Global AppSec US 2021 Virtual
2021-11-08..2021-11-12
-- online --
as the organisers put it
Global AppSec US 2021 Virtual on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
| title | author | length |
|---|---|---|
| Keynote: 25 Years in AppSec: Looking Back, Looking Forward | Adam Shostack | 44m |
Claims 25 years of firsthand AppSec practice including released internal security guidelines (1996) and later work on Microsoft SDL and ship delays show… | ||
| Keynote: Request Forgery on the Web - SSRF, CSRF and Clickjacking | Jim Manico | 47m |
Explains concrete attacks and fixes: Cross‑Site Request Forgery lets an attacker force authenticated actions; defenses that work are synchronizer token… | ||
| Keynote: Data is a new security boundary | Anastasiia Voitova | 51m |
Claim: treat data as the security boundary and use encryption so it “can’t be suddenly, unnoticeably decrypted.” Concrete examples: client-side field-level… | ||
| Keynote: We Deserve Rights | Chloe Messdaghi | 36m |
Talk argues that laws and media perception cause tangible harms: 1 out of 4 researchers avoid reporting, companies lack VDPs, and 94% of Forbes 2000 have no… | ||
| Magecart - The Rising Threat to e-commerce Websites | Shrutirupa Banerjiee | 44m |
Explains how Magecart compromises e-commerce checkout flow by injecting obfuscated JavaScript into third-party widgets and payment libraries to perform digital… | ||
| Application Threat Modeling Implementation Tips and Tricks | Mohamed Alfateh | 51m |
Provides concrete steps: map application services to information assets, draw DFDs that pull microservices and client‑side processes into the core, and produce… | ||
| All your Ether are belong to us (a.k.a Hacking Ethereum-based DApps) | Luis Quispe Gonzales | 46m |
Live demos use Remix + local Ethereum node and Metamask to show concrete failures: a public transaction reveals a player's secret bid, an integer overflow buys… | ||
| Harmonizing the OWASP API and Application Top 10 Lists | Joe Schottman | 51m |
Combine OWASP API Top Ten (2019) with OWASP App Top Ten (2017/2021) to cover gaps: shows which categories overlap (injection, auth, misconfiguration) and which… | ||
| We’re not in HTTP anymore: Investigating WebSocket Server Security | Erik Elbieh | 48m |
A new open-source stews toolset is released for discovery fingerprinting and vulnerability checks of WebSocket servers: discovery at 5,000+ URLs/s uses a… | ||
| How hackers can breach your C.I / C.D systems | Daniel Garcia, César Gallego | 51m |
Concrete exploits and working demos show how CI/CD tooling actually fails: Jenkins agents run a reverse shell via netcat; GitHub Actions and third‑party… | ||
| Insiders Guide to Mobile AppSec with Latest OWASP MASVS | Brendan Hann | 29m |
Claims a vendor pen tested thousands of apps and scanned millions and finds concrete failure rates not platitudes 50% insecure data storage 48% use HTTP not… | ||
| Exploiting web messaging implementations | Barak Tawily | 58m |
Explains concrete failures in postMessage implementations, shows an open‑source Chrome extension called pasta that enumerates windows listeners, captures… | ||
| Outside the box: pwning IoT devices through their applications | Alexei Kojenov | 45m |
Findings: unauthenticated firmware backup and unauthenticated firmware upload lets an attacker push uk.rar with uk.txt and gain a reverse shell via uk.rar… | ||
| Azure Vulnerability Testbed (AzGOAT) | Akriti Srivastava | 47m |
AzGOAT presents concrete Azure exploits and a working lab: SSRF in an app yields a managed identity token and subscription keys, a public blob reveals VM… | ||
| Roadblocks for CSP and Where to Find Them | Sebastian Roth | 39m |
A qualitative study uses semi-structured interviews, drawing and coding tasks with 12 real-world developers to show many deployed CSPs are trivially… | ||
| Cluster Wrangling: How to make Kubernetes clusters secure and usable | Rory McCune | 49m |
Claim: many clusters are exposed and misconfigured — a census finds ~900,000 clusters on the internet, ~100,000 kubelets and ~5,000 etcd exposed, and 25% run… | ||
| How to Thwart Malicious Automation and Kick Bot Butt for $0 | Randy Gingeleski | 48m |
Claims that a practical anti-bot program can run with zero vendor spend, using open-source pieces and architecture choices, and shows a working demo. Tools and… | ||
| Bots have gone phishing, but all they get is the boot | Pedro Fortuna, Jasvir Nagra | 50m |
Claim: phishing bots are cheap and scalable but can be made impractical by forcing them to run the real frontend and by raising extraction costs… | ||
