OWASP AppSec California 2016
2016-01-25..2016-01-27
Santa Monica, United States
[OWASP AppSec California 2016, OWASP AppSec California 2018]
who it's for
application security engineers, security managers, devops engineers, software developers, penetration testers, qa engineers, cloud engineers, product security teams
topics
RASP for deserialization protection; Rails contextual escaping; React JSX escaping edge cases; PHP taint tracking proposals; LinOTP and OATH/TOTP authentication; CI/CD security automation with ZAP and Burp; ThreadFix and JIRA integration for triage; threat modeling practices and myths; software security metrics and benchmarking; container attack trees for CaaS; connected car and vehicle security; iot security cornerstones
| title | author | length |
|---|---|---|
| Advances in Secure Coding Frameworks | Jim Manico | 47m |
Claims that modern frameworks provide automatic defenses on by default get concrete examples: Rails auto-escapes but HTML safe undermines it, React JSX… | ||
| 15 Years of Web Security: the Rebellious Teenage Years | Jeremiah Grossman | 47m |
If the goal is actionable facts: web security teams already know how to reduce risk but economic incentives fail them, backed by WhiteHat’s measurements: 6% of… | ||
| Panel: Women in Security | Lisa Napier, Wei Lin, Emily Stark, Caroline Wong | 59m |
Panelists give concrete numbers and fixes not platitudes They cite 35% in 1985 to 17% in 2011 for CS degrees and tie that to attrition at every career stage… | ||
| Ad Hoc Mutable Infrastructure for Security Management | R. Wood, W. Bengston | 50m |
Claim: a fully mutable Active Directory identity stack lives mostly in AWS and can be spun up or destroy and redeploy daily to remove persistence… | ||
| Making Security Agile | Oleg Gryb, Saniay Tambe | 46m |
Outlines how a two‑to‑four person security team scales to thousands of QA regression tests and multiple daily releases by wiring scanners into CI/CD: ZAP runs… | ||
| Fixing the Unfixable: Solving Pervasive Vulnerabilities with RASP | Jeff Williams | 49m |
Claims a practical fix for Java deserialization by weaving security into running apps: a free open source RASP agent hooks the JVM, blocks ysoserial-style… | ||
| All our APIs are belong to us | Jad Boutros | 53m |
Snapchat reports running 140 security reviews and 550 privacy reviews in 2015 while fighting third-party apps that harvest credentials. Defenses include… | ||
| Keynote: Closing the Security Talent Gap | Jacob West | 50m |
Conference claims that 40% of security roles are vacant (senior roles ~49%) and offers seven concrete levers: retrofit computer science curriculum with… | ||
| Skillful, Scalefull Fullstack Security in a State of Constant Flux | Eoin Keary | 41m |
Argues that automation (Selenium, Burp/ZAP, CI hooks, Jenkins) finds the routine XSS/SQLi stuff while humans focus on business logic, component management and… | ||
| Open Source Authentication: Security without high cost | Donald Malloy | 53m |
Claims an open, low-cost route to strong authentication by using the OATH algorithms HOTP and TOTP (IETF standards), a free LinOTP server from LSExperts, and a… | ||
| Keynote - Starting a metrics program | Marcus Ranum | 01h 01m |
Concrete claims, tools, counts and results: pick a talk that names a unit of measurement and shows how it maps to business impact, shows data from Nessus scans… | ||
| 10 years of Working with the Community | Dave Lenoe | 44m |
Ten years of corporate response becomes a checklist of concrete changes: a central PSIRT and ASSET move from reactive email fights to HackerOne bounties and… | ||
| Video Game Security | Carter Jones | 44m |
Demo shows unlimited ammo by finding the ammo memory address (30 → 29 when fired), identifying the write instruction and replacing it with a no-op patch, and… | ||
| Benchmarking AppSec Across Industries | Chris Eng | 46m |
Veracode’s cloud scans cover 200,000 application assessments over 18 months and report nearly 10 million detected flaws with 7 million fixes verified, leaving… | ||
| 5 Steps to Drive Enterprise Software Security | John Dickson | 36m |
Claims a concrete five‑step program that gets budget and results: Characterize the landscape, Secure champions, Define standards and strategy, Execute… | ||
| 6 Myths of Threat Modeling | Jim DelGrosso, Brook S.E. Schoenfield | 55m |
Claims six myths are false and shows that threat modeling finds design flaws pen tests and code review miss like an HVAC vendor access path, missing audit… | ||
| Attack tree vignettes for Containers as a Service applications | Tony Uceda Velez | 57m |
