Software is vulnerable. The good news is, software is vulnerable in ways that are known and can be addressed. For the past 15+ years, the security community has been publishing and tracking a list of common security vulnerabilities called the OWASP Top 10. This session provides a brief overview of ten common DevSecOps security vulnerability categories. It's a lot to cover in 30 minutes, so this session focuses on the general concepts. Presented at 2019 All Day Dev Ops: https://www.alldaydevops.com/addo-speakers/caroline-wong

1. NOVEMBER 6, 2019
Caroline Wong
OWASP Top 10
Overview

2. www.owasp.org

3. The OWASP Top 10

5. Linkedin Learning

6. NOVEMBER 6, 2019
Caroline Wong
OWASP Top 10
Overview

7. NOVEMBER 6, 2019
Caroline Wong
OWASP Top 10
An Intro
Using Fun
Analogies!

8. https://www.linkedin.com/learning/pat
hs/master-the-owasp-top-10
https://www.owasp.org/images/b/b0/O
WASP_Top_10_2017_RC2_Final.pdf

9. #1 Injection

10. https://www.amazon.com/Katzco-
Hide-Spare-Fake-
Rock/dp/B01AVJZ3HO
#2 Broken
Authentication

11. https://www.amazon.com/Extra-Wide-Swing-
Gate-North-States/dp/B0002JETPQ
#3 Sensitive
Data Exposure

12. #4 XXE
(XML
External
Entities)

13. #5 Broken
Access
Control

14. https://support.apple.com/en-us/HT201441
#6 Security
Misconfiguration

15. #7 Cross
Site
Scripting

16. #8 Insecure
Deserialization

17. #9 Components
with Known Vulns

18. #9 Components
with Known Vulns

19. Photo: Toy Story 3 (Walt Disney Studios Motion Pictures)
#10 Insufficient
Logging and
Monitoring

20. https://www.linkedin.com/learning/pat
hs/master-the-owasp-top-10
https://www.owasp.org/images/b/b0/O
WASP_Top_10_2017_RC2_Final.pdf

21. See you on Slack!
https://www.linkedin.com/in/carolinewmwong/
https://twitter.com/CarolineWMWong