AppSec USA 2016

AppSec USA 2016 took place Oct. 11, 2016 through Oct. 14, 2016 (2 years, 6 months ago) at Renaissance Washington DC Hotel, Washington, DC, USA.

• https://2016.appsecusa.org/
• https://www.youtube.com/playlist?list=PLpr-xdpM8wG8DPozMmcbwBjFn15RtC75N
• https://infocon.org/cons/OWASP/AppSecUSA 2016/

Presentations:

Thursday, Oct. 13, 2016

• 08:00 - Keynote - Software Supply Chain Lifecycle Management: Reducing Attack Vectors and Enabling Rugged DevOps
• 09:15 - Lightning Talk - Demystifying CSP
• 09:30 - Everything is Terrible: Three Perspectives on Building, Configuring, and Securing Software
• 09:30 - Lightning Talk - Assessing and Exploiting XML Schemas Vulnerabilities
• 09:30 - Continuous Integration: Live Static Analysis using Visual Studio & the Roslyn API
• 09:30 - The Ways Hackers Are Taking To Win The Mobile Malware Battle
• 09:45 - Lightning Talk - Application Security in a DevOps World: Three Methods for Shifting Left
• 10:00 - Lightning Talk - Automated Gadget Chain Generation for Object Injections
• 10:15 - Lightning Talk - WAF Evolution, or How I Stopped Worrying About Vulnerabilities
• 10:15 - Lightning Talk - If you can dodge a wrench!..... (or how not to security test your web app):
• 10:30 - Lightning Talk - Taking Back Privacy to Gain Control
• 10:45 - Your License for Bug Hunting Season
• 10:45 - SPArring with the Security of Single Page Applications
• 10:45 - Lightning Talk - Beyond The ‘Cript: Practical iOS Reverse Engineering
• 10:45 - Practical Static Analysis for Continuous Application Security
• 11:00 - Lightning Talk - LANGSEC 101: Taking the Theory Mainstream
• 11:15 - Lightning Talk - Building your Own Security ChatBot
• 11:30 - Lightning Talk - Can IT & Engineering get along for the sake of building, deploying, and maintaining app security?
• 11:45 - Lightning Talk - The hidden bug in public bug bounties
• 12:00 - Lightning Talk - Demystifying Windows Application
• 13:00 - Next Gen Web Pen Testing: Handling Modern Applications in a Penetration Test
• 13:00 - Using language-theoretics and runtime visibility to align AppSec with DevOps
• 13:00 - Barbarians at the Gate(way)
• 14:15 - Should there be an Underwriters Laboratories certification for software in IoT products?
• 14:15 - Cleaning Your Applications' Dirty Laundry with Scumblr
• 14:15 - Threat Modeling with Architectural Risk Patterns
• 15:30 - How to Find the Next Great Deserialization CVE
• 15:30 - When encryption is not enough: Attacking Wearable - Mobile Application communication over BLE
• 15:30 - HTTPS & TLS in 2016: Security practices from the front lines
• 17:00 - Keynote - The Less Hacked Path

Friday, Oct. 14, 2016

• 08:00 - Keynote - Cryptography in the age of Heartbleed
• 08:00 - WASPY Awards
• 09:15 - Serverless Security: Doing Security in 100 milliseconds
• 09:30 - Why using SMS in the authentication chain is risky and what better options are available
• 09:30 - Protect Containerized Applications With System Call Profiling
• 09:30 - Putting an “I” in Code Review – Turning Code Reviewing Interactive
• 10:05 - Continuous Security: DevOps and Ongoing Authorization
• 10:45 - Practical tips for web application security in the age of agile and DevOps
• 10:45 - DevOps to DevSecOps: a 2-dimensional view of security for DevOps
• 10:45 - Exploiting CORS Misconfigurations for Bitcoins and Bounties
• 10:45 - Patterns of Authentication and Self-Announcement in the Internet of Things (IoT)
• 11:25 - Where bits & bytes meet flesh & blood: Devops, Cybersafety, and the Internet of Things
• 13:00 - DevOops: Redux
• 13:00 - Automating API Penetration Testing using fuzzapi
• 13:00 - Needle: Finding Issues within iOS Applications
• 13:05 - DevSecOps: A Peek Inside the Pipeline
• 13:55 - Making Invisible Things Visible: Revealing Secrets from 25,000 Applications
• 14:15 - If You Can’t Beat ‘Em Join ‘Em: Practical Tips For Running A Successful Bug Bounty Program
• 14:15 - Misconfigured CORS and why web application security is not getting easier.
• 14:15 - Scaling Security Assessment at the Speed of DevOps
• 14:35 - Moving to the Left: DevOps practices and the changing role of SecOps
• 15:15 - Glad You Could Join Us: Bringing Security into the DevOps Fold
• 15:30 - Containerizing your Security Operations Center
• 15:30 - AppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
• 15:30 - Breaking and Fixing your ‘Docker’ ized environments
• 15:55 - Mapping the Risk in Your Value Stream
• 17:00 - Keynote - What does winning look like?

Presenters:

• Aaron Lindsay
• Aaron Weaver
• Abhijeth Dugginapeddi
• Adrien Thebo
• Amir Pourafshar
• Andrew Hoernecke
• Anita D'Amico
• Arshan Dabirsiaghi
• Bill Weiss
• Blake Hitchcock
• Brian Manifold
• Brian McHenry
• Bryan Batty
• Casey Ellis
• Chandra Prakash Gopalaiah
• Chenxi Wang
• Chris Barker
• Chris Corriere
• Chris Gates
• Dan Geer
• Daniel Trauner
• Dan Kuykendall
• Dave Ferguson
• Dave Lewis
• Derek Weeks
• Eric Johnson
• Eric Mill
• Evan Johnson
• Farbod H Foomany
• Fernando Arnaboldi
• Frank Catucci
• Grant McCracken
• Hendrik Buchwald
• Ilya Nesterov
• Jacob Hansen
• James Kettle
• James Wickett
• Jason Gillam
• Jim Denaro
• Jimmy Mesta
• Joe Jarzombek
• Joshua Corman
• Justin Collins
• Kavya Racharla
• Ken Johnson
• Kenneth White
• Kevin Greene
• Kevin Johnson
• Kunal Anand
• Lalith Rallabhandi
• Manideep Konakandla
• Marco Lancini
• Mark Stutzman
• Matthew Green
• Matt Tesauro
• Michael Allen
• Ofer Maor
• Paula Thrasher
• Roger Seagle
• Rupali Dash
• Samy Kamkar
• Sanjeev Sharma
• Scott Behrens
• Shannon Lietz
• Simon Thorpe
• Stephen de Vries
• Steve Shillingford
• Sumanth Naropanth
• Yair Amit
• Zane Lackey