OWASP 2024 Global AppSec San Francisco

OWASP 2024 Global AppSec San Francisco

THE MUST ATTEND EVENT FOR CYBERSECURITY PROFESSIONALS

9:00am PDT

3 Day Training: Attacking and Defending - AWS, Azure and GCP Applications Room: Seacliff B (Bay Level)Abhay Bhargav 3 Day Training: Hacking Modern Web & Desktop apps: Master the Future of Attack Vectors Room: Seacliff A (Bay level)Abraham Aranguren 3 Day Training: The Mobile Playbook - A guide for iOS and Android App Security Room: Seacliff D (Bay Level)Sven Schleier 3 Day Training: Web Application Security Essentials Room: Seacliff C (Bay Level)Fabio Cerullo

10:30am PDT

AM Break Seacliff Foyer

12:30pm PDT

Lunch Seacliff Foyer

3:00pm PDT

PM Break Seacliff Foyer

9:00am PDT

2 Day Training:Agile Whiteboard Hacking – aka Hands-on Threat Modeling Room: Regency A (Street Level)Sebastien Deleersnyder 2-Day Training: OWASP in Action: ASPM with OWASP Projects Room: Regency B (Street Level)Matt Tesauro • Harold Blankenship 3 Day Training: Attacking and Defending - AWS, Azure and GCP Applications Room: Seacliff B (Bay Level)Abhay Bhargav 3 Day Training: Hacking Modern Web & Desktop apps: Master the Future of Attack Vectors Room: Seacliff A (Bay level)Abraham Aranguren 3 Day Training: The Mobile Playbook - A guide for iOS and Android App Security Room: Seacliff D (Bay Level)Sven Schleier 3 Day Training: Web Application Security Essentials Room: Seacliff C (Bay Level)Fabio Cerullo Global Board of Directors Private/Closed Face to Face Meeting Room: Boardroom A (Atrium Lobby Level)

10:30am PDT

AM Break Seacliff Foyer

12:30pm PDT

Lunch Seacliff Foyer

3:00pm PDT

PM Break Seacliff Foyer

9:00am PDT

2 Day Training:Agile Whiteboard Hacking – aka Hands-on Threat Modeling Room: Regency A (Street Level)Sebastien Deleersnyder 2-Day Training: OWASP in Action: ASPM with OWASP Projects Room: Regency B (Street Level)Harold Blankenship • Matt Tesauro 3 Day Training: Attacking and Defending - AWS, Azure and GCP Applications Room: Seacliff B (Bay Level)Abhay Bhargav 3 Day Training: Hacking Modern Web & Desktop apps: Master the Future of Attack Vectors Room: Seacliff A (Bay level)Abraham Aranguren 3 Day Training: The Mobile Playbook - A guide for iOS and Android App Security Room: Seacliff D (Bay Level)Sven Schleier 3 Day Training: Web Application Security Essentials Room: Seacliff C (Bay Level)Fabio Cerullo SAMM User Day Room: Bayview B (Bay Level)Sebastien Deleersnyder Global Board of Directors Private/Closed Face to Face Meeting Room: Boardroom A (Atrium Lobby Level) Juice Shop & DSOMM User Day 2024 Room: Bayview A (Bay Level)Bjoern Kimminich • Timo Pagel

10:30am PDT

AM Break Seacliff Foyer

12:30pm PDT

Lunch Seacliff Foyer

3:00pm PDT

PM Break Seacliff Foyer

5:30pm PDT

Global Board of Directors Public Board Meeting Room: Seacliff A (Bay level)

7:00pm PDT

Women in AppSec Reception (registration required) Room: Upper Atrium

8:00pm PDT

Newcomers Reception (registration required) Room: Waterfront CDE Foyer (Atrium Lobby Level)

8:00am PDT

Breakfast Room: Pacific Concourse (Expo Hall) Start up Exhibitors Room: Grand Ballroom Foyer Expo Hall Room: Pacific Concourse (Expo Hall)

8:50am PDT

Opening Remarks Room: Grand Ballroom

9:00am PDT

Thriving in the Age of AI (Keynote) Room: Grand BallroomAnchaal Gupta Member Lounge Room: Golden Gate

