The document discusses trends and issues in application security, highlighting the prevalence of zero-day vulnerabilities and the growing sophistication of cyber attacks, particularly targeting web servers and personal data. It references the OWASP Top 10 application security risks and various security practices and tools essential for builders and defenders in the field. The emphasis is on the need for improved security measures as digital interactions continue to expand.

1. APPLICATION SECURITY :
TREND & ISSUE
By : Dedi Dwianto,CEH,OSCP,eMPAT,ISO 27001:LA
WORKSHOP & TRAINING APPLICATION SECURITY :
OTORITAS JASA KEUANGAN (OJK)
11-12 Mei 2016

5. A New Zero-Day Vulnerability Discovered
Each Week
Attackers profit from flaws in
browsers and website plugins
www.symantec.com

7. WEB ATTACKS, TOOLKITS, AND EXPLOITING
VULNERABILITIES ONLINE
“If web servers are vulnerable, then so are the websites they host
and the people who visit them”

8. Browser Vulnerabilities

9. Anual Plugins Vulnerabilities

10. Anual Plugins Vulnerabilities

11. Top Five Web Attack Toolkits

12. DEFACEMENT
zone-h.org

13. WE LIVE IN AN INCREASING
DIGITAL WORLD

15. Smartphones are an increasingly attractive target for
online criminals. As a result, they are investing in more
sophisticated attacks that are effective at stealing
valuable personal data or extorting money from victims
IoT

16. IRISS-Survey-2015

17. OWASP (OPEN WEB APPLICATION SECURITY PROJECT)OWASP (OPEN WEB APPLICATION SECURITY PROJECT)
The OWASP Top 1010 (a community-driven,
consensus-based list of top 10 application security risks,
with lists available for web and mobile applications)
is by far the leading application security standard or guideline followed by builders

21. • NOT Network Security
• Securing “custom” code
• Securing libraries
• Securing Backend System
• Securing web & application server
APPLICATION SECURITY

22. APPLICATION SECURITY

23. APPLICATION SECURITY PROGRAM

24. APPLICATION SECURITY PROGRAM
sans.org

25. Useful SECURITY Practices for Application
Defenders
sans.org

26. Useful SECURITY Practices for Application
Builders
sans.org

27. PENETRATION TESTING
TOOLS
By : Dedi Dwianto,C|EH,OSCP,eMPAT,ISO 27001:LA
WORKSHOP & TRAINING APPLICATION SECURITY :
OTORITAS JASA KEUANGAN (OJK)
11-12 Mei 2016

28. • System
• Network
• Web Application
TOOLS