Building an AppSec Program with a Budget of $0: Beyond the OWASP Top 10
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 10:15· Westminster- 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Claims that a complete AppSec program can be built with zero budget using OWASP projects and a small staff; concrete components and steps matter. Use ASVS and SAM for requirements and roadmap, Proactive Controls and Cheat Sheets for developer guidance, and hands‑on apps like deploy Juice Shop with one‑click Heroku for training. Add Dependency‑Check to CI and ZAP for testing, pilot Threat Dragon for threat modeling, and put ModSecurity + CRS at the edge; plan for ~4.5 FTEs to roll out.
AI-written summary · about
chapters (19)
- 0:00Start
- 0:51Application Security Podcast
- 1:48Traditional App Sect Programs
- 6:16Scale of Project Risk
- 7:39Awareness
- 8:01The Automated Threat Handbook
- 9:04Proactive Controls
- 9:56Automated Threat Handbook
- 16:53Process and Measurements
- 18:52Threat Modeling
- 20:01The Owasp Testing Guide
- 21:20Program Metrics
- 21:43Deployment Advice
- 22:21App Threat Modeling
- 24:23Tools Section
- 26:29Dependency Check
- 27:33Dependency Tracker
- 32:23Security Knowledge Framework
- 33:10Final Thoughts
related talks
08mRunning an Appsec Program with Open Source Projects"
26mHow to Build an Application Security Program
29mAppSec on a budget
36mApp Security Does Not Need To Be Fun: Ignoring OWASP To Have A Terrible Time
28mSecurity Does Not Need to Be Fun: Ignoring OWASP to Have a Terrible Time
41mThe AppSec Poverty Line: Minimal Viable Security (Tanya Janca)
57mKeynote: Maturing Your Application Security Program
36m5 Steps to Drive Enterprise Software Security