OWASP Global AppSec Singapore 2023
2023-10-03..2023-10-05
-- online --
who it's for
application security engineers, devops engineers, platform engineers, security engineers, incident responders, engineering managers
topics
LLM-assisted vulnerability remediation; supply chain incident response planning; API end-to-end security testing; developer account compromise attacks; security of machine learning systems; Coraza open source WAF; application security posture management; scratch container build tradeoffs; large-scale attack surface management; automated container vulnerability scanning; CI/CD secrets rotation and runtime injection; cross-tenant request forgery attacks
| title | author | length |
|---|---|---|
| Keynote: Using LLMs and generative AI to fix software vulnerabilities | Asankhaya Sharma | 57m |
Claim: LLMs can autonomously remediate many real vulnerabilities by combining models (StarCoder, CodeLlama, GPT‑4), commit‑based fine‑tuning, and… | ||
| Supply Chain Threats Deserve Their Own Incident Response Plan | Omer Yaron | 56m |
Most organizations lack a supply‑chain–specific incident response plan and standard playbooks, so the claim is that supply chain breaches require their own IR… | ||
| API Security Assurance via E2E Testing | Alex Mor | 55m |
Argues that API security becomes continuous by baking concrete checks into E2E suites, demonstrates a toy app called insecure Cuts, shows failing then fixed… | ||
| Hacking the software supply chain one developer at a time | Paul McCarty | 48m |
Claim: developer accounts are the weakest link and attacks on them rise ~740% since 2019 with automation. Evidence: 70% of devs skip security, 48% push code… | ||
| Security of Machine Learning Systems | Shain Singh | 53m |
Shows concrete attacks and engineering, not vague theory: live demos use published adversarial code to turn a golf ball image into a rifle with adversarial… | ||
| OWASP Coraza: Open Source WAF for Cloud Native Service Mesh | Zufar Dhiyaulhaq | 53m |
Coraza claims drop‑in compatibility with ModSecurity rules and the OWASP CRS and shows concrete integrations: a Go library embedding the SecLang engine, a… | ||
| Lessons Learned: A Retrospective on Application Security Failures | Iqbal Singh | 53m |
Argues that consolidating into Application Security Posture Management beats stitching SCA SAST secret and container scanners from many vendors, shows a live… | ||
| Scratch containers and the supply chain trouble | Naveen S | 49m |
Claims that scratch containers eliminate OS-layer risk meet experiments: Go static binary images drop reported issues from 675 vulnerabilities (Debian base) to… | ||
| Large-Scale Application Attack Surface Management | Fariskhi Vidyan | 45m |
Claims a working scalable ASM architecture at Traveloka that catalogs hundreds to thousands of hostnames, enriches each entry with routes, request/response… | ||
| CVE Overload: Scaling Container Vulnerability Scans | Lucas Ferreira | 55m |
Gets specific: a risk formula that combines CVSS EPSS and KEV reclassifies most highs into moderate and cuts critical counts after August, while automation… | ||
| Enhancing CI/CD Secrets Security: The 3Rs Approach | Bobby Lin | 49m |
Describes concrete fixes: after a real incident where a CI provider’s master private key was stolen the talk lays out the 3Rs — inventory and remove high‑risk… | ||
| Enterprise Application Risk Profiling | Alex Mor | 53m |
Starts from a single claim: a maintained inventory ranked by actual risk and updated in real time. It defines static / dynamic / real‑time layers, uses… | ||
| Breaking and Fixing Web Application Security | Antara Mane | 55m |
Claims that 85,000 applications contain major flaws and that 83% of web attacks trace to application weaknesses, and demonstrates concrete exploitation: a… | ||
| Cross-Tenant Request Forgery Attack in Multi-Tenancy Environments | Albert Yu, Alan Bishop | 51m |
Claim: an attacker can use public identifiers and naive OAuth flows to make one customer’s integration act for another customer and read or modify their data… | ||
| ATOR (Authentication Token Obtain and Replace) Burp Plugin | Manikandan Rajappan, Ashwath Kumar | 54m |
ATOR v3 is a Burp plugin that actually automates complex auth flows: it obtains and replaces JWTs and session tokens across multistep logins, SSO chains and… | ||
| Keynote: Defining and Embracing The Software Fragility | Bernard Tan | 56m |
Argues that fragility is measurable and reducible by concrete architecture and operations: adopt event-driven designs, centralize with an API Gateway, use… | ||
| nothing matches | ||