OWASP 20th Anniversary 2021
2021-09-24
-- online --
as the organisers put it
OWASP 20th Anniversary on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
who it's for
application security engineers, security researchers, devops engineers, software developers, security managers, open source project maintainers, security educators
topics
OWASP Top 10 2021; Application Security Verification Standard; CycloneDX SBOM format; Dependency-Track supply chain analysis; Dependency-Check evidence identification; Threat modeling CI/CD pipelines; Mobile Security Testing Guide; CSRF and XSS mitigations; OWTF pentest orchestration tool; Security Shepherd gamified training; Security chaos engineering; JWT parsing and validation
| title | author | length |
|---|---|---|
| Keynote: Who Deserves Cybersecurity? Expanding Our Circle of Care | Eva Galperin | 52m |
Claims that AVs miss commercial stalkerware (about a 60% hit rate on early tests) prompt formation of a coalition of EFF plus nine organizations, a tight… | ||
| Keynote: 20:20 The History and Future of OWASP | Mark Curphey | 51m |
A founding story: a Wall Street Journal XSS at Charles Schwab sparks a no-plan launch of OWASP, the original static guide mutates into a wiki, and projects… | ||
| Keynote: AppSec: From Outsiders to Allies | Chris Wysopal | 56m |
Narrative traces a concrete arc: early bug research finds broken access control in Lotus Domino that still tops OWASP years later; vendor coordination leads to… | ||
| Keynote: Our Secure Future | Jaya Baloo | 01h 14m |
Ransomware now looks like a professional ransom‑as‑a‑service industry with call centers and infrastructure, and defenders lag on basics; the practical fixes… | ||
| Keynote: Philippe De Ryck - AppSec is too hard? | Philippe De Ryck | 53m |
Modern AppSec fails on concrete details: JSON Web Token libraries expose six parsing methods so developers accidentally accept unsigned tokens — an alg=none… | ||
| Flagship Projects: CSRFGuard | Albert-Tóth István | 35m |
CSRFGuard is a concrete anti‑CSRF library that now supports stateless web apps and offers token per page and single‑use tokens, automatic token injection into… | ||
| Flagship Projects: Security Shepherd | Sean Duggan | 28m |
OWASP Security Shepherd is a gamified CTF framework that presents real web and mobile vulnerabilities and ships as a Docker image or a VirtualBox VM running a… | ||
| Flagship Projects: Dependency Track | Steve Springett | 25m |
Dependency Track claims to ingest, analyze and produce software bills of materials at high velocity and it is Apache 2.0 licensed with about 4 million Docker… | ||
| Flagship Projects: OWTF Flagship Project | Saurabh Nandedkar | 13m |
OWTF is a Python-based pentest orchestration tool with Docker install and standard Python install options, a React web UI plus CLI, and a REST API for… | ||
| Flagship Projects: CycloneDX | Steve Springett, Patrick Dwyer | 26m |
CycloneDX presents a claim: a lightweight SBOM format born in 2018 with yearly releases and an active 1.4 draft, focused on inventory, integrity and provenance… | ||
| Flagship Projects: Top 10 "The making of the OWASP Top 10 and beyond" | Brian Glas | 26m |
Explains how the OWASP Top 10 2021 is derived from the largest dataset yet, combining raw incidence rate with a new coverage factor, CVSS exploit/impact… | ||
| Flagship Projects: Dependency-Check | Jeremy Long | 29m |
OWASP Dependency-Check claims to find known vulnerable components by matching dependencies against the NVD and OSS Index, using evidence-based identification… | ||
| Flagship Projects: Application Security Verification Standard | A. van der Stock, J. Manico | 24m |
ASVS claims to be a testable standard with verifiable requirements used for code review, architecture and QA rather than just awareness material. Version… | ||
| Flagship Projects: DefectDojo | Matt Tesauro, Aaron Weaver | 29m |
OWASP DefectDojo claims to consolidate and dedupe findings from many scanners and it actually ingests 100+ tool parsers into a Django/Python backend with a… | ||
| Flagship Projects: Cheat Sheet Series | Jim Manico | 11m |
