1. //ALPHA.1 OWASP Knoxville Application Security Then and Now. Make a Difference Now 2015 June 11 Phil Agcaoili

2. A Career Path…printf(“hello, world\n”);

3. Why OWASP is VERY Important! source: Checkmarx

4. OWASP 10 – Then and Now Not Substantially Different *Challenging for automation tools OWASP Top 10 – 2001-2004 EditionOWASP Top 10 – 2013 Edition A1 Unvalidated InputA1 Injection A2 Broken Access ControlA2 Broken Authentication and Session Management A3 Broken Authentication and Session ManagementA3 Cross-Site Scripting (XSS) A4 Cross Site ScriptingA4 Insecure Direct Object References A5 Buffer OverflowA5 Security Misconfiguration A6 Injection FlawsA6 Sensitive Data Exposure A7 Improper Error HandlingA7 Missing Function Level Access Control A8 Insecure StorageA8 Cross-Site Request Forgery (CSRF) A9 Application Denial of ServiceA9 Using Components with Known Vulnerabilities A10 Insecure Configuration Management A10 Unvalidated Redirects and Forwards

5. The Intent of OWASP The Top 10 is about managing risk – Not just avoiding vulnerabilities Take a big picture approach to application security. – OWASP Top 10 doesn't mean it's the most important problem facing your organization

6. Keep it simple…It’s not as difficult as you think it is.

8. START SMALL BUILD THE MOMENTUM OF SUCCESS

9. HOPE FOR SERENDIPITY The occurrence and development of events by chance in a happy or beneficial way

10. ACHIEVE BUY-IN FROM MANAGEMENT AND EMPLOYEES Provide opportunities for teams and clear advantages for company.

12. TAKE APPLICATION SECURITY ONE STEP AT A TIME Allow the organization to grow into the process rather than dropping it on the teams all at once

13. EDUCATE YOUR DEVELOPERS AND GET THEM WRITING SECURE CODE

14. RECRUIT THE SMART PEOPLE IN THE DEV TEAMS TO ACT AS CHAMPIONS Senior developers with a need to learn something new or Junior developers with the motivation to move ahead within the organization.

15. GET THE RIGHT PARTNERS TO HELP YOU

16. NETWORK SECURITY CANNOT PREVENT APPLICATION BREACHES ON ITS OWN STATIC ANALYSIS SHOULD BE PERFORMED AT EARLIER DEVELOPMENT STAGES Web application Firewalls (WAF) and/or RASP should be used as temporary band aids for non-remediated vulnerabilities

17. CAUTION WITH AUTOMATION Tools make educated guesses that require validation by trained humans. Peer code reviews with trained peers is still the best option.

18. Phil Agcaoili Distinguished Fellow and Fellows Chairman, Ponemon Institute Board of Advisors, PCI Security Standards Council (SSC) Contributor, NIST Cybersecurity Framework version 1 Co-Founder & Board Member, Southern CISO Security Council Founding Member, Cloud Security Alliance (CSA) Inventor & Co-Author, CSA Cloud Controls Matrix, GRC Stack, Security, Trust and Assurance Registry (STAR), and CSA Open Certification Framework (OCF) – AICPA SOC @hacksec https://www.linkedin.com/in/philA