| 600 apps in 60 days: Our journey to uncover vulnerable dependencies at scale with ... | Frank Liauw | 51m |
Centralized process uses OWASP Dependency-Check run by vendors, reports uploaded to SharePoint, parsed by a Python pipeline into a data warehouse and… | ||
| Web Application Honeypot Threat Intelligence | Adrian Winckles | 31m |
OWASP Web Application Honeypot Project claims a working proof of concept that uses ModSecurity + CRS on VM, Docker and Raspberry Pi nodes to capture attacks… | ||
| Building Security Champions | Tanya Janca | 51m |
Scaling security by building a champions program instead of hiring dozens requires a concrete recipe: recruit engage teach recognize reward with manager buy… | ||
| OWASP ESAPI – A Retrospective: The Good, the Bad, & the Ugly | Kevin Wall | 47m |
OWASP ESAPI originates around 2007 as interface-first security library with bundled reference implementations that lead to monolithic dependencies. The encoder… | ||
| Data-Driven AppSec Champions Programs – Benchmarking Your Program with Numbers | John Dickson | 28m |
A structured nine‑month survey of 26 AppSec champions programs claims concrete benchmarks: mature programs show a 1:50 ratio of AppSec staff to developers… | ||
| Security Design Anti-Patterns – Creating Awareness to Limit Security Debt | Joern Freydank | 46m |
Lists 12 concrete security anti patterns and shows how they arise during threat modeling with manual prototyping versus limited automation that only finds… | ||
| Automating Architectural Risk Analysis with the Open Threat Model format | Fraser Scott | 47m |
Claims a reproducible format, Open Threat Model (OTM), that turns Infrastructure as Code into interoperable threat models using infrastructure as code sources… | ||
| Data at Rest Encryption Going Beyond the Basics to Address Modern Attacks | Chuck Willis, Wias Issa | 47m |
Transparent disk or database encryption stops physical theft but fails against SQL injection, ransomware exfiltration, and privileged insiders; attackers pull… | ||
| The How and Why of the OWASP Top Ten 2021 | Brian Glas | 50m |
Explains how the OWASP Top Ten 2021 is built: empirical analysis of over half a million applications from 13 contributors, heavy CWE mapping (≈400 unique CWEs… | ||
| How to build a security mindset | Anna Lezhikova | 48m |
Claims 95% of breaches stem from human error and tests a Māori-inspired approach—kaiako and storytelling—to shift behaviour. Shows concrete practices: embed… | ||
| Container Security: It’s All About the Supply Chain | Michele Chubirka | 48m |
Argues that container security is a software supply chain problem and demands concrete controls: validate images at build, repository and runtime; enforce… | ||
| OWASP Leaders Meeting | Lisa Jones, Andrew van der Stock | 35m |
OWASP consolidates and publishes a single policy repository consolidated with many refreshed policies, a revised expense and events policy that accepts… | ||
| OWASP cautions against “insufficient logging & monitoring.” What does sufficient l... | Rob Dickinson | 48m |
OWASP A10 insists on concrete controls: append-only centralized store for logs, enough retention and normalization to enable forensic reconstruction, runtime… | ||
| Normalizing AppSec Issues for Contextual Risk-Based Prioritization at Enterprise Scale | Moshe Zioni | 18m |
Claim: normalizing diverse AppSec findings into a contextual, change-oriented model lets teams prioritize real risk at enterprise scale. Implementation details… | ||
| How Do They Get In?! Understanding the API Attack Vector | Michael Isbitski | 25m |
Explains how attackers find and abuse APIs using concrete tools and techniques: Burp Suite, OWASP ZAP, Charles Proxy and Fiddler to proxy and decrypt mobile… | ||
| Leave It To The Machines | Yuval Schhory | 23m |
Claims that ML/AI can shift left security by automatically learning real cloud traffic and producing enforceable controls. Demonstrates a system that inspects… | ||
| Practical Threat Modeling for real-world and Cloud Situations in our hybrid and W... | Uma Rajagopal | 53m |
Covers a concrete five‑step threat‑modeling workflow: Create, Identify, Address, Validate, Communicate, and claims to be directly applicable to hybrid/WFH… | ||
| Automated Serverless Security Testing: Delivering secure apps continuously | Tal Melamed | 50m |
Claims a fully automated, frictionless serverless testing pipeline that discovers every cloud resource and maps flows, then runs targeted scans and can… | ||
| SBOM SmackDown: Conquer dragons in the shadows with OWASP CycloneDX | Steve Springett | 50m |
Concrete claims and usable details: CycloneDX is presented as a lightweight SBOM format used in production by 100,000 organizations, version 1.3 is current and… | ||
