Top Ten Proactive Web Application Controls
summary
Project status: OWASP proactive controls in beta with a concrete checklist. Key claims and tools: use query parameterization to eliminate SQL injection, adopt OWASP Java Encoder and Mike Samuel’s HTML sanitizer for XSS-safe HTML, choose pbkdf2 and scrypt or HMAC with cryptographic isolation for password storage, expect GPU crackers at billions of hashes per second, prefer activity/attribute-based access control, deploy CSP, certificate pinning and certificate transparency for TLS.
AI-written summary · about
chapters (13)
- 0:00Project introduction
- 2:22Engaging developers
- 4:44Secure design strategy
- 9:58Defining requirements
- 13:27Privacy requirements
- 14:17Access control patterns
- 21:34Leveraging frameworks
- 24:16Identity and authentication
- 36:21Authentication workflows
- 40:56Content security policy
- 42:32SQL injection prevention
- 47:06XSS and input validation
- 55:51Encryption and SSL
related talks
50mTop Ten Proactive Controls
53mOWASP Top Ten Proactive Controls
58m: The OWASP Top Ten Proactive Controls 2018
54m10 commandments of secure coding
46mThe Path of Secure Software
01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017
53mOWASP Top 10: What are them and how to prevent them
01h 03mTen Key Steps for Enhanced Web App Security