The OWASP Cheat Sheet Series moves off the old wiki into GitHub automation, running hundreds of contributors through scripted editing and review, and maintains… | ||
| Flagship Projects: Amass | Jeff Foley | 29m |
Amass claims to produce the most complete internet-facing inventory by ingesting OSINT, probing with DNS/TLS/web techniques and attack surface mapping, storing… | ||
| Flagship Projects: Cloud-Native Application Security Top 10 Flagship Project | Ron Vider | 21m |
OWASP launches a community-driven cloud native application security top 10 that lists ten concrete risks, not abstractions, with each entry naming attack… | ||
| Flagship Projects: ModSecurity Core Rule Set | Christian Folini | 29m |
A ready-to-run rule set on the ModSecurity engine that removes common automated exploits: a Burp test of ~4M requests drops ~80–90% of reported weaknesses… | ||
| Flagship Projects: Top 10 "Intro of Top 10" | Andrew van der Stock | 29m |
OWASP Top 10 2021 is released with analysis of 515,000 applications and concrete changes: injection drops from A1, cross-site scripting and JS injection are… | ||
| Flagship Projects: Web Security Testing Guide | Matteo Meucci | 20m |
OWASP Web Security Testing Guide presents a concrete, versioned checklist, downloadable PDF and sample tests that target authentication, cross‑site scripting… | ||
| Flagship Projects: Security Knowledge Framework | Glenn ten Cate | 26m |
The OWASP Security Knowledge Framework claims to turn ASVS and MASVS into actionable work by using an expert wizard that picks from 300 ASVS requirements, by… | ||
| Flagship Projects: Software Assurance Maturity Model (SAMM) | Bart De Win | 28m |
OWASP SAMM is a versioned software assurance maturity model with a live online assessment tool that replaces ad-hoc PDF/Excel surveys. It provides automated… | ||
| Flagship Projects: Juice Shop | Björn Kimminich | 24m |
Shows that OWASP Juice Shop is a playable vulnerable e‑commerce app with 100 hacking exercises and about 20 live coding challenges that load the real source… | ||
| Flagship Projects: ZAP | Simon Bennetts | 27m |
ZAP 2.11.0 delivers a YAML-driven automation framework with GUI editing and runnable tests (demo spider test expects 100 urls and actually finds 126), a new… | ||
| Flagship Projects: Mobile Security Testing Guide | Carlos Holguera, Sven Schleier | 19m |
OWASP mobile guidance moves from slow manual releases to a fast automated pipeline that builds PDFs and 12–13 translations in under two minutes, and converts… | ||
| Standard Classification: Automate Security, Don't Tell Your Boss | M. Tesauro | 27m |
Automates security work with a concrete pipeline: intake, triage, run tests, normalize into Defect Dojo, and push to Jira so results flow instead of piling up… | ||
| Standard Classification: Fight Club | Grow your Chapter | Sam Stepanyan, Tom Brennan | 30m |
OWASP chapter advice focuses on concrete wins not platitudes: London grows to 1,000 members and routinely draws 100–300 attendees; capture‑the‑flag events… | ||
| Standard Classification: DevSecOps in 2031: How robots and humans will ... | S. Streichsbier | 27m |
An explicit roadmap and specific claims decide whether to watch: a semi‑sentient hacker AI has compromised 95% of critical apps, the industry moves to typesafe… | ||
| Standard Classification: Back to Basics: Looking for subtle bugs in beginne... | Cole Cornford | 13m |
Shows concrete failures: an authentication bypass via fail-open logic where a constructor defaults a flag to false and five authentication methods let requests… | ||
| Standard Classification: Purple Teaming with PurpleTeam | Kim Carter | 25m |
PurpleTeam is a security regression testing CLI and SaaS for web apps and APIs that runs headless in build pipelines or with a UI, built as NodeJS… | ||
| Standard Classification: Live Q&A Session | Troy Hunt | 31m |
A live Q&A explains what was built and what actually works: a searchable breach service holding 11.5 billion records with a domain search used by half the… | ||
| Standard Classification: Birds & Buttons - Cyber Risk Success Criteria for Board ... | S. Tan | 28m |
