OWASP Global AppSec Virtual 2020
2020-10-22..2020-10-23
-- online --
as the organisers put it
The Open Web Application Security Project® (OWASP) is a nonprofit foundation that works to improve the security of software through open-source tools, expert education, and collaborative innovation.
who it's for
application security engineers, web developers, security architects, platform and devops engineers, engineering managers, incident responders, mobile developers
topics
software supply chain assurance; OWASP Top 10 adoption; static analysis and SAST tooling; OAuth2 and OpenID Connect for SPAs; API security and abuse; container attacks and defense; machine learning model attacks; cryptography misuse and exploits; application layer WAFs and sanitizers; mobile app security testing (MASVS/MSTG)
| title | author | length |
|---|---|---|
| Opening Remarks | Andrew van der Stock | 43m |
Organization states concrete targets and rules: over 280 chapters, 3,200 active members and 65,000 regular contacts, 190 projects; finance reform will end… | ||
| Keynote Presentation Balancing Core Conflicts A DevOps Story | Andrew Clay Shafer | 01h 01m |
Chronicle of concrete practices and wins not slogans: history of borg paper instrumentation that surfaces thousands of metrics, Puppet and EC2 automations that… | ||
| Keynote Presentation Survive Your Nightmare Security Incident and Thrive Again | Coleen Coolidg | 46m |
A company experiences a Labor Day 2019 account takeover exposing business contact and usage data but not end-user records and responds with concise near-term… | ||
| Keynote Presentation Software Defined Security Governance | John Steven | 01h 26m |
Argues that modern appsec needs concrete actions not slogans: developers adopt cloud, containers, terraform ansible helm and pipeline-as-a-service, which… | ||
| Keynote Presentation Blinded by “the weakest link” A New Perspective on Human Risk | Masha Sedova | 01h 07m |
Claim: human risk is the largest unsolved security problem and is measurable using existing logs and behavioral signals rather than generic training. Past… | ||
| Yes, you too can break crypto Exploiting common crypto mistakes | Alexei Kojenov | 54m |
Shows concrete exploits and working demos: a ransomware (Linux Encoder) recovers keys from predictable RNG seeded by file time; RC4 reuse xors two ciphertexts… | ||
| Why Developers Struggle with AppSec | Scott Gerlach | 28m |
The talk claims developers struggle because security decisions happen without context, appsec tools are built for security teams not engineers, and scans are… | ||
| Weakest in the herd EoL software and a journey to secure it | Anuprita Patankar, Aastha Sahni | 51m |
EoL software creates concrete, exploitable risk: legacy XP fuels large ransomware campaigns and WannaCry 2017 ~200,000 infected, Python 2 and Windows 7 reach… | ||
| WAFs! WAFs! We don't need no Stinkin' WAFs! Extending WAFs at the Application Layer | Bernardo San | 38m |
Claim: an application-layer sanitizer called san juan catches what network WAFs miss by validating inputs before app code runs. Implementation details: Java… | ||
| Supplier Risk Where OSS Collides With Vendor Management | JC Herz | 36m |
Argues that supplier risk outgrows simple SCA and moves to measurable supplier behavior: regulators demand software bill of materials, SPDX and CycloneDX… | ||
| Time for a Change Why It's More Important Than Ever to Revisit the CFAA | Casey Ellis | 46m |
Argues that the CFAA is chilling good‑faith research and points to concrete data: a Go security.txt scanner finds only 933 of the top 100,000 sites expose a… | ||
| Understanding the Threats and Attacks on Data Science Applications and Models | Abraham Kang | 33m |
Shows concrete threats: data poisoning via fake tweets and millisecond buy‑cancel orders that trick trading models, sensor spoofing in manufacturing, and… | ||
| Using the OWASP Top 10 As The Foundation for Security and Privacy Programs Across Your Organization | Marina Kelly | 32m |
Claim: the OWASP Top 10 serves as a concrete, language‑agnostic foundation to align secure‑by‑design, privacy‑by‑design, GDPR, CCPA and ISO 27001 controls… | ||
| Start me up, safe! | Ismael Goncalves | 35m |
Startups must know concrete steps not slogans: use the ASVS to turn requirements into testable rules, run dependency scanning (Dependency-Check, npm/yarn… | ||
| Social Media Botnet Detection with Linkage Analysis and Machine Learning | Rundong Liu | 29m |
Claims a behavior‑based linkage graph plus graph clustering and label‑propagation finds coordinated botnets at scale, not just topic signals. Pipeline builds… | ||
| Secure React Native Apps Against API Abuse | Skip Hovsmith | 45m |
React Native app reverse engineers reveal an exposed API key in unminified JS bundle and a proof‑of‑concept modified app that loops the getNearestShipment call… | ||
| Secure application design with high data privacy requirements | James Bohem | 40m |
