Talks·49 min
Brad Burkle
Shows how rogue third-party scripts on web pages can be found, fenced in, and blocked before they steal payment data.
webappsecrisk+2
Talks LASCON 2022
Austin, TX, USA · October 2022 · 41 talks
Talks from LASCON 2022.
1–24 of 41 talks
Talks·55 min
Garrett Gross
Shares lessons from building a security operations function from the ground up at a company mid-transformation.
security-operationslessons-learnedmanagement+1
Talks·49 min
Anton Aleksandrov
Explains why OAuth2, OIDC and JWTs exist, how their grant flows differ, and how bearer tokens get validated.
identityapplicationweb+2
Talks·35 min
Phillip Wylie
Shows how API endpoints fit into external attack surface management, from asset discovery to continuous testing.
applicationwebinfrastructure+2
Talks·40 min
Rafal Los
Draws parallels between raising children and running security programs, covering containment, behavior change, and leadership.
lessons-learnedmanagementteam+2
Talks·45 min
Gabe Schuyler
Shows how Docker containers let teams run web application security scans repeatedly and automatically in development pipelines.
appseccontainerautomation+3
Talks·45 min
Farshad Abasi
Shows how the OWASP Security Knowledge Framework turns ASVS requirements into labs, checklists and a Kubernetes deployment.
appsecowaspkubernetes+2
Talks·31 min
Jet Anderson
Walks through the OWASP Secrets Management Cheat Sheet's guidance on storing, detecting, and responding to exposed credentials.
owaspappsecdetection+3
Talks·52 min
Pranshu Bajpai
Maps common security weak points in CI/CD pipelines and explains how to bring security into developer workflows.
devopsbuildvulnerabilities+2
Talks·55 min
John Poulin
Walks through design patterns that help web applications survive incidents, prevent regressions, and resist XSS edge cases.
appsecwebincident-response+2
Talks·52 min
Moshe Zioni
Shows how design-stage decisions create supply chain weaknesses, with IoT, cryptography standard and influence case studies.
supply-chainarchitectureiot+2
Talks·34 min
James Wickett
Outlines common warning signs that a DevSecOps move is stalling, with practical questions teams can use to course-correct.
lessons-learnedmanagementteam+2
Talks·51 min
Dan Cornell
Presents survey findings on what drives software supply chain security programs, who leads them, and how budgets are shifting.
supply-chainriskopen-source+3
Talks·40 min
Chris Koehnecke
Walks through the OWASP DevSecOps Maturity Model with open source tools mapped to each of its security requirements.
appsecframeworkopen-source+2
Talks·49 min
Chris Romeo
Presents a maturity framework for building a security champions program that developers actively want to join.
security-championsappsecdevops+3
Talks·49 min
Arthur Loris
Shows how to turn STRIDE threat models into dollar-based loss estimates using FAIR and Monte Carlo simulation.
riskappsecapplication+2
Talks·56 min
Alex (hex0punk) Useche
Shows common Go bugs, concurrency pitfalls, and how static and dynamic tools find them.
vulnerabilitiesfuzzingcode+2
Talks·53 min
Matt Tesauro
Walks through the OWASP API Top 10 from both attacker and defender views, mapping each attack to detection and testing.
appsecwebattack+3
Talks·52 min
Marcus J. Carey
Shows how Ethereum wallets and Solidity contracts work, then demonstrates a withdrawal flaw and a re-entrancy exploit.
smart-contractsethereumappsec+2
Talks·46 min
Abraham Aranguren
Shows how to audit Electron desktop apps and chain XSS into code execution through node integration, preload scripts and IPC.
appsecwebapplication+2
Talks·48 min
Igor Matlin
Shows how exposed mobile app APIs and open cloud storage can be found and abused with simple scripts.
applicationmobilecloud+2
Talks·53 min
Tiago Mendo
Explains how to run the ZAP web scanner across thousands of applications, tuning batching, sessions and false positives.
appsecwebtool+2
Talks·56 min
Adrian Sanabria
Argues that budgets, products and staff have not stopped breaches, and that testing and practice are what is missing.
incident-responselessons-learnedmanagement+2
Talks·46 min
Robert Hansen
Argues that infosec is failing to reduce risk and explains why current scoring and tooling mislead executives.
riskmanagementvulnerabilities+1