Leveraging OWASP in Open Source Projects
summary
CAS AppSec Working Group applies OWASP resources to Jasig CAS and shows concrete results: data‑flow diagrams and OWASP STRIDE threat modeling, plus static and dynamic scans. Analysis identifies 19 threats, yields about ten concrete proposals and a mix of documentation and code fixes, including a ticket-in-URI bug mitigated by changing to POSTs and logging hygiene and a change to disabled proxying by default that lands in the next release.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 0:30Who is this for
- 0:42Open Source is Secure
- 1:19CAVS
- 2:38CAVS Security
- 3:16COS Apps Tech
- 3:54Apps Tech Goals
- 4:50Working Apps
- 5:42Security
- 6:04Open Source
- 7:44Base of Security
- 8:06Moodle
- 8:51Top 10
- 9:34Top 9
- 19:28Our Experience
- 26:38Threat Libraries
- 29:18Information Disclosure Attack
- 32:56Remediation
- 36:24Results
- 37:14Challenges
- 38:12Volunteering
- 39:00Data Flow Diagrams
- 42:30Why Stride
- 42:49Strike Character Categorization
related talks
38mFree security resources that your competitors use!
26mOpenSec and Why WebAppSec Matters
45mOWASP for Developers
29mOWASP Open Application Security Curriculum
45mLeveraging Projects and Tools to Transform Your SDLC
51mKeynote: 20:20 The History and Future of OWASP
36mApp Security Does Not Need To Be Fun: Ignoring OWASP To Have A Terrible Time
27mSecurity Does Not Need to Be Fun: Ignoring OWASP to Have a Terrible Time