Design decisions emphasize concrete controls not slogans for example separate identity from health data and store tokens or join records only when authorized… | ||
| Real World Static Analysis For Real Humans | Adrian Bravo, Nick Gonella | 51m |
Evaluates six vendors because Scala support is nonnegotiable, benchmarks tools against 46 known vulnerable samples, and targets roughly 20% false positive… | ||
| Real Time Vulnerability Alerting by Using Principles from the United States Tsunami Warning Center | Amol Sarwate | 44m |
A system that collects public feeds and social posts, weights signals and emits real‑time prioritized alerts is already built and running; it uses AWS Lambda… | ||
| Pwning WhatsApp The Dark Side Of Web based Messaging Apps | Gal Weizman | 29m |
Demonstrates concrete, working flaws: reply-text fabrication lets a sender craft a fake quoted message; rich-preview URL tampering creates an open redirect… | ||
| Purple Team Strategies for Application Security | Joe Schottman | 34m |
Concrete outcomes matter: the method pairs offensive and defensive work so red and blue share logs, replay tens of thousands of requests only for validation… | ||
| OWASP SAMM 2 Your Dynamic Software Security Journey | John Ellingsworth | 36m |
An overview of SAMM 2.0 that gives concrete claims and tools: SAMM 2.0 ships January 2020 with five functions and three maturity levels plus zero, mapping… | ||
| OWASP Top 10 Maturity Categories for Security Champions | Lucian Corlan, Gareth Dixon | 33m |
Claims a concrete tracking system: an Excel now and a web maturity categories app soon that scores ten contribution types with 1–3 points, shows belt colors… | ||
| Practical Mobile App Attacks By Example | Abraham Aranguren | 35m |
Live demos show a netcat + yes DoS via endless stream that crashes apps, plaintext SD storage leaking identities (one case risks death), XSS from concatenating… | ||
| Privacy Threat Modeling Analysis of Cloud Services Against Privacy Regulations | Farbod H Foomany | 41m |
Claims that regulation-driven privacy threat modeling for cloud services produces actionable requirements and LINDDUN and CPTM and Q-TTM methods map to… | ||
| OWASP IoTGoat Project Overview and Roadmap | Abhinav Mohanty, Parag Mhatre | 36m |
A deliberately built firmware image exposes concrete, testable failures: deliberately insecure OpenWRT image containing hard‑coded credentials, a persistent… | ||
| Overwhelmed by Vulnerability Triage Hear a Blend of Finest Best Practices | Eduardo Silva, Jorge Bastos | 33m |
Names actual tools and testing types, shows a three‑phase triage flow (pre‑analysis → target → release), and measures outcomes like false positives and false… | ||
| OSINT to Compromise | Frank Vianzon | 17m |
Demonstrates an end-to-end OSINT-to-compromise pipeline that moves from Lockheed Martin kill chain recon to exfiltration, showing concrete tools and artifacts… | ||
| MLSec Going Deeper | Abraham Kang | 38m |
Claims that adversarial samples hit nearly every model not just deep nets and demonstrates concrete attacks on k‑NN, Naive Bayes, linear classifiers, decision… | ||
| Mobile DevSecOps 5 Tips from Building Mobile Apps Used by Millions | Brian Reed | 30m |
Five case studies show what actually works: Uber (500M Android installs) and McDonald’s use a single codebase with feature flags and automated security gates… | ||
| OAuth2 and OpenID Connect for Single Page Applications | Philippe De Ryck | 37m |
Covers secure OAuth 2.0/OpenID Connect patterns for Single Page Applications: move away from implicit flow to Authorization Code Flow with PKCE, use… | ||
| OD approach to the champions dilemma | Péter Nyilasy, Timur Khrotko | 36m |
An organizational development program adds the missing glue: mandates no code into production without security review, embeds security across design… | ||
| Measure and Improve Software Supply Chain Assurance with OWASP SCVS | Steve Springett, JC Herz | 19m |
Claims a practical standard that measures and raises software supply chain assurance by requiring concrete controls: software bill of materials (SBOMs) for… | ||
| Magecart 2020 The New Face of XSS | Ameet Naik, Ido Safruti | 34m |
Research finds attackers inject obfuscated skimmers via writable S3 buckets, compromised open‑source libraries and look‑alike domains, affecting 70%… | ||
| Learn to Exploit TOCTOU Race Condition Vulnerabilities with OWASP TimeGap Theory | Abhi Balakrishnan | 32m |
Claims that TOCTOU (race) bugs are real beyond payments and demonstrates a working OWASP TimeGap Theory CTF (seven challenges, Dockerized) that reliably… | ||
| Knock knock, who's there Identifying assets in the cloud | Ben Sadeghipou | 48m |
Scans target cloud IP space at scale: a custom Go scanner plus go fingerprint and meg hit 535k /24s across 11 ports yielding 1.4 billion unique targets and ~28… | ||
| Does “diversity” really have an impact on software and security teams | Anita D'Amico | 20m |
