sapran
3/26/2018 - 10:33 AM
AppSec Awareness Training - Day 1
Notes to Application Security awareness training in line with OWASP SAMM initial development team education effort according to Education and Guidance practice.
Establish context: demonstrate current state of applicaiton security and its effect on technology and economy.
Massive data breaches
- http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
- NotPetya losses estimate (FedEx+Maersk=600kk alone, ~2kkk globally)
Personal data and password breaches
- https://haveibeenpwned.com
- https://haveibeenpwned.com/Passwords
- Threat analysis sneak peek: API and k-anonymity
Software vulnerabilities
- https://nvd.nist.gov
- https://nvd.nist.gov/general/visualizations/vulnerability-visualizations/cwe-over-time
Walk through the OWASP Top 10 appsec risks
- https://www.owasp.org/index.php/Top_10-2017_Top_10
- https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf
- Methodology overview
- Vulnerability examples by class