OWASP Global AppSec Amsterdam 2019
2019-09-23..2019-09-27
Amsterdam, Netherlands
as the organisers put it
Global AppSec is coming September 23-28 2019 to the RAI Amsterdam. Designed for private and public sector infosec professionals, the OWASP three day training and two day conference equips developers, defenders, and advocates to build a more secure web.
| title | author | length |
|---|---|---|
| Closing Remarks | Martin Von Knobloch, Marvin Waschke, David Rook, Owen Pendlebury, Sebastien Deleersnyder, Lieven Desmet, Lars Cornelissen, Sjoerd Meijer, Edwin Gozeling, David Molnar, David Mathy, James Pullen, Joren Poll, Ricardo Vinhas Cunha, Riccardo ten Cate, Tim Webb, Tom Wirschell, Erlend Oftedal, Erik Cabel, Mario Heiderich, Niels Croese | 02m |
Thanks and reminders focus on logistics and community: long gratitude for volunteers and sponsors, mention of a return to Dublin next year and San Francisco in… | ||
| OWASP SAMM2: Your Dynamic Software Security Journey | Sebastien Deleersnyder | 46m |
OWASP SAMM2 is a concrete software security maturity model that defines measurable activities, four scoring levels (zero to mastery), and five business… | ||
| An Infosec Timeline: Noteworthy Events From 1970 To 2050 | Mario Heiderich | 01h 02m |
Chronological catalogue claims the first worm Creeper and counter‑worm Reaper, the NSA’s early IDS and Clifford Stoll’s honeypot that catches Markus Hess, the… | ||
| How Scripting In ZAP Can Bridge The Gap Between Dev Teams And Security | Peter Hauschulz | 41m |
Turns the claim that testers can bridge Dev and security into concrete steps: run a browser through ZAP as a proxy and watch the alerts tab populate with… | ||
| Being Powerful While Powerless: Elevating Security By Leading Without Authority | Nathan Yee | 39m |
A one‑person security role scales through code and relationships not titles: writing automation, running static analysis, managing vulnerable dependencies, and… | ||
| Controlled Mayhem With Cloud Native Security Pipelines | Ben Pick | 39m |
Cloud-native pipelines shift risk into orchestration and cloud layers and the concrete points matter: GitOps and GitOps workflows drive deployments, Spinnaker… | ||
| Mobile- Or Attacker-Friendly? A Security Evaluation Of Mobile-First Websites | Tom Van Goethem | 46m |
Large-scale crawl uses headless Chromium on one million sites and finds mobile versions arrive much later — median 6.8 years after desktop — producing 10,222… | ||
| The Now And The Future Of Malicious WebAssembly | Marius Musch | 31m |
A crawl of 1,000,000 sites and 3.5 million pages finds ~2,000 WebAssembly modules but only ~150 distinct binaries, with many tiny test modules and popular uses… | ||
| OWASP Docker Top 10 | Dirk Wetter | 50m |
An OWASP Top Ten for Docker that prioritizes actionable fixes, supported by hands‑on scans and an interactive simulator that reproduces failures. It covers… | ||
| Choosing The Right Static Code Analyzers Based On Hard Data | Chris Horn | 40m |
An independent benchmarking project produces a public catalog of static analyzers and a small web product at compare.tools that currently lists 73 tools. The… | ||
| Practical OWASP CRS In High Security Settings | Christian Folini | 41m |
CRS 3.2 plus ModSecurity on Apache proves able to stop active testers even when backend code is broken: Burp sends 4.5 million requests, default CRS already… | ||
| Web Apps vs Blockchain DApps (Smart Contracts): Tools, Vulns And Standards | Damian Rusinek | 40m |
Compares concrete failure modes and fixes rather than high-level history: common exploits include reentrancy, unbounded loops/gas exhaustion, unchecked… | ||
| Threat Modelling Stories From The Trenches | David Johannson, Andrew Lee-Thorp | 47m |
Six concrete failure stories from real production systems reveal where controls fail in practice: an mutual TLS vs XML signature mismatch that lets a client… | ||
| Modern And Secure IAM For Modern Applications | Vinod Anandan | 32m |
Argues for a central federated IAM instead of per-app auth and names OpenID Connect and JWT for identity tokens, PKCE for public clients and FIDO2 for… | ||
| Security Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities | Katy Anton | 41m |
Injection stays top of the list (OWASP Top 10 2017) despite 20+ years of knowledge, so the concrete moves matter: parametrize queries as the primary defense… | ||
| WebAuthn: Strong Authentication vs Privacy vs Convenience | Suby Raman | 44m |
WebAuthn replaces shared passwords with origin‑bound public keys, uses hardware-backed private keys, and requires explicit user consent; server code verifies… | ||
| Exploiting Hardware Glitches And Side Channels In Perfect Software | Herbert Bos | 51m |
Demonstrates concrete, bug‑free attacks: uses Rowhammer bit flips from JavaScript to change pointers and gain code execution in modern browsers (Edge/Chakra)… | ||
| Attacking AWS: The Full Cyber Kill Chain | Pawel Rzepa | 46m |
Walks through a repeatable AWS kill chain: SSRF to 169.254.169.254 exposes instance metadata and leaking role credentials, then PACU AWS exploitation framework… | ||
| Opening Remarks | 06m | |
-- no description -- | ||
| Knative Security Pipelines | Spyros Gasteratos | 43m |
Builds a Kubernetes-native security pipeline called Drakon that actually runs on Tekton pipelines and uses a protobuf message contract between producers and… | ||
