The Language of Cybersecurity The Changing Cybersecurity Landscape AppSec Dissection of SolarWinds The Human Perimeter Interpreting the 2021 Verizon Data Breach Investigation Report First Axiom in Web Application Security Analysis First Axiom in Addressing ALL Security Concerns Lab: Case Study in Failure

Working Ethically Respecting Privacy Bug/Defect Notification Bug Bounty Programs Bug Hunting Mistakes to Avoid

Open Web Application Security Project (OWASP) OWASP Top Ten Overview Web Application Security Consortium (WASC) CERT Secure Coding Standards Microsoft Security Response Center Software-Specific Threat Intelligence

Security is a Lifecycle Issue Minimize Attack Surface Area Layers of Defense: Tenacious D Compartmentalize Consider All Application States Do NOT Trust the Untrusted AppSec Dissection of the Verkada Exploit

Buffer Overflows Integer Arithmetic Vulnerabilities Defining and Defending Trust Boundaries Rigorous., Positive Specifications Whitelisting vs Blacklisting Challenges: Free-Form Text, Email Addresses, and Uploaded Files

Elevation of Privileges Insufficient Flow Control Unprotected URL/Resource Access/Forceful Browsing Metadata Manipulation (JWTs) CORS Misconfiguration Issues Cross Site Request Forgeries (CSRF) CSRF Defenses Lab: Spotlight: Verizon

Identifing Protection Needs Evolving Privacy Considerations Options for Protecting Data Transport/Message Level Security Weak Cryptographic Processing Keys and Key Management NIST Recommendations

Injection Flaws SQL Injection Attacks Evolve Drill Down on Stored Procedures Other Forms of Server-Side Injection Minimizing Injection Flaws Client-side Injection: XSS Persistent, Reflective, and DOM-Based XSS Best Practices for Untrusted Data

Secure Software Development Processes Shifting Left Cost of Continually Reinventing Leveraging Common AppSec Practices and Control Paralysis by Analysis Actionable Application Security Additional Tools for the Toolbox Lab: Actionable AppSec

System Hardening Risks with Internet-Connected Resources (Servers to Cloud) Minimalist Configurations Application Whitelisting Secure Baseline Segmentation with Containers and Cloud Demo / Lab: Configuration Guidance Resolution of External References Safe XML Processing

Quality and Protection of Authentication Data Proper hashing of passwords Handling Passwords on Server Side Session Management HttpOnly and Security Headers

Serialization / Deserialization Issues with Consuming Vulnerable Software Using Trusted Repositories CI/CD Pipeline Issues Protecting Software Development Resources

Detecting Threats and Active Attacks Best Practices for Determining What to Log Safe Logging in Support of Forensics Lab: Auditing and Logging Guidance

Understanding SSRF Remote Resource Access Scenarios Complexity of Cloud Services SSRF Defense in Depth Positive Allow Lists

Common Vulnerabilities and Exposure CWE/SANS Top 25 Most Dangerous SW Errors Strength Training: Project Teams/Developers Strength Training: IT Organizations Lab: Spotlight: Capital One

Attack Phases: Offensive Actions and Defensive Controls Secure Software Development Processes Shifting Left Actionable Items Moving Forward

Risk Escalators Risk Escalator Mitigation SDL Phases Actions for each SDL Phase SDL Best Practices