Are you safe from OWASP #11?
summary
Claims that OWASP Top 10 is a starting point not a ceiling and that many real failures live in the “#11” beyond it: a pen test finds a 12 minute outage from a single modified pagination parameter, practical fixes are use ASVS and SAM to measure and demand controls and focus on API-specific practice: build an API inventory by passive traffic monitoring then hook tests into CI/CD and run pre-prod active tests with detection, ticketing, or automated blocking.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:16Setting the scene
- 1:22What you missed
- 1:44The Top 10
- 3:39Top 10 Lists
- 4:20Pen Testing
- 6:02ASVS
- 8:22Ola SAM
- 9:45Oauth Cheat Sheets
- 11:40API Security Risks
- 13:24API Web Top 10
- 14:50API Security Posture
- 16:39API Inventory
- 17:21API Data
- 17:47Detect and Respond
- 19:10Active Testing
- 20:40Security Journey
related talks
52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVS
30mTop 10 Introduction
27mAddressing OWASP API Security Top 10 starts at design time
47mOWASP Top 10
30mBOLA, IDOR, MA, BFLA. Welcome to the OWASP API Top 10!
01h 02mUnderstanding the OWASP Top 10
58m: The OWASP Top Ten Proactive Controls 2018
51mBigger, Faster and More Secure