This masterclass is designed for developers, security professionals, and technical leads who want to master the 2022 OWASP Top Ten and learn effective strategies to mitigate these critical security risks.

Day 1: Understanding the 2022 OWASP Top Ten

Session 1: Introduction to OWASP and the 2022 Top Ten


- Overview of OWASP and its mission
- Introduction to the 2022 OWASP Top Ten: What it is and why it matters
- The impact of the Top Ten on modern web applications

Session 2: Broken Access Control (A01:2022)


- Understanding access control vulnerabilities
- Real-world examples and case studies
- Defensive coding techniques to prevent broken access control

Session 3: Cryptographic Failures (A02:2022)


- Common pitfalls in implementing cryptography
- Best practices for secure cryptographic storage and transmission
- Case studies of cryptographic failures and their impacts


- SQL, NoSQL, and command injection explained
- Real-world examples and case studies
- Defensive coding techniques to prevent injection attacks


- Principles of secure software design 
- Identifying and mitigating design flaws early in the SDLC
- Case studies on insecure design

Day 2: Advanced Defense Strategies for the 2022 OWASP Top Ten

Session 6: Security Misconfiguration (A05:2022)


- Common security misconfigurations and their impacts
- Best practices for secure configuration management
- Automating security configuration checks

Session 7: Vulnerable and Outdated Components (A06:2022)


- Risks of using outdated or vulnerable components
- Strategies for managing component security 
- Tools and techniques for maintaining up-to-date dependencies

Session 8: Identification and Authentication Failures (A07:2022)


- Implementing robust authentication mechanisms
- Secure session management practices
- Multi-factor authentication (MFA) and its importance

Session 9: Software and Data Integrity Failures (A08:2022)


- Ensuring the integrity of software and data
- Techniques for securing software supply chains
- Real-world examples of integrity failures and mitigation strategies

Session 10: Security Logging and Monitoring Failures (A09:2022)


- Importance of effective logging and monitoring
- Best practices for logging and monitoring setup
- Incident detection and response strategies

Session 11: Server-Side Request Forgery (SSRF) (A10:2022)


- Understanding SSRF vulnerabilities
- Real-world examples and impacts of SSRF attacks
- Defensive coding and configuration practices to prevent SSRF

Participants will leave this masterclass with a comprehensive understanding of the 2022 OWASP Top Ten and practical skills to secure their applications against these critical vulnerabilities. Each attendee will receive detailed course materials, hands-on labs, and a certificate of completion.

Dive deep into the latest web application security threats with a 2-day masterclass led by Jim Manico, a globally recognized expert in secure coding and application security. 

Farfetch exists for the love of fashion. We operate a modular end-to-end technology platform purpose built to connect the luxury fashion ecosystem worldwide. Our vision was to create a single operating system that could address the complex demands of consumers and luxury sellers alike. Our platform is built on an API-enabled proprietary technology stack, which provides the foundation for the three main components: applications, services and data.

FarFetch

Avalonia

Blip

Bosch

Checkout

deloitte

We specialize in the development of financial software and help financial industry firms grow, adapt and gain a technological advantage by providing custom software solutions and sharing our FinTech expertise. We are committed to providing an individual approach to each customer, focusing on technical excellence and on delivering the best-in-class software products.

Devexperts

devscope

edreams

Evident

Kaizen Gaming

Kühne + Nagel

Since 1975, Microsoft has empowered every person and organisation on the planet to achieve more. Imagination and innovation drives today’s technology. Our software, services, devices, and solutions help users realise their full potential in incredible new ways – from AI to the cloud, we want to help every software developer create fast and create smart. At NDC London 2020, we’ll be helping all software developers and businesses accelerate technical skills through the Microsoft Learn platform, plus Q&As and expert insights from Microsoft’s Most Valuable Professionals.

Microsoft

We believe in a world of work where people can find their true self and achieve their full potential. This not only makes individuals more satisfied and happier, it also makes companies more successful. 
 
Based on this conviction, New Work SE aligns its brands, products and services around its vision – For a better working life. We’re already seeing a paradigm shift in terms of what we call ‘work’. Demographic change is exacerbating the shortage of skilled workers, in turn shifting power away from employers and over to employees.

Digitalisation is not only revolutionising entire industries, it also enables people to work wherever and whenever they want or need to. And younger generations, in particular, are eschewing long-standing values in favour of more modern ones with a clearer focus on a positive work-life balance.
 
All of these aspects are already driving radical change on the labour market. All of the activities undertaken by each New Work Group brand aim to help shape the future of work and gear it more towards people, while assisting companies in the pursuit of success by enabling employees to do what they really, really want to do.

New Work SE

Nexer

Innovating With No Limits Since 2001. In 2001, we pioneered the low-code market with a vision to transform how enterprise software is delivered.  Today, we’re proud to be recognized as a market leader with offices around the world and over 1.200 customers in 60 countries.

Outsystems

Planet

Semasio enables marketers to unify their targeting by understanding consumers on their own terms

At Semasio we believe the best way to understand modern consumers is on their own terms – the terms they consume every day on the web. This also means we understand the pages they consume based on the terms these pages contain.
The benefit of semantically understanding consumers and pages is the ability to seamlessly target across consumers and pages with one unified targeting strategy. We call it targeting on your terms.