10:00am PDT

AM Break Room: Pacific Concourse (Expo Hall)

10:30am PDT

OWASP Mobile Application Security (MAS) Room: Bayview A (Bay Level)Sven Schleier • Carlos Holguera Living off Microsoft Copilot Room: Grand BallroomMichael Bargury Striding Your Way to LINDDUN: Threat Modeling for Privacy Room: Seacliff ABShanni Prutchi • Chris Bush 5 Steps to VEX Success: Managing the End-to-End Workflow Room: Seacliff CDCortez Frazier Jr From Start Line to Security Finish: Running Your Application Security Program Like a Marathon Room: Bayview B (Bay Level)Derek Fang Meet the Mentor Room: Regency ASemgrep

11:00am PDT

OWASP DevSecOps Maturity Model (DSOMM) Room: Bayview A (Bay Level)Timo Pagel

11:30am PDT

OWASP Top 10 Risks for Open Source Software Room: Bayview A (Bay Level)George Apostolopoulos GraphQL Exploitation: Secondary Context Attacks and Business Logic Vulnerabilities Room: Grand BallroomWillis Vandevanter Under the Radar: How we found 0-days in the Build Pipeline of OSS Packages Room: Seacliff ABFrançois Proulx (CANCELLED) AI Code Security: A Challenge to be Solved by... AI Room: Seacliff CD AppSec Meets Project Management: Hacking the Frameworks for Secure Software Room: Bayview B (Bay Level)Stefan Brätsch

12:15pm PDT

Lunch Room: Pacific Concourse (Expo Hall)

1:15pm PDT

O My Data: OData Injection attack and other injections in Microsoft Power Platform and UiPath Room: Grand BallroomAmichai Shulman Don’t Make This Mistake: Painful Learnings of Applying AI in Security Room: Seacliff ABEitan Worcel The Container Escape Room: An Exploration of Container Escapes Room: Seacliff CDAmit Schendel Businesses Run On Risk And Debt: Why Communicating Security Risk Is Hard Room: Bayview B (Bay Level)Dwayne McDaniel How to write a good CfT/CfP Submission Room: Regency AAvi Douglen • Izar Tarandach

1:45pm PDT

OWASP Coraza Room: Bayview A (Bay Level)Juan Pablo Tosso

2:15pm PDT

OWASP Nightingale Docker for Pentesters Room: Bayview A (Bay Level)Raja Nagori AI Goat: A Damn Vulnerable AI Infrastructure Room: Grand BallroomOfir Yakobi • Shir Sadon Threat Modeling in the Age of AI Room: Seacliff ABSusanna Cox Self-Discovering API Key Permissions and Resources Room: Seacliff CDJoseph Leon • Dylan Ayrey Who Hurt You? Earning the trust of developers Room: Bayview B (Bay Level)Tanya Janca

2:30pm PDT

Bob the Breaker CTF (Low-code/no-code hacking!) Room: Regency ANokod Security

2:45pm PDT

OWASP Software Assurance Maturity Model (SAMM) Room: Bayview A (Bay Level)Aram Hovsepyan • Sebastien Deleersnyder

3:00pm PDT

3:15pm PDT

OWASP Leaders Meeting Room: Bayview A

3:30pm PDT

Web Security Experts: Are you overlooking WebRTC vulnerabilities? Room: Grand BallroomSandro Gauci OWASP Top 10 for Large Language Models: Project Update Room: Seacliff ABSteve Wilson The Missing Link - How we collect and leverage SBOMs Room: Seacliff CDCassie Crossley Bridging Security & Privacy Standards: Harnessing OpenCRE for Effective Mapping Room: Bayview B (Bay Level)Dimitar Raichev

4:30pm PDT

Breaking the Mold: Navigating the Intersection of Technology, Security, and Trust (Keynote) Room: Grand BallroomReeny Sondhi

5:30pm PDT

Brain Battle Spectacula Room: Grand Ballroom

6:30pm PDT

Networking Reception Room: Pacific Concourse (Expo Hall)

