OWASP 2022 Global AppSec Europe Virtual Event
2022-11-04..2022-11-07
-- online --
as the organisers put it
Global AppSec Dublin 2022 on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
who it's for
application security engineers, security researchers, open source project maintainers, software developers, cloud engineers, DevOps engineers, security managers
topics
cloud attack surface management; infrastructure as code security; S3 and IAM misconfigurations; container security and Kubernetes misconfig; software supply chain security; DefectDojo vulnerability management; OWASP CRS rule sandbox; Trusted Types for XSS; client side CSRF mitigation; security test pyramid shift left
| title | author | length |
|---|---|---|
| Helpful Hackers | Astrid Oosenbrug | 51m |
Runs continuous internet-wide scans from a dedicated IP range and triages findings into three buckets: critical vulns, exposed databases with credential leaks… | ||
| Cloud Attack Surface Management | Alex Shulman Peleg | 58m |
Claims that cloud risk comes from the same application exploits applied to infrastructure as code and public APIs, citing the Log4j outbreak and… | ||
| 15 years of OWASP Top 10 - Has the Cloud Made a Difference? | Shira Shamban | 50m |
Claim: the cloud shifts OWASP Top 10 from user-facing bugs toward backend and infrastructure risks, shown by a 15-year review of 2007–2021 lists and cloud… | ||
| Insider Threats and New Economy Industries | Lisa Forte | 54m |
Insider risk breaks down into three concrete attack types — theft sabotage fraud — with theft dominating recent cases: stolen source code leads to criminal… | ||
| Snow Project | Abhi Balakrishnan | 30m |
A working tool called PrivacySnow exists at privacysnow.com: a JavaScript snippet that blurs page content and makes only the area under the mouse readable… | ||
| Web Honeypot Project | Adrian Winckles | 26m |
Proof of concept deploys Apache with mod security and the OWASP CRS as honeypot probes on VMs and Docker containers, logs mod_security audit JSON into an ELK… | ||
| Bug Logging Tool Project | Sourav Badami | 38m |
Crowdsourced bug-reporting platform with live web backend and a Chrome extension plus a Flutter mobile app, open‑source on GitHub and developed via Google… | ||
| DefectDojo Project | Timo Pagel, Stefan Fleckenstein | 30m |
Open source vulnerability management that consolidates scanner output, tracks products→engagements→tests→findings, and performs deduplication so repeated scans… | ||
| DSOMM Project | Timo Pagel | 29m |
DSOMM presents a usable DevSecOps maturity model with concrete activities, a web app backed on GitHub and exportable auditor reports, claiming you can fill… | ||
| Open Application Security Curriculum Project | Adrian Winckles | 59m |
Claim: most vulnerabilities live in software not networks — Gartner: 75%, NIST: 92% — and fixing bugs costs far more after release ($30k in the field vs $5k… | ||
| What's New in CRS4: An Update from the CRS Project | Christian Folini | 53m |
CRS v4 introduces a plugin architecture and CRS sandbox for testing rules and paranoia levels, adds early blocking to stop requests after headers, and migrates… | ||
| SAMM Project | John DiLeo, Seba Deleersnyder, Bart De Win | 01h 00m |
SAMM claims a runnable, risk based way to measure and improve software security posture with concrete outputs not platitudes It defines five business functions… | ||
| ASVS Project | Josh Grossman | 55m |
Comprehensive application-security requirements live in a GitHub repo as Markdown and export to PDF/Word/JSON via scripts, with a master branch for ongoing… | ||
| ZAP Project | Simon Bennetts | 59m |
ZAP claims wide real‑world use — about 3 million check-for-updates in a month — and runs on any JVM (even a Raspberry Pi). Recent work replaces the old… | ||
| Cheatsheets Project | Jim Manico | 40m |
Cheat sheets live on GitHub as markdown, updated by hundreds of contributors, with 42 open issues right now and CI lint checks that gate merges; a pull request… | ||
| Dependency Check Project | Jeremy Long | 01h 00m |
Open-source SCA that started in 2011 and currently uses the NVD plus Sonatype’s OSS Index to find CVEs, with a Docker image at about 3.5M pulls and… | ||
| Juice Shop Project | Björn Kimminich | 01h 00m |
