: The OWASP Top Ten Proactive Controls 2018

on YouTube ↗58m

" summary

Covers the OWASP Top Ten Proactive Controls with actionable specifics: use the ASVS three risk levels, ~200 controls to define requirements; run dependency scanning (OWASP Dependency-Check) on every build to avoid third‑party breaches (Equifax exploited a missed 72‑hour patch window); prevent SQL injection with parameterized queries; stop XSS with contextual escaping and DOMPurify plus server sanitizers; store passwords with bcrypt/scrypt/Argon2 (work factor ~13); sanitize uploads via ImageMagick rewrite and keep keys in a key vault.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 24:38Encode and Escape Data
3. 28:13Validate All Inputs
4. 52:06Enforce Access Control
5. 55:27Cryptographic process isolation
6. 56:51Handle All Errors and Exceptions

" related talks

• 50mTop Ten Proactive ControlsJim Manico · AppSecUSA 2013
• 41mFrom the OWASP Top Ten(s) to the OWASP ASVSPhilippe De Ryck · GOTO Berlin 2018
• 53mOWASP Top Ten Proactive ControlsJim Manico · AppSec California 2015
• 01h 01mTop Ten Proactive Web Application ControlsJim Manico · AppSec California 2014
• 46mThe Path of Secure SoftwareKaty Anton · Devoxx Belgium 2017
• 52mAppSec: From the OWASP Top Ten(s) to the OWASP ASVSJim Manico · GOTO Chicago 2019
• 53mOWASP Top 10: What are them and how to prevent themAyesh Karunaratne · DrupalCon Amsterdam 2019
• 47mOWASP Top 10Andrew van der Stock · OWASP AppSec California 2018