InfoconDB

AppSec USA 2017 took place Sept. 19, 2017 through Sept. 22, 2017 (6 years, 7 months ago) at Disney's Coronado Springs Resort in Orlando, Florida, USA.

https://2017.appsecusa.org/
https://www.youtube.com/playlist?list=PLpr-xdpM8wG9emx73fEjX0Cn6VHruJ4-l
https://infocon.org/cons/OWASP/AppSecUSA 2017/

Presentations

Tuesday, Sept. 19, 2017

09:00 - Practical DevOps Security and Exploitation (1 of 2 days)
09:00 - Practical Hands-on Internet of Things Hacking - 2017 Edition (1 of 2 days)
09:00 - Hands-on Security in DevOps and Application Security Automation Workshop (1 of 2 days)
09:00 - Mobile App Attack (1 of 2 days)
09:00 - Whiteboard Hacking aka Hands-on Threat Modeling (1 of 2 days)
09:00 - Open Source Defensive Security (1 of 2 days)

Wednesday, Sept. 20, 2017

09:00 - Practical Hands-on Internet of Things Hacking - 2017 Edition (2 of 2 days)
09:00 - Mobile App Attack (2 of 2 days)
09:00 - AppSec Fundamentals (1 of 1 day)
09:00 - Open Source Defensive Security (2 of 2 days)
09:00 - Hands-on Security in DevOps and Application Security Automation Workshop (2 of 2 days)
09:00 - Hands On Hardened Web Service Development using ASP.NET (1 of 2 days)
09:00 - Advanced SQL Injection Exploitation (1-day)
09:00 - Defensive Application Security Program (1 of 1 day)
09:00 - Whiteboard Hacking aka Hands-on Threat Modeling (2 of 2 days)
09:00 - Practical DevOps Security and Exploitation (2 of 2 days)

Thursday, Sept. 21, 2017

09:00 - KeyNote - Discussion on Application Security: John Steven and Jim Manico will be discussing application security from a unique perspective.
10:30 - Test Driven Security in the DevOps pipeline
10:30 - Federated Login CSRF
10:30 - Moving Fast and Securing Things
10:30 - Securing C code that seems to work just fine
10:30 - An Investigation into the Differences Between Web Application Scanning Tools when Scanning for XSS and SQLi
11:30 - Top 10 Security Best Practices to secure your Microservices
11:30 - Overcoming Mobile App Security Challenges with DevOps
11:30 - There’s a new sheriff in town; dynamic security group recommendations with Grouper and Dredge
11:30 - Bug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
11:30 - Popular Approaches to Preventing Code Injection Attacks are Dangerously Wrong
13:30 - Leveraging the ASVS in the Secure SDLC
13:30 - When Molehill Vulnerabilities Become Mountainous Exploits
13:30 - Leveraging Blockchain for Identity and Authentication in IoT is good for Security
13:30 - Making Vulnerability Management Less Painful with OWASP DefectDojo
13:30 - Measuring End-to-End Security Engineering
14:30 - iGoat – A Self Learning Tool for iOS App Pentesting and Security
14:30 - Juggling the Elephants – Making AppSec a Continuous Program
14:30 - Application Security “Built from Scratch”
14:30 - Embedding GDPR into the SDLC
14:30 - An Overview of API Underprotection
15:30 - Androsia: A tool for securing in memory sensitive data
15:30 - “Capture the Flag” for Developers: Upping your Training Game
15:30 - DASTProxy: Don’t let your automated security testing program stall on crawl. Instead focus on business context.
15:30 - Black-Box Approximate Taint Tracking by Utilizing Data Partitioning
15:30 - WAFs FTW! A modern devops approach to security testing your WAF
17:00 - KeyNote - Runa A. Sandvik: Building a Culture of Security at The New York Times
18:00 - WASPY Award Ceremony

