Practical Security for Web Applications
summary
Covers concrete fixes: cites Equifax (143 million), Yahoo (3 billion) and OPM (9 million) as web‑app breaches and recommends OWASP Top 10, dependency checks and scanners like ZAP and Metasploit for CI/CD and pen tests; use prepared statements to stop SQL injection, sanitize and HTML‑escape at render time to stop XSS, implement CSRF tokens, validate ORM query binding and NoSQL casting, prefer bcrypt/Argon2 hashing, enforce TLS, use OIDC for auth, apply least‑privilege DB accounts, avoid public data stores and deploy WAFs such as ModSecurity with careful tuning.
AI-written summary · about
chapters (35)
- 0:00Intro
- 0:49Software is Everywhere
- 4:13Security Breaches
- 6:55Web Applications
- 8:12Strategies
- 10:43Open Web Application Security Project
- 12:00Code Scanning: PHP
- 12:42Code Scanning: Python
- 13:24Dependency Check
- 14:41Penetration Testing
- 16:18Web Application Firewalls
- 18:04Low-Level Vulnerabilities
- 23:07ORM SQL Injection Data Mapper
- 24:44ORM SQL Injection Active Record
- 27:39XSS: Cross-Site Scripting
- 28:28XSS: Mitigation
- 29:04XSS: Rendering: Mitigation
- 31:21XSS: Saving Data: Mitigation
- 33:14CSRF: Cross-Site Req. Forgery
- 35:22CSRF: Mitigation
- 37:09Application Vulnerabilities
- 37:41User Authentication
- 38:09User Auth: Failure Messaging
- 39:04User Auth: Failure Handling
- 39:59User Auth: Multi-Factor
- 40:41User Auth: Account Recovery
- 42:10User Auth: Password Policies
- 43:26User Auth: Password Hashing
- 45:25User Auth: Password Transport
- 47:24Compromised Account
- 51:44Resource Access & Multi-Tenancy
- 52:19Securing Data Stores
- 54:56Network & System Design
- 57:28Securing Credentials
- 58:26InfoSec Mindset
related talks
52mPractical Security in Web Applications
01h 03mTen Key Steps for Enhanced Web App Security
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
30mWeb Security Engineering - Protect all layers of your project
55mBreaking and Fixing Web Application Security
01h 04mWeb Security And You
19mFrontend Security is a Thing
23mWeb Application Security - owasp top 10 vulnerabilities