| Secure Agile Development According To SAMM | Rob Van Der Veer | 34m |
OWASP SAM gets a narrowly scoped Agile extension: a published SAM Agile notes set that adds triggers and pick lists so story refinement yields specific… | ||
| OWASP Based Threat Modelling: Creating A Feedback Model In An Agile Environment | Chaitanya Bhatt | 44m |
Claims a practical PSC (policy standards controls) approach that maps InfoSec policy to 13 reusable standards and per-flow controls (e g limit sign‑in attempts… | ||
| Securing The Future | Mikko Hypponen | 45m |
Argues that the next crisis is cheap connected devices — if it’s smart it’s vulnerable — and gives concrete signs: telnet worms sweep exposed IoT, Linux IoT… | ||
| How Do JavaScript Frameworks Impact The Security Of Applications? | Ksenia Peguero | 34m |
Compares real code across hundreds of projects and finds that framework-level mitigations only help when they’re actually used: automated parsing and custom… | ||
| HTTP Desync Attacks: Smashing Into The Cell Next Door | James Kettle | 45m |
Demonstrates concrete HTTP request smuggling techniques that desynchronize front-end and back-end parsers by mixing Content-Length and chunked framing and by… | ||
| How To Learn (And Teach) Hacking | Ruben Gonzalez | 45m |
Explains concrete learning paths: read CS foundations, join CTFs, and use problem-based labs where students run a weekly CTF scoreboard and solve real… | ||
| Restricting The Scripts, You're To Blame, You Give CSP A Bad Name | Sebastian Roth, Ben Stock | 47m |
A longitudinal scan of 10,000 sites (2012–2018) shows CSP adoption rising but script restriction rarely effective: only about one third of policies touch… | ||
| Breaches Are Everywhere. What’s A Good Security Leader To Do?! | Richard Greenberg | 46m |
Breaches are rising, attackers often live in systems six to nine months, and average breach cost is about $3.86M with a million-record incident estimated at… | ||
| Unlikely Allies: How HR Can Help Build A Security-First Culture | Alison Eastaway | 44m |
HR frames concrete claims: collaborate with security to shape behavior, not just hand out training; design onboarding that publishes the CTOs phone number for… | ||
| [In]secure Deserialization, And How [Not] To Do It | Alexei Kojenov | 40m |
Live demos show Java deserialization can crash a Tomcat thread with a tiny serialized file and spin CPU to denial of service, Python pickle cookies can spawn a… | ||
| Five Key Trends In Application Security | Ameya Talwalkar | 37m |
Five concrete trends and why they matter: apps move across data centers public and private clouds, perimeter shifts to CDNs and often fragments across multiple… | ||
| SUSTO: Systematic Universal Security Testing Orchestration | Luis Saiz | 43m |
Proposes a concrete open source platform to systematize the long tail of security checks, claiming hundreds of reusable rules, plugin connectors to… | ||
| The State Of Credential Stuffing And The Future Of Account Takeovers | Jarrod Overson | 41m |
Credential stuffing relies on concrete numbers and tools: attackers start with 2.3 billion unique credentials from public dumps, use Sentry MBA or Browser… | ||
| How I Could Have Stolen Your Photos From Google | Gergo Turcsanyi | 28m |
Finds a Gmail invite parameter that accepts multiple emails with a crafted display name to spoof addresses and earns $500; discovers Google Slides exposes… | ||
| ScriptProtect: Mitigating Unsafe Third-Party JavaScript Practices | Marius Musch, Martin Johns | 39m |
Claims a concrete mitigation: a lightweight protection suite that protects against third‑party XSS, intercepts event handlers and script APIs, and integrates… | ||
| Do Certain Types Of Developers Or Teams Write More Secure Code? | Anita D'Amico | 43m |
Research claims: static analyzers individually find about ~14% of known vulnerabilities per tool and require aggregation; retrospective and concurrent studies… | ||
| The Insecurity Caused By Trusting Your Client-Side Storage | Ben Stock, Marius Steffens | 41m |
Client-side stores like cookies localStorage and IndexedDB lead to persistent client-side XSS when developer code later writes those values into the DOM. The… | ||
| The Security We Need: Designing Usable IoT Security | Damilare D. Fagbemi | 42m |
Argues that usable IoT security needs concrete mechanisms not slogans: a smart home often has 40 devices so secure defaults and zero-touch provisioning (device… | ||
| How To Find And Prevent Entire Classes Of Security Vulnerabilities | Sam Lanning | 34m |
A practical claim: describe a bug’s root cause, write a semantic code query that tracks data- and control-flow and run it across the codebase. Real results… | ||
| Fast Forwarding Mobile Security With The OWASP Mobile Security Testing Guide | Jeroen Willemsen | 45m |
A concrete checklist-backed program: a maintained MASVS + MASTG set of requirements with translations and growing government and industry adoption, plus a… | ||
| The Woman Who Squashed Terrorists: When An Embassy Gets Hacked | Chris Kubecka | 35m |
Embassy email compromise in 2014 reveals a rootkit visible in packet captures, an unpatched residential modem with password 123456, and extortion that… | ||
| nothing matches | ||