8:00am PDT

Breakfast Start up Exhibitors Room: Grand Ballroom Foyer Expo Hall Room: Pacific Concourse (Expo Hall)

9:00am PDT

Red, Blue, and Purple AI (Keynote) Room: Grand BallroomJason Haddix Member Lounge Room: Golden Gate

10:00am PDT

AM Break Room: Pacific Concourse (Expo Hall)

10:30am PDT

OWASP IoT Security Testing Guide (ISTG) Room: Bayview A (Bay Level)Aaron Guzman Sanitize Client-Side: Why Server-Side HTML Sanitization is Doomed to Fail Room: Grand BallroomYaniv Nizry OWASP AI Exchange experts on the future of security for AI Room: Seacliff ABDan Sorenson • Chloé Messdaghi • Susanna Cox • Aruneesh Salhotra Automatic application hardening by leveraging container runtime behavior analysis during CI processes Room: Seacliff CDAmit Schendel How to get developers to want to adopt AppSec Room: Bayview B (Bay Level)Matan Rabi

11:00am PDT

OWASP dep-scan Room: Bayview A (Bay Level)Prabhu Subramanian

11:30am PDT

OWASP Nettacker Room: Bayview A (Bay Level)Sam Stepanyan Hidden Chains: Revealing High-Impact Bugs from Bounty submissions Room: Grand Ballroomvinay prabhushankar • Murali Vadakke Puthanveetil Millions Of Public Certificates Are Reusing Old Private Keys Room: Seacliff ABDylan Ayrey • Joseph Leon Practical Software Supply Chain Security Solutions Room: Seacliff CDRobert Marion The Path to Influence: How Three Threat Modelers Can Influence an Entire Organization Room: Bayview B (Bay Level)Léandre Forget-Besnard • Laurent Bouchard

12:15pm PDT

1:15pm PDT

OWASP Serverless Top 10 Room: Bayview A (Bay Level)David Melamed • Aruneesh Salhotra Hackuracy: Boosting AST accuracy through hacking Room: Grand BallroomAndres Roldan Slack’s Vulnerability Aggregator: How we built a platform to manage vulnerabilities at scale Room: Seacliff ABAtul Gaikwad • Nicholas Lin AI Under the Hood: Unmasking Hidden Threats Room: Seacliff CDDr. Nitish M. Uplavikar Learning from "edge of tomorrow" to build an effective security design review program Room: Bayview B (Bay Level)Felix Matenaar • Ari Fay

1:45pm PDT

OWASP DefectDojo Room: Bayview AMatt Tesauro

2:15pm PDT

OWASP Application Security Verification Standard (ASVS) Room: Bayview A (Bay Level)Shanni Prutchi • Ryan Armstrong Kernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections Room: Grand BallroomSubho Halder Escaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams Room: Seacliff ABAhmad Sadeddin Learning from Past Security Breaches: Strengthening AppSec Efforts and Focus Room: Seacliff CDJon McCoy From Hype to Reality: The Broken State of DevSecOps and Its Maturity Model Room: Bayview BEitan Worcel • Dustin Lehr

2:45pm PDT

OWASP Machine Learning Security Top 10 Room: Bayview A (Bay Level)

3:00pm PDT

PM Break with Exhibitors Room: Pacific Concourse (Expo Hall)

3:15pm PDT

OWASP JuiceShop Room: Bayview A (Bay Level)Bjoern Kimminich

3:30pm PDT

Modernizing the Application Penetration Engagement and Reporting Lifecycle Room: Grand BallroomRyan Armstrong Maturing Your Application Security Program with ASVS-Driven Development Room: Seacliff ABAram Hovsepyan Threat Modeling Large Scale K8s Based Platform Room: Seacliff CDAnurag Dwivedy • Brian "Mello" Kirouac I Know What You Did Last Summer: Lessons Learned from Privacy Breaches and Scandals Room: Bayview B (Bay Level)Dr. Kim Wuyts

4:30pm PDT

The Hackable Method (Keynote and book signing) Room: Grand BallroomTed Harrington

5:30pm PDT

Closing Ceremony and Raffle Room: Grand Ballroom