Resources · free
Tools and notes to sharpen your application security.
Self-assess in three minutes, see which attacks get through, work through practitioner checklists, or read field notes from real programmes.
- 4 articlesInsightsField notes from real programmesOpen
- 5 programmesCase studiesFive programmes, anonymisedOpen
- 12 questionsMaturity scorecard3 minutes, instant resultOpen
- 9 attacksAttack simulatorWhich attacks get through?Open
- 5 checklistsChecklistsInteractive, printableOpen
- 60 termsAppSec glossaryPlain-English definitionsOpen
- 6 topicsSpeakingTalks and workshopsOpen
Insights
Latest field notes.
- What 112 application migrations taught me about moving to cloud WAAPRead
- From vulnerability lists to exposure management: CTEM for South Asian enterprisesRead
- Mobile app shielding for banks: what RASP protects, and what it doesn'tRead
- Measuring application security maturity with OWASP SAMM: a practical starting pointRead
Checklists
Tick what is true. See your gaps.
- WAAP go-live checklistWhat to check before, during and after moving an application behind a cloud WAAP.
- API security checklistInventory, authorisation, input controls and monitoring for every API you expose.
- Mobile app protection checklistPolicy, build, runtime, backend and telemetry checks for a protected customer app.
- Exposure management checklistCheck a vulnerability programme against the five CTEM stages, scoping to mobilisation.
- Application security logging checklistWhat applications should log, how events reach the SIEM reliably, and who acts on them.
Glossary
Jargon, decoded.
- BOLAAn API flaw where the server returns or changes a data object, such as an account or order, without checking the caller may access that specific object. Also known as IDOR.
- RASPSecurity built into an application that detects and responds to attacks while it runs. In mobile apps it detects rooted devices, hooking, debuggers, emulators and tampering.
- CTEMA programme approach described by Gartner that reduces exposure to attack on a repeating cycle of five stages: scoping, discovery, prioritisation, validation and mobilisation.
- WAAPA platform, usually delivered from a cloud edge, that combines a web application firewall with API protection, bot management and DDoS protection in front of web apps and APIs.
- EPSSA model published by FIRST that estimates the probability, from 0 to 1, that a published vulnerability (CVE) will be exploited in the wild within the next 30 days.
- Shadow APIAn API that is live in production but missing from the organisation’s inventory, such as an undocumented endpoint, a forgotten test service or an old version never retired.