Research from more than a thousand CxOs condenses into five executive questions (what data matters where it lives who can access it how it is protected and how… | ||
| Standard Classification: Security Chaos Engineering - Turning the Tide in ... | A. Rinehart | 23m |
Claims that Security Chaos Engineering moves security from hope to measurable practice and demonstrates it with a working toolkit and experiments. Uses an open… | ||
| Standard Classification: Achieving Security by Shifting Left in Agile | Bhushan B Gupta | 27m |
Claim: security belongs in the backlog as concrete stories with acceptance criteria, not as vague "examples." The process embeds STRIDE prioritization and… | ||
| Standard Classification: Threat Modeling the CI/CD Pipeline to Improve Softwar... | D. Cornell | 28m |
Shows that CI/CDs have a fractal attack surface illustrated by SolarWinds and Codecov incidents, explains failed netflow monitoring and a successful… | ||
| Standard Classification: Everything You Always Wanted to Know About Finge... | N. Nikiforakis | 29m |
Claims that extensions leak identity via three concrete vectors: web-accessible resources, DOM side effects and a new CSS-based extension fingerprinting… | ||
| Standard Classification: How To Review Code For Vulnerabilities | Vickie Li | 28m |
The session gives concrete review steps: use an IDE with global and regex search, run quick terminal scripts, and combine SAST SCA and secret‑scanners. Demo… | ||
| Standard Classification: Good Bot, Bad Bot: Characterizing Automated Brows... | N. Nikiforakis | 29m |
A deployable system called Aristeus honeysites runs 100 fresh domains for seven months and records 26.4M requests and 200 GB from ~287K IPs, producing concrete… | ||
| Standard Classification: Rough Consensus - An OWASP Story | Jeff Williams | 27m |
Claims that software security labels will fix market failure by making security visible and that prototypes plus dozens of studies and meetings with NIST and… | ||
| Standard Classification: What Shall We Do With a Vendor SBOM? | Wendy Nather | 26m |
SBOMs arrive as concrete inventories and demand decisions: use them for pre‑procurement gating (license and provenance checks), for annotated vulnerability… | ||
| Standard Classification: Top 10 Privacy Risks 2021 | Florian Stahl | 23m |
OWASP publishes Top 10 Privacy Risks 2021 v2.0 after a yearlong update, using OECD principles and a structured risk rating that combines frequency and impact… | ||
| Standard Classification: Introducing graph theory to Policy-As-Code | Barak Schoster | 26m |
Checkov builds an in-memory DAG of infrastructure as code and runs graph policies that traverse dependencies to catch multi-resource misconfigurations, not… | ||
| Standard Classification: Connecting the Dots: How Threat Intelligence Protect... | C. Curelaru | 27m |
Claims a working CTI program that turned monitoring into action by building an onboarding service and alert pipeline, integrating Recovery Future feeds with an… | ||
| Standard Classification: Application Gateway: What is it and how can you ... | G. Frei | 24m |
A concrete system description: an OWASP reverse proxy called Application Gateway implements session management and federated login using OpenID Connect (plus… | ||
| Standard Classification: Stop the looters: method to detect digital skimming a... | N. Alexiou | 28m |
Claims a concrete detection method: compute one-way SHA-256 checksums of inline and referenced JavaScript, store baseline hashes, and alert when a script’s… | ||
| Standard Classification: API Security Top 10 - A Beginner's Guide to Mitigation | I. Mauny | 31m |
OWASP API Security claims that APIs drive major breaches — IBM links 60% of cloud breaches to misconfigured APIs — and the Parler leak exposes 70 terabytes via… | ||
| Topics of Interest: Effective Usage Analysis: The Shortest Path Between a Developer ... | R. Elron | 30m |
Claims a study of hundreds of Java .NET Python and JavaScript projects finds about 70% ineffective reported vulnerabilities; implements vulnerability… | ||
