Security for Modern Webapps: New Web Platform Security Features to Protect your Application
Channel: OWASP Foundation
Date: 2019-07-05

OWASP Global AppSec Tel Aviv
https://telaviv.appsecglobal.org/

Web applications have historically been plagued by vulnerabilities which allow attackers to compromise the session of a logged-in user: XSS, CSRF, clickjacking and related issues. Luckily, new security mechanisms available in web browsers in 2019 offer exciting features which allow developers to protect their applications. In this talk, we'll introduce these features and explain how to most effectively use them.
We'll start by reviewing major threats based on an analysis of thousands of vulnerability reports Google receives each year under our Vulnerability Reward Program. We will find common themes between bugs which appear unrelated and focus our attention on the most frequent high-risk problems.
We'll then turn our attention to protective mechanisms implemented in modern browsers, which address entire classes of security problems. This includes CSP3 and Trusted Types to prevent XSS, Fetch Metadata Request Headers to protect from CSRF, and CORP/COOP to mitigate the threat of Spectre.

Lukas Weichselbaum
Staff Information Security Engineer, Google
Lukas Weichselbaum is a Staff Information Security Engineer at Google with 10+ years of industry experience who frequently speaks at international infosec and developer conferences.He's passionate about securing Web applications from common Web vulnerabilities.

-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project