OWASP New Zealand Day 2024
2024-09-05..2024-09-06
Auckland, New Zealand
as the organisers put it
Conference on the main website for AppSec New Zealand Incorporated (AppSec NZ). AppSec NZ is a NZ-registered charity that supports and promotes application Security (AppSec) awareness and education.
who it's for
application security engineers, security architects, devops engineers, engineering managers, penetration testers, developer advocates
topics
PCI DSS v4.0.1 compliance; SLSA software supply chain; MFA bypass testing; GraphQL API hardening; pentesting engagement process; LLM jailbreak defenses; threat modeling with DFD and STRIDE; email authentication DMARC DKIM SPF; generative AI security strategies; breach and attack simulation (BAS); serverless environment security
| title | author | length |
|---|---|---|
| Keeping the Bank Happy: PCI DSS v4 | Peter Jakowetz | 28m |
PCI DSS v4.0.1 (released March this year) requires concrete controls: annual internal and external penetration tests, ASV scans (Qualys or equivalent)… | ||
| Make Your CI More Secure and Less Spicy with SLSA | James Cooper | 29m |
SLSA presents concrete, incremental requirements: SLSA levels 0–3 require automated builds, JSON provenance attestations and cryptographic signatures, and only… | ||
| MFA: Stories that make you go 'Huh?' | David (Karit) Robinson, Jacob Hawthorne | 45m |
Shows concrete, repeatable failures: SMS and TOTP codes accepted after reuse, QR seeds reissued in sessions, and OTP reuse that never expires; web flows that… | ||
| API Security: Securing GraphQL without going around in circles | Kirk Jackson | 51m |
A demo GraphQL site so.net shows a browser-heavy app using an Apollo server and Apollo Studio sandbox that proxies to a REST backend (port 2000 left exposed)… | ||
| How to run a Pentesting Engagement | Matt Tompkins | 29m |
Pentesting here means an active, human-led exercise that chains CVEs and business logic flaws to produce real risk, not just a scan. The process follows 8… | ||
| Jailbreaking and Securing LLM Apps: Lessons from an online wargame experiment | Pedram Hayati | 28m |
A public online wargame uses OpenAI APIs (GPT 3.5) and an SDK to let players patch a baseline chatbot, publish source and a unique URL, then attack others… | ||
| Threat Modelling: Star Wars Edition | Audrey Long | 37m |
Explains how threat modeling finds concrete failures not metaphors: builds a DFD of the Death Star, applies STRIDE + DFDs + SDL and frameworks (MCSB, MITRE… | ||
| Securely Sending Email in 2024 | Richard Gray | 44m |
Shows actual deployment details and results: DMARC, DKIM, and SPF are configured, signature keys live in DNS, and reporting is functional. One-week data shows… | ||
| Harnessing Generative AI: Security strategies for next-gen applications | Ratan Kumar, Ryan Tan | 27m |
Claims a generative security scoping Matrix that classifies five scopes (buy consumer, buy enterprise, build on pre‑trained models, fine‑tune, train from… | ||
| The not-so-secret diary of building Visa's Security Champion program | Anastasia Hotchin, Joe Cairns | 30m |
Visa's 'Security Champions Program' chronicles a concrete 14‑month effort that recruits voluntary champions across ~400 staff to fix a 5‑person AppSec… | ||
| Conference Opening Session | John Deo | 29m |
Agenda and logistics list practical details and hard constraints: venue exits and assembly points, toilets and water refill locations, basic first aid at… | ||
| Conference Keynote - The next 25 years | Andrew van der Stock | 54m |
OWASP is 25 in September 2026 and claims concrete wins and gaps: a Slack of 26,000 people, 279 chapters and 345 projects but many inactive; the 2021 Top 10… | ||
| Leveraging Projects and Tools to Transform Your SDLC | John DiLeo | 45m |
Claims rapid tour of 30+ OWASP projects and demos like Juice Shop CTF and Threat Dragon v2 while asserting practical utility of Sam (OWASP Flagship ~10 years)… | ||
| Secure Your APIs the AWS Well-Architected Way | Jhalak Modi | 45m |
Claims that the AWS Well‑Architected security pillar directly addresses several OWASP API Security Top 10 failures and gives concrete remediations rather than… | ||
| Top 10 Introduction | Austin Chamberlain | 30m |
OWASP Top 10 2021 is the current baseline with a 2025 revision underway using hundreds of thousands of data points from thousands of sources plus a… | ||
| The Windows Data Protection API (DPAPI) | Claudio Contin | 30m |
Concrete claims and demos: DPAPI encrypts secrets with per‑user and per‑machine master keys that live on disk, get cached in LSASS memory, and expire every… | ||
| Security Is an API: Evolving to a decentralised security culture | Roger Wang | 26m |
Claims that security becomes a scalable interface by treating engagements as APIs backed by templated threat models and baseline security controls, with… | ||
| Helping Elderly Activists Improve Their Security | Kris Hardy | 26m |
Volunteer work with activists and elderly surfaces a concrete claim: community infosec remains unsolved and practical fixes must be specific, incremental and… | ||
| Dynamic Defense: Crafting threat models with real-world Intelligence | Kade Morton | 20m |
Claim: build dynamic, accurate threat models from live data by automating collection, mapping observed indicators to MITRE techniques, and turning those into… | ||
| Breach and Attack Simulation (BAS) - Thursday | Patrick Williams | 28m |
Demo uses Datacom and AttackIQ to run automated WAF rule validation against an Azure W with its default OWASP rule set and reports which rules actually block… | ||
| Breach and Attack Simulation (BAS) - Friday | Aba Dasa | 24m |
Shows a working Breach and Attack Simulation pipeline using the AttackIQ platform to run both control‑centric and threat‑centric assessments, validating an… | ||
| Doing More with Less: DevSecOps on a limited budget | Pramod Rana | 29m |
Argues that limited DevSecOps budgets force prioritization and shows concrete results: an automation called secret validator that runs regex and API probes to… | ||
| Security in the Serverless Environment | Mahesh Pandit | 30m |
Describes concrete serverless plumbing: SFTP → staging bucket → destination bucket → Amazon Event Bridge → Lambda → DynamoDB, with encryption at rest and in… | ||
| Strategies for Identifying and Mitigating Bot Threats | David MacDonald | 31m |
Walks through concrete defenses and tradeoffs: starts with user‑agent and robots.txt and public IP reputation lists, escalates through rate limits then 30… | ||
| Painless Agile Security | Julian Simpson | 29m |
Argues that security must live inside short iterations with measurable practices not vague promises, and gives concrete ways to do it: write tests first with… | ||
| nothing matches | ||