| Topics of Interest: Automatic Vulnerability Remediation: The Trusted and Secure Road ... | R. Elron | 30m |
Claims that automatic remediation generates safe, human‑looking code, preserves functionality, and measurably reduces unattended issues; demonstrates fixes for… | ||
| Topics of Interest: Unlocking Mobile App Security Secrets | Jan Seredynski | 31m |
Demo shows walking through walls in Among Us by invoking a revive/die function and using a memory scanner to change Tamagotchi diamonds, claiming the scanner… | ||
| Topics of Interest: React Native Security. Addressing typical mistakes | Julia Potapenko | 23m |
React Native increases attack surface by adding Facebook and optional JS engines so vulnerabilities in Hermes vulnerabilities found matter to apps. Platform… | ||
| Topics of Interest: Five philosophies to building better application logs | Veronica Schmitt | 23m |
A concrete claim: the five philosophies (simplicity, tagging/metadata, hygiene, assume compromise, device-aware storage) produce forensically useful logs… | ||
| Topics of Interest: Creating an IoT-connected Mobile App Compliance Program... MASVS | B. Reed | 30m |
Claims a working certification built on OWASP MASVS and MSTG, not a new theory: a 19‑page application profile plus a test‑case library whittles MASVS’s ~80… | ||
| Topics of Interest: These are the Vulns You are Looking For: AppSec Champions & Jedi... | J. Dickson | 26m |
Nine months of structured research surveys 26 companies and produces concrete findings: mature programs use SAST DAST SCA, most take about a year to build, and… | ||
| Topics of Interest: Attacking the microservice systems: methods and practical tips | A. Barabanov | 30m |
A concise checklist and concrete findings help decide: a fragile npm JWT library at version 0.1.1 with no signature verification infects seven microservices; a… | ||
| Topics of Interest: Scaling AppSec through Education | Grant Ongers | 31m |
Claims that security teams are outnumbered 100:1 and that 50–80% more bugs surface in code review than in testing drive a programmatic approach: measure… | ||
| Topics of Interest: Automated Finding Correlation where do SAST, DAST and ... | R. Klein, E. Worcel | 24m |
Built an automated correlation service that matches IAST, DAST and SAST findings and runs them against the OWASP Benchmark. IAST hits 100% on the benchmark… | ||
| Topics of Interest: Post-DevOps, what should we shift-left? | Riotaro Okada | 26m |
Shows concrete results from the Hardening Project, an 8-hour security competition with 100+ participants split into 10–12 teams, live scoreboard, purchasable… | ||
| Topics of Interest: vAPI: Vulnerable Adversely Programmed Interface (API Top 10) | T. Kulkarni | 23m |
A runnable vAPI lab reproduces the OWASP API Top 10 2019 as ten sequential exercises that yield a flag when exploited. The environment is vAPI lab with 10… | ||
| Topics of Interest: An Attackers View on APAC's 2021 Three Major Breaches | Ric Campo | 25m |
Covers three 2021 APAC breaches summarized from IHaveBeenPwned and public reports: Raychat leaks ~938,981 records (some reports say 150 million records)… | ||
| Topics of Interest: Building Diversity into AppSec | Zoe Braiterman, Loredana Mancini, Vandana Verma Sehgal, Aastha Sahni, Jessica Gottsleben | 45m |
Panel lists concrete outputs and next steps: free global trainings and mentorship programs, infosec girls and infosec kids chapters spun up, a developer… | ||
| Attacking the microservice systems: methods and practical tips | A. Barabanov | 28m |
Claims that microservice architectures reshape the attack surface and shows concrete assessment patterns: run SAST (bandit), dependency scans (safety), secret… | ||
| Top 10 Challenges for DevSecOps | Gary Robinson | 26m |
A concise, actionable checklist: a Top 10 challenges list distilled from work with hundreds of companies since 2015 that names concrete failures — hooking… | ||
| How Security, Development & Testing can work together to stop ... | S. Chaplin | 27m |
OWASP 2021 draft analyzes 500,000 applications and expands scope to roughly 400 CWEs, introducing insecure design (a cluster of ~40 CWEs) while merging… | ||
