Fake Security - App Sec Myths People Believe

Distill the purpose of the OWASP top ten as a frequency-based guide, not impact, and learn to address vulnerabilities outside the list using risk management and CVSS scoring.

Learn that HTTPS protects data in transit, not the processing, debunking the myth that encryption secures apps and showing how command injection, SQL injection, and cross-site scripting injections can succeed.

Explain that robots.txt disallow directives are not security controls and do not prevent access; instead, implement authentication and proper access control to protect confidential resources.

This lecture compares blacklists and white lists for handling untrusted input in web apps, explores evasion tricks like cross-site scripting, and shows how white lists overcome these weaknesses.

Understand the cloud responsibility model and who secures what across on-prem, IaaS, PaaS, and SaaS, emphasizing that customers retain data governance, endpoints, and access management.

Evaluate each release on its security merits using risk assessment, testing, hardening, and software bill of materials review. Align procurement and DevOps to secure by default.

Debunk the myth that APIs behind a UI are inaccessible. Use an API gateway to enforce policy and authentication, and monitor abuse cases to prevent bypass and DoS.

Debunk the plug-and-play myth by exposing insecure default configurations and default credentials, and promote hardening that disables unused ports and changes passwords.

Conclude the course by reinforcing that confidentiality, integrity, and availability define a secure system and protect data from disclosure or destruction amid the iron triangle of scope, budget, and schedule.