Semasio

NDC Porto 2022

Alfândega Porto Congress Centre

acos

Aigonix

Apryse

For over 12 years, Amazon Web Services has been the world’s most comprehensive and broadly adopted cloud platform. AWS offers over 165 fully featured services for compute, storage, databases, networking, analytics, robotics, machine learning and artificial intelligence (AI), Internet of Things (IoT), mobile, security, hybrid, virtual and augmented reality (VR and AR), media, and application development, deployment, and management from 60 Availability Zones (AZs) within 20 geographic regions, spanning the U.S., Australia, Brazil, Canada, China, France, Germany, India, Ireland, Japan, Korea, Singapore, Sweden, and the UK. AWS services are trusted by millions of active customers around the world—including the fastest-growing startups, largest enterprises, and leading government agencies—to power their infrastructure, make them more agile, and lower costs. To learn more about AWS, visit aws.amazon.com.

Bekk

Bouvet

A global leader in consulting, technology services and digital transformation, Capgemini is at the forefront of innovation to address the entire breadth of clients’ opportunities in the evolving world of cloud, digital and platforms. Building on its strong 50-year heritage and deep industry-specific expertise, Capgemini enables organizations to realize their business ambitions through an array of services from strategy to operations. Capgemini is driven by the conviction that the business value of technology comes from and through people. It is a multicultural company of 200,000 team members in over 40 countries. The Group reported 2017 global revenues of EUR 12.8 billion.

Capgemini

Cegal

Cloudberries

Cloudworks

Computas

Contrast Security

Couchbase

Dfind

Dips

Ensō is an Oslo-based consultancy company with specialist expertise within Microsoft .Net, Java and project management. We do projects for both private and public enterprises within development of it-systems, architecture and consulting. Our ambition is to build Oslo’s best team of experienced consultants with proven domain and business knowledge. Ensō provides the help you need to solve your IT challenges. We participate with our specialists in your projects or we can take charge of the whole project.

enso

We use our competence and technology to provide energy to a growing population in a responsible manner. This guides us as we work towards a future where energy is affordable and sustainable for all.

Equinor

Ciber Experis

Geodata

Get Academy

glasspaper

gyldendal

Inmeta Consulting takes a central part in the digitalization of Norwegian enterprises. Our headquarter is based in Oslo, in addition to our offices in Trondheim and Hamar. Our broad range of services includes advisory, big data & advanced analytics, cloud, systems development, project- and test mananagement, e-commerce and UX. We create business value together with our customers, by providing knowledge, experience and creativity.

inmeta

With offices in Oslo, Bryne, Stockholm, Copenhagen, Kiev and Bratislava, Itera is delivering innovative solutions and services to Nordic and international businesses with local presence in the Nordic region. The Nordics has a highly educated mobile workforce, with many innovative businesses and organizations. Itera has worked in the region for over 15 years.

itera

At JetBrains, code is our passion. For over 15 years we have strived to make the strongest, most effective developer tools on earth. By automating routine checks and corrections, our tools speed up production, freeing developers to grow, discover and create.

Jetbrains

Knowit is a consultancy firm that creates unique customer value in a world of accelerating digitization, by offering international solutions in three divisions – Experience, Insight and Solutions. What sets us apart is our ability to combine expertise in design and communication, management consulting and IT.

Knowit

Kontent.ai

Miles

norkart

Norsk Helsenett

nova

Octopus Deploy is an easy to use release management, deployment automation and operations runbook platform for software teams. It solves the hardest part of CI/CD - getting software into production, reliably and with less downtime - and keeping it running.

Octopus Deploy

1881

Orange Business

Particular

Report URI

Sentry

Sonar

Sopra Steria, a European leader in consulting, digital services and software development, helps its clients drive their digital transformation to obtain tangible and sustainable benefits. It provides end-to-end solutions to make large companies and organisations more competitive by combining in-depth knowledge of a wide range of business sectors and innovative technologies with a fully collaborative approach. Sopra Steria places people at the heart of everything it does and is committed to making the most of digital technology to build a positive future for its clients. With 45,000 employees in 25 countries, the Group generated revenue of €4.1 billion in 2018. In Scandinavia, 2300 employees generated revenue of NOK 2.9 billion in 2018.

soprasteria

Systek

Text Control

tietoevry

twoday

variant

Veeam
Veeam® is the leader in Backup solutions that deliver Cloud Data Management™. Veeam provides a single platform for modernizing backup, accelerating hybrid cloud and securing your data. With 365,000+ customers worldwide, including 81% of the Fortune 500 and 66% of the Global 2,000, Veeam customer-satisfaction scores are the highest in the industry at 3.5x the average. Veeam’s global ecosystem includes 70,000+ partners, including HPE, NetApp, Cisco and Lenovo as exclusive resellers. Veeam was recently acquired by American Insight Partners and has offices in more than 30 countries. To learn more, visit https://www.veeam.com​ or follow Veeam on Twitter @veeam.​

Veeam

Vipps

Vitec

Vonage

Webstep

Xlent

Netcompany

NDC Oslo 2023

Oslo Spektrum

Jim Manico is the founder of Manicode Security where he trains software developers on secure coding and security engineering. He is also an investor/advisor for KSOC, Nucleus Security, Signal Sciences, and BitDiscovery. Jim is a frequent speaker on secure software practices, is a Java Champion, and is the author of 'Iron-Clad Java - Building Secure Web Applications' from Oracle Press. Jim also volunteers for OWASP as the project co-lead for the OWASP ASVS and the OWASP Proactive Controls.

Mastering the 2022 OWASP Top Ten with Jim Manico

Agenda: