑10 engineers, automated onboarding and quarterly… | ||
| SAMM: Interactive Introduction And Update | Seba Deleersnyder, Bart De Win | 32m |
SAMM claims to let organizations measure secure‑development maturity and map those activities to compliance frameworks; the project provides mappings to OpenC… | ||
| Coraza Web Application Firewalls Revisited | José Carlos Chávez | 23m |
Open source Coraza is a Go WAF that claims production readiness with OWASP endorsement and a recent v3.2.1 release and ~2K on GitHub. It runs as native Go or… | ||
| Dawn Of The Dead: The Tale Of The Resurrected Domains | Pedro Fortuna | 48m |
Claim: criminals re-register abandoned JavaScript domains and turn them into a supply‑chain vector that injects skimmers into checkout pages. Method… | ||
| SamuraiWTF | Kevin Johnson | 30m |
Samurai WTF is an open source, reproducible training platform that builds cloud or VM labs; Katana CLI and web UI installs assessment tools and vulnerable… | ||
| 5 AppSec Stories, And What We Can Learn From Them | Paul Molin | 40m |
Five concrete failures and fixes: a Spring databin ding RCE that used a module.classloader bypass to drop a shell.jsp via Apache Tomcat logging; a Jakarta… | ||
| What Can Traditional Web App Security Learn From Browser Wallet Extensions? | Gal Weizman | 46m |
Claims that hardening the client prevents irreversible crypto theft by confining untrusted code via compartments and per-dependency static analysis. Implements… | ||
| Closing Ceremony | Martin hard to miss | 02m |
An award ceremony recognizes Martin as a distinguished lifetime member of OWASP and calls up the volunteers and staff who ran the event, with one person… | ||
| From Theory To Practice: Navigating The Challenges Of Vulnerability Research | Raphael Silva | 47m |
Shows concrete bug chains and tools: a reflected XSS that only executes because of innerHTML tag soup behavior discovered by reading the HTML spec, an Angular… | ||
| OWASP API Security Project | Paulo Silva, Erez Yalon | 31m |
OWASP API Top 10 history and methods are explicit: the project first compiles incidents by scraped bug bounty platforms then cross‑checks CWEs and community… | ||
| nothing matches | ||