Breaking and Fixing Web Application Security
summary
Claims that 85,000 applications contain major flaws and that 83% of web attacks trace to application weaknesses, and demonstrates concrete exploitation: a vulnerable PDF library enables SSRF to AWS metadata via Burp Collaborator, a brute‑forceable zip (oaps) exposes backups, and hardcoded AWS keys lead to EC2 compromise. Also cites real incidents (MoveIt, LastPass, T‑Mobile, ChatGPT) and recommends software composition analysis, vulnerability scanning, threat simulation and tighter secret management with measurable results.
AI-written summary · about
chapters (14)
- 0:00Session introduction
- 2:58Security architecture layers
- 6:13Perimeter and network defense
- 9:41Endpoint and access control
- 12:14Application security essentials
- 22:00Data security and management
- 24:51Prevention and threat modeling
- 29:14Operations and monitoring
- 30:40Rising application threats
- 34:18Breach impacts and trust
- 38:24Recent cybersecurity incidents
- 42:55Common development pitfalls
- 50:06Strategic security mindset
- 53:02Software composition analysis
related talks
59mPractical Security for Web Applications
30mHow to hack a web app?
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
46mLive hacking: Breaking into your Java web app
38mFinding Security Issues in Open Source
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders
41mLive Hacking: Breaking into Your Web App
51m10 things developers need to know about web application security