| Kubernetes Security: Attacking and Defending K8s Clusters | Magno Logan | 29m |
Shows a concrete RCE against an outdated Drupal pod that leads to container escape, worker‑node takeover and cloud API key theft used to mine cryptocurrency… | ||
| Common Application Security Mistakes that Enable Automated Attacks | Jason Kent | 27m |
Analysis of billions of transactions finds concrete root causes: exposed swagger and wp json specs, forgotten v1 endpoints, verbose error messages, predictable… | ||
| Common NGINX Misconfigurations That Leave Your Web Server Open ... | S. Pearlman | 21m |
Detectify researchers download and analyze 50,000 nginx configs with Google BigQuery and shell tooling and report concrete findings: a global missing root… | ||
| Security begins with secure development environments | V. Verma, S. Coochin | 21m |
Snyk discloses concrete VS Code extension flaws that enable remote code execution by tricking a developer to click a link; the demo targets the instant… | ||
| Software Security Engineering (Learnings from the past to fix ...) | D. Mohanty | 39m |
Claims that known bug classes persist for ~20 years and that it is possible to eliminate them across an organisation and reach 99.99% security resilience… | ||
| AWS (mis)configuration from an attacker’s-eye view | Kavisha Sheth | 26m |
Quick, practical tour of real AWS misconfigurations with live demos and measurable results: uses aws-cli and the IAM Policy Simulator to enumerate privileges… | ||
| Costly mistakes in serverless computing | Miguel A. Calles | 28m |
Built a serverless app on AWS using Route53 S3 CloudFront API Gateway Lambda DynamoDB and it works but exposes concrete failures: accidental input-injection of… | ||
| Using binary search algorithms for blind sql injection | Juan Pablo Quiñe Paz | 32m |
Applies a binary search algorithm to boolean blind SQL injection and shows concrete gains versus character‑by‑character queries, implemented as a Python script… | ||
| Hack Your APIs in 15 Minutes or Less | Himanshu Dwivedi | 26m |
Claims that hackers routinely exfiltrate large volumes of data from Shadow APIs in about 15 minutes by decrypting an app, decompiling it, and extracting URLs… | ||
| Security Metrics: Protecting Our Digital Assets of the Future | Caroline Wong | 25m |
A concrete metric is defined: defect density (vulns per million LOC) and used to align dev and execs; a concrete target of 20% reduction goal achieved across… | ||
| Agile Threat Modeling with Open-Source Tools | Christian Nils Schneider | 30m |
Claim: Threagile turns threat models into YAML model as code that live in Git, generate diagrams and reports, and track mitigations. It runs as a CLI and REST… | ||
| Your code might be secure, but what about your pipeline? ... | M. Szydłowski | 26m |
Claim: CI/CD components are the weak link — misconfigured CI, SCM or artifact stores let attackers bypass code review and inject artifacts. Evidence: common… | ||
| Developers Struggle with Application Security (and How to Make ...) | S. Gerlach | 27m |
Claim: developers struggle because tooling, process, and trust are misaligned and security teams create bottlenecks. Recommended fixes are concrete: treat… | ||
| Running a local Chapter | Serge Borso | 28m |
Chapter needs: steady speakers, sponsors and a small volunteer board (about six active helpers) to handle venues, vetting and outreach. Expect to pay for… | ||
| All your Ether belong to us (Hacking Ethereum-based DApps) | L. Q. Gonzales | 26m |
Live demos deploy Solidity contracts to a local test chain via Remix and Web3 (v3.js) with MetaMask and successfully exploit them. The talk shows calldata… | ||
| Redefining Threat Modeling: Security team goes on vacation | Jeevan Singh | 29m |
Claims that a structured program trains engineers to own most threat models using STRIDE and three staged workshops, then phases of observation, review and a… | ||
| Security As Code - The New Model Of Achieving Security At Scale | Chenxi Wang | 23m |
