OWASP AppSec USA 2018
2018-10-11..2018-10-12
San Jose, United States
who it's for
application security engineers, security engineers, developers, devops engineers, security managers, cloud-native engineers, iot security researchers
topics
DNS enumeration with Amass; ZAP heads up display; CycloneDX SPDX dependency tracking; HashiCorp Vault and KMS; service mesh mutual TLS; Kubernetes application security; serverless malware infections; deserialization gadget chain discovery; threat model-as-code; code coverage instrumentation (Code Pulse)
| title | author | length |
|---|---|---|
| Welcome Address | Karen Staley, Travis McPeak | 07m |
Organizational welcome that lists concrete actions and numbers: introduction of the staff and board changes, a call to vote for three board slots, membership… | ||
| (in)Security is eating the world | Michael Coates | 44m |
Claim: defense must shift to autonomy and speed — automate or die — by moving security to the data source and using behavioral analytics, machine learning… | ||
| Defensible Application Security for the Artificial Intelligence Era | Chenxi Wang | 39m |
Claims that AI breaks traditional trust: facial recognition tests show high mismatch rates—32% mismatch (Amazon) and 24% mismatch (Google Cloud) in a 2017… | ||
| Making Security Approachable for Developers and Operators | Armon Dadgar | 42m |
Argues that castle‑and‑moat perimeter assumptions fail and proposes zero trust as the model, with concrete changes: centralize secret handling with HashiCorp… | ||
| OWASP Leaders Workshop AppSecUSA 2018 - Part 1 | Matt Tesauro, Karen Staley, Harold Blankenship, Dawn Aitken | 55m |
Covers concrete governance and ops details: chapter and project counts (228 chapters, 110 projects), how revenue splits and surpluses work (90/10 regional… | ||
| OWASP Leaders Workshop AppSecUSA 2018 - Part 2 | Matt Tesauro, Karen Staley, Harold Blankenship, Dawn Aitken | 01h 54m |
Proposes concrete fixes: revive chapter and project committees and pick measurable chapter metrics (meeting frequency, paid members versus walk‑ins) and add… | ||
| OWASP IoT Top 10 | Daniel Miessler | 21m |
Defines the OWASP IoT Top 10 with a clear methodology and concrete outputs: a dataset aggregated from NVD Bugcrowd and internal vulns, weighted and analyzed to… | ||
| ZAP Heads Up Display | David Scrobonia | 29m |
ZAP adds an in‑browser Heads Up Display that overlays live tooling on pages and injects JS and iframes to show scope, site tree, alerts and history; it uses… | ||
| OWASP Amass Project | Jeff Foley | 45m |
Amass is an in-depth DNS enumeration and network mapping tool written in Go that reaches out to more than 30 passive data sources and then blends passive… | ||
| Dependency Track | Steve Springett | 34m |
Open source platform that ingests a CycloneDX bill-of-material or SPDX files and continuously monitors components against NVD NPM Public Advisories Sonatype… | ||
| OWASP Glue Tool | Matt Konda | 39m |
A Ruby gem orchestrates security tools, running analyzers (Brakeman, Bandit, safety, zap, nmap, trufflehog, dependency‑check, bundler-audit, retire, clamav… | ||
| OWASP Code Pulse and Attack Surface Detector | Ken Prole | 34m |
Two open source tools are demonstrated with concrete results: OWASP Code Pulse instruments server bytecode (Java and .NET) to provide real-time code coverage… | ||
| OWASP SEDATED | Simeon Cloutier, Dennis Kennedy | 31m |
SEDATED is a server-side Git pre-receive hook that scans pushed deltas and rejects pushes with violations rather than just reporting them. It ships ~75… | ||
| Exposing Security Flaws in Trading Technologies | Alejandro Hernandez | 38m |
Scans of 30 websites (7 crypto), 17 desktop, 34 mobile platforms reveal concrete failures: Wireshark captures show plaintext FIX/proprietary protocols and… | ||
| Security Vulnerabilities in AI Assistant Based Applications | Abraham Kang | 48m |
Claims that malware can record assistant commands and location and an app was removed from the Play Store; a physical attack using an inductive speaker demo… | ||