| Scaling Security through Context-Based Security Asses... | Andrew Lien, Sanjeev Reddy, Teja Myneedu | 43m |
Claims that context drives triage into a hybrid model — capture product metadata once, score security impact, then route high‑impact work to humans while… | ||
| Why SecDevOps is the new way in Cybersecurity? | Saman Fatima | 31m |
Argues that embedding security into CI/CD prevents shipping vulnerabilities by doing automated security as code checks (SAST and DAST) at every pipeline stage… | ||
| Why security fails, and how we can solve for it | Richard Ford | 24m |
Praetorian catalogs concrete failures and fixes: an exposed S3 bucket and a bespoke, nation‑state style takeover, nested SQL subqueries that produce broken… | ||
| Why checking your infrastructure-as-code for misconfigurations is not enough – How ... | Aakash Shah | 48m |
Claims that scanning infrastructure-as-code for misconfigurations alone misses architectural risk, and that keyword-based rule engines (Terraform/terraform… | ||
| Are you safe from OWASP #11? | Matt Tesauro | 22m |
Claims that OWASP Top 10 is a starting point not a ceiling and that many real failures live in the “#11” beyond it: a pen test finds a 12 minute outage from a… | ||
| OWASP ZAP & DeepFactor Continuous AppSec Observability: Made For Each Other! | Kiran Kamity | 38m |
Claims that observability plus OWASP ZAP produce more than additive value backed by concrete tooling and numbers: DeepFactor drops into your Kubernetes cluster… | ||
| Purple Teaming with OWASP PurpleTeam | Kim Carter | 30m |
Claim: purpleteam CLI and SaaS embeds security regression tests into build pipelines and as a standalone UI, implemented as NodeJS microservices with a… | ||
| Application Security Playbook for Business | Karthik Krishnamo | 20m |
Lists every public‑facing application and its APIs, runs security assessments to prioritize actual risk, and pairs mitigation with a managed WAF+CDN service… | ||
| Security Observability 101: Thinking Inside the Box! | Jeff Williams | 51m |
Claims that runtime instrumentation exposes real behavior: an open source JOT Java Observability Toolkit lets teams add YAML sensors to Java apps at startup… | ||
| How to Use Your Vulnerabilities to Train Your Developers on Security | Jared Ablon | 20m |
Claims that using real vulnerabilities to train developers raises ROI and changes behavior, backed by data from tens of thousands of developers. Demonstrates a… | ||
| Flipping the script on application security | Isaac Cohen | 19m |
Claims that GitHub data show security threats scale linearly with size after analyzing 70 million lines and that the rate hasn’t improved in six years lead to… | ||
| Who’s in control: Human or Machine? | David Senecal, Luke Stork | 48m |
Detects bots by specific signals not buzzwords: device and IP intelligence plus behavioral biometrics (mouse trajectories, velocity, acceleration, keystroke… | ||
| Traceable AI | Dan Gordon | 23m |
Claim: API-driven microservices create a new, large attack surface that legacy signature and gateway tools miss. Evidence: a cited statistic of 91% of… | ||
| Ending Injection Vulnerabilities | Craig Francis | 48m |
Claims that distinguishing strings from a trusted developer eliminates injection by forcing libraries to accept only programmer-defined SQL/HTML/CLI fragments… | ||
| Metabadger: Automating IMDS Protection at Scale in AWS | Ashish Patel | 33m |
An open source tool called Metabadger automates discovery by parsing CloudTrail and EC2 APIs, then upgrades or enforces IMDSv2 across accounts and regions with… | ||
| OWASP Open Application Security Curriculum | Adrian Winckles | 29m |
Claims an OWASP-led open curriculum is needed because 75% of breaches at the application layer and 92% of reported vulnerabilities in applications, argues… | ||
| Demystifying the Digital Pandemic | Greeshma M R, Adarsh Nair | 50m |
Argues that the COVID era produces an Infodemic driven by viral content on WhatsApp groups and social platforms, maps how visual and closed-message vectors… | ||
| Changed Responsibilities in Modern Development Practices | Martin Von Knobloch | 26m |
Claim: as development moves to CI/CD pipeline and DevOps, most apps use only ~10–15% in-house code so SCA/SAST/DAST are mandatory and cheap to automate. The… | ||
| Analyzing Google’s SLSA Framework for Securing Software Supply Chains | Ronen Slavin | 20m |
Claims that SLSA defines SLSA levels 0–4 with concrete controls: scripted builds and provenance at level 1, hosted build and signing at level 2, stronger… | ||
| nothing matches | ||