OWASP Top Ten Proactive Controls
Talkat AppSec California 2015 · on Tuesday, 2015-01-27· at 13:45· Annenberg Community Beach House: Track 3, 415 Pacific Coast Hwy·
summary
Gives concrete fixes: use parameterize queries to eliminate SQL injection, encode output per context with the OWASP Java encoder or antixss, and sanitize WYSIWYG HTML with a formal HTML sanitizer. Recommend PBKDF2, bcrypt or scrypt with per‑user salt (examples use ~500,000 iterations), avoid ECB for AES (use GCM/CBC with unique IVs), and use certificate pinning/HSTS. Prefer permission‑based access checks not hardcoded roles (hardcoding hits ~5,000 locations), run dependency‑check, and deploy AppSensor style traps that flag intrusions in seconds.
AI-written summary · about
chapters (19)
- 0:00Start
- 10:02Crosstalk Scripting
- 14:01Overwatch Java Encoder
- 16:41To Do Input Validation on all Inputs
- 17:10Validating Comments in Cnn
- 19:46Access Control
- 20:04Add Access Control to an Application
- 23:19Authentication and Identity Controls
- 23:39Password Theft
- 29:52Forgot Password Workflow
- 31:41Application Security Verification Standard
- 32:36Six Data Protection and Privacy
- 32:53Data Protection and Privacy
- 35:08Hstf
- 35:32Ephemeral Cipher Suite
- 38:23Browser Error Messages
- 45:31Dependency Check
- 46:04Error Handling
- 49:58Security Requirements
related talks
50mTop Ten Proactive Controls
01h 01mTop Ten Proactive Web Application Controls
58m: The OWASP Top Ten Proactive Controls 2018
53mOWASP Top 10: What are them and how to prevent them
46mThe Path of Secure Software
26mStop Hitting Yourself: How to Prevent Common Attacks to your Application
56mHow to avoid vulnerabilities and adopt security best practices?
59mPractical Security for Web Applications