| Value Driven Threat Modeling | Avi Douglen | 35m |
Argues that a lightweight, value-driven threat modeling process lets developers fold security into agile work by adding threat checks to user stories and… | ||
| Prevent Business Logic Attacks using Dynamic Instrumentation | Jean-Baptiste Aviat | 26m |
Claims a working prototype that instruments running apps to push business events into an event stream, detects anomalies and pushes automated responses without… | ||
| SCORE Bot: Shift Left, at Scale! | Vidhu Jayabalan, Laksh Raghavan | 30m |
SCORE Bot automates PayPal’s PR security gate by hooking into GitHub Pull Request payloads, running custom static/semantic checks (about 25 checks) and posting… | ||
| Lessons from integrating third party library scanning in DevOps workflow | Tim Champagne, Harshil Parikh | 21m |
Shows a working CI-integrated scanning pipeline: a local scan script mirrored in Jenkins, a baseline high-watermark to avoid blocking legacy debt, and separate… | ||
| Open Source Security Tools for Kubernetes Applications | Michael Ducy | 38m |
Concrete claims and artifacts: container-image scanning with Clair, Anchore, Falco plus an Encore engine that enforces policies via admission controllers and… | ||
| Security as a Service: Work where You Engineers Live | Julia Knecht, Taylor Lobb | 28m |
Claims a measurable, operational change: security integrates into git, JIRA, and wikis instead of separate dashboards, feeding automated findings into… | ||
| Security Culture Hacking: Disrupting the Security Status Quo | Chris Romeo | 37m |
Profiles anonymous orgs vs external story, offers 15 hacks and a 30-60-90-1-year plan that were used at scale (examples from 5 to 25,000 developers), points to… | ||
| The Anatomy of a Secure Web Application in Java Using Spring Security and Apache Fortress | Shawn McKinney, John Tumminaro | 35m |
A runnable Apache Wicket app on Tomcat demonstrates Java + Spring + Apache Fortress controls: a three‑page, three‑customer policy that maps to 9 roles with a… | ||
| Scratching the Surface of your CD? | Ofer Maor | 36m |
Claims that continuous delivery forces inline, fully automated security: fast IDE "spell‑checker" SAST, incremental SAST on build servers, IAST agent on… | ||
| Domino's Delivery of a Faster Response was No Standard Order | Michael Sheppard | 36m |
Claim: Domino's converts a slow multi‑ticket grind into an automated Application Security Engagement workflow that actually produces measurable outcomes. It… | ||
| Are we using Java Crypto API Securely ? | Mansi Sheth | 30m |
Concrete failures, not high-level warnings: JCA has insecure defaults and ambiguous docs, demonstrated with code that shows setSeed misuse producing… | ||
| Teach a man how to fish | Jeroen Willemsen | 30m |
Claim: make security stick by changing practices not doing the work for them. Start with an assessment, measure security maturity with a few meaningful metrics… | ||
| My journey through building an advanced bot detection product | David Senecal | 33m |
Built a product that detects and manages bots at the edge for large ecommerce and finance sites and launches iteratively from 2015 to 2017, combining passive… | ||
| Identity Theft: Attacks on SSO Systems | Kelby Ludwig | 31m |
Claims a practical comment truncation class of SAML/XML‑signature bugs that lets an authenticated attacker tamper signed assertions (insert XML comments) so… | ||
| Empowering the Employee: Incident Response with a Security Bot | Jeremy Krach | 22m |
A production Slack bot routes user-related alerts from Amazon SQS into an RDS store, DMing employees with event details (timestamps IPs document titles) and… | ||
| Web application compromise mitigation with crypto anchoring | Jon Debonis | 26m |
Claim: move encryption keys and operations off app servers into a dedicated microservice so keys never leave the data center, decryption is logged, and offline… | ||
| SDL at Scale: Growing Security Champions | Ryan O'Boyle | 35m |
