BRICK'D - Making End User AppSec Training Awesome with building bricks

The talk presents a way to make application security training stick with non-technical end users by pairing it with humorous photos of minifigures and custom brick builds. The speaker has used these images with OWASP chapters and Java user groups, and explains that the aim is to bridge gaps between development, security and business teams by giving them a memorable framing instead of dry material.

Much of the talk walks through the OWASP Top 10 categories, each illustrated with a scene. Examples include a builder, breaker and defender to frame team roles, a hiker with a map for security guides, mad scientists and aliens with needles for injection, a superhero with a lasso for supply chain trust, and a spaceman whose helmet keeps breaking for known vulnerable components. Other topics cover insecure design and developer incentives, default configurations and stack-trace exposure, continuous review of aging dependencies, malicious open-source packages, financial impact framing for executives, logging of both good and bad events, and input sanitizing with parameterized queries. It also addresses multi-factor authentication beyond SMS, social engineering such as business email compromise, scam calls targeting older relatives, insider risk, and badge tailgating.

The closing takeaway is that security messaging works better when it is cooperative and tailored to each audience. The speaker invites attendees to discuss adapting the approach with their own teams and chapters.