Ten Key Steps for Enhanced Web App Security
summary
A ten‑step, developer‑centric checklist that backs each point with demos and numbers: a live SQL injection demo plus XSS that exfiltrates cookies via ngrok and successfully hijacks sessions; headline stats (cybercrime ~$9.5T in 2024, ransomware hits 66.6% of orgs, $1.82M average recovery, ~2,200 attacks/day); concrete tools and fixes: ORMs (Prisma/Entity Framework), linters and SAST (ESLint, SonarQube), runtime shields (DOMPurify, Helmet, ArcJet), dependency scanning (Snyk, Dependabot, supply‑chain warnings) and observability (Datadog, Prometheus/Grafana).
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:43About Ben
- 1:33Web Application Security
- 5:40Developer Responsibility
- 8:09The 10 Steps
- 8:48OASP Top 10
- 10:24Demo
- 11:46Users
- 19:42Further Reading
- 20:47Strengthening Authentication and Session Management
- 24:07Managing Shadow APIs
- 27:00ClientSide Security
- 30:31Data Protection Privacy
- 40:01Monitoring Logging
- 48:58Zero Dependency
- 51:24Tools
- 53:34Compliance
- 55:12Automate
- 56:11Defending against DOS Bot Attacks
- 57:16Context Awareness
- 59:33Example
related talks
59mPractical Security for Web Applications
30mWeb Security Engineering - Protect all layers of your project
51m10 things developers need to know about web application security
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
19mFrontend Security is a Thing
52mPractical Security in Web Applications
01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017
48mSecurity Practices for Developers