AppSec: From the OWASP Top Ten(s) to the OWASP ASVS

on YouTube ↗52m

" summary

Claims that the OWASP Top Ten is only entry-level awareness and contrasts it with OWASP ASVS v4.0, a 180+ requirement standard for testing web and API controls. Gives concrete fixes: use parameterized queries for SQL, stop deserializing untrusted data, disable XML external entities, enforce HTTPS and KMS-backed crypto, store passwords with salts plus bcrypt/scrypt/Argon2, check breached credential lists and require MFA, run dependency scanners and continuous security tests (SSL Labs, dependency-check, NIST 800-series guidance).

AI-written summary · about

" chapters (8)

1. 0:00Start
2. 11:04Broken Authentication and Session Management
3. 35:15Sensitive Data Exposure
4. 39:51XML External Entity (XXE)
5. 42:08Broken Access Control
6. 44:12Security Misconfiguration
7. 45:05Cross Site Scripting (XSS)
8. 48:06Insecure Deserialization

" related talks

• 01h 02mFrom the OWASP Top Ten(s) to the OWASP ASVSJim Manico · NDC London 2020
• 41mFrom the OWASP Top Ten(s) to the OWASP ASVSPhilippe De Ryck · GOTO Berlin 2018
• 43mFrom OWASP top 10 to Secure ApplicationsRoberto Velasco · Spring I/O 2019
• 58m: The OWASP Top Ten Proactive Controls 2018Jim Manico · NDC London 2020
• 35mGetting benefits of OWASP ASVS at initial phasesOleksandr Kazymyrov · NDC Oslo 2018
• 39mIntroducing the ASVS 4.0Andrew van der Stock · nullcon Goa 2019
• 22mAre you safe from OWASP #11?Matt Tesauro · Global AppSec US 2021 Virtual
• 23mWeb Application Security - owasp top 10 vulnerabilitiesShan Jun Ng · FOSSASIA Summit 2017