Argues for moving security into policy as code with a concrete pipeline: author, test, deploy, monitor and remediate; names infrastructure as code examples… | ||
| The future of Dev[Sec]Ops transformation | Larry Maccherone | 30m |
Decides on concrete claims: a tested Comcast prototype that scales to 600 development teams and ~10,000 developers, a reported 85% reduction in risk, and a… | ||
| OWASP ESAPI – A Retrospective: The Good, the Bad, & the Ugly | Kevin Wall | 24m |
Project history and concrete outcomes matter: ESAPI starts as interfaces plus a bundled reference implementation, that bundling creates brittle coupling and… | ||
| Over 20 Years of SQL Injection Attacks in the Wild - Time to Refine and ... | Or Katz | 25m |
Claims that CDN logs classified as SQL injection attacks plus NLP and data‑mining produce usable rules and insights: a five-step process cleans and tokenizes… | ||
| Preventing an OWASP Top 10 in the world of AI | Aaron Ansari | 25m |
Claims a working exploit of prompt injection where a chatbot learns a provided filename like malicious.exe and later serves it back as an action item, and… | ||
| Code-Origin Policy: Towards a Formal User Privacy Protection for the Web | Phu H. Phung | 27m |
Claims a code-origin policy that mediates JavaScript at runtime by tracking the code’s source, enforces per-origin permissions (cookies, network, DOM) and lets… | ||
| OWASP Nettacker Project Presentation | Sam Stepanyan | 26m |
OWASP Nettacker presents a Python multi-threaded network scanner that combines port scanning, vulnerability checks and brute forcing into reusable profiles and… | ||
| It's Not Your Developers' Fault | Edwin Kwan | 27m |
Claim: modern breaches often stem from cloud and supply‑chain realities not developer sloppiness. Teams now assemble 98% open‑source by component count — one… | ||
| Objects In The Rear View Mirror Are Closer Than They Appear | Erez Yalon | 24m |
Claim: cloud native complexity raises real exploitable gaps by gluing code, SCA, SAST, container scans, Kubernetes and IaC (Terraform, CloudFormation) so… | ||
| Achieving the Web Isolation Nirvana - How far along are we? | Jasvir Nagra, Pedro Fortuna | 30m |
Shows a runnable client-side sandbox that is embeddable and requires no browser modification, demonstrates a plain compromised third‑party script exfiltrating… | ||
| Your company, as a Knowledge Graph - the foundation of cybersecurity’s future | O. Cical | 24m |
Claims that merging a knowledge graph with cloud security posture management yields a Security Knowledge Graph that maps multi‑cloud entities, supports… | ||
| Decoded: Leverage Cybersecurity as a Business Enabler | Nicole Dove | 20m |
Claims a concrete playbook: a three‑pronged alignment accountability awareness strategy, a listening tour to change audit behavior, and operationalized… | ||
| The future is simple - introducing the CRE | Rob Van Der Veer, Spyros Gasteratos | 28m |
Official go live of the Common Requirement Enumeration (CRE), an interactive linking platform that maps requirements across ASVS, Testing Guide, NIST, PCI‑DSS… | ||
| Bot or human? Detecting malicious bots with machine... | Benjamin Fabre, Antoine Vastel | 23m |
Claims a production engine that ingests billions of signals and combines client‑side fingerprints and server‑side TLS/HTTP attributes to spot advanced bots… | ||
| Looking at 4 years of web honeypot attacks: tactics, ... | Malcolm Heath, Raymond Pompon | 26m |
Collection covers over 9 million events across ~52 months from hundreds of web honeypots, ingesting about 11,000 events/day into a Python/pandas/Jupyter… | ||
| Blockchain-based Security Framework for Cyber Physical Systems (BSF-CPS) | A. Vyas | 27m |
Proposes a hybrid open and consortium blockchain to federate CPS actors, with smart contracts verifying device-signed payloads and a nonce-per-request to… | ||
| AppSec Timeline: Wins, Failures, Promises, and Predictions | Joseph Feiman | 30m |
Stats: 32% information leakage, 18.3% cross-site scripting, 20% insufficient transport protection, multiple severe flaws per site and 7.3 HTTP response… | ||
| nothing matches | ||