An interactive insecure web application exists as a complete training environment with 100 hacking challenges, an Angular front end, Node/Express back end and… | ||
| Understanding the Complete Chain of Application Security Using | Spyros Gasteratos, Rob | 49m |
Claims a working, searchable index that links standards, tools and fixes across ASVS NIST CWE MITRE etc and proves it by demoing imports and live lookups… | ||
| Landmines in the API Landscape | Matt Tesauro | 01h 00m |
Claim: APIs become the top attack vector (Gartner) because surface, controls and tooling lag. Walks through the OWASP API Top 10 with concrete attack patterns… | ||
| Shift Left Security with the Security Test Pyramid | Andreas Falk | 57m |
Argues for concrete security checks at every pyramid layer and shows working demos: a purposely vulnerable bookmark app, unit and ArcUnit tests that catch… | ||
| Layered Threat Modeling: An Architectural Approach | Michael Boeynaems | 01h 00m |
Argues that threat modeling must be layered: separate architectural from solution-level work, with different scopes and goals, and shows a reproducible method… | ||
| WrongSecrets: We Have a Secret for Everyone! | Jeroen Willemsen, Ben de Haan | 45m |
A runnable vulnerable app plus a secret-detector testbed exists on Heroku and GitHub and currently contains 18 challenges that exercise real failures: a Docker… | ||
| Trusted Types: A World Without XSS | Gabor Pék, Dávid Schütz | 57m |
Trusted Types blocks DOM XSS by requiring specially created objects (TrustedHTML, TrustedScriptURL) and enforcing them via a CSP header so raw strings cannot… | ||
| “Mobile Wanderlust”! Our Journey to Version 2 0! | Sven Schleier, Carlos Holguera | 46m |
Refactors the OWASP mobile standard into a machine-readable, automation-first v2: a python script already generates the mobile testing checklist as an Excel… | ||
| Web Developers, Beware of the Tarpits for SAST in Your Code | Luca Compagna, Feras Al Kassar | 47m |
Claims that static analyzers miss widespread “tarpits” called testability patterns and shows concrete evidence: uses code property graphs to find 120 PHP… | ||
| Abusing Cloud Apps 101: Command and Control | Dagmawi Mulugeta | 53m |
Presents 23 reported cloud C2 incidents from Apr 2020–Apr 2022 with Dropbox 8 instances, OneDrive 5 and Google Drive 4, and real-world abuses by Molerats and… | ||
| A Wander Through the World of Container Security | Anais Urlichs | 52m |
Slides and live demos show concrete failures not high-level platitudes: containers are just Linux processes demonstrated via /proc and Docker exec, a Docker… | ||
| Docker for Pentesters | Raja Nagori | 38m |
Nightingale is a Docker image that ships a ready pentesting environment: preinstalled languages and tools (Python, Go, Node, Java, nmap, Metasploit, MobSF… | ||
| Everything You Wanted to Know About Client side CSRF But Were Afraid to Ask | Soheil Khodayari | 54m |
Claims that a new class of client-side CSRF can bypass traditional defenses and quantifies it with a working tool: JOE hybrid property graph crawls and models… | ||
| Securing an API Ecosystem with OAuth 2 0 | Philippe De Ryck | 56m |
Concrete rules and tradeoffs: use the authorization code grant with PKCE for any user flows and the client credentials grant for machine-to-machine; prefer… | ||
| JavaScript Obfuscation: It’s All About the P a c k e r s | Or Katz | 47m |
Built a static scanner that converts code to AST to JSON and matches structural signatures for five packers, finding 2.1% matches in a 100k phishing corpus and… | ||
| Making ASVS Truly Your Own | Luis Servin | 56m |
Shows how ASVS gets forked, edited as Markdown, and rebuilt with pandoc inside a Docker container to produce PDFs with clickable CWE links and derivation… | ||
| Defending Against New Phishing Attacks that Abuse OAuth Authorization Flows | Jenko Hwong | 01h 00m |
Shows concrete attacks: attackers register or reuse OAuth client IDs, send a Microsoft device‑code URL, and with 50 lines of code and social engineering obtain… | ||
| Catching Transparent Phish: Understanding and Detecting MITM Phishing Kits | Nick Nikiforakis, Bria | 58m |
Claims that MITM phishing kits steal credentials and 2FA in real time, demonstrated using evil Gen X, Moran and moglishka and a working demo. Detection relies… | ||
| Team of 30 million: Reducing Software Vulnerability at a Global Scale | Laura Bell | 59m |
