OWASP Top 10 is the most well-known web security awareness document. From the first publication in 2003 till the latest one of 2017, OWASP Top 10 has become the de facto application security standard. OWASP Top 10 – 2017 can be the best start for your journey on application security. The speaker will introduce the OWASP Top 10 structure, historical comparison, and the latest trends. Besides, the speaker will also introduce other popular application security documents and tools for developers, security testers and application managers.

2. •
•
• SECURITY
TRAINING
• WEB SECURITY TESTER
• TRANSLATED
•
• REVIEWER

8. Symantec 2017 Internet Security Threat Report

9. - Verizon 2017 Data Breach Investigations Report
- Symantec 2018 Internet Security Threat Report

11. •
•
•
•
• COMMUNITIES
• APIS
• APPLICATION MANAGERS

14. •
•
• UNTRUSTED DATA INPUT
•
• PARAMETERIZED STATEMENT
•
•
•

15. •
•
•
•
• MULTI-FACTOR AUTHENTICATION
•
•
•

16. •
• GDPR
•
•
•
•
AT REST IN TRANSIT
•

17. •
•
• EXTERNAL ENTITY
• SSRF
•
•
•
•
•
• STATIC SCANNER

18. •
• DIFFICULT!
• BAD DESIGN
•
•
•
• DENY BY DEFAULT
• ACCESS CONTROL MATRIX
•
•
•
•

19. • MOST PREVALENT ONE
•
•
•
•
•
•
• CLOUD STORAGE

20. •
• INJECT CLIENT-SIDE SCRIPTS
•
•
• XSS ESCAPE
•
• CONTENT SECURITY POLICY

21. •
•
• REMOTE CODE EXECUTION PRIVILEGE
ELEVATION
•
•
• INTEGRITY CHECK DIGITAL SIGNATURE
• IN LOW
PRIVILEGE
•

22. •
• LIBRARIES AND
FRAMEWORKS
• VERSIONS
•
•
• INVENTORY
• UNNECESSARY FEATURES
• OWASP DEPENDENCY CHECK
•
NRI 2017 Cyber Security Trend Review

23. •
• 200 DAYS
•
•
•
•
•
•
• OWASP APPSENSOR

26. • API
• MICROSERVICES
• SINGLE PAGE APPLICATIONS
• COMMUNITY INPUT
•
• APPLICATION MANAGERS
•
•
• BUDGETING
•
•

29. • CROSS-SITE REQUEST FORGERY (CSRF)
• CSRF
TOKEN
•
• UNVALIDATED REDIRECT AND FORWARDS
•
•
• OPEN REDIRECT RESULTS IN XSS

31. • KEEP GOING
• ASVS
•
• CHEAT SHEETS
•
• PROACTIVE CONTROL
•
• INTRUSION DETECTI
•
• ZAP

32. SHIFT LEFT, RIGHT AND EVERYWHERE!
MAY SECURITY BE WITH YOU!