A quick literature review claims that knowledge diversity improves software quality and adaptability by increasing shared mental models and productive… | ||
| Don’t Worry, Be API Addressing AppSec’s Modern Challenge | Erez Yalon | 30m |
Claims that API security is now modern app security and that access control is the biggest gap backed by concrete outcomes: an OWASP API Security Top 10 is… | ||
| Election Security The post pandemic acceleration of secure web based voting | Anita D'Amico | 48m |
Panelists list concrete changes not slogans: California upgrades voting systems across 58 counties replaced and requires paper ballots; the U.S. is tracking a… | ||
| Enabling Message Level Protection at Uber | Debosmit Debo Ray, Jovon Itwaru | 54m |
A central client‑side field‑level crypto library is built and deployed that uses AES‑GCM envelope encryption with key‑wrapping, integrates with Vault/AWS KMS… | ||
| Eradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants | Clint Gibler, Isaac Evans | 45m |
Argues that replacing mass bug hunting with enforced secure defaults and invariants removes whole classes of flaws, citing Microsoft’s ~41% reduction from… | ||
| Falling Water Vulnerability disclosure for Medical Devices | Veronica Schmitt | 37m |
Argues that medical-device disclosure must hinge on concrete actions not platitudes: manufacturers use a waterfall approach with long lifespans and 100%… | ||
| How the latest MASVS & MSTG Specs Make the Best Mobile Pen Testing Cocktails | Brian Reed, Tony Ram | 44m |
Covers specific MASVS & MSTG changes (webview storage, third‑party keyboards, platform features) with hard numbers — 85% fail OWASP Top Ten, 50% have insecure… | ||
| How to Break API's | Inon Shkedy | 35m |
Shows concrete attacks and tools: use Burp or Fiddler to create users copy session tokens and replay requests to prove BOLA (Broken Object Level… | ||
| How to select between SAST, DAST, IAST, RASP, and AST | Abraham Kang | 25m |
Static analysis scans all reachable code paths but produces high false positives and needs rules for niche frameworks; binary SAST finds third‑party binaries… | ||
| Insider Threat Detection & Automation by Behaviour Analytics | Hima Bindu Vejella | 23m |
Claims that user and entity behavior analytics (UEBA) uses supervised and unsupervised machine learning to baseline normal activity and emit a risk score for… | ||
| Detecting session hijacking using rotating refresh tokens in web applications | Rishabh Poddar | 14m |
Claims that rotating refresh tokens let the backend detect stolen sessions by issuing one-time refresh tokens and flagging reuse, and that combining very… | ||
| Date Classification with Serverless Functions | Yitao Wang | 30m |
Prototype automates classification inside an AWS account using AWS Lambda workers triggered by CloudWatch rules, DB audit logs or S3 events, and it samples… | ||
| Creating a Security Policy Framework That works | Isaac Painter | 23m |
Explains a working program: consolidate policies into one source of truth (indexed PDF library or SharePoint), enforce an annual review lifecycle with… | ||
| Containers Attack and Defense | Rohit Pitke, Emmanuel Law | 35m |
Claim: break out of a privileged container with a 140 character cgroup release_agent sequence that maps container paths to host paths and triggers a host-side… | ||
| Chinese Surveillance and CloudPets | Abraham Aranguren | 27m |
CloudPets’ backend exposes an unauthenticated MongoDB that leaks emails, password hashes and voice recordings for roughly 800000 users exposed; firmware… | ||
| Breaches Are Everywhere; What's a Good Security Leader to Do | Richard Greenberg | 28m |
The talk lists concrete benchmarks and controls: 279 days to detect and a 314‑day breach lifecycle, global average breach cost $3.9M, mega‑breach examples of… | ||
| Before It's Out the Door Securing Outbound Open Source | Eric Goldman | 37m |
Walks through concrete outbound-open-source steps: a linked repo of templates and a sample security.md and responsible disclosure policy, prescriptive checks… | ||
| AppSec is Dead Long Live DevSecOps! | Matias Madou | 38m |
A clear claim: one in three newly scanned apps has SQL injection and 22 years after discovery the bug still appears. Data points: 111 billion lines of code per… | ||
| Application logging in the era of GDPR | Karen Lu | 29m |
Shows concrete rules: log only what is necessary and justify each field, classify fields into high/medium/low sensitivity, and keep examples (SSNs and health =… | ||
| A Warrior's Journey Building a Global AppSec Program | Brian Levine | 44m |
Program outlines concrete benchmarks and tools: a 600‑developer org with 7 R D sites and ~150 products, an SSG sized 1–3% SSG to developers per Bsim/BSIM study… | ||
| A Dancefloor that is Literally Just Banana Peels – AppSec Awareness Program Pitfalls | Eugene Rojavs | 31m |
Practical takeaways: awareness works only when it targets actual stacks, measures baseline and progress, and has an owner and budget; a surprising 1:200 expert… | ||
| nothing matches | ||