Claims a global patchwork of 30 million developers exists with ~1.2M added yearly and only ~2% on bleeding‑edge toolchains, and argues five concrete measures… | ||
| Security as Code: A DevSecOps Approach | Joseph Katsioloudes | 59m |
Argues for making security decisions executable and shareable by codifying checks as queries and wiring them into CI. Shows CodeQL running on an intentionally… | ||
| Plain and Simple: The Art of Writing Clearly | Anne Turner | 54m |
Clear claim: plain language speeds decisions, saves time and money, and improves compliance by making security recommendations usable. Concrete tools and moves… | ||
| The Hand That Feeds: How to Misuse Kubernetes | Lewis Denham Parry | 01h 00m |
A vulnerable CI/CD web page allows command injection via a copied curl request and the attacker builds a reverse shell through angrock and Penelope, gaining an… | ||
| Evolving Threat Modeling Through the Open Threat Model Format | Fraser Scott | 01h 00m |
Proposes a concrete, machine-readable specification called Open Threat Model (OTM) — a minimal YAML/JSON schema (inspired by OpenAPI) that encodes project… | ||
| Becoming A Master In The Dojang With DefectDojo | Cody Maffucci | 59m |
DefectDojo consolidates vulnerability results from about 150 scan types into a single vulnerability management platform with monthly releases. It offers import… | ||
| Quantifiable Quality: The New Standard of Secure Code | Matias Madou | 57m |
Claims that people matter more than tools backed by a 1 200 developer survey that shows 48 percent admit shipping vulnerable code and independent research… | ||
| Stable, Safer, Faster: AKA How to Avoid K8s Misconfig with Automation | Noaa Barki | 57m |
Explains concrete failures (Target, Zalando, Blue Matador) and three root misconfig types: syntax errors, knowledge defaults, and policy drift, then shows… | ||
| How Source Code is Revealing our Secrets | Ziad Ghalleb | 48m |
Claims large-scale measurement: over 6 million secrets found on public GitHub, about three commits with secrets per 1,000, private repos are four times… | ||
| Over a Decade of Software Security: What Have We Learned | Adam Brown | 53m |
An open industry measurement called the Bsim/BCM framework collects interview-driven data from over 550 assessments across 128 organizations and scores 122… | ||
| Mitigate Risks In Code: Protect Your Software based Supply Chain | Maor Kuriel | 49m |
Claims that supply‑chain attacks are rising and that keeping dependencies current avoids ~90% of newly discovered vulnerabilities and addresses issues in ~60%… | ||
| Using IAC to Accelerate Threat Modeling | Arnaud Monhon Bah | 50m |
Claim is that using infrastructure as code speeds threat modeling by importing templates and auto-generating results. The demo uses CloudFormation and… | ||
| How to Meet the New Mobile Application Security Imperative | Oliver Williams | 48m |
Surveys and research report real numbers: 81% leaking sensitive information in one financial-app sample, analysis of over a million apps finds 131,000 apps… | ||
| A Risk based Approach to API Security | Tim De Boeck | 58m |
Claims concrete numbers: a cited survey shows 200% increase in APIs created and deployed and that one in four respondents suffers an API-driven data breach… | ||
| Worrisome Web Vulnerability Trends in the Race to Innovation | Nicholas Sciberras | 50m |
Aggregated Invicta scan data cover 23 billion checks from ~1,000 customers and report 280,000 direct-impact vulnerabilities, with a confirmed false positive… | ||
| Benchmarking the Security of Your Software Supply Chain | Eylam Milner, Mor Weinberger | 54m |
Claims an open source CLI called chainbench automates a CIS Benchmark for the software supply chain, scanning GitHub repos and CI for concrete failures… | ||
| Software Supply Chain Security | Vandana Verma Sehgal | 39m |
Covers concrete failures and fixes: the Event‑Stream backdoor (malicious code inserted into a 2011 package), a 2015 Java markdown flaw taking over a year to… | ||
| Flipping the Script on Application Security | Isaac Cohen | 53m |
GitHub finds a linear rise in security threats as lines of code grow, with a 40% increase in dependency alerts from 2019–2020 and about a 60% year‑over‑year… | ||
| nothing matches | ||