Build more secure apps by harnessing the power of OWASP SKF & ASVS on Kubernetes

The talk addresses a common gap: development teams are asked to build secure software but have no concrete list of requirements to work from. The speaker proposes the OWASP Application Security Verification Standard (ASVS) as that shared baseline, usable as a testing yardstick, a design guide and a consistent basis for security assessments. Scoping the standard to an application's sensitive data and risk level is presented as the first step.

The middle section introduces the OWASP Security Knowledge Framework (SKF), a platform that wraps ASVS data with checklists, code examples, a knowledge base and containerized labs that each demonstrate a single weakness. The speaker recommends tracking requirements in existing ticketing tools and turning cross-cutting controls into shared libraries or pull request checklists. Deploying SKF was difficult because its Kubernetes configuration predated later API changes, so the presenters patched it and explained a two-cluster design that keeps vulnerable labs isolated from the main application. Scripted deployment on minikube or on AWS with kops and Terraform was walked through, followed by a demonstration of a local file inclusion lab.

The closing advice is to use ASVS as the requirements source, use SKF for training and traceability, and customize its labs and content. The speaker suggested that learning the level one requirements might take a week or two, while implementing them often spans about a year.