Friday, Sept. 22, 2017

09:00 - What We Learned Remediating XSS in GitHub Open Source Projects
09:00 - This Old App, a guide to renovating apps for the cloud
09:00 - Passive Fingerprinting of HTTP/2 Clients
09:00 - Cookie Security – Myths and Misconceptions
09:00 - Building a Secure DevOps Pipeline
10:30 - Supply Chain Anarchy – Trojaned Binaries in the Java Ecosystem
10:30 - R2-D2: ColoR-inspired Convolutional NeuRal Network (CNN)-based AndroiD Malware Detections
10:30 - HUNT: Data Driven Web Hacking & Manual Testing
10:30 - Where we’re going… we won’t need passwords…
10:30 - Monitoring Application Attack Surface and Integrating Security into DevOps Pipelines
11:30 - SPLC as a Service
11:30 - Handling of Security Requirements in Software Development Lifecycle
11:30 - Core Rule Set for the Masses
11:30 - Friday the 13th: Attacking JSON
11:30 - Enhancing Physical Perimeter Defense Using SDR
13:30 - How to detect CSRF vulnerability, reliably?
13:30 - DevSecOps is real - What we learned by matching our appsec testing to our continuous release cycles
13:30 - Beyond End-to-End Encryption: Threats Models For Secure Messaging
13:30 - Common Developer Crypto Mistakes (with illustrations in Java)
13:30 - ReproNow: Save time Reproducing and Triaging Security bugs
14:30 - NoSQL Is Not NoVulnerable
14:30 - How to stop worring about application Container security
14:30 - How To Approach InfoSec Like a Fed(eral Auditor)
14:30 - A Static Tainting Analysis Method for Aspect-Oriented Programs
14:30 - Automating TLS Configuration Verification on the Back-End of the Web Application Stack
15:30 - Practical Dynamic Application Security Testing within an Enterprise
15:30 - Crafting the next-generation Man-in-the-Browser Trojan
15:30 - Building Secure ASP.NET Core MVC Applications
15:30 - Beyond Takeover – Attacker’s in. Now what?
15:30 - An Agile Framework for Building GDPR Privacy and Data Protection Requirements into SDLC
17:00 - KeyNote - Tony UcedaVelez: Fixing Broken Enterprise Threat Models w/ OWASP Measures: Commissioning AppSec Professionals for Real Change

Presenters

Aaron Weaver
Abhay Bhargav
Aditya Gupta
Alvaro Muñoz
Amol Bhure
Boris Chen
Brian Andrzejewski
Brian Lawrence
Cassio Goldschmidt
Chia-Mu Yu
Chintan Jain
Chris Romeo
Christian Price
Chris Wells
Dan Cornell
Daniel Kefer
Dave Ferguson
David Caissy
David Johansson
Davit Baghdasaryan
Demetria Robertson
Derek Fisher
Donald Malloy
Elad Shuster
Evan H. Dygert
Farbod H Foomany
Fikrie Yunaz
Garrett Held
Greg Anderson
Hung-Yu Kao
Itsik Mantin
Jeff Williams
Jim Manico
Joël Alwen
Johannes Ullrich
John Matthew Holt
John Steven
Jonathan Foote
JP Villanueva
Julia Knecht
Julien Vehent
Kelly Correll
Kevin Glisson
Kevin Wall
Kiran Sharadkumar Shirali
Kris Lahiri
Lakshmi Sudheer
Leszek Mis
Mark Hoopes
Matt Hajda
Matt Rose
Matt Stanchek
Matt Tesauro
Max Feldman
Michael Gallagher
Michael Stewart
Michael Stoker
Mike Fauzy
Mina Miri
Mindy White
Murali Vadakke Puthanveetil
Nicholas Doell
Nicholas Kenney
Niels Tanis
Oleksandr Mirosh
Pedro Fortuna
Rafael Brinhosa
Rene Reuter
Richard Taylor
Robert Feeney
Robert Whitley
Runa A. Sandvik
Samit Anwer
Scott Cutler
Sean Martin
Sean Melia
Sneha Rajguru
Srinivasa Rao Chirathanagandla
Steven Danneman
Steven Wierckx
Suraj Biyani
Swaroop Yermalkar
Taylor Lobb
Tin Zaw
Tom Cline
Tom Leavy
TonTon Huang
Tony Miller
Tony UcedaVelez
Umesh Salian
Vinayendra Nataraja
Yitao Wang
Zachary Pritchard
Zack Allen