Philippe De Ryck

Hi, I'm Philippe, and I help developers protect companies through better web security. As the founder of Pragmatic Web Security, I travel the world to teach practitioners the ins and outs of building secure software.

From the OWASP top 10(s) to the OWASP ASVS

This page contains the resources for the talk titled 'From the OWASP top 10(s) to the OWASP ASVS'.

Abstract

Some people are under the misconception that if they follow the OWASP top 10 that they will have secure applications. But in reality the OWASP Top Ten (and other top ten lists) are just the bare minimum for the sake of entry-level awareness. A more comprehensive understanding of Application Security is needed. This talk will review the OWASP Top Ten 2017 and the OWASP Top Ten Proactive Controls 2018 and compare them to a more comprehensive standard, the OWASP Application Security Verification Standard (ASVS) v3.1. OWASP's ASVS contains over 150 requirements that can provide a basis for testing web application technical security controls and also provide developers with a list of requirements for secure development in a fashion with much more nuance and detail than a top ten list! You cannot base a security program off a Top Ten list. You can base an AppSec program off of the ASVS.

Recording

About Dr. Philippe De Ryck

Philippe De Ryck helps developers protect companies through better web security. As the founder of Pragmatic Web Security, he travels the world to train developers on web security and security engineering. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. Google recognizes Philippe as a Google Developer Expert for his work on security in Angular applications.

Philippe De Ryck

Dr. Philippe De Ryck

Hi, I'm Philippe, and I help developers protect companies through better web security. As the founder of Pragmatic Web Security, I travel the world to teach practitioners the ins and outs of building secure software.


Talks and workshops

You will often find me speaking and teaching at public and private events around the world. My talks always encourage developers to step up and get security right.


Security resources

Getting security right is all about knowledge. I strongly believe in sharing that knowledge to move forward as a community. Among my resources, you can find developer cheat sheets, recorded talks, and extensive slide decks.


Mailing list

Subscribe to the Pragmatic Web Security mailing list to stay up to date on the latest activities and resources.

Subscribe