A security champions program that starts with less than one full‑time security person scales to ~20 dev teams by training volunteers, not mandating process… | ||
| Chromebooks and network motes to enforce security posture from the device to the cloud | Jon Debonis | 31m |
Claims a concrete rollout: Chromebooks with HSM and a locked-down Google Enterprise policy, disabling email on the secure device, stop phishing and credential… | ||
| A new framework to automate MSTG and MASVS in your CI/CD pipeline | Davide Cioccia | 26m |
Claims a working pipeline that automates MSTG and MASVS into BDD tests and integrates those tests into CI/CD with Jenkins and Docker. It actually wires UI… | ||
| Fixing Mobile AppSec | Sven Schleier | 29m |
The talk explains the MASVS and MSTG standards for mobile app security on iOS and Android, specifying concrete requirements and test cases for data storage… | ||
| Threat Model-as-Code | Abhay Bhargav | 34m |
Claims an open-source tool called Automaton — Threat Modeling as Code that keeps threat models as YAML, links YAML user/abuser stories to concrete threat… | ||
| Ecosystem, Interoperability and Standards: IoT Security | Sumanth Naropanth, Kavya Racharla | 31m |
Claims an IoT-tailored Security & Privacy Development Lifecycle (SPDL) and a privacy score called CPVSS; demonstrates concrete failures: a tiny script plus a… | ||
| Deserialization: what, how and why [not] | Alexei Kojenov | 34m |
Code runs live showing Java native serialization bytes and base64 signatures, a hex edit of a base64 session cookie to flip role to administrator, crafted… | ||
| Pentesting Swift Application with OWASP iGoat | Swaroop Yermalkar | 15m |
Demonstrates a Swift 4 rework of OWASP iGoat with live demos and a Docker server so lessons run locally and on AWS The talk shows concrete bugs found in real… | ||
| Deserialization Vulnerability Remediation with Automated Gadget Chain Discovery | Ian Haken | 32m |
Claims an approach that automatically finds real exploitable chains across an entire Java classpath and ships as a FOSS toolkit called Gadget Inspector. It… | ||
| Serverless Infections: Malware Just Found a New Home | Erez Yalon | 34m |
Claiming the first-ever RCE stored and viral PoC, the team implements a payload on Amazon Lambda that reads the Lambda task root, compresses and curls entire… | ||
| Breaking fraud & bot detection solutions | Mayank Dhiman | 35m |
Browser fingerprinting and user behavior tracking run as JavaScript snippets (for example fingerprint.js) and claim to detect bots but rely on signals that are… | ||
| Flying Above the Clouds: Securing Kubernetes | Jack Mannino | 53m |
Kubernetes control plane compromise gives full cluster control (example: exposed API led to cryptomining), so the talk emphasizes concrete defenses: enable… | ||
| Battle Tested Application Security | Ty Sbano | 33m |
Shows that static analysis can spit out 50,000 static analysis findings and explains triage that narrows those to real vulnerabilities, maps pipelines like… | ||
| Single Page Applications: Is your design secure? | Rafael Dreher, Murali Vadakke Puthanveetil | 30m |
Demonstrations show a simple script extracting tokens from Chrome storage and an XSS payload reading those tokens from storage to exfiltrate them, proving XSS… | ||
| Human factors that influence secure software development | Anita D'Amico, Chris Horn | 43m |
Retrospective analyses across four repositories find concrete predictors: unfocused contribution increases vulnerabilities (developers editing many files… | ||
| Authentication as a Microservice: Portable Customer Identity Management | Brian Pontarelli | 38m |
Argues for replacing session state with JSON Web Token payloads verified by RSA or HMAC, warns about the “none” and HMAC->RSA key tricks, and recommends… | ||
| How to get the best AppSec test of your life | Josh Grossman | 32m |
Opt for a transparent box test: hold a scoping meeting with devs/architects, ask for an example report, and give source access so testers tailor payloads… | ||
| nothing matches | ||