Look Who it Was Random video

OWASP Top Ten Proactive Controls - Jim Manico - OWASP AppSec California 2015

2,526 views · Published 30 April 2015 · 53:27 · Indexed 23 October 2026

Channel: OWASP Foundation · 2015 · Science & Technology

Watch on YouTube

AppSec California 2015 - Day 1, Track 3, Slot 3

Title

OWASP Top Ten Proactive Controls

Abstract

The major cause of web insecurity is poor development practices. We cannot “firewall” or “patch” our way to secure websites. Programmers need to learn to build websites differently. No company or industry is immune.

The OWASP Ten Ten Proactive Controls Project is a Top-Ten like document that focuses directly on informing developers of necessary secure coding techniques. This talk describes the bare minimum required of a development team if they wish to have even a small chance of producing secure software.

– Validation
– Whitelist Validation (struggles with internationalization)
– URL validation (as part of redirect features)
– HTML Validation (as part of untrusted content from features like TinyMCE)

Authentication
– Password storage, HMAC’s for scale
– Multi-factor AuthN implementation details
– OAuth
– Forgot password workflow

Access Control
– Limits of access control
– Permission-based access control

Encoding
– Output encoding for XSS
– Query Parameterization
– Other encodings for LDAP, XML construction and OS Command injection resistance

Data Protection
– Secure number generation
– Certificate pinning
– Proper use of AES (CBC/IV Management)

Secure Requirements
– Core requirements for any project (technical)
– Business logic requirements (project specific)

Secure Architecture and Design
– When to use request, session or database for data flow

Bio

Jim Manico authors and delivers developer security awareness training and has a 20 year history building software as a developer and architect. Jim is also a global board member for the OWASP foundation where he helps drive the strategic vision for the organization. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and several secure coding projects.

-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project

More from this channel