Risk‑centric attack vignettes map concrete threats to container tooling and show what actually works: Docker images and Dockerfile pulls from Docker Hub enable… | ||
| Unlocking Threat Modeling | Brook S.E. Schoenfield | 57m |
Claims threat modeling is architecture-first applied security and gives concrete techniques: draw architectures, mark red attack surfaces (message bus, data… | ||
| Software Security Metrics | Caroline Wong | 50m |
Claims a practical method: start from 20 risk management objectives, pick relevant objectives, turn each into specific questions, and collect the data that… | ||
| Dissecting Bitcoin Security | Cassio Goldschmidt | 53m |
Explains concrete mechanics: private keys are 256‑bit numbers and public keys use secp256k1 ECDSA, addresses derive via SHA‑256 then RIPEMD‑160 and Base58, and… | ||
| Hard to Port! - A Snapshot of the Vulnerability Landscape in 2015 | Rahim Jina | 39m |
edgescan’s 2015 dataset shows specifics not slogans: thousands of assets from Dec 2014–Nov 2015 reveal 15.1% of assets carry high/critical risk, web apps… | ||
| All You Need Is One - A ClickOnce Love Story | Ryan Gandrud | 40m |
Shows a concrete exploit chain: ClickOnce delivers a per-user malicious .application that launches a bundled .exe or in-memory PowerShell payload; payloads are… | ||
| Radio Hacking: Cars, Hardware, and more! | Samy Kamkar | 51m |
Shows actual exploits and working gear: records fixed RF garage codes and reduces brute force from ~30 minutes to 8 seconds to brute force by using de Bruijn… | ||
| Software Security Initiative Capabilities - Where do I begin? | Jim DelGrosso | 40m |
Compares three SSI entry points—penetration testing, static code analysis, and threat modeling—and gives concrete tradeoffs: mature tools for pen testing and… | ||
| Integrating Mobile Devices into your Penetration Testing Program | Georgia Weidman | 40m |
Claim: mobile devices become internet‑facing pivot points that bypass perimeter controls. Demonstrated tools and results include Stagefright remote RCE on… | ||
| https://*every site here* | Emily Stark | 41m |
Chrome adds an opt‑in certificate error report that surfaces real-world causes and shows client clocks cause about 47% of validation failures, while… | ||
| Connected Cars - What could possibly go wrong? | Ed Adams | 43m |
Millions of cars already run huge swaths of software — an S‑class can contain ~100 million lines of code, five networks, two miles of cable and fifty OSes —… | ||
| Adaptive Testing Methodology: Crowdsourced Testing... | Daniel Miessler | 40m |
Claim: a live service parses a site with curl to detect stack and returns a tailored checklist drawn from plain-text rules in crowdsourced GitHub; checks are… | ||
| Preventing Security Bugs through Software Design | Christoph Kern | 51m |
Argues that changing APIs, not dev behavior, eliminates whole classes of bugs and shows concrete artifacts: a compile-time-constant builder plus an error-prone… | ||
| To bounty, or not to bounty? Security@ insights from 500 organizations | Alex Rice | 50m |
Aggregated data from over 500 programs yields a weighted index across six dimensions (Researcher Breadth, Researcher Depth, Vulnerabilities Found, Response… | ||
| Design Approaches for Security Automation | Peleus Uhley | 40m |
Argues decisions rest on concrete tradeoffs not buzzwords: whether build, buy, or borrow depends on who will maintain it, how collected data gets processed… | ||
| Security Automation in the agile SDLC - Real World Cases | Ofer Maor | 40m |
Three real customers show what gets built and what actually works: an insurance shop that integrates Seeker into Jenkins, records manual tests, and accepts… | ||
| AuthMatrix: Simplified Authorization Testing for Web Applications | Mick Ayzenberg | 47m |
Introduces AuthMatrix, a Burp Suite extension that automates authorization testing by mapping roles, recording session tokens, generating every role×action… | ||
| Taking AppSec to 11: Pipelines, DevOps and making things better | Matt Tesauro | 51m |
Claims a practical pipeline that raises yearly assessments from ~44 to ~200 while losing ~3.5 staff and peaking at a 12‑person team, using automation and… | ||
| Visualizing Security via LANGSEC | Kunal Anand | 52m |
Claim: pattern matching (regular expressions) loses to fuzzers so LANGSEC treats data as code and inspects it with lexers/parsers. Implementation: a… | ||
| IoT Cornerstones of Security | Brian Witten | 35m |
Four concrete claims decide whether to watch: authentication-first design with signing data on capture for low-power hops; practical performance